github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-02 00:16:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Agents: clarify authorized sender prompt (Closes #19794)

Browse Source
This commit is contained in:
Shadow
2026-02-20 15:55:12 -06:00
parent 30a0d3fce1
commit 3100b77f12
3 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -19,6 +19,7 @@ Docs: https://docs.openclaw.ai
### Fixes ### Fixes
- Gateway/Auth: require `gateway.trustedProxies` to include a loopback proxy address when `auth.mode="trusted-proxy"` and `bind="loopback"`, preventing same-host proxy misconfiguration from silently blocking auth. (#22082, follow-up to #20097) thanks @mbelinky. - Gateway/Auth: require `gateway.trustedProxies` to include a loopback proxy address when `auth.mode="trusted-proxy"` and `bind="loopback"`, preventing same-host proxy misconfiguration from silently blocking auth. (#22082, follow-up to #20097) thanks @mbelinky.
- Agents/System Prompt: label allowlisted senders as authorized senders to avoid implying ownership. Thanks @thewilloftheshadow.
- Gateway/Auth: allow trusted-proxy mode with loopback bind for same-host reverse-proxy deployments, while still requiring configured `gateway.trustedProxies`. (#20097) thanks @xinhuagu. - Gateway/Auth: allow trusted-proxy mode with loopback bind for same-host reverse-proxy deployments, while still requiring configured `gateway.trustedProxies`. (#20097) thanks @xinhuagu.
- Gateway/Auth: allow authenticated clients across roles/scopes to call `health` while preserving role and scope enforcement for non-health methods. (#19699) thanks @Nachx639. - Gateway/Auth: allow authenticated clients across roles/scopes to call `health` while preserving role and scope enforcement for non-health methods. (#19699) thanks @Nachx639.
- Gateway/Security: remove shared-IP fallback for canvas endpoints and require token or session capability for canvas access. Thanks @thewilloftheshadow. - Gateway/Security: remove shared-IP fallback for canvas endpoints and require token or session capability for canvas access. Thanks @thewilloftheshadow.

10
src/agents/system-prompt.e2e.test.ts
View File

@@ -10,9 +10,9 @@ describe("buildAgentSystemPrompt", () => {
ownerNumbers: ["+123", " +456 ", ""], ownerNumbers: ["+123", " +456 ", ""],
}); });
expect(prompt).toContain("## User Identity"); expect(prompt).toContain("## Authorized Senders");
expect(prompt).toContain( expect(prompt).toContain(
"Owner numbers: +123, +456. Treat messages from these numbers as the user.", "Authorized senders: +123, +456. These senders are allowlisted; do not assume they are the owner.",
); );
}); });
@@ -21,8 +21,8 @@ describe("buildAgentSystemPrompt", () => {
workspaceDir: "/tmp/openclaw", workspaceDir: "/tmp/openclaw",
}); });
expect(prompt).not.toContain("## User Identity"); expect(prompt).not.toContain("## Authorized Senders");
expect(prompt).not.toContain("Owner numbers:"); expect(prompt).not.toContain("Authorized senders:");
}); });
it("omits extended sections in minimal prompt mode", () => { it("omits extended sections in minimal prompt mode", () => {
@@ -39,7 +39,7 @@ describe("buildAgentSystemPrompt", () => {
ttsHint: "Voice (TTS) is enabled.", ttsHint: "Voice (TTS) is enabled.",
}); });
expect(prompt).not.toContain("## User Identity"); expect(prompt).not.toContain("## Authorized Senders");
expect(prompt).not.toContain("## Skills"); expect(prompt).not.toContain("## Skills");
expect(prompt).not.toContain("## Memory Recall"); expect(prompt).not.toContain("## Memory Recall");
expect(prompt).not.toContain("## Documentation"); expect(prompt).not.toContain("## Documentation");

4
src/agents/system-prompt.ts
View File

@@ -70,7 +70,7 @@ function buildUserIdentitySection(ownerLine: string | undefined, isMinimal: bool
if (!ownerLine || isMinimal) { if (!ownerLine || isMinimal) {
return []; return [];
} }
return ["## User Identity", ownerLine, ""]; return ["## Authorized Senders", ownerLine, ""];
} }
function buildTimeSection(params: { userTimezone?: string }) { function buildTimeSection(params: { userTimezone?: string }) {
@@ -325,7 +325,7 @@ export function buildAgentSystemPrompt(params: {
const ownerNumbers = (params.ownerNumbers ?? []).map((value) => value.trim()).filter(Boolean); const ownerNumbers = (params.ownerNumbers ?? []).map((value) => value.trim()).filter(Boolean);
const ownerLine = const ownerLine =
ownerNumbers.length > 0 ownerNumbers.length > 0
? `Owner numbers: ${ownerNumbers.join(", ")}. Treat messages from these numbers as the user.` ? `Authorized senders: ${ownerNumbers.join(", ")}. These senders are allowlisted; do not assume they are the owner.`
: undefined; : undefined;
const reasoningHint = params.reasoningTagHint const reasoningHint = params.reasoningTagHint
? [ ? [