OpenClaw
OpenClaw scopes models, media and desktops to the owning agent
OpenClaw proposes making model reads follow the selected agent, limiting embedded prompt media to that agent’s roots and opening desktop controls for the session that owns them. The three changes close cross-agent context leaks in a growing multi-session interface.
openclaw/openclaw PR #123415 is the inspected primary source: “fix(ui): scope model reads to selected agent.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- openclaw/openclaw PR #123415 was created 2026-08-14T01:35:33Z and was open at inspection; its title is “fix(ui): scope model reads to selected agent.” - openclaw/openclaw PR #123413 was created 2026-08-14T01:26:00Z and was open at inspection; its title is “fix(agents): scope embedded prompt media roots to the owning agent.” - openclaw/openclaw PR #123412 was created 2026-08-14T01:21:51Z and was open at inspection; its title is “fix(apps): per-session desktop button opens that session's machine.” - The repository reported 386206 stars, 5574 open issues, default branch main, and last push 2026-08-14T01:35:13Z. - The latest tagged-release baseline checked was v2026.7.1-2 published 2026-08-04T00:41:26Z.
What changed
openclaw/openclaw PR #123415 reports: Summary scope every automatic Control UI models.list and models.authStatus request to the concrete selected agent keep Debug, Appearance, and sidebar data available before selection while skipping only model/auth subrequests preserve agent identity across same-client selection changes and All-agents page scope add a real Gateway regression proving both startup-published explicit-agent owners serve prepared model/auth RPCs without request-time discovery Root cause Mainframe's explicit two-agent roster exposed two connected ownership failures: 1. Gateway startup owners were published with allowGatewaySubagentBinding:true, but flagless readers could not select them. That caused prepared-only requests to fall into synchronous request-time preparation and stall the event loop for 67–94 seconds. This owner-selection defect is fixed on current main by e3915058961 (#123208); this PR adds the missing operator-visible two-agent Gateway regression. 2. Several automatic Control UI callers still omitted agentId or inferred an ambient/default owner. Explicit rosters correctly reject those calls, so open UI pages repeatedly produced fast INVALID_REQUEST responses and could retain stale model state after a same-client agent switch. The UI now reads the existing agentSelection.state.selectedId ownership fact. It no longer invents a server default or uses page scopeId as request ownership. Shared loaders require an agent id
openclaw/openclaw PR #123413 reports: What Problem This Solves 122684 fixed named-agent image hydration for the CLI runner by passing agent-scoped media roots, but the embedded/plugin-harness sibling path (prepareEmbeddedAttemptPromptExecution) never got the same treatment. There, detectAndLoadPromptImages falls back to workspaceOnly? [workspaceDir]: undefined — so with tools.fs.workspaceOnly: false, a named agent's workspace- staging path is validated against the default roots (which only allow the literal workspace dir) and hydration throws failed to hydrate N structured image attachment(s). This is the residual path behind #123273's "workspaceOnly=false does NOT help" observation: on the embedded path, disabling workspaceOnly is the only thing that *could* break it. Why This Change Was Made One-sided fix completion: the CLI runner (src/agents/cli-runner/execute.ts:178) and the embedded runner share the hydration invariant, but only one got the agent-scoped roots. This mirrors the exact same owner resolution (session-key owner first, then explicit agentId) and keeps the boundary tight — getAgentScopedMediaLocalRoots adds only the *active* agent's workspace; sibling workspace-* dirs stay rejected by local-media-access.ts. The strict workspaceOnly: true fallback ([workspaceDir] only) is deliberately left untouched so this change never widens that mode. User Impact Named (non-default) agents on the embedded/plugin-harness path can now receive image
openclaw/openclaw PR #123412 reports: Related: #123097 What Problem This Solves Fixes an issue where tapping the per-session desktop button in the iOS or Android app would open the desktop source picker instead of the machine that session actually runs on. The button knows which session it belongs to, but the native session models carry neither placement nor execNode, so the viewer had nothing to preselect and fell back to asking. Why This Change Was Made The Control UI already owns this mapping: resolveChatPaneDesktopTarget turns a GatewaySessionRow into an environment id (cloud placement to its environmentId, else node:, else gateway), and the web dock panel already uses it. Rather than plumbing placement data into two native apps and duplicating the rule, the apps pass the session key they already hold as?view=desktop&session=, and the Control UI resolves it. Precedence lives in one place, resolveDesktopDocumentTarget: an explicit source wins, otherwise session resolves through the gateway's session rows, otherwise the picker shows. The lookup is scoped to the key's own agent because sessions.list has no exact-key filter and a key that prefixes longer ones could otherwise fall outside the page. An unknown session, or one
Why it matters
An agent switch is not cosmetic when models, files and desktop targets carry authority. If any one surface keeps the prior agent’s context, the interface can show or operate on the wrong machine. The operator test is whether visible state, retained state and authority still describe the same event after retries, switching or restart.
Current
The primary record was open when captured on 2026-08-14. The tagged-release baseline was v2026.7.1-2 published 2026-08-04T00:41:26Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/openclaw/openclaw/pull/123415. Supporting records are https://github.com/openclaw/openclaw/pull/123413 and https://github.com/openclaw/openclaw/pull/123412. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Treat agent identity as a required parameter from model lookup through media resolution and desktop launch, then test rapid profile and session switching for stale state. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.