garrytan / garrytan/gstack

Session tracking and OPENCLAW_SESSION preamble not gated by telemetry config

Open
#1,150 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
133k
Forks
19.9k
Avg merge
18h 46m
Merged PRs (30d)
26

Description

## Problem

Enterprise security scanners flag gstack installations due to strings in every generated SKILL.md preamble:

```bash
mkdir -p ~/.gstack/sessions
touch ~/.gstack/sessions/"$PPID"
_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
find ~/.gstack/sessions -mmin +120 -type f -exec rm {} + 2>/dev/null || true
```

```bash
[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true
```

These run **regardless of the `telemetry: off` config setting**. The telemetry config only gates remote data sending and local JSONL analytics, but session file creation, session cleanup via `find`, and the `OPENCLAW_SESSION` env var check are unconditional in the preamble.

At my company, a custom security rule monitoring for `OpenClaw` strings and suspicious `find` commands in shell initialization scripts triggered an alert, requiring investigation and remediation.

## Current behavior

- `scripts/resolvers/preamble.ts` embeds session tracking and `OPENCLAW_SESSION` detection into every SKILL.md
- Setting `telemetry: off` in `~/.gstack/config.yaml` does **not** disable these
- 765+ references across all generated SKILL.md files (every host variant × every skill)

## Suggested improvement

1. **Gate session tracking behind telemetry config** — wrap `mkdir/touch/find` for `~/.gstack/sessions/` in the same `_TEL != "off"` guard used for analytics
2. **Gate `OPENCLAW_SESSION` detection behind a config flag** — or remove it from the preamble entirely since it's only relevant when running inside OpenClaw
3. **Document what `telemetry: off` actually disables** — current config comments imply it controls all data collection, but session files are still created on disk

This would let enterprise users set `telemetry: off` and have confidence that no session tracking artifacts are created on disk.

## Workaround

Manually strip the patterns from all generated SKILL.md files after installation. This works but gets overwritten on `gstack-upgrade`.

Contributor guide

Open the contributing guide

Research direction

Start in scripts/resolvers/preamble.ts and trace the telemetry config guard already used for analytics. Compare generated SKILL.md preambles with telemetry: off, then verify that session-directory commands and OPENCLAW_SESSION detection are absent or gated and that the configuration documentation matches.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell, typescript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.