Session History Enhanced

Session history system for OpenClaw — persistent, browsable, resumable chat sessions with SQLite index, archive/restore, migration, paginated UI, and chat dr...

This skill appears internally consistent and implements a local session-history feature. Before applying it: (1) back up your OpenClaw session directories (e.g., ~/.openclaw/agents/*/sessions/) because the migration and archive operations move and can delete transcript files; (2) review INSTALL.md and ensure your environment can build / has the SQLite/native node bindings referenced by the code (DatabaseSync); (3) test in a staging copy of your data first so you can confirm migration behavior; (4) be aware that the migration auto-runs on first access and will index/move orphaned .jsonl files — if you want to control timing, run migration manually or inspect the code first; (5) review the code snippets for any site-specific path usage if you run multiple agents, since operations are performed per-agentId. If you want extra assurance, ask for the missing INSTALL.md and a diff/PR that will be applied so you can review the exact changes before installing.

Type: OpenClaw Skill Name: session-history-enhancements Version: 1.0.1 The skill introduces a session history system with SQLite indexing and file management. While the primary functionality is benign and uses good practices like prepared statements for SQL and TypeBox for RPC input validation, there are theoretical vulnerabilities. Specifically, the `sessions.deleteArchived` RPC in `references/backend-rpc-handlers.ts.txt` uses `fs.unlinkSync(filePath)` to delete transcript files. Although `filePath` is derived from internal logic (`path.join` with controlled directories and filenames), a sophisticated path traversal vulnerability could theoretically lead to arbitrary file deletion if an attacker could inject a malicious path into the SQLite database. Similarly, `JSON.parse` is used on the first line of internal `.jsonl` transcript files in `references/backend-session-archive.ts.txt` and `references/backend-history-migration.ts.txt`, which could pose a risk if an attacker could introduce a specially crafted file. These are vulnerabilities (flaws that *allow* attacks) rather than clear evidence of *intentional malicious behavior*.