fix: constrain wildcard subagent targets by joshavant · Pull Request #84357 · openclaw/openclaw

joshavant · 2026-05-19T23:36:49Z

Summary

Problem: agents.*.subagents.allowAgents: ["*"] let sessions_spawn.agentId target arbitrary unconfigured agent ids, creating ad hoc state roots.
Solution: Treat wildcard subagent allowlists as “any configured target” while preserving explicit allowlist entries.
What changed: Native subagent and ACP spawn policy now pass configured target ids into the shared target policy; docs and config comments describe the tightened wildcard behavior.
What did NOT change: Explicit allowlisted-but-unconfigured target ids still work, including mixed allowlists like ["*", "beta"].

Motivation

Closes sessions_spawn accepts unknown agentId with allowAgents:"*" (auto-provisions default-configured subagent, no registry validation) #84040 by making the wildcard match the configured agent registry instead of acting as an open-ended agent-id creation escape.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes sessions_spawn accepts unknown agentId with allowAgents:"*" (auto-provisions default-configured subagent, no registry validation) #84040
This PR fixes a bug or regression

Real behavior proof (required for external PRs)

Behavior addressed: sessions_spawn with allowAgents: ["*"] rejects an unconfigured explicit agentId instead of spawning a new arbitrary agent state root.
Real environment tested: AWS Crabbox direct provider, provider=aws, lease cbx_687b1eaafdfc, run run_5a730368b161, built branch from source, live Gateway, OpenAI openai/gpt-5.5.
Exact steps or command run after this patch: Started Gateway with one configured agent main, main.subagents.allowAgents: ["*"], exposed sessions_spawn, then ran a live parent agent turn that called sessions_spawn once with agentId: "bogus-84040-b397f15f".
Evidence after fix: Run output reported ISSUE_84040_FIX_EVIDENCE with finalText: "ISSUE_84040_PARENT_REJECTED_b397f15f", one sessions_spawn tool call, transcript containing both forbidden and configured agent registry, rogueAgentDirExists: false, and rogueWorkspaceDirExists: false.
Observed result after fix: The model saw the forbidden tool result and replied with the rejected sentinel; no rogue agent or workspace directory was created.
What was not tested: Live Telegram/channel delivery was not involved; this is a Gateway/OpenAI subagent tool-path proof.
Before evidence: Current-main AWS repro accepted a bogus agentId and created agents/bogus-84040-.../sessions plus workspace/bogus-84040-....

Root Cause (if applicable)

Root cause: The shared subagent target policy treated allowAgents containing "*" as unconditional allow-any before checking whether the target id existed in the configured registry.
Missing detection / guardrail: Existing tests covered wildcard acceptance but not wildcard rejection for unconfigured ids.
Contributing context (if known): Explicit allowlists historically allowed unconfigured ids, so the fix preserves explicit entries while narrowing only wildcard expansion.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: src/agents/subagent-target-policy.test.ts, src/agents/openclaw-tools.subagents.sessions-spawn.allowlist.test.ts, src/agents/acp-spawn.test.ts.
Scenario the test should lock in: Wildcard allowlists include configured ids plus requester, reject unconfigured ids, and preserve explicit entries in mixed wildcard allowlists.
Why this is the smallest reliable guardrail: The shared target-policy test proves the pure contract; native and ACP spawn tests prove both callers pass configured target ids correctly.
Existing test that already covers this (if any): Existing wildcard tests only asserted broad acceptance.
If no new test is added, why not: N/A.

User-visible / Behavior Changes

subagents.allowAgents: ["*"] now means any configured target agent, not arbitrary agent ids. Operators who intentionally need an unconfigured target can still list that id explicitly.

Diagram (if applicable)

Before:
sessions_spawn(agentId=bogus) -> allowAgents ["*"] -> accepted -> bogus agent/workspace state

After:
sessions_spawn(agentId=bogus) -> allowAgents ["*"] -> registry check -> forbidden

Security Impact (required)

New permissions/capabilities? No
Secrets/tokens handling changed? No
New/changed network calls? No
Command/tool execution surface changed? Yes
Data access scope changed? Yes
If any Yes, explain risk + mitigation: The change narrows wildcard delegation to configured agents, reducing accidental or model-driven creation of arbitrary agent state/workspace roots. Explicit allowlist entries preserve intentional compatibility.

Repro + Verification

Environment

OS: Linux on AWS Crabbox
Runtime/container: Node 24 via repository build on direct AWS Crabbox
Model/provider: OpenAI openai/gpt-5.5
Integration/channel (if any): Gateway RPC only; no external channel
Relevant config (redacted): one configured main agent with subagents.allowAgents: ["*"]; OpenAI API key sourced from environment

Steps

Build OpenClaw from this branch.
Start Gateway with one configured main agent and main.subagents.allowAgents: ["*"].
Run a live parent agent turn that calls sessions_spawn once with an unconfigured bogus agentId.

Expected

The tool call returns forbidden with a configured-registry error and no bogus state root is created.

Actual

Parent final text was ISSUE_84040_PARENT_REJECTED_b397f15f; transcript contained forbidden and configured agent registry; no rogue agent/workspace directories existed.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

Verified scenarios: Target-policy pure contract, native sessions_spawn allowlist enforcement, ACP envelope allowlist enforcement, live AWS Gateway/OpenAI repro path.
Edge cases checked: Mixed wildcard-plus-explicit allowlists preserve explicit unconfigured ids; explicit self-target behavior remains denyable; default omitted-agent self-spawn remains allowed.
What you did not verify: Channel-specific delivery flows.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? Mostly
Config/env changes? Yes
Migration needed? No
If yes, exact upgrade steps: If an operator intentionally used ["*"] to target an unconfigured id, add that id explicitly to allowAgents.

Risks and Mitigations

Risk: Operators relying on wildcard to target ad hoc ids will now see a forbidden result.
- Mitigation: Explicit allowlist entries still allow those ids, and the error lists configured/allowed targets.

clawsweeper · 2026-05-19T23:37:52Z

Codex review: needs maintainer review before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR threads configured agent IDs into native and ACP subagent spawn policy, changes wildcard allowlists to reject unconfigured targets, updates tests/docs, and adds a changelog entry.

Reproducibility: yes. Current main source clearly returns success on allowed.allowAny, existing tests expect wildcard to accept an unconfigured target, and the PR body includes before/after live Gateway evidence.

PR rating
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Summary: Focused patch with strong live proof and regression coverage, held at a normal good tier because the compatibility/security decision still needs maintainer ownership.

Rank-up moves:

none

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Sufficient (live_output): The PR body supplies after-fix live AWS Crabbox/Gateway output showing the forbidden result and absence of rogue state roots for the changed behavior.

Risk before merge

Merging changes allowAgents: ["*"] from any well-formed target to configured targets only, so deployments relying on ad hoc auto-provisioned IDs will start receiving forbidden spawn results unless those IDs are listed explicitly.
Existing rogue/ad hoc agent state is not deleted, but workflows that only reached it through wildcard targeting may lose their implicit access path after upgrade.
This read-only review did not run the PR tests or replay the Crabbox proof; required CI and maintainer/security acceptance should still gate merge.

Maintainer options:

Accept fail-closed wildcard hardening
Maintainers can land the PR as-is if they accept that wildcard no longer provisions ad hoc targets and operators must explicitly list compatibility IDs.
Add an explicit compatibility mode
If preserving current auto-provision behavior is required, add a documented opt-in compatibility knob with tests for default strict behavior and opt-in lax behavior.
Pause for allowlist semantics coordination
Hold merge until the interaction with the open SPAWN_ALLOWLIST wildcard PR is resolved so env-derived wildcard behavior does not drift from the registry contract.

Next step before merge
The PR is maintainer-labeled and compatibility-sensitive; the next action is human maintainer/security review, not an automated repair PR.

Security
Cleared: The diff narrows an existing spawn authorization boundary and does not add dependencies, workflow execution, secret handling, or broader permissions.

Review details

Best possible solution:

Land a single tightened wildcard contract only after maintainer/security review accepts the fail-closed compatibility tradeoff and the open SPAWN_ALLOWLIST wildcard work is checked for semantic conflict.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main source clearly returns success on allowed.allowAny, existing tests expect wildcard to accept an unconfigured target, and the PR body includes before/after live Gateway evidence.

Is this the best way to solve the issue?

Mostly yes. Threading configured IDs into the shared policy is the narrow owner-boundary fix, but changing wildcard from permissive to fail-closed is a maintainer/security compatibility decision rather than a safe automated merge choice.

Label changes:

add P1: The PR fixes a security-relevant agent scoping bug that can create unintended agent/session state roots under wildcard spawn permission.
add merge-risk: 🚨 compatibility: The diff intentionally changes the documented wildcard behavior and can make existing wildcard-based spawn configurations fail closed on upgrade.
add merge-risk: 🚨 session-state: Existing ad hoc agent/session roots may become unreachable through wildcard targeting unless operators add explicit allowlist entries.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies after-fix live AWS Crabbox/Gateway output showing the forbidden result and absence of rogue state roots for the changed behavior.
add rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🦞 diamond lobster, patch quality is 🐚 platinum hermit, and Focused patch with strong live proof and regression coverage, held at a normal good tier because the compatibility/security decision still needs maintainer ownership.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body supplies after-fix live AWS Crabbox/Gateway output showing the forbidden result and absence of rogue state roots for the changed behavior.

Label justifications:

P1: The PR fixes a security-relevant agent scoping bug that can create unintended agent/session state roots under wildcard spawn permission.
merge-risk: 🚨 compatibility: The diff intentionally changes the documented wildcard behavior and can make existing wildcard-based spawn configurations fail closed on upgrade.
merge-risk: 🚨 session-state: Existing ad hoc agent/session roots may become unreachable through wildcard targeting unless operators add explicit allowlist entries.
rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🦞 diamond lobster, patch quality is 🐚 platinum hermit, and Focused patch with strong live proof and regression coverage, held at a normal good tier because the compatibility/security decision still needs maintainer ownership.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body supplies after-fix live AWS Crabbox/Gateway output showing the forbidden result and absence of rogue state roots for the changed behavior.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies after-fix live AWS Crabbox/Gateway output showing the forbidden result and absence of rogue state roots for the changed behavior.

Acceptance criteria:

node scripts/run-vitest.mjs src/agents/subagent-target-policy.test.ts src/agents/openclaw-tools.subagents.sessions-spawn.allowlist.test.ts
node scripts/run-vitest.mjs src/agents/acp-spawn.test.ts
Before merge, verify required CI for head 5ee8b1a and review the supplied Crabbox run evidence.

What I checked:

Current main wildcard bypass: On current main, resolveSubagentTargetPolicy returns ok when allowed.allowAny is true, so wildcard validation does not require the target ID to be in the configured registry. (src/agents/subagent-target-policy.ts:73, a00e7d3898cf)
Current native spawn call lacks configured IDs: The native spawnSubagentDirect policy call passes requester, target, requested ID, and allowAgents but no configured agent registry, matching the linked issue's source-level root cause. (src/agents/subagent-spawn.ts:835, a00e7d3898cf)
Current ACP spawn call has the same policy shape: The ACP envelope policy call also omits configured target IDs on current main, so the wildcard semantics are shared across both spawn paths. (src/agents/acp-spawn.ts:797, a00e7d3898cf)
PR narrows wildcard policy: The PR adds configuredAgentIds to the target-policy input, removes the unconditional allowAny success path, and returns a configured-registry error for wildcard misses. (src/agents/subagent-target-policy.ts:63, 5ee8b1a8e0e3)
PR threads configured targets through callers: The native path uses listAgentIds(cfg), and the ACP path builds configured targets from OpenClaw agent IDs, ACP runtime mappings, ACP defaults, and explicit ACP allowed agents before calling the shared policy. (src/agents/acp-spawn.ts:447, 5ee8b1a8e0e3)
Regression coverage added: The patch adds pure policy, native sessions_spawn, and ACP spawn tests for configured wildcard acceptance, unconfigured wildcard rejection, and mixed wildcard-plus-explicit compatibility. (src/agents/subagent-target-policy.test.ts:64, 5ee8b1a8e0e3)

Likely related people:

Patrick-Erichsen: Current checkout blame attributes the relevant subagent policy and spawn files to d60ab48, which GitHub maps to this author; the checkout history is shallow/compressed, so confidence is limited. (role: recent area contributor; confidence: medium; commits: d60ab485114a; files: src/agents/subagent-target-policy.ts, src/agents/subagent-spawn.ts, src/agents/acp-spawn.ts)
Jefsky: The related open PR fix(config): apply SPAWN_ALLOWLIST env for sessions_spawn (#79490) #79913 changes how SPAWN_ALLOWLIST=* reaches agents.defaults.subagents.allowAgents, which overlaps this wildcard semantics decision. (role: adjacent allowlist contributor; confidence: medium; commits: 389b46eb14a0; files: src/config/io.ts, src/config/spawn-allowlist-env.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against a00e7d3898cf.

clawsweeper · 2026-05-19T23:45:07Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Cosmic Merge Sprite

        /\     /\            
      _/  \___/  \_          
     /  ( o   o )  \         
    |      \_/      |        
    |   /\  ===  /\ |        
     \_/  \_____/  \_/       
        _/|_| |_|\_          
       /__| | | |__\         
          ' ' ' '            
         /_/     \_\         
       .-----------.         
      '-------------'

Rarity: 🥚 common.
Trait: sniffs out flaky tests.
Image traits: location release reef; accessory commit compass; palette seafoam, black, and opal; mood proud; pose balancing on a branch marker; shell translucent glimmer shell; lighting golden review-room light; background gentle dashboard dots.
How to hatch it: once this PR reaches status: 👀 ready for maintainer look or status: 🚀 automerge armed, the PR author or a maintainer can comment @clawsweeper hatch to turn this ASCII egg into its generated creature image.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Cosmic Merge Sprite in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchable usually means sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

…026.5.20) (#615) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520) [Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20) ##### Changes - Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed. - Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#84264](openclaw/openclaw#84264)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#84499](openclaw/openclaw#84499)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog. - CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#80407](openclaw/openclaw#80407)) Thanks [@giodl73-repo](https://github.com/giodl73-repo). - Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. - Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#84005](openclaw/openclaw#84005)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@amknight](https://github.com/amknight). ##### Fixes - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#84691](openclaw/openclaw#84691)) Thanks [@efpiva](https://github.com/efpiva). - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#84736](openclaw/openclaw#84736)) Thanks [@JARVIS-Glasses](https://github.com/JARVIS-Glasses). - Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#84508](openclaw/openclaw#84508). Thanks [@neeravmakwana](https://github.com/neeravmakwana). - Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#84699](openclaw/openclaw#84699)) Thanks [@nxmxbbd](https://github.com/nxmxbbd). - WhatsApp: update Baileys to `7.0.0-rc12`. - Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@romneyda](https://github.com/romneyda). - CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#84684](openclaw/openclaw#84684)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired. - Mac app: update the About settings copyright year to 2026. ([#84385](openclaw/openclaw#84385)) Thanks [@pejmanjohn](https://github.com/pejmanjohn). - Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS. - Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@romneyda](https://github.com/romneyda). - Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#84595](openclaw/openclaw#84595)) - Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#77803](openclaw/openclaw#77803). - Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#84718](openclaw/openclaw#84718)) Thanks [@lukaIvanic](https://github.com/lukaIvanic). - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`. - WebChat: clear stale typing indicators when session change events mark the active chat run complete. - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports. - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows. - Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed. - fix(mattermost): fail closed on missing channel type \[AI]. ([#84091](openclaw/openclaw#84091)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Recheck rebuilt system.run argv \[AI]. ([#84090](openclaw/openclaw#84090)) Thanks [@pgondhi987](https://github.com/pgondhi987). - CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#84519](openclaw/openclaw#84519)) - CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#83856](openclaw/openclaw#83856). ([#83989](openclaw/openclaw#83989)) - Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#84289](openclaw/openclaw#84289)) - Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#83477](openclaw/openclaw#83477)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#82930](openclaw/openclaw#82930). ([#82933](openclaw/openclaw#82933)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#84269](openclaw/openclaw#84269)) Thanks [@Kaspre](https://github.com/Kaspre). - Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#84254](openclaw/openclaw#84254)) Thanks [@moritzmmayerhofer](https://github.com/moritzmmayerhofer). - Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#82937](openclaw/openclaw#82937)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#84191](openclaw/openclaw#84191)) Thanks [@100menotu001](https://github.com/100menotu001). - Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#60799](openclaw/openclaw#60799). ([#84433](openclaw/openclaw#84433)) Thanks [@IWhatsskill](https://github.com/IWhatsskill). - Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#84355](openclaw/openclaw#84355); refs [#57835](openclaw/openclaw#57835)) Thanks [@luoyanglang](https://github.com/luoyanglang). - Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#84303](openclaw/openclaw#84303)) Thanks [@VACInc](https://github.com/VACInc). - Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#84153](openclaw/openclaw#84153)) - Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#84188](openclaw/openclaw#84188)) Thanks [@100menotu001](https://github.com/100menotu001). - Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#83887](openclaw/openclaw#83887). ([#84244](openclaw/openclaw#84244)) Thanks [@hclsys](https://github.com/hclsys). - Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#82766](openclaw/openclaw#82766). ([#82767](openclaw/openclaw#82767)) Thanks [@galiniliev](https://github.com/galiniliev). - Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#84067](openclaw/openclaw#84067)) Thanks [@abnershang](https://github.com/abnershang). - Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#84045](openclaw/openclaw#84045)) Thanks [@abnershang](https://github.com/abnershang). - Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@SebTardif](https://github.com/SebTardif). - harden update restart script creation \[AI]. ([#84088](openclaw/openclaw#84088)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#83613](openclaw/openclaw#83613). ([#83626](openclaw/openclaw#83626)) Thanks [@YuanHanzhong](https://github.com/YuanHanzhong). - CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`. - Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#84057](openclaw/openclaw#84057)) - CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#83995](openclaw/openclaw#83995)) Thanks [@ThiagoCAltoe](https://github.com/ThiagoCAltoe). - Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@bdjben](https://github.com/bdjben). - CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#83904](openclaw/openclaw#83904). ([#84080](openclaw/openclaw#84080)) - Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#84055](openclaw/openclaw#84055)) Thanks [@dutifulbob](https://github.com/dutifulbob). - Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering. - CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@amknight](https://github.com/amknight). - CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#56222](openclaw/openclaw#56222). Thanks [@galiniliev](https://github.com/galiniliev). - Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#83858](openclaw/openclaw#83858)) Thanks [@brokemac79](https://github.com/brokemac79). - CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#84392](openclaw/openclaw#84392)) Thanks [@joshavant](https://github.com/joshavant). - Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#84387](openclaw/openclaw#84387)) Thanks [@samzong](https://github.com/samzong). - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#82961](openclaw/openclaw#82961). ([#82962](openclaw/openclaw#82962)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#83699](openclaw/openclaw#83699). ([#83700](openclaw/openclaw#83700)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#84040](openclaw/openclaw#84040). ([#84357](openclaw/openclaw#84357)) Thanks [@joshavant](https://github.com/joshavant). - Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#84222](openclaw/openclaw#84222). ([#84374](openclaw/openclaw#84374)) Thanks [@joshavant](https://github.com/joshavant). - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#83979](openclaw/openclaw#83979)) Thanks [@yujiawei](https://github.com/yujiawei). - Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#83836](openclaw/openclaw#83836). ([#84367](openclaw/openclaw#84367)) Thanks [@joshavant](https://github.com/joshavant). - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#82964](openclaw/openclaw#82964)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#83931](openclaw/openclaw#83931)) Thanks [@honor2030](https://github.com/honor2030). - Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#84050](openclaw/openclaw#84050). ([#84052](openclaw/openclaw#84052)) Thanks [@jbetala7](https://github.com/jbetala7). - WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#83846](openclaw/openclaw#83846)) Thanks [@neeravmakwana](https://github.com/neeravmakwana). - WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#79083](openclaw/openclaw#79083)) Thanks [@Oviemudiaga](https://github.com/Oviemudiaga). - CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#83640](openclaw/openclaw#83640)) Thanks [@se7en-agent](https://github.com/se7en-agent). - Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#83684](openclaw/openclaw#83684)) Thanks [@ngutman](https://github.com/ngutman). - iOS: repair Release archive compilation for the TestFlight build. ([#84255](openclaw/openclaw#84255)) Thanks [@ngutman](https://github.com/ngutman). - Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#84083](openclaw/openclaw#84083)) Thanks [@100yenadmin](https://github.com/100yenadmin). - Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#42197](openclaw/openclaw#42197)) Thanks [@Rain120](https://github.com/Rain120). - Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#84386](openclaw/openclaw#84386). ([#84412](openclaw/openclaw#84412)) Thanks [@openperf](https://github.com/openperf). - Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#81561](openclaw/openclaw#81561)) Thanks [@moeedahmed](https://github.com/moeedahmed). - Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#79396](openclaw/openclaw#79396). ([#79489](openclaw/openclaw#79489)) Thanks [@aayushprsingh](https://github.com/aayushprsingh). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615

* fix subagent wildcard targets * add changelog for subagent wildcard fix

fix subagent wildcard targets

9c9a795

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels May 19, 2026

add changelog for subagent wildcard fix

5ee8b1a

joshavant merged commit 00da318 into main May 20, 2026
143 of 146 checks passed

joshavant deleted the fix/subagent-wildcard-registry branch May 20, 2026 00:21

joshavant mentioned this pull request May 20, 2026

sessions_spawn accepts unknown agentId with allowAgents:"*" (auto-provisions default-configured subagent, no registry validation) #84040

Closed

github-actions Bot mentioned this pull request May 20, 2026

📡 Upstream Digest — 2026-05-20 02:34 UTC curtismercier/openclaw-mods#901

Open

clawsweeper Bot mentioned this pull request May 21, 2026

agents_list shows orphaned allowlist entries as spawnable agents; sessions_spawn accepts them without validation #84811

Closed

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

5c698d6

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

68c0cee

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

b8b8ddb

* fix subagent wildcard targets * add changelog for subagent wildcard fix

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

71acf1c

* fix subagent wildcard targets * add changelog for subagent wildcard fix

galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 25, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

fe8f325

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

2c4646f

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

6fdbe13

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

579263d

* fix subagent wildcard targets * add changelog for subagent wildcard fix

martingarramon mentioned this pull request May 28, 2026

Guard subagent spawns from direct OpenAI overrides #81466

Closed

jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

bf6e214

* fix subagent wildcard targets * add changelog for subagent wildcard fix

SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

36a30bc

* fix subagent wildcard targets * add changelog for subagent wildcard fix

sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026

fix: constrain wildcard subagent targets (openclaw#84357)

686ccfe

* fix subagent wildcard targets * add changelog for subagent wildcard fix

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: constrain wildcard subagent targets#84357

fix: constrain wildcard subagent targets#84357
joshavant merged 2 commits into
mainfrom
fix/subagent-wildcard-registry

joshavant commented May 19, 2026

Uh oh!

clawsweeper Bot commented May 19, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

joshavant commented May 19, 2026

Summary

Motivation

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Real behavior proof (required for external PRs)

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

Uh oh!

clawsweeper Bot commented May 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented May 19, 2026 •

edited

Loading