PT-2026-22455

Summary Inter-session messages sent via sessions send could be interpreted as direct end-user instructions because they were persisted as role: "user" without provenance metadata. Affected Packages / Versions - Package: openclaw npm - Affected versions: = 2026.2.13 Impact A delegated or internal...