fix(cli): force dynamicBankGranularity=[agent] for SDA openclaw setups

SDA agents are local/per-agent — they don't have a channel or sender,
so the plugin's default granularity ["agent","channel","user"] produces
banks like "marketing-seo::unknown::anonymous" once a session starts.

Fix: after enabling knowledge tools, ensure the plugin's
dynamicBankGranularity is ["agent"]. On a fresh install we set it
silently; on an existing config that's already set to something else,
ask the user to confirm before overwriting. Also update the dry-run
preview default in resolveFromPlugin to match.

Author: nicoloboschi

src/cli.ts

@@ -158,6 +158,33 @@ function enableKnowledgeTools(): void {
   writeFileSync(OPENCLAW_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
 }
 
+// SDA agents are isolated per-agent only — no channel/user. The plugin's default
+// (["agent","channel","user"]) produces banks like "marketing-seo::unknown::anonymous"
+// for local sessions where channel/sender aren't populated.
+async function ensureOpenClawAgentGranularity(): Promise<void> {
+  const config = readOpenClawConfig();
+  if (!config) return;
+  const pc = config.plugins?.entries?.["hindsight-openclaw"]?.config;
+  if (!pc) return;
+
+  const current: string[] | undefined = pc.dynamicBankGranularity;
+  const desired = ["agent"];
+  const matches = Array.isArray(current) && current.length === 1 && current[0] === "agent";
+  if (matches) return;
+
+  if (current && current.length > 0) {
+    const ok = await p.confirm({
+      message: `Plugin has dynamicBankGranularity=${color.yellow(JSON.stringify(current))}. SDA agents need ${color.cyan('["agent"]')}. Override?`,
+      initialValue: true,
+    });
+    if (p.isCancel(ok) || !ok) return;
+  }
+
+  pc.dynamicBankGranularity = desired;
+  writeFileSync(OPENCLAW_CONFIG_PATH, JSON.stringify(config, null, 2) + "\n");
+  p.log.success("Set dynamicBankGranularity = [\"agent\"] for per-agent bank isolation");
+}
+
 const MIN_PLUGIN_VERSION = "0.7.2";
 
 function getInstalledPluginVersion(): string | null {
@@ -211,7 +238,7 @@ function resolveFromPlugin(agentId: string): { apiUrl: string; bankId: string; a
   if (pc.dynamicBankId === false && pc.bankId) {
     bankId = pc.bankId;
   } else {
-    const granularity: string[] = pc.dynamicBankGranularity || ["agent", "channel", "user"];
+    const granularity: string[] = pc.dynamicBankGranularity || ["agent"];
     const fieldMap: Record<string, string> = {
       agent: agentId,
       channel: "unknown",
@@ -831,9 +858,11 @@ async function main() {
     if (harness === "openclaw") {
       await ensurePlugin();
       enableKnowledgeTools();
+      await ensureOpenClawAgentGranularity();
       ({ apiUrl, bankId, apiToken } = resolveFromPlugin(agentId));
     } else if (harness === "nemoclaw") {
       await ensureNemoClawPlugin(sandbox!, agentId);
+      await ensureOpenClawAgentGranularity();
       ({ apiUrl, bankId, apiToken } = resolveFromPlugin(agentId));
     } else if (harness === "hermes") {
       // Resolve Hindsight connection: hermes config > openclaw config > prompt

src/tests/cli.test.ts

@@ -739,6 +739,38 @@ describe("claude-code allowed-tools merge", () => {
   });
 });
 
+describe("openclaw dynamicBankGranularity enforcement", () => {
+  // Mirrors ensureOpenClawAgentGranularity's decision logic. SDA agents are
+  // local/per-agent — they don't have channel/user, so the plugin's default
+  // ["agent","channel","user"] produces "<agent>::unknown::anonymous" banks.
+  type Action = "noop" | "set-fresh" | "ask-confirm";
+  function decide(current: unknown): Action {
+    if (Array.isArray(current) && current.length === 1 && current[0] === "agent") {
+      return "noop";
+    }
+    if (Array.isArray(current) && current.length > 0) {
+      return "ask-confirm";
+    }
+    return "set-fresh";
+  }
+
+  it("sets [agent] when not configured (fresh install)", () => {
+    expect(decide(undefined)).toBe("set-fresh");
+    expect(decide(null)).toBe("set-fresh");
+    expect(decide([])).toBe("set-fresh");
+  });
+
+  it("noop when already [agent]", () => {
+    expect(decide(["agent"])).toBe("noop");
+  });
+
+  it("asks confirmation when set to a different value", () => {
+    expect(decide(["agent", "channel", "user"])).toBe("ask-confirm");
+    expect(decide(["channel"])).toBe("ask-confirm");
+    expect(decide(["agent", "project"])).toBe("ask-confirm");
+  });
+});
+
 describe("claude-code Hindsight config persistence", () => {
   // Mirrors the config-write logic: if existing config has a connection
   // (hindsightApiUrl or llmProvider), don't prompt; otherwise prompt.