Session tracking and OPENCLAW_SESSION preamble not gated by telemetry config
- Dominant language
- TypeScript
- Stars
- 133k
- Forks
- 19.9k
- Avg merge
- 18h 46m
- Merged PRs (30d)
- 26
Description
## Problem
Enterprise security scanners flag gstack installations due to strings in every generated SKILL.md preamble:
```bash
mkdir -p ~/.gstack/sessions
touch ~/.gstack/sessions/"$PPID"
_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
find ~/.gstack/sessions -mmin +120 -type f -exec rm {} + 2>/dev/null || true
```
```bash
[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true
```
These run **regardless of the `telemetry: off` config setting**. The telemetry config only gates remote data sending and local JSONL analytics, but session file creation, session cleanup via `find`, and the `OPENCLAW_SESSION` env var check are unconditional in the preamble.
At my company, a custom security rule monitoring for `OpenClaw` strings and suspicious `find` commands in shell initialization scripts triggered an alert, requiring investigation and remediation.
## Current behavior
- `scripts/resolvers/preamble.ts` embeds session tracking and `OPENCLAW_SESSION` detection into every SKILL.md
- Setting `telemetry: off` in `~/.gstack/config.yaml` does **not** disable these
- 765+ references across all generated SKILL.md files (every host variant × every skill)
## Suggested improvement
1. **Gate session tracking behind telemetry config** — wrap `mkdir/touch/find` for `~/.gstack/sessions/` in the same `_TEL != "off"` guard used for analytics
2. **Gate `OPENCLAW_SESSION` detection behind a config flag** — or remove it from the preamble entirely since it's only relevant when running inside OpenClaw
3. **Document what `telemetry: off` actually disables** — current config comments imply it controls all data collection, but session files are still created on disk
This would let enterprise users set `telemetry: off` and have confidence that no session tracking artifacts are created on disk.
## Workaround
Manually strip the patterns from all generated SKILL.md files after installation. This works but gets overwritten on `gstack-upgrade`.
Contributor guide
Research direction
Start in scripts/resolvers/preamble.ts and trace the telemetry config guard already used for analytics. Compare generated SKILL.md preambles with telemetry: off, then verify that session-directory commands and OPENCLAW_SESSION detection are absent or gated and that the configuration documentation matches.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell, typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100