Summary
On v2026.2.24, the cron tool passes sandbox tool policy (openclaw sandbox explain confirms cron in allow, not in deny), but the tool definition is never sent to the model provider. The agent cannot call cron. This is a follow-up to #25656 — the fix in #25821 addressed the coding tool profile for /tools/invoke but did not fix tool schema injection into agent sessions.
Steps to reproduce
- Set cron.enabled: true in config
- Add "cron" to tools.sandbox.tools.allow
- openclaw gateway restart
- Start a new session (/new)
- Ask the agent to list its available tools
Expected behavior
cron is absent from the agent's tool list. All other tools in tools.sandbox.tools.allow are present (exec, read, write, browser, web_search, etc.). Only cron is missing.
Actual behavior
cron appears in the agent's tool list and can be called (e.g. cron.list, cron.add).
openclaw sandbox explain output:
allow (global): exec, process, read, write, edit, apply_patch, sessions_list, sessions_history, sessions_send, sessions_spawn, subagents, session_status, browser, canvas, cron, memory_search, memory_get, web_search, web_fetch, image
deny (global): canvas, nodes, gateway, telegram, whatsapp, discord, googlechat, slack, signal, imessage
OpenClaw version
2026.2.24 (51d76eb)
Operating system
Ubuntu (OrbStack VM on macOS)
Install method
npm global
Logs, screenshots, and evidence
Agent tool list at session start:
read, write, edit, exec, process, browser, web_search, web_fetch,
sessions_spawn, sessions_send, sessions_list, sessions_history,
subagents, session_status, image, memory_search, memory_get
No "cron" despite sandbox explain showing it in allow.
Impact and severity
Affected: any sandboxed agent with cron enabled. Severity: medium — cron scheduling works via CLI workaround (openclaw cron add ... on host), but agent cannot self-manage jobs. Frequency: 100% reproducible.
Additional information
Original issue: #25656. Fix landed in #25821 (v2026.2.24) but only addressed the coding tool profile for /tools/invoke. The tool definition injection into the model's tool list at agent session startup appears to be a separate code path that still does not include cron. Config is correct — the gap is between policy resolution (which passes) and tool schema serialization to the provider.
Summary
On v2026.2.24, the cron tool passes sandbox tool policy (openclaw sandbox explain confirms cron in allow, not in deny), but the tool definition is never sent to the model provider. The agent cannot call cron. This is a follow-up to #25656 — the fix in #25821 addressed the coding tool profile for /tools/invoke but did not fix tool schema injection into agent sessions.
Steps to reproduce
Expected behavior
cron is absent from the agent's tool list. All other tools in tools.sandbox.tools.allow are present (exec, read, write, browser, web_search, etc.). Only cron is missing.
Actual behavior
cron appears in the agent's tool list and can be called (e.g. cron.list, cron.add).
openclaw sandbox explain output:
allow (global): exec, process, read, write, edit, apply_patch, sessions_list, sessions_history, sessions_send, sessions_spawn, subagents, session_status, browser, canvas, cron, memory_search, memory_get, web_search, web_fetch, image
deny (global): canvas, nodes, gateway, telegram, whatsapp, discord, googlechat, slack, signal, imessage
OpenClaw version
2026.2.24 (51d76eb)
Operating system
Ubuntu (OrbStack VM on macOS)
Install method
npm global
Logs, screenshots, and evidence
Impact and severity
Affected: any sandboxed agent with cron enabled. Severity: medium — cron scheduling works via CLI workaround (openclaw cron add ... on host), but agent cannot self-manage jobs. Frequency: 100% reproducible.
Additional information
Original issue: #25656. Fix landed in #25821 (v2026.2.24) but only addressed the coding tool profile for /tools/invoke. The tool definition injection into the model's tool list at agent session startup appears to be a separate code path that still does not include cron. Config is correct — the gap is between policy resolution (which passes) and tool schema serialization to the provider.