fix(cron-cli): bound loadCronJobForShow pagination (#83856) by yaoyi1222 · Pull Request #83989 · openclaw/openclaw

yaoyi1222 · 2026-05-19T04:43:14Z

Summary

loadCronJobForShow was paginating with for (;;) — no max-pages cap, no check that nextOffset actually advances. If the gateway ever returns hasMore=true with nextOffset stuck at the same value, openclaw cron show <id-or-name> would loop forever, reissuing identical cron.list RPCs.

The sibling loadCronJobForEditSchedulePatch in register.cron-edit.ts already has this guard; this PR mirrors that pattern in register.cron-simple.ts:

cap at CRON_SHOW_LOOKUP_MAX_PAGES = 50 iterations
assert nextOffset > offset between pages, throw if not
throw if the page cap is exceeded

Also exports loadCronJobForShow so the regression test can target it directly (the issue specifically calls out that this feature group has no tests).

AI-assisted (Claude Code).

Verification

node scripts/run-vitest.mjs src/cli/cron-cli — 25/25 pass, including the four new regression tests
node scripts/run-oxlint.mjs src/cli/cron-cli/register.cron-simple.ts src/cli/cron-cli/register.cron-simple.test.ts — 0 warnings, 0 errors
oxfmt --check on both touched files — clean
pnpm tsgo:core — clean

Real behavior proof

Behavior addressed: openclaw cron show <name> would hang indefinitely if the gateway returned a cron.list page with hasMore=true and a non-advancing nextOffset (e.g. stuck at 0), reissuing the same RPC forever.
Real environment tested: local macOS checkout, rebased on upstream main (d60ab48). The real openclaw cron CLI command tree (registerCronSimpleCommands) was driven through commander as a spawned node process against a minimal ws stub gateway running on 127.0.0.1. The stub completes the real connect / hello-ok handshake and returns { jobs: [], hasMore: true, nextOffset: 0 } for every cron.list call.
Exact steps or command run after this patch:
- Spawned the stub: node .tmp-repro/stub-gateway.mjs — prints READY ws://127.0.0.1:<port>.
- Spawned the real CLI against it: node node_modules/.bin/tsx .tmp-repro/cron-show-shim.ts cron show foo --url ws://127.0.0.1:<port> --token stub (the shim does nothing but call the real registerCronSimpleCommands).

Evidence after fix: copied live terminal output, including the full CLI stderr and the stub's per-RPC log. After this PR, the real cron show command exits via the new error after a single cron.list round-trip:

[stub] cron.list #1 (offset=0)

=== CLI result ===
exit code: 1
signal: null
timed out: false
elapsed: 1330 ms
--- cli stderr ---
Error: cron.list pagination did not advance while looking up cron job
--- stub stderr (RPC log) ---
[stub] cron.list #1 (offset=0)

For comparison, against an unbounded build of the same code path (loop temporarily reverted locally, then restored), the same node-spawned CLI hangs and gets SIGKILLed by the 6 s driver timeout after issuing over a thousand identical cron.list RPCs all at offset=0:

[stub] cron.list #1 (offset=0)
[stub] cron.list #150 (offset=0)
[stub] cron.list #200 (offset=0)
... (continues to #1137+)
=== CLI result ===
exit code: null
signal: SIGKILL
timed out: true
elapsed: 6003 ms
--- cli stderr ---
(empty — process was spinning)

Observed result after fix: the real node-spawned openclaw cron show foo CLI process exits with code 1 in ~1.3 s after a single cron.list round-trip, emitting Error: cron.list pagination did not advance while looking up cron job on stderr. No more hang; one RPC, one error, clean exit.
What was not tested: I did not stand up the full production openclaw gateway and force it to actually misbehave at the cron.listPage source — the stub gateway above answers the same wire protocol as the real one (real hello-ok handshake, real cron.list req/res frames), which is what the issue itself recommends.

clawsweeper · 2026-05-19T04:44:15Z

Codex review: passed.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
Adds a 50-page and advancing-nextOffset guard to loadCronJobForShow, exports that helper for regression tests, and adds an unreleased changelog entry.

Reproducibility: yes. Current main is source-reproducible because loadCronJobForShow loops while hasMore is true and accepts a repeated numeric nextOffset; the PR discussion also includes terminal before/after proof for the same CLI path.

PR rating
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Summary: Strong terminal proof supports a focused, normally mergeable patch with no blocking findings from this review.

Rank-up moves:

none

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Sufficient (terminal): The PR body and follow-up comment provide terminal before/after output from a spawned real cron CLI command against a stub gateway that exercises the wire protocol and shows the hang becoming a one-RPC error exit.

Risk before merge

This read-only review did not execute the PR's validation commands, so exact-head CI or maintainer-run checks should remain the merge gate.

Maintainer options:

Decide the mitigation before merge
Land this focused guard through the existing automerge and CI gates, then let the linked cron CLI issue close after merge.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge
No repair lane is needed; the PR has no blocking findings and should proceed through exact-head CI and automerge gates.

Security
Cleared: The diff only changes cron CLI lookup code, a colocated test, and changelog text; it does not touch dependencies, workflows, credentials, package scripts, or code-download paths.

Review details

Best possible solution:

Land this focused guard through the existing automerge and CI gates, then let the linked cron CLI issue close after merge.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main is source-reproducible because loadCronJobForShow loops while hasMore is true and accepts a repeated numeric nextOffset; the PR discussion also includes terminal before/after proof for the same CLI path.

Is this the best way to solve the issue?

Yes. Mirroring the existing cron edit page cap and advancing-offset check is the narrowest maintainable fix for this cron show lookup loop.

Label justifications:

P2: This is a normal-priority CLI availability bug with limited blast radius to openclaw cron show lookups against malformed or buggy pagination responses.
rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🦞 diamond lobster, patch quality is 🐚 platinum hermit, and Strong terminal proof supports a focused, normally mergeable patch with no blocking findings from this review.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (terminal): The PR body and follow-up comment provide terminal before/after output from a spawned real cron CLI command against a stub gateway that exercises the wire protocol and shows the hang becoming a one-RPC error exit.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body and follow-up comment provide terminal before/after output from a spawned real cron CLI command against a stub gateway that exercises the wire protocol and shows the hang becoming a one-RPC error exit.

What I checked:

Current main source-reproducible hang path: loadCronJobForShow on current main uses for (;;), keeps calling cron.list while hasMore is true, and assigns offset = page.nextOffset without checking that the offset advances. (src/cli/cron-cli/register.cron-simple.ts:95, 0c67dc7f82af)
Existing sibling guard pattern: loadCronJobForEditSchedulePatch already caps lookup pagination at 50 pages and throws when nextOffset does not advance, matching the PR's chosen fix shape. (src/cli/cron-cli/register.cron-edit.ts:42, 0c67dc7f82af)
PR implementation: The PR head changes loadCronJobForShow to use a 50-page loop, throw on non-advancing pagination, and throw when the page cap is exceeded. (src/cli/cron-cli/register.cron-simple.ts:91, 7828b4bdaef6)
Regression tests: The PR adds focused tests for non-advancing pagination, excessive pagination, finding a job on a later page, and no-match termination. (src/cli/cron-cli/register.cron-simple.test.ts:28, 7828b4bdaef6)
Gateway pagination contract: The gateway cron.list handler delegates to context.cron.listPage, whose normal implementation computes nextOffset = offset + jobs.length and reports hasMore from that offset, so the PR guards a malformed or buggy pagination response at the CLI boundary. (src/cron/service/ops.ts:349, 0c67dc7f82af)
Real behavior proof from PR discussion: The PR body and contributor follow-up include terminal before/after output from a spawned cron CLI process against a stub gateway: current behavior spins until killed, while the patched command exits after one cron.list call with the new pagination error. (7828b4bdaef6)

Likely related people:

Ayaan Zaidi: git blame and git log on the cron CLI files in this checkout attribute the current loadCronJobForShow, sibling edit lookup, and cron CLI tests to commit af5e0b26ef. (role: current-main code introducer and recent area contributor; confidence: medium; commits: af5e0b26efa2; files: src/cli/cron-cli/register.cron-simple.ts, src/cli/cron-cli/register.cron-edit.ts, src/cli/cron-cli.test.ts)
Takhoffman: The PR discussion includes an explicit @clawsweeper automerge request from this account, making them a likely follow-up reviewer for this PR state. (role: automerge requester; confidence: medium)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0c67dc7f82af.

yaoyi1222 · 2026-05-19T05:14:12Z

Real behavior proof — stubbed gateway

Added the redacted terminal output the review asked for. Setup: a minimal ws server stubs the gateway, answers the handshake with hello-ok, and returns { jobs: [], hasMore: true, nextOffset: 0 } for every cron.list call. The real cron show CLI command (registered via the actual registerCronSimpleCommands) connects to it with --url/--token.

Before this PR (unbounded loop)

CLI hangs; killed externally with SIGKILL after a 6 s driver timeout. During that 6 s the stub received over a thousand identical cron.list RPCs, all at offset=0:

[stub.err] [stub] cron.list #1 (offset=0)
[stub.err] [stub] cron.list #150 (offset=0)
[stub.err] [stub] cron.list #200 (offset=0)
...
[stub.err] [stub] cron.list #1137 (offset=0)
...

=== CLI result ===
exit code: null
signal: SIGKILL
timed out: true
elapsed: 6003 ms
--- cli stderr ---
(empty — process was spinning)

After this PR (guard applied)

CLI exits cleanly after a single cron.list round-trip with the new error:

[stub.err] [stub] cron.list #1 (offset=0)

=== CLI result ===
exit code: 1
signal: null
timed out: false
elapsed: 1330 ms
--- cli stderr ---
Error: cron.list pagination did not advance while looking up cron job
--- stub stderr (RPC log) ---
[stub] cron.list #1 (offset=0)

One RPC, advancement guard fires, process exits 1. Same change in commit f9d9e0b as the original PR — pre-fix run was produced by temporarily reverting just loadCronJobForShow's loop locally, then restored.

— AI-assisted (Claude Code).

Takhoffman · 2026-05-19T11:46:10Z

@clawsweeper automerge

clawsweeper · 2026-05-19T11:48:06Z

🦞🧹
ClawSweeper automerge is enabled.

Head: 7828b4bdaef6
Label: clawsweeper:automerge
Action: exact-head review queued (workflow sweep.yml, event repository_dispatch).
Flow: review this head, repair/rebase only if needed, then re-review the exact repaired head before merge.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

2026-05-19 11:51:51 UTC repair completed (no branch change) in 46s Run: https://github.com/openclaw/clawsweeper/actions/runs/26095168547 source PR fix(cron-cli): bound loadCronJobForShow pagination (#83856) #83989 is paused by clawsweeper:human-review; refusing to mutate the PR branch

2026-05-19 11:51:53 UTC repair finished (blocked) in 47s Run: https://github.com/openclaw/clawsweeper/actions/runs/26095168547 source PR fix(cron-cli): bound loadCronJobForShow pagination (#83856) #83989 is paused by clawsweeper:human-review; refusing to mutate the PR branch

2026-05-20 06:51:26 UTC review passed e055fa292a2f (structured ClawSweeper verdict: pass (sha=e055fa292a2fbc94eba65507fcb35d009582b...)

2026-05-20 06:51:46 UTC repair queued e055fa292a2f (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364

2026-05-20 06:58:11 UTC repair started (running) in 0s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 automerge-openclaw-openclaw-83989

2026-05-20 06:58:30 UTC validation plan (passed) in 20s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-05-20 06:58:44 UTC Codex write preflight (passed) in 34s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 danger-full-access

2026-05-20 07:02:30 UTC Codex edit 1 67c12e036802 (complete) in 4m 20s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 exit 0

2026-05-20 07:09:39 UTC validation and review 1 7828b4bdaef6 (base moved) in 11m 28s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 codex-reconciled

2026-05-20 07:09:46 UTC repair completed 7828b4bdaef6 (branch updated) in 11m 36s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 initial automerge rebase is delegated to Codex repair

2026-05-20 07:09:46 UTC review queued 7828b4bdaef6 (after repair)

2026-05-20 07:19:22 UTC automerge wait 7828b4bdaef6 (ready) in 21m 11s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 checks and exact-head review are ready

2026-05-20 07:19:23 UTC repair finished 7828b4bdaef6 (pushed) in 21m 13s Run: https://github.com/openclaw/clawsweeper/actions/runs/26146456364 repair_contributor_branch

2026-05-20 07:17:00 UTC review passed 7828b4bdaef6 (structured ClawSweeper verdict: pass (sha=7828b4bdaef67c4487c2d10e66af2f29897f2...)

2026-05-20 07:19:41 UTC merged 7828b4bdaef6 (merged by ClawSweeper automerge)

2026-05-20 07:19:45 UTC review queued 7828b4bdaef6 (queued)

clawsweeper · 2026-05-19T11:49:37Z

🦞✅
ClawSweeper is pausing this repair loop for human review.

Source: clawsweeper[bot]
Reason: No ClawSweeper repair lane is needed; the patch has no blocking findings and should proceed through normal maintainer merge gates.; Cleared: The diff only touches cron CLI lookup code and colocated tests, with no dependency, workflow, credential, package, or code-download surface changed. (sha=f9d9e0b4deb87cb27c52d0437670643a398a5474)

Why human review is needed:
This item has security-sensitive risk. ClawSweeper is pausing instead of making an autonomous change that could affect trust, credentials, permissions, or exposure.

Recommended next action:
Have a maintainer review the security-sensitive detail and provide an explicit safe path before asking ClawSweeper to continue.

I added clawsweeper:human-review and left the final call with a maintainer.

giodl73-repo

Looks good. The fix mirrors the existing bounded cron edit lookup behavior for cron show, adds advancement and max-page guards, and includes focused regression coverage for the stuck-pagination, page-cap, later-page, and empty-result paths. The supplied stub-gateway proof demonstrates the previous hang and the new one-RPC failure mode, with current CI/checks green.

clawsweeper · 2026-05-20T06:51:28Z

ClawSweeper PR egg

✨ Hatched: 💎 rare Mossy Review Wisp

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 💎 rare.
Trait: keeps receipts.
Image traits: location review cove; accessory little merge flag; palette seafoam, black, and opal; mood patient; pose nestled inside a glowing shell; shell starlit enamel shell; lighting warm desk-lamp glow; background soft code-shaped tiles.
Share on X: post this hatch
Copy: My PR egg hatched a 💎 rare Mossy Review Wisp in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Summary: - Adds a 50-page and advancing-`nextOffset` guard to `loadCronJobForShow`, exports that helper for regression tests, and adds an unreleased changelog entry. - Reproducibility: yes. Current main is source-reproducible because `loadCronJobForShow` loops while `hasMore` ... ed numeric `nextOffset`; the PR discussion also includes terminal before/after proof for the same CLI path. Automerge notes: - No ClawSweeper repair was needed after automerge opt-in. Validation: - ClawSweeper review passed for head 7828b4bdaef67c4487c2d10e66af2f29897f2a55. - Required merge gates passed before the squash merge. Prepared head SHA: 7828b4bdaef67c4487c2d10e66af2f29897f2a55 Review: openclaw/openclaw#83989 (comment) Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

@altaywtf

* fix(errors): dedupe identical messages when traversing error .cause chain (openclaw#84556) Merged via squash. Prepared head SHA: 46aa27f Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com> Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com> Reviewed-by: @altaywtf * fix(cli): gate exported subcli descriptors (openclaw#84519) Summary: - This PR filters exported sub-CLI descriptors through the private-QA gate, centralizes that filter, adds regr ... ge, and carries small validation repairs in workspace glob and tunnel-timeout tests plus a changelog entry. - Reproducibility: yes. Current-main source shows the raw SUB_CLI_DESCRIPTORS export can include qa while the helper surfaces filter it, and src/cli/argv.ts consumes that export for root command policy. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(cli): gate exported subcli descriptors - PR branch already contained follow-up commit before automerge: fix(clawsweeper): address review for automerge-openclaw-openclaw-8451… Validation: - ClawSweeper review passed for head ba197a6. - Required merge gates passed before the squash merge. Prepared head SHA: ba197a6 Review: openclaw#84519 (comment) Co-authored-by: Zhaocun <zhaocunsun@gmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com> * fix(doctor): migrate invalid thinking formats (openclaw#84626) * fix(cron-cli): bound loadCronJobForShow pagination (openclaw#83856) (openclaw#83989) Summary: - Adds a 50-page and advancing-`nextOffset` guard to `loadCronJobForShow`, exports that helper for regression tests, and adds an unreleased changelog entry. - Reproducibility: yes. Current main is source-reproducible because `loadCronJobForShow` loops while `hasMore` ... ed numeric `nextOffset`; the PR discussion also includes terminal before/after proof for the same CLI path. Automerge notes: - No ClawSweeper repair was needed after automerge opt-in. Validation: - ClawSweeper review passed for head 7828b4b. - Required merge gates passed before the squash merge. Prepared head SHA: 7828b4b Review: openclaw#83989 (comment) Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com> * fix(config): accept execApprovals.enabled="auto" in zod schema * fix: honour tool error suppression for mutating tools (openclaw#81561) Merged via squash. Prepared head SHA: 7462a86 Co-authored-by: moeedahmed <5780040+moeedahmed@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman * Add OpenRouter provider routing params (openclaw#84579) Co-authored-by: Alex Knight <15041791+amknight@users.noreply.github.com> * Preserve AGENTS.md policy during bootstrap truncation (openclaw#82921) Fixes openclaw#82920 * chore: regenerate base config schema Updated after MODEL_THINKING_FORMATS changed from z.union literals to z.enum, and session/session.agentToAgent gained detailed help text. * Revert "Add OpenRouter provider routing params (openclaw#84579)" This reverts commit 53254dc. --------- Co-authored-by: Dallin Romney <dallinromney@gmail.com> Co-authored-by: RomneyDa <6581799+RomneyDa@users.noreply.github.com> Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com> Co-authored-by: Zhaocun Sun <zhaocunsun@gmail.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com> Co-authored-by: Gio Della-Libera <giodl73@gmail.com> Co-authored-by: yaoyi1222 <yaoyi_1222@163.com> Co-authored-by: Sarah Fortune <sarah.fortune@gmail.com> Co-authored-by: Moeed Ahmed <drmoeedahmed@gmail.com> Co-authored-by: moeedahmed <5780040+moeedahmed@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Co-authored-by: Alex Knight <aknight@atlassian.com> Co-authored-by: Alex Knight <15041791+amknight@users.noreply.github.com> Co-authored-by: Galin Iliev <iliev@galcho.com>

…026.5.20) (#615) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520) [Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20) ##### Changes - Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed. - Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#84264](openclaw/openclaw#84264)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#84499](openclaw/openclaw#84499)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog. - CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#80407](openclaw/openclaw#80407)) Thanks [@giodl73-repo](https://github.com/giodl73-repo). - Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. - Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#84005](openclaw/openclaw#84005)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@amknight](https://github.com/amknight). ##### Fixes - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#84691](openclaw/openclaw#84691)) Thanks [@efpiva](https://github.com/efpiva). - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#84736](openclaw/openclaw#84736)) Thanks [@JARVIS-Glasses](https://github.com/JARVIS-Glasses). - Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#84508](openclaw/openclaw#84508). Thanks [@neeravmakwana](https://github.com/neeravmakwana). - Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#84699](openclaw/openclaw#84699)) Thanks [@nxmxbbd](https://github.com/nxmxbbd). - WhatsApp: update Baileys to `7.0.0-rc12`. - Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@romneyda](https://github.com/romneyda). - CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#84684](openclaw/openclaw#84684)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired. - Mac app: update the About settings copyright year to 2026. ([#84385](openclaw/openclaw#84385)) Thanks [@pejmanjohn](https://github.com/pejmanjohn). - Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS. - Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@romneyda](https://github.com/romneyda). - Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#84595](openclaw/openclaw#84595)) - Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#77803](openclaw/openclaw#77803). - Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#84718](openclaw/openclaw#84718)) Thanks [@lukaIvanic](https://github.com/lukaIvanic). - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`. - WebChat: clear stale typing indicators when session change events mark the active chat run complete. - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports. - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows. - Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed. - fix(mattermost): fail closed on missing channel type \[AI]. ([#84091](openclaw/openclaw#84091)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Recheck rebuilt system.run argv \[AI]. ([#84090](openclaw/openclaw#84090)) Thanks [@pgondhi987](https://github.com/pgondhi987). - CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#84519](openclaw/openclaw#84519)) - CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#83856](openclaw/openclaw#83856). ([#83989](openclaw/openclaw#83989)) - Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#84289](openclaw/openclaw#84289)) - Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#83477](openclaw/openclaw#83477)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#82930](openclaw/openclaw#82930). ([#82933](openclaw/openclaw#82933)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#84269](openclaw/openclaw#84269)) Thanks [@Kaspre](https://github.com/Kaspre). - Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#84254](openclaw/openclaw#84254)) Thanks [@moritzmmayerhofer](https://github.com/moritzmmayerhofer). - Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#82937](openclaw/openclaw#82937)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#84191](openclaw/openclaw#84191)) Thanks [@100menotu001](https://github.com/100menotu001). - Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#60799](openclaw/openclaw#60799). ([#84433](openclaw/openclaw#84433)) Thanks [@IWhatsskill](https://github.com/IWhatsskill). - Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#84355](openclaw/openclaw#84355); refs [#57835](openclaw/openclaw#57835)) Thanks [@luoyanglang](https://github.com/luoyanglang). - Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#84303](openclaw/openclaw#84303)) Thanks [@VACInc](https://github.com/VACInc). - Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#84153](openclaw/openclaw#84153)) - Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#84188](openclaw/openclaw#84188)) Thanks [@100menotu001](https://github.com/100menotu001). - Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#83887](openclaw/openclaw#83887). ([#84244](openclaw/openclaw#84244)) Thanks [@hclsys](https://github.com/hclsys). - Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#82766](openclaw/openclaw#82766). ([#82767](openclaw/openclaw#82767)) Thanks [@galiniliev](https://github.com/galiniliev). - Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#84067](openclaw/openclaw#84067)) Thanks [@abnershang](https://github.com/abnershang). - Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#84045](openclaw/openclaw#84045)) Thanks [@abnershang](https://github.com/abnershang). - Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@SebTardif](https://github.com/SebTardif). - harden update restart script creation \[AI]. ([#84088](openclaw/openclaw#84088)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#83613](openclaw/openclaw#83613). ([#83626](openclaw/openclaw#83626)) Thanks [@YuanHanzhong](https://github.com/YuanHanzhong). - CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`. - Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#84057](openclaw/openclaw#84057)) - CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#83995](openclaw/openclaw#83995)) Thanks [@ThiagoCAltoe](https://github.com/ThiagoCAltoe). - Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@bdjben](https://github.com/bdjben). - CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#83904](openclaw/openclaw#83904). ([#84080](openclaw/openclaw#84080)) - Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#84055](openclaw/openclaw#84055)) Thanks [@dutifulbob](https://github.com/dutifulbob). - Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering. - CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@amknight](https://github.com/amknight). - CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#56222](openclaw/openclaw#56222). Thanks [@galiniliev](https://github.com/galiniliev). - Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#83858](openclaw/openclaw#83858)) Thanks [@brokemac79](https://github.com/brokemac79). - CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#84392](openclaw/openclaw#84392)) Thanks [@joshavant](https://github.com/joshavant). - Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#84387](openclaw/openclaw#84387)) Thanks [@samzong](https://github.com/samzong). - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#82961](openclaw/openclaw#82961). ([#82962](openclaw/openclaw#82962)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#83699](openclaw/openclaw#83699). ([#83700](openclaw/openclaw#83700)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#84040](openclaw/openclaw#84040). ([#84357](openclaw/openclaw#84357)) Thanks [@joshavant](https://github.com/joshavant). - Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#84222](openclaw/openclaw#84222). ([#84374](openclaw/openclaw#84374)) Thanks [@joshavant](https://github.com/joshavant). - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#83979](openclaw/openclaw#83979)) Thanks [@yujiawei](https://github.com/yujiawei). - Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#83836](openclaw/openclaw#83836). ([#84367](openclaw/openclaw#84367)) Thanks [@joshavant](https://github.com/joshavant). - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#82964](openclaw/openclaw#82964)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#83931](openclaw/openclaw#83931)) Thanks [@honor2030](https://github.com/honor2030). - Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#84050](openclaw/openclaw#84050). ([#84052](openclaw/openclaw#84052)) Thanks [@jbetala7](https://github.com/jbetala7). - WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#83846](openclaw/openclaw#83846)) Thanks [@neeravmakwana](https://github.com/neeravmakwana). - WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#79083](openclaw/openclaw#79083)) Thanks [@Oviemudiaga](https://github.com/Oviemudiaga). - CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#83640](openclaw/openclaw#83640)) Thanks [@se7en-agent](https://github.com/se7en-agent). - Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#83684](openclaw/openclaw#83684)) Thanks [@ngutman](https://github.com/ngutman). - iOS: repair Release archive compilation for the TestFlight build. ([#84255](openclaw/openclaw#84255)) Thanks [@ngutman](https://github.com/ngutman). - Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#84083](openclaw/openclaw#84083)) Thanks [@100yenadmin](https://github.com/100yenadmin). - Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#42197](openclaw/openclaw#42197)) Thanks [@Rain120](https://github.com/Rain120). - Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#84386](openclaw/openclaw#84386). ([#84412](openclaw/openclaw#84412)) Thanks [@openperf](https://github.com/openperf). - Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#81561](openclaw/openclaw#81561)) Thanks [@moeedahmed](https://github.com/moeedahmed). - Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#79396](openclaw/openclaw#79396). ([#79489](openclaw/openclaw#79489)) Thanks [@aayushprsingh](https://github.com/aayushprsingh). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615

…penclaw#83989) Summary: - Adds a 50-page and advancing-`nextOffset` guard to `loadCronJobForShow`, exports that helper for regression tests, and adds an unreleased changelog entry. - Reproducibility: yes. Current main is source-reproducible because `loadCronJobForShow` loops while `hasMore` ... ed numeric `nextOffset`; the PR discussion also includes terminal before/after proof for the same CLI path. Automerge notes: - No ClawSweeper repair was needed after automerge opt-in. Validation: - ClawSweeper review passed for head 7828b4b. - Required merge gates passed before the squash merge. Prepared head SHA: 7828b4b Review: openclaw#83989 (comment) Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: takhoffman Co-authored-by: takhoffman <781889+takhoffman@users.noreply.github.com>

openclaw-barnacle Bot added cli CLI command changes size: S triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels May 19, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: mock-only-proof Candidate: PR proof only shows tests, mocks, snapshots, lint, typecheck, or CI. labels May 19, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 19, 2026

clawsweeper Bot added the clawsweeper:human-review Needs maintainer review before ClawSweeper can continue label May 19, 2026

giodl73-repo approved these changes May 19, 2026

View reviewed changes

clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 20, 2026

clawsweeper Bot removed the clawsweeper:human-review Needs maintainer review before ClawSweeper can continue label May 20, 2026

fix(cron-cli): bound loadCronJobForShow pagination (openclaw#83856)

7828b4b

clawsweeper Bot force-pushed the fix/83856-cron-show-unbounded-loop branch from e055fa2 to 7828b4b Compare May 20, 2026 07:09

clawsweeper Bot merged commit 110042d into openclaw:main May 20, 2026
97 of 98 checks passed

frankhli843 mentioned this pull request May 21, 2026

maintenance: selective upstream sync 2026-05-21 (8 commits ported) gemmaclaw/gemmaclaw#209

Merged

4 tasks

yaoyi1222 deleted the fix/83856-cron-show-unbounded-loop branch May 21, 2026 07:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cron-cli): bound loadCronJobForShow pagination (#83856)#83989

fix(cron-cli): bound loadCronJobForShow pagination (#83856)#83989
clawsweeper[bot] merged 1 commit into
openclaw:mainfrom
yaoyi1222:fix/83856-cron-show-unbounded-loop

yaoyi1222 commented May 19, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 19, 2026 •

edited

Loading

Uh oh!

yaoyi1222 commented May 19, 2026

Uh oh!

Takhoffman commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 19, 2026

Uh oh!

giodl73-repo left a comment

Uh oh!

clawsweeper Bot commented May 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

yaoyi1222 commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Real behavior proof

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yaoyi1222 commented May 19, 2026

Real behavior proof — stubbed gateway

Before this PR (unbounded loop)

After this PR (guard applied)

Uh oh!

Takhoffman commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 19, 2026

Uh oh!

giodl73-repo left a comment

Choose a reason for hiding this comment

Uh oh!

clawsweeper Bot commented May 20, 2026

Hatch command

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

yaoyi1222 commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading