fix(cron): use structured denial signals by abnershang · Pull Request #84067 · openclaw/openclaw

abnershang · 2026-05-19T09:07:52Z

Summary

Remove cron outcome classification based on denial tokens found in summary, output text, final assistant text, or payload prose.
Preserve fatal cron denial handling through typed failureSignal metadata sourced from structured tool error codes.
Preserve thrown gateway/node-host denial codes across the embedded tool lifecycle catch path, including wrapped UNAVAILABLE gateway errors whose nested nodeError.message starts with a canonical denial token.
Add regression coverage so prose-only denial text is not promoted to fatal, while structured denial signals still are.

Real behavior proof

Behavior addressed: cron diagnostic classification no longer treats ordinary assistant/tool prose containing denial-looking phrases as a fatal cron failure unless structured error metadata marks the run as fatal. The follow-up patch also covers thrown gateway errors from the real lifecycle catch path, where GatewayClientRequestError.gatewayCode, nested details.nodeError.code, and nested details.nodeError.message must survive conversion into tool_execution_end.

Real environment tested: local OpenClaw source checkout in an isolated worktree on this branch, using the patched embedded tool lifecycle and cron failure-signal modules from the worktree root.

Exact steps or command run after the patch:

node --import tsx -e '<build a thrown gateway/node-host denial, convert it through buildToolLifecycleErrorResult, extract the structured code, and resolve the cron failure signal>'
node scripts/run-vitest.mjs src/agents/pi-embedded-subscribe.tools.test.ts src/agents/pi-embedded-subscribe.handlers.tools.test.ts src/agents/pi-embedded-runner/failure-signal.test.ts src/cron/isolated-agent.helpers.test.ts
pnpm tsgo:test:src
pnpm check:changed
git diff --check

Evidence after fix: terminal output from the one-shot runtime probe:

{
  "lifecycleStatus": "error",
  "wrapperCode": "UNAVAILABLE",
  "nestedNodeCode": "UNAVAILABLE",
  "nestedNodeMessage": "SYSTEM_RUN_DENIED: approval required",
  "extractedErrorCode": "SYSTEM_RUN_DENIED",
  "fatalForCron": true,
  "failureSignalCode": "SYSTEM_RUN_DENIED",
  "failureSignalMessage": "UNAVAILABLE: SYSTEM_RUN_DENIED: approval required"
}

Observed result after fix: prose-only SYSTEM_RUN_DENIED / could not run text remains normal cron output, prose-only tool output does not synthesize an error code, typed structured denial metadata still produces a fatal cron failure, and thrown gateway/node-host denials now normalize the production shape where both wrapper and nested codes are UNAVAILABLE while the nested message starts with SYSTEM_RUN_DENIED.

What was not tested: full baseline pnpm build && pnpm check && pnpm test was not run; this used the focused core lane for the touched classifier and tool-error lifecycle surfaces. No production cron job was modified.

Supplemental checks:

Focused Vitest lane passed: 6 files, 145 tests.
pnpm tsgo:test:src passed.
pnpm check:changed passed the core/coreTests lane, lint, typechecks, dependency guards, import-cycle guard, and related changed-file checks.
git diff --check passed.
docs/automation/cron-jobs.md was updated so the documented cron contract matches the structured-only classifier plus node-host wrapper compatibility.

Review

codex review --base origin/main was attempted twice locally, but the local Codex CLI failed before review started with OpenAI API 401 auth errors. Manual review caught and fixed one extraction bug before opening the PR, and the ClawSweeper/Codex review finding about thrown gateway errors is addressed in the latest commit.

AI-assisted

This PR was AI-assisted. I reviewed the diff, understand the code path, and ran the proof above locally.

clawsweeper · 2026-05-19T09:09:02Z

Codex review: needs changes before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR changes isolated cron denial handling from prose-token scanning to structured tool error metadata, preserves node-host wrapper metadata through embedded tool lifecycle errors, updates focused tests, and adjusts one cron docs page.

Reproducibility: yes. by source inspection: current main scans cron summary/output/final text for denial markers, and existing tests assert prose-marker promotion. I did not run tests because this review was read-only.

PR rating
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Summary: Normal good PR signal: focused implementation and proof with one low-risk docs alignment item plus a compatibility decision before merge.

Rank-up moves:

Update docs/cli/cron.md so both cron docs describe the same structured-only denial contract.

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

PR egg
✨ Hatched: 🥚 common Pearl Lint Imp

       /\  .---.  /\         
      /  \/     \/  \        
     /   ( -   - )   \       
    |       ._.       |      
    |   /|  ===  |\   |      
     \  \|______/|/  /       
      '._  `--'  _.'         
         '-.__.-'            
       _/|_|  |_|\_          
      /__|      |__\         
       .-----------.         
      '-------------'

Rarity: 🥚 common.
Trait: stacks clean commits.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Pearl Lint Imp in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
How to hatch it: reach status: 👀 ready for maintainer look or status: 🚀 automerge armed; that usually means sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Real behavior proof
Sufficient (terminal): The PR body includes copied terminal output from an after-fix runtime probe that exercises lifecycle error conversion, nested node denial extraction, and fatal cron signal resolution for the current wrapper shape.

Risk before merge
Why this matters: - Merging changes a documented compatibility path: cron output that only contains denial-looking prose will no longer fail the run unless structured metadata is present.

The companion CLI cron docs still describe the removed fallback, so users would see conflicting guidance until that page is updated.
If maintainers want stronger upgrade proof than the supplied runtime probe and focused tests, a real isolated cron smoke should exercise a node-host denial before landing.

Maintainer options:

Align the structured-only cron contract (recommended)
Update the companion CLI cron documentation so every user-facing cron page says structured denial metadata is authoritative and final-output marker fallback is no longer supported.
Accept the fallback removal explicitly
Maintainers can merge the runtime behavior intentionally once they are comfortable that existing prose-only denial marker workflows should be treated as ordinary cron output.
Ask for a full cron smoke first
If probe-level proof is not enough for this compatibility change, pause merge until a redacted isolated cron run shows the node-host denial recorded as a failed run and not delivered as green output.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Update docs/cli/cron.md so its Structured denials section matches the structured-only contract introduced by this PR: isolated cron uses structured execution-denial metadata, including node-host UNAVAILABLE wrappers whose nested message starts with SYSTEM_RUN_DENIED or INVALID_REQUEST, and ordinary assistant/final-output prose is not treated as a denial. Do not change runtime code.

Next step before merge
A narrow docs-only repair remains and can be handled safely without changing the runtime behavior under review.

Security
Cleared: No supply-chain, CI, dependency, secret-handling, permission expansion, or approval bypass concern was found; the diff changes post-failure classification and metadata propagation.

Review findings

[P3] Update the companion cron CLI docs — docs/automation/cron-jobs.md:54

Review details

Best possible solution:

Land the structured-only classifier after aligning all cron docs and explicitly accepting that prose-only denial markers are ordinary output, with the node-host wrapper regression coverage kept in place.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection: current main scans cron summary/output/final text for denial markers, and existing tests assert prose-marker promotion. I did not run tests because this review was read-only.

Is this the best way to solve the issue?

Mostly yes: structured error metadata is the maintainable boundary, and the latest commit handles the real node-host UNAVAILABLE wrapper shape. The remaining safer path is to align the companion CLI docs and have maintainers accept the structured-only compatibility change.

Label justifications:

P2: This is a focused cron/agent correctness fix with limited surface area but real scheduled-run reporting impact.
merge-risk: 🚨 compatibility: The PR intentionally removes a documented final-output denial-marker fallback that existing cron behavior currently supports.
merge-risk: 🚨 message-delivery: Cron denial classification controls whether a blocked scheduled command is reported as a failed run or delivered as ordinary output.

Full review comments:

[P3] Update the companion cron CLI docs — docs/automation/cron-jobs.md:54
This line updates the scheduled-task docs to say cron uses structured denial metadata only, but docs/cli/cron.md still tells users that isolated cron falls back to final-output denial markers and approval-binding phrases. Please update that companion page too so the public cron contract is consistent after this behavior change.
Confidence: 0.93

Overall correctness: patch is correct
Overall confidence: 0.86

Acceptance criteria:

git diff --check
pnpm docs:list

What I checked:

Current main prose fallback: Current main still contains cron denial-token fallback logic that scans output text for SYSTEM_RUN_DENIED, INVALID_REQUEST, and denial phrases before marking an isolated cron run fatal. (src/cron/isolated-agent/helpers.ts:53, d0f7c8fa2805)
PR removes fallback classifier: The PR diff removes detectCronDenialToken/resolveCronDenialSignal and makes fatal cron denial classification depend on structured failureSignal metadata, structured error payloads, or run-level errors. (src/cron/isolated-agent/helpers.ts:332, 119fa5d69f83)
Node-host denial contract: The node host sends denied system.run results as ok: false with wrapper code UNAVAILABLE and the canonical denial marker in error.message, matching the production shape the PR now handles. (src/node-host/invoke-system-run.ts:228, d0f7c8fa2805)
PR wrapper extraction: The PR head reads canonical denial codes from nested nodeError.message before falling back to wrapper codes and preserves GatewayClientRequestError.details.nodeError in lifecycle error results. (src/agents/pi-embedded-subscribe.tools.ts:108, 119fa5d69f83)
Remaining docs mismatch: docs/cli/cron.md still tells users that isolated cron falls back to denial markers in final output, while the PR updates only docs/automation/cron-jobs.md to the structured-only contract. (docs/cli/cron.md:168, d0f7c8fa2805)
Prior review context: The supplied review timeline shows two earlier P1 findings about thrown gateway/node-host denial wrappers; the latest PR commit 119fa5d69f83f1768af2248e3eed65c9bdd370c0 specifically adds wrapper normalization and tests for that feedback. (src/agents/pi-embedded-subscribe.tools.test.ts:54, 119fa5d69f83)

Likely related people:

Josh Avant: Blame and history show the current cron denial classifier, cron docs, and embedded tool helpers in this checkout were introduced together in Fix memory plugin CLI help dispatch. (role: current classifier and docs introducer; confidence: high; commits: eb6dd2c65d11; files: src/cron/isolated-agent/helpers.ts, docs/automation/cron-jobs.md, docs/cli/cron.md)
Peter Steinberger: Recent node-host approval hardening commits touch invoke-system-run.ts, including the denial paths whose wrapper shape the PR now normalizes. (role: node-host approval boundary contributor; confidence: medium; commits: a94ec3b79be9, dc825e59f540, 500d7cb10746; files: src/node-host/invoke-system-run.ts, src/node-host/invoke-system-run.test.ts)
Robin Waslander: Recent node-host work extended script-runner approval guards in the same system.run denial surface. (role: adjacent node-host contributor; confidence: medium; commits: b7a37c202316; files: src/node-host/invoke-system-run.ts, src/node-host/invoke-system-run.test.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against d0f7c8fa2805.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9393507524

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-19T09:11:55Z

+  const code = resolveFailureSignalCode(normalizeOptionalString(lastToolError.errorCode));
  if (!code) {
    return undefined;


Preserve thrown gateway error codes for cron denial

When a cron exec tool fails by throwing from callGatewayTool (for example host=node system.run rejected by the gateway/node host), the lifecycle catch in src/agents/pi-embedded-subscribe.ts:1077-1081 forwards only details.error = error.message and drops GatewayClientRequestError.gatewayCode/details.nodeError.code. Because this line now requires lastToolError.errorCode, those structured denials never produce a failureSignal, so the cron outcome can be reported as ordinary output instead of a fatal denial even though the gateway supplied structured error metadata.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a93da80605

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-19T12:27:53Z

+  const code = resolveFailureSignalCode(normalizeOptionalString(lastToolError.errorCode));
  if (!code) {
    return undefined;


Preserve node denial messages when code is unavailable

For cron host=node exec denials, relying only on lastToolError.errorCode misses the production shape: sendSystemRunDenied sends the node invoke result as error: { code: "UNAVAILABLE", message: params.message } while the denial marker (SYSTEM_RUN_DENIED: ...) is in the message, so extractToolErrorCode records UNAVAILABLE and this branch returns no failureSignal. Fresh evidence after the earlier review is that the patch now preserves nodeError, but src/node-host/invoke-system-run.ts:228-230 shows its code is still UNAVAILABLE, so the actual cron denial can again be delivered as ordinary output instead of a fatal cron failure.

Useful? React with 👍 / 👎.

abnershang · 2026-05-19T12:28:16Z

@clawsweeper re-review

clawsweeper · 2026-05-19T12:30:05Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26098088498
Updated: 2026-05-19T12:54:35.342Z

abnershang · 2026-05-19T12:31:37Z

@clawsweeper re-review

abnershang · 2026-05-19T14:49:07Z

@clawsweeper re-review

clawsweeper · 2026-05-19T14:51:00Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26105116721
Updated: 2026-05-19T14:59:58.580Z

Takhoffman · 2026-05-19T18:57:50Z

@clawsweeper automerge

clawsweeper · 2026-05-19T19:00:05Z

🦞🔧
ClawSweeper automerge is enabled.

Head: 119fa5d69f83
Label: clawsweeper:automerge
Action: repair worker queued. Run: https://github.com/openclaw/clawsweeper/actions/runs/26118754898
Flow: review this head, repair/rebase only if needed, then re-review the exact repaired head before merge.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

2026-05-19 18:57:50 UTC review queued 119fa5d69f83 (queued)

2026-05-19 19:00:04 UTC repair queued 119fa5d69f83 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26118754898

2026-05-19 20:37:03 UTC repair started (running) in 0s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 automerge-openclaw-openclaw-84067

2026-05-19 20:37:18 UTC validation plan (passed) in 16s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-05-19 20:37:28 UTC Codex write preflight (passed) in 26s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 danger-full-access

2026-05-19 20:44:47 UTC Codex edit 1 ec6f23550ee3 (complete) in 7m 45s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 exit 0

2026-05-19 20:51:20 UTC validation and review 1 c76769b4a95b (base moved) in 14m 18s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 rebased

2026-05-19 20:51:57 UTC repair finished c76769b4a95b (opened) in 14m 55s Run: https://github.com/openclaw/clawsweeper/actions/runs/26123602867 open_fix_pr

clawsweeper · 2026-05-19T20:51:55Z

ClawSweeper 🐠 reef update

Thanks for the work on this. ClawSweeper did not have permission to update this branch directly, so it opened a narrow replacement PR instead. that's a branch access thing, not a knock on the contribution.

Why replacement: ClawSweeper could not update the source PR branch directly; GitHub did not grant sufficient push rights to the bot for that branch.
Replacement PR: #84311
Why close: this run explicitly closes the superseded source PR after the credited replacement PR is open, so review continues in one place.
This closeout is intentional for this run: the replacement PR is now the active review lane.
Contributor credit is copied into the replacement PR notes and changelog path.
Co-author credit kept:

@abnershang: Co-authored-by: Abner Shang 75654486+abnershang@users.noreply.github.com

fish notes: model gpt-5.5, reasoning high; reviewed against c76769b.

…026.5.20) (#615) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520) [Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20) ##### Changes - Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed. - Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#84264](openclaw/openclaw#84264)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#84499](openclaw/openclaw#84499)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog. - CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#80407](openclaw/openclaw#80407)) Thanks [@giodl73-repo](https://github.com/giodl73-repo). - Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. - Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#84005](openclaw/openclaw#84005)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@amknight](https://github.com/amknight). ##### Fixes - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#84691](openclaw/openclaw#84691)) Thanks [@efpiva](https://github.com/efpiva). - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#84736](openclaw/openclaw#84736)) Thanks [@JARVIS-Glasses](https://github.com/JARVIS-Glasses). - Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#84508](openclaw/openclaw#84508). Thanks [@neeravmakwana](https://github.com/neeravmakwana). - Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#84699](openclaw/openclaw#84699)) Thanks [@nxmxbbd](https://github.com/nxmxbbd). - WhatsApp: update Baileys to `7.0.0-rc12`. - Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@romneyda](https://github.com/romneyda). - CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#84684](openclaw/openclaw#84684)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired. - Mac app: update the About settings copyright year to 2026. ([#84385](openclaw/openclaw#84385)) Thanks [@pejmanjohn](https://github.com/pejmanjohn). - Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS. - Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@romneyda](https://github.com/romneyda). - Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#84595](openclaw/openclaw#84595)) - Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#77803](openclaw/openclaw#77803). - Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#84718](openclaw/openclaw#84718)) Thanks [@lukaIvanic](https://github.com/lukaIvanic). - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`. - WebChat: clear stale typing indicators when session change events mark the active chat run complete. - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports. - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows. - Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed. - fix(mattermost): fail closed on missing channel type \[AI]. ([#84091](openclaw/openclaw#84091)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Recheck rebuilt system.run argv \[AI]. ([#84090](openclaw/openclaw#84090)) Thanks [@pgondhi987](https://github.com/pgondhi987). - CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#84519](openclaw/openclaw#84519)) - CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#83856](openclaw/openclaw#83856). ([#83989](openclaw/openclaw#83989)) - Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#84289](openclaw/openclaw#84289)) - Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#83477](openclaw/openclaw#83477)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#82930](openclaw/openclaw#82930). ([#82933](openclaw/openclaw#82933)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#84269](openclaw/openclaw#84269)) Thanks [@Kaspre](https://github.com/Kaspre). - Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#84254](openclaw/openclaw#84254)) Thanks [@moritzmmayerhofer](https://github.com/moritzmmayerhofer). - Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#82937](openclaw/openclaw#82937)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#84191](openclaw/openclaw#84191)) Thanks [@100menotu001](https://github.com/100menotu001). - Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#60799](openclaw/openclaw#60799). ([#84433](openclaw/openclaw#84433)) Thanks [@IWhatsskill](https://github.com/IWhatsskill). - Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#84355](openclaw/openclaw#84355); refs [#57835](openclaw/openclaw#57835)) Thanks [@luoyanglang](https://github.com/luoyanglang). - Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#84303](openclaw/openclaw#84303)) Thanks [@VACInc](https://github.com/VACInc). - Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#84153](openclaw/openclaw#84153)) - Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#84188](openclaw/openclaw#84188)) Thanks [@100menotu001](https://github.com/100menotu001). - Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#83887](openclaw/openclaw#83887). ([#84244](openclaw/openclaw#84244)) Thanks [@hclsys](https://github.com/hclsys). - Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#82766](openclaw/openclaw#82766). ([#82767](openclaw/openclaw#82767)) Thanks [@galiniliev](https://github.com/galiniliev). - Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#84067](openclaw/openclaw#84067)) Thanks [@abnershang](https://github.com/abnershang). - Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#84045](openclaw/openclaw#84045)) Thanks [@abnershang](https://github.com/abnershang). - Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@SebTardif](https://github.com/SebTardif). - harden update restart script creation \[AI]. ([#84088](openclaw/openclaw#84088)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#83613](openclaw/openclaw#83613). ([#83626](openclaw/openclaw#83626)) Thanks [@YuanHanzhong](https://github.com/YuanHanzhong). - CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`. - Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#84057](openclaw/openclaw#84057)) - CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#83995](openclaw/openclaw#83995)) Thanks [@ThiagoCAltoe](https://github.com/ThiagoCAltoe). - Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@bdjben](https://github.com/bdjben). - CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#83904](openclaw/openclaw#83904). ([#84080](openclaw/openclaw#84080)) - Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#84055](openclaw/openclaw#84055)) Thanks [@dutifulbob](https://github.com/dutifulbob). - Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering. - CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@amknight](https://github.com/amknight). - CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#56222](openclaw/openclaw#56222). Thanks [@galiniliev](https://github.com/galiniliev). - Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#83858](openclaw/openclaw#83858)) Thanks [@brokemac79](https://github.com/brokemac79). - CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#84392](openclaw/openclaw#84392)) Thanks [@joshavant](https://github.com/joshavant). - Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#84387](openclaw/openclaw#84387)) Thanks [@samzong](https://github.com/samzong). - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#82961](openclaw/openclaw#82961). ([#82962](openclaw/openclaw#82962)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#83699](openclaw/openclaw#83699). ([#83700](openclaw/openclaw#83700)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#84040](openclaw/openclaw#84040). ([#84357](openclaw/openclaw#84357)) Thanks [@joshavant](https://github.com/joshavant). - Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#84222](openclaw/openclaw#84222). ([#84374](openclaw/openclaw#84374)) Thanks [@joshavant](https://github.com/joshavant). - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#83979](openclaw/openclaw#83979)) Thanks [@yujiawei](https://github.com/yujiawei). - Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#83836](openclaw/openclaw#83836). ([#84367](openclaw/openclaw#84367)) Thanks [@joshavant](https://github.com/joshavant). - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#82964](openclaw/openclaw#82964)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#83931](openclaw/openclaw#83931)) Thanks [@honor2030](https://github.com/honor2030). - Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#84050](openclaw/openclaw#84050). ([#84052](openclaw/openclaw#84052)) Thanks [@jbetala7](https://github.com/jbetala7). - WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#83846](openclaw/openclaw#83846)) Thanks [@neeravmakwana](https://github.com/neeravmakwana). - WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#79083](openclaw/openclaw#79083)) Thanks [@Oviemudiaga](https://github.com/Oviemudiaga). - CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#83640](openclaw/openclaw#83640)) Thanks [@se7en-agent](https://github.com/se7en-agent). - Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#83684](openclaw/openclaw#83684)) Thanks [@ngutman](https://github.com/ngutman). - iOS: repair Release archive compilation for the TestFlight build. ([#84255](openclaw/openclaw#84255)) Thanks [@ngutman](https://github.com/ngutman). - Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#84083](openclaw/openclaw#84083)) Thanks [@100yenadmin](https://github.com/100yenadmin). - Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#42197](openclaw/openclaw#42197)) Thanks [@Rain120](https://github.com/Rain120). - Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#84386](openclaw/openclaw#84386). ([#84412](openclaw/openclaw#84412)) Thanks [@openperf](https://github.com/openperf). - Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#81561](openclaw/openclaw#81561)) Thanks [@moeedahmed](https://github.com/moeedahmed). - Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#79396](openclaw/openclaw#79396). ([#79489](openclaw/openclaw#79489)) Thanks [@aayushprsingh](https://github.com/aayushprsingh). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615

openclaw-barnacle Bot added agents Agent runtime and tooling size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 19, 2026

chatgpt-codex-connector Bot reviewed May 19, 2026

View reviewed changes

clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 19, 2026

fix(cron): use structured denial signals

a93da80

abnershang force-pushed the fix/error-token-classifier-structured-fields branch from 9393507 to a93da80 Compare May 19, 2026 12:23

chatgpt-codex-connector Bot reviewed May 19, 2026

View reviewed changes

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 19, 2026

fix(cron): normalize node denial wrappers

119fa5d

openclaw-barnacle Bot added the docs Improvements or additions to documentation label May 19, 2026

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 19, 2026

clawsweeper Bot mentioned this pull request May 19, 2026

fix(cron): use structured denial signals #84311

Merged

clawsweeper Bot closed this May 19, 2026

Uh oh!

Conversation

abnershang commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Review

AI-assisted

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 19, 2026

Choose a reason for hiding this comment

Uh oh!

abnershang commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

abnershang commented May 19, 2026

Uh oh!

abnershang commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Takhoffman commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

abnershang commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading

clawsweeper Bot commented May 19, 2026 •

edited

Loading