Severity: medium / Confidence: high / Category: bug
Triage: confirmed-bug
Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18)
Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• src/cli/node-cli/register.ts:15-16 (parsePortWithFallback)

function parsePortWithFallback(value: unknown, fallback: number): number {
  const parsed = parsePort(value);
  return parsed ?? fallback;
}

• src/cli/node-cli/register.ts:58-68 (None)

const port = parsePortWithFallback(opts.port, existing?.gateway?.port ?? 18789);
      await runNodeHost({
        gatewayHost: host,
        gatewayPort: port,

• src/cli/node-cli/daemon.ts:89-97 (runNodeDaemonInstall)

if (!Number.isFinite(port ?? Number.NaN) || (port ?? 0) <= 0 || (port ?? 0) > 65_535) {
    fail(
      opts.port !== undefined
        ? formatInvalidPortOption("--port")
        : formatInvalidConfigPort("node.gateway.port"),
    );
    return;
  }

Reasoning

The run subcommand uses parsePortWithFallback, which silently returns the fallback value (config port or 18789) when the supplied --port value is non-numeric or out of range. This means openclaw node run --port abc starts the node host on the fallback port with no diagnostic. The install subcommand validates the same value and calls fail with formatInvalidPortOption. A user who mis-types a port for run will get a silently wrong runtime address, which is hard to diagnose — especially when TLS fingerprinting or a NAT target is involved.

Reproduction

Run openclaw node run --port abc — the host starts on port 18789 without any error or warning.

Recommendation

Validate the port in the run action the same way runNodeDaemonInstall does: call parsePort, and if opts.port was provided but parsed as null, print an error and exit rather than falling back silently. The parsePortWithFallback helper should either be removed or renamed to parsePortWithSilentFallback to make the silent behavior explicit at each call-site.

Why existing tests miss this

No tests exist for this feature (the feature definition lists an empty tests array), so this path has never been exercised in a test environment.

Suggested regression test

In a Vitest unit test for registerNodeCli, invoke the run action with { port: 'abc' } and assert that runNodeHost is NOT called (or is called only after an error is surfaced), mirroring the existing validation contract in runNodeDaemonInstall.

Minimum fix scope

Add port validation to the run action handler in src/cli/node-cli/register.ts, matching the pattern in runNodeDaemonInstall.

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-264278dce9-_0ae855a8ab.