fix(cron): parse PowerShell tools allow list by chen-zhang-cs-code · Pull Request #68858 · openclaw/openclaw

chen-zhang-cs-code · 2026-04-19T07:20:31Z

AI-assisted: yes (Codex).

Summary

cron add --tools and cron edit --tools now share a parser that accepts both comma-separated and whitespace-separated tool lists. This keeps the normal exec,read,write path working while also handling the Windows PowerShell shape reported in #68826, where the CLI can receive exec read write instead of the original comma-separated text.

Closes #68826.

What Changed

Added parseCronToolsAllow() in src/cli/cron-cli/shared.ts.
Reused that parser from both register.cron-add.ts and register.cron-edit.ts.
Covered comma, comma+space, whitespace-only, and array-shaped inputs in shared parser tests.
Added cron add/edit CLI regressions for --tools "exec read write".

Why This Is Safe

Existing quoted CSV input still parses to the same toolsAllow array.
The change only affects cron CLI option parsing before payload creation.
Empty input still omits toolsAllow rather than persisting a bogus entry.

Testing

pnpm exec node scripts/run-vitest.mjs run --config test/vitest/vitest.cli.config.ts src/cli/cron-cli.test.ts src/cli/cron-cli/shared.test.ts
pnpm exec oxfmt --check src/cli/cron-cli/shared.ts src/cli/cron-cli/register.cron-add.ts src/cli/cron-cli/register.cron-edit.ts src/cli/cron-cli/shared.test.ts src/cli/cron-cli.test.ts
pnpm exec oxlint src/cli/cron-cli/shared.ts src/cli/cron-cli/register.cron-add.ts src/cli/cron-cli/register.cron-edit.ts src/cli/cron-cli/shared.test.ts src/cli/cron-cli.test.ts
pnpm tsgo:core
pnpm tsgo:core:test

greptile-apps · 2026-04-19T07:22:13Z

Greptile Summary

This PR adds parseCronToolsAllow() in shared.ts to handle both comma-separated and whitespace-separated tool lists, fixing a PowerShell CLI regression (#68826) where --tools "exec read write" wasn't being parsed. The shared parser is then wired into both cron add and cron edit, replacing duplicated inline splitting logic.

Confidence Score: 5/5

Safe to merge — the change is narrowly scoped to CLI option parsing, all edge cases are well-tested, and normalizeOptionalString confirms no unintended normalization beyond trimming.

No P0/P1 findings. The shared parser correctly handles comma, comma+space, whitespace-only, and array inputs. Behavioral parity with the old code is maintained: an empty/whitespace-only --tools still omits toolsAllow, and the hasAgentTurnPatch guard is correctly extended to cover the Array.isArray(opts.tools) case. The old asymmetry between cron-add and cron-edit is cleanly resolved.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(cron): parse PowerShell tools allow ..." | Re-trigger Greptile}

chen-zhang-cs-code · 2026-04-19T08:42:49Z

Follow-up: rebased this onto current upstream/main and force-pushed the single cron-tools commit as 6288923b5e. The previous CI check lint failure is gone on the new run; all required jobs are green now. Scope is unchanged: cron add/edit --tools parsing only, fixing #68826.

chen-zhang-cs-code · 2026-04-19T09:29:54Z

@obviyus when you have a moment, could you take a quick look at this one?

It is rebased onto current main and fully green. The scope is intentionally narrow: only cron add/edit --tools parsing for the Windows PowerShell shape reported in #68826. Greptile also marked it safe to merge with no findings.

…chen-zhang-cs-code

…chen-zhang-cs-code)

obviyus

Verified the Windows PowerShell --tools failure mode and confirmed the shared parser now normalizes both comma-separated and space-joined input for cron add and cron edit.

Maintainer follow-up: clarified the --tools CLI help text and added the Unreleased changelog entry for this user-facing fix.

Local gate: pnpm test src/cli/cron-cli.test.ts src/cli/cron-cli/shared.test.ts and pnpm exec oxfmt --check CHANGELOG.md src/cli/cron-cli/register.cron-add.ts src/cli/cron-cli/register.cron-edit.ts.

obviyus · 2026-04-19T09:41:34Z

Landed on main.

Landed source commit: 777d0f6
Merge commit: 25e51bb

Thanks @chen-zhang-cs-code.

@jalehman

* test: stabilize standalone Parallels smoke lanes * fix: strip orphaned OpenAI reasoning blocks before responses API call (openclaw#55787) Merged via squash. Prepared head SHA: 263b952 Co-authored-by: suboss87 <11032439+suboss87@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman * fix: stabilize release smoke reruns * test: tolerate empty fireworks live responses * test: make OpenWebUI smoke deterministic * tasks: extract detached task lifecycle runtime (openclaw#68886) * tasks: extract detached task lifecycle runtime * tests: relax gateway seam expectation --------- Co-authored-by: Mariano Belinky <mariano@mb-server-643.local> * test: complete workspace setup in update smokes * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) * fix(cron): parse PowerShell tools allow list * fix(cron): clarify tools allow-list help * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) --------- Co-authored-by: Ayaan Zaidi <hi@obviy.us> * fix(browser): discover CDP websocket from bare ws:// URL before attach (openclaw#68715) * fix(browser): discover CDP websocket from bare ws:// URL before attach When browser.cdpUrl is set to a bare ws://host:port (no /devtools/ path), ensureBrowserAvailable would call isChromeReachable -> canOpenWebSocket against the URL verbatim. Chrome only accepts WebSocket upgrades at the specific path returned by /json/version, so the handshake failed immediately with HTTP 400. With attachOnly: true, that surfaced as: Browser attachOnly is enabled and profile "openclaw" is not running. even though the CDP endpoint was reachable and the profile was healthy. Reproduced by the new tests in chrome.test.ts and cdp.test.ts (openclaw#68027). Fix: introduce isDirectCdpWebSocketEndpoint(url) — true only when a ws/wss URL has a /devtools/<kind>/<id> handshake path. Route any other ws/wss cdpUrl (including the bare ws://host:port shape) through HTTP /json/version discovery by normalising the scheme via the existing normalizeCdpHttpBaseForJsonEndpoints helper. Apply this in isChromeReachable, getChromeWebSocketUrl, and createTargetViaCdp. Direct WS endpoints with a /devtools/ path are still opened without an extra discovery round-trip. Fixes openclaw#68027 * test(browser): add seeded fuzz coverage for CDP URL helpers Adds property-based / seeded-fuzz tests for the URL helpers the attachOnly CDP fix depends on (openclaw#68027): - isWebSocketUrl - isDirectCdpWebSocketEndpoint - normalizeCdpHttpBaseForJsonEndpoints - parseBrowserHttpUrl - redactCdpUrl - appendCdpPath - getHeadersWithAuth Follows the existing repo convention (see src/gateway/http-common.fuzz.test.ts): no fast-check dep, small mulberry32 PRNG + hand-rolled generators, deterministic per-describe seeds so failures are reproducible. Lifts cdp.helpers.ts coverage from 77.77% -> 89.54% statements, 67.9% -> 80.24% branches, 78% -> 90% lines. Remaining uncovered lines are inside the WS sender internals (createCdpSender, withCdpSocket, fetchCdpChecked rate-limit branch), which require integration-style mocks and are unrelated to the attachOnly fix. * test(browser): drive cdp.helpers/cdp/chrome to 100% coverage Lifts the three files touched by the openclaw#68027 attachOnly fix to 100% statements/branches/functions/lines across the extensions test suite. Adds cdp.helpers.internal.test.ts, cdp.internal.test.ts, and chrome.internal.test.ts covering error paths, branch matrices, CDP session helpers, Chrome spawn/launch/stop flows, and canRunCdpHealthCommand. Defensively unreachable guards are annotated with c8 ignore + inline justifications. * fix(browser): restore WS fallback for non-/devtools ws:// CDP URLs When /json/version discovery is unavailable (or returns no webSocketDebuggerUrl), fall back to treating the original bare ws/wss URL as a direct WebSocket endpoint. This preserves the openclaw#68027 fix for Chrome's debug port while restoring compatibility with Browserless/ Browserbase-style providers that expose a direct WebSocket root without a /json/version endpoint. Priority order for bare ws/wss cdpUrl inputs: 1. /devtools/<kind>/<id> URL \u2192 direct handshake, no discovery (unchanged) 2. bare ws/wss root \u2192 try HTTP discovery first; if discovery returns a webSocketDebuggerUrl use it; otherwise fall back to the original URL as a direct WS endpoint 3. HTTP/HTTPS URL \u2192 HTTP discovery only, no fallback (unchanged) Affected call sites: isChromeReachable, getChromeWebSocketUrl, createTargetViaCdp. Also renames a misleading test ('still enforces SSRF policy for direct WebSocket URLs') to accurately describe what it tests: SSRF enforcement on the navigation target URL, not on the CDP endpoint. New tests added for all three fallback paths. Coverage remains 100% on all three touched files (238 tests). * fix: browser attachOnly bare ws CDP follow-ups (openclaw#68715) (thanks @visionik) * test(tasks): align detached runtime mock return types * browser: route existing-session user profile through browser nodes (openclaw#68891) * browser: route user profile through browser nodes * browser: align existing-session node docs * browser: preserve host fallback on node discovery errors * browser: preserve configured node pin errors * browser: widen config mock in node pin test * fix: default kimi thinking to off (openclaw#68907) Co-authored-by: termtek <termtek@ubuntu.tail2b72cd.ts.net> * docs(changelog): note kimi thinking default fix * docs(changelog): add thanks for kimi fix * tasks: add detached runtime plugin registration contract (openclaw#68915) * tasks: register detached runtime plugins * tasks: harden detached runtime ownership * tasks: extract detached runtime contract types * changelog: note detached runtime contract * changelog: attribute detached runtime contract * feat(ui): add a2a operator dashboard shell * fix(ui): align a2a baseline with current read contract * feat(ui): add A2A case inspector panels * CI: route small workflows to ubuntu-latest * CI: route fork-blocked workflows to GitHub-hosted runners * CI: fall back to GITHUB_TOKEN for fork automation * CI: skip app-token steps when fork secrets are absent * CI: gate fork app-token steps through env guards * CI: fix stale fallback env guard * fix(ui): sync A2A locale snapshots * fix(ui): sync A2A locale metadata --------- Co-authored-by: Peter Steinberger <steipete@gmail.com> Co-authored-by: Subash Natarajan <suboss87@gmail.com> Co-authored-by: suboss87 <11032439+suboss87@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Co-authored-by: Mariano <132747814+mbelinky@users.noreply.github.com> Co-authored-by: Mariano Belinky <mariano@mb-server-643.local> Co-authored-by: ZC <chenzhangcode@163.com> Co-authored-by: Ayaan Zaidi <hi@obviy.us> Co-authored-by: Viz <visionik@pobox.com> Co-authored-by: Frank Yang <frank.ekn@gmail.com> Co-authored-by: termtek <termtek@ubuntu.tail2b72cd.ts.net> Co-authored-by: bangtong-ai <bangtong-ai@users.noreply.github.com> Co-authored-by: OpenClaw Agent <openclaw-agent@users.noreply.github.com> Co-authored-by: OpenClaw Bot <bot@openclaw.local>

…chen-zhang-cs-code

…chen-zhang-cs-code) * fix(cron): parse PowerShell tools allow list * fix(cron): clarify tools allow-list help * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) --------- Co-authored-by: Ayaan Zaidi <hi@obviy.us>

…chen-zhang-cs-code

…chen-zhang-cs-code) * fix(cron): parse PowerShell tools allow list * fix(cron): clarify tools allow-list help * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) --------- Co-authored-by: Ayaan Zaidi <hi@obviy.us>

…chen-zhang-cs-code

…chen-zhang-cs-code) * fix(cron): parse PowerShell tools allow list * fix(cron): clarify tools allow-list help * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) --------- Co-authored-by: Ayaan Zaidi <hi@obviy.us>

…chen-zhang-cs-code

…chen-zhang-cs-code) * fix(cron): parse PowerShell tools allow list * fix(cron): clarify tools allow-list help * fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @chen-zhang-cs-code) --------- Co-authored-by: Ayaan Zaidi <hi@obviy.us>

openclaw-barnacle Bot added cli CLI command changes size: S labels Apr 19, 2026

chen-zhang-cs-code force-pushed the codex/issue-68826-cron-tools-windows branch from 2e47257 to 6288923 Compare April 19, 2026 08:39

obviyus self-assigned this Apr 19, 2026

chen-zhang-cs-code and others added 3 commits April 19, 2026 15:09

fix(cron): parse PowerShell tools allow list

1fdfc90

fix(cron): clarify tools allow-list help

1fc8431

fix: parse PowerShell cron tools allow-list (openclaw#68858) (thanks @…

777d0f6

…chen-zhang-cs-code)

obviyus force-pushed the codex/issue-68826-cron-tools-windows branch from a6e35c8 to 777d0f6 Compare April 19, 2026 09:40

obviyus approved these changes Apr 19, 2026

View reviewed changes

obviyus merged commit 25e51bb into openclaw:main Apr 19, 2026
8 checks passed

github-actions Bot mentioned this pull request Apr 19, 2026

📡 Upstream Digest — 2026-04-19 10:32 UTC curtismercier/openclaw-mods#616

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cron): parse PowerShell tools allow list#68858

fix(cron): parse PowerShell tools allow list#68858
obviyus merged 3 commits intoopenclaw:mainfrom
chen-zhang-cs-code:codex/issue-68826-cron-tools-windows

chen-zhang-cs-code commented Apr 19, 2026

Uh oh!

greptile-apps Bot commented Apr 19, 2026

Uh oh!

chen-zhang-cs-code commented Apr 19, 2026

Uh oh!

chen-zhang-cs-code commented Apr 19, 2026

Uh oh!

obviyus left a comment

Uh oh!

Uh oh!

obviyus commented Apr 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

chen-zhang-cs-code commented Apr 19, 2026

Summary

What Changed

Why This Is Safe

Testing

Uh oh!

greptile-apps Bot commented Apr 19, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chen-zhang-cs-code commented Apr 19, 2026

Uh oh!

chen-zhang-cs-code commented Apr 19, 2026

Uh oh!

obviyus left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

obviyus commented Apr 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants