Summary

Found one regression in the new GitHub App active-PR-limit exemption. A concurrent successful removal by the Labeler workflow can make Barnacle receive a 404, keep the stale in-memory r: too-many-prs label, and then close the App-authored PR for the exact limit this commit meant to skip.

What ClawSweeper Is Fixing

• Medium: Barnacle can still close App-authored PRs when stale limit-label removal races (regression)
  • File: scripts/github/barnacle-auto-response.mjs:986
  • Evidence: The new App-author path calls removeLabels(...) at scripts/github/barnacle-auto-response.mjs:986, but removeLabels only deletes from labelSet after a successful API removal and ignores 404s without clearing the local set at scripts/github/barnacle-auto-response.mjs:799. The Labeler workflow now also removes the same stale label for bot/App authors at .github/workflows/labeler.yml:299, so both workflows can race on the same pull_request_target event. I reproduced this with a focused harness where removeLabel throws 404 for a renovate[bot] PR whose event payload includes r: too-many-prs; Barnacle attempted removal twice, then created the “more than 10 active PRs” close comment and closed the PR.
  • Impact: GitHub App-authored PRs can still be auto-closed by Barnacle if Labeler removes the stale limit label first. This undermines the commit’s intended exemption and can disrupt bot/App PR queues on synchronize, edited, or reopened events with a stale label in the webhook payload.
  • Suggested fix: When the code has decided a label should be treated as absent, delete it from labelSet even if GitHub returns 404. A small targeted test should simulate removeLabel returning 404 for an App-authored PR with r: too-many-prs and assert no comment/update happens.
  • Confidence: high

Expected Repair Surface

• scripts/github/barnacle-auto-response.mjs
• .github/workflows/labeler.yml
• test/scripts/barnacle-auto-response.test.ts

Source And Review Context

• ClawSweeper report: https://github.com/openclaw/clawsweeper/blob/main/records/openclaw-openclaw/commits/ef799fd57a77ff34eba85cae283267fb98543ad4.md

• Commit under review: ef799fd

• Latest main at intake: 52bf20b

• Original commit author: Shadow

• GitHub author: @thewilloftheshadow

• Highest severity: medium

• Review confidence: high

• Diff: 5a3b75de33dda11de7931686264ecf86df93de2d..ef799fd57a77ff34eba85cae283267fb98543ad4

• Changed files: .github/workflows/labeler.yml, scripts/github/barnacle-auto-response.mjs, test/scripts/barnacle-auto-response.test.ts

• Code read: changed files, Auto response workflow entry point, active-label callers, Barnacle label/action flow, CI workflow docs, scoped script instructions

• Dependencies/web: no dependency manifests changed; no web checks needed

Expected validation

• pnpm check:changed

ClawSweeper already ran:

• pnpm docs:list
• git diff --check 5a3b75de33dda11de7931686264ecf86df93de2d..ef799fd57a77ff34eba85cae283267fb98543ad4
• pnpm install
• pnpm test test/scripts/barnacle-auto-response.test.ts passed: 19 tests
• pnpm exec oxfmt --check --threads=1 scripts/github/barnacle-auto-response.mjs test/scripts/barnacle-auto-response.test.ts passed
• pnpm check:workflows passed

Known review limits:

• No full CI/Testbox run; this was a focused commit review.
• pnpm exec actionlint .github/workflows/labeler.yml was unavailable directly, so I used the repo wrapper pnpm check:workflows, which installs/runs the pinned actionlint path.

ClawSweeper Guardrails

• Re-check the finding against latest main before changing code.
• Keep the patch to the narrowest behavior change and matching regression coverage.
• Do not merge automatically; this PR stays for maintainer review.

ClawSweeper 🐠 replacement reef notes:

• Cluster: clawsweeper-commit-openclaw-openclaw-ef799fd57a77
• Source PRs: none
• Credit: Detected by ClawSweeper commit review for ef799fd.; Original commit author: Shadow.
• Validation: pnpm check:changed

fish notes: model gpt-5.5, reasoning medium; reviewed against 97ba924.