fix(openclaw): scope recall and capture by project

[MackDing]

Summary

• derive project/workspace scope from OpenClaw hook events
• pass that scope into OpenClaw recall requests via smart-search
• include project and cwd on OpenClaw observe payloads so captured sessions are grouped consistently
• add regression tests for scoped recall/capture behavior

Problem

The OpenClaw integration recalled memory using only the prompt text and captured turns with only a session id. In shared agentmemory deployments, that makes it too easy for the OpenClaw plugin to query global memory without any project/workspace scoping.

Fix

This PR keeps the change deliberately small and backward-compatible:

• before_agent_start now derives a project value from the OpenClaw event (project, nested workspace metadata, or cwd fallback) and passes it to /agentmemory/smart-search
• agent_end now includes project and cwd in /agentmemory/observe
• when no project metadata is available, capture falls back to the session id so the payload still satisfies the observe contract and avoids collapsing everything into an empty/global bucket

This is not full principal/tenant isolation, but it is a practical hardening step that restores existing project-based filtering support in the backend and reduces cross-project leakage risk for the OpenClaw integration.

Verification

• npm test -- --run test/openclaw-plugin.test.ts test/openclaw-project-scope.test.ts test/integration-plaintext-http.test.ts

Refs #596

Summary by CodeRabbit

• New Features

  • Plugin now derives project context from multiple event locations and includes project (and a derived cwd/fallback) in outgoing memory API requests to better associate observations with session/workspace context.

• Tests

  • Added test suite validating project-scoping behavior across scenarios, ensuring smart-search and observation requests include the correct project and cwd values.

[vercel]

@MackDing is attempting to deploy a commit to the rohitg00's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2da1874e-c372-481b-985c-14f85cb0bfb3

📥 Commits

Reviewing files that changed from the base of the PR and between a81bd0a and 0c32986.

📒 Files selected for processing (1)

• test/openclaw-project-scope.test.ts

---

📝 Walkthrough

Walkthrough

Adds helpers to derive a project identifier from several OpenClaw event fields and propagates that project into /agentmemory smart-search (before_agent_start) and /agentmemory/observe (agent_end) payloads; includes Vitest tests validating propagation and fallback behavior.

Changes

OpenClaw Project Scoping

Layer / File(s)	Summary
Project derivation and smart-search integration integrations/openclaw/plugin.mjs	Adds normalizeString and getProject helpers to extract a project identifier from event fields (project, workspace.project, agent.project, metadata/context, and cwd variants). Updates before_agent_start to compute derived project and conditionally include it in the /agentmemory/smart-search request body.
Observe request enrichment with project and cwd integrations/openclaw/plugin.mjs	Updates agent_end to derive project and augment the /agentmemory/observe request body with project (or empty fallback) and cwd computed from the derived project (or falling back to the session identifier).
Project scoping test suite test/openclaw-project-scope.test.ts	Adds Vitest test module with mockFetch and registerPlugin helpers. Tests: smart-search project propagation, observe payload project/cwd fallback using sessionKey, and nested workspace.project discovery.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• OpenClaw plugin should scope recall/capture by session/user to avoid cross-user memory leakage #596: Implements derived project/context propagation into smart-search and observe payloads as discussed in that issue.

Poem

🐰 I nibble lines of code with cheer,
A project found where things were unclear,
Smart-search now remembers its scope,
Observe logs sessions with hoppity hope,
Cheers — a rabbit celebrates this year!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'fix(openclaw): scope recall and capture by project' directly and clearly summarizes the main change—adding project scoping to OpenClaw recall and capture operations.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/openclaw-project-scope.test.ts`:
- Around line 34-40: The test setup deletes process.env["AGENTMEMORY_SECRET"] in
beforeEach but never restores it, risking state leakage; modify the setup to
capture the original value (e.g., const originalAgentMemorySecret =
process.env["AGENTMEMORY_SECRET"] or similar) before deleting in beforeEach and
then restore process.env["AGENTMEMORY_SECRET"] = originalAgentMemorySecret (or
delete it if undefined) in afterEach alongside restoring globalThis.fetch =
originalFetch; update the beforeEach/afterEach blocks in
test/openclaw-project-scope.test.ts to use these variables.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 18de1097-da1a-4435-85e1-83a08def6653

📥 Commits

Reviewing files that changed from the base of the PR and between bc64107 and a81bd0a.

📒 Files selected for processing (2)

• integrations/openclaw/plugin.mjs
• test/openclaw-project-scope.test.ts

[MackDing]

Quick update: I addressed the CodeRabbit test-isolation comment by restoring AGENTMEMORY_SECRET after each test, and verified test/openclaw-project-scope.test.ts locally. The remaining Vercel check appears to require authorization from a member of the Vercel team.