Guard OpenAI chat payload turns by clawsweeper[bot] · Pull Request #86497 · openclaw/openclaw

clawsweeper · 2026-05-25T13:31:01Z

Makes #86177 merge-ready for the ClawSweeper automerge loop.
The edit pass should inspect the live PR diff, review comments, and failing checks; rebase if needed; keep the contributor branch credited; and stop only when validation is green or an external blocker is proven.

ClawSweeper 🐠 replacement reef notes:

Cluster: automerge-openclaw-openclaw-86177
Source PRs: Guard OpenAI chat payload turns #86177
Credit: Source PR: Guard OpenAI chat payload turns #86177
Validation: pnpm check:changed
Replacement reason: ClawSweeper could not update the source PR branch directly, so it opened a writable replacement PR instead.
Automerge requested by: @osolmaz

Repair fallback: GitHub rejected the repair branch push because it updates workflow files and the ClawSweeper app token does not have workflows permission

Inherited issue-closing references from the source PR:
Fixes #86145

Co-author credit kept:

@TurboTheTurtle: Co-authored-by: Andy Ye 35905412+TurboTheTurtle@users.noreply.github.com

fish notes: model gpt-5.5, reasoning high; reviewed against be26fde.

clawsweeper · 2026-05-25T13:33:32Z

Codex review: passed. Reviewed May 25, 2026, 10:24 AM ET / 14:24 UTC.

Summary
Adds a scoped ModelStudio/DashScope OpenAI-compatible guard for chat payloads with no non-empty user or assistant turn, shared turn-detection helper coverage, prompt-skip handling, regression tests, and a changelog entry.

PR surface: Source +83, Tests +298, Docs +1. Total +382 across 10 files.

Reproducibility: yes. source-reproducible for the OpenClaw-side malformed payload shape: current main has no final non-empty-turn guard, and the linked source PR shows a system/tool-only payload path plus focused transport proof. The exact qwen-long/qwen3-coder-plus provider error was not reproduced with the available DashScope account.

Review metrics: 1 noteworthy metric.

Provider compatibility defaults: 1 added. The new ModelStudio-like non-empty-turn default changes which OpenAI-compatible payloads are sent, so maintainers should notice the compatibility impact before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Let required exact-head checks finish green before automerge.

Risk before merge

Merging intentionally makes ModelStudio-like OpenAI-compatible requests fail locally when the final payload has no non-empty user or assistant turn; the source proof notes one DashScope account accepted some qwen3-coder-plus system-only shapes, so this remains a compatibility tradeoff even though the guard is scoped.
Exact-head GitHub checks were still in progress when inspected, so automerge should wait for required checks on e16a3fe to finish cleanly.

Maintainer options:

Land The Scoped Guard (recommended)
Accept the local fail-closed behavior for ModelStudio-like endpoints because it prevents known malformed system/tool-only payloads while preserving generic OpenAI-compatible routes.
Add A Compatibility Override First
If maintainers need to preserve known-working system-only ModelStudio requests, add a documented opt-out plus focused default-and-override tests before merge.

Next step before merge
No automated repair is needed; this should stay in the automerge/maintainer acceptance lane while exact-head checks finish and the compatibility tradeoff remains visible.

Security
Cleared: The diff changes TypeScript runtime validation, focused tests, and changelog only; it does not add dependency, workflow, secret, permission, package, or supply-chain surface.

Review details

Best possible solution:

Land the scoped ModelStudio/DashScope guard after exact-head checks pass, while keeping the compatibility-risk signal visible for maintainer acceptance of the local fail-closed behavior.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible for the OpenClaw-side malformed payload shape: current main has no final non-empty-turn guard, and the linked source PR shows a system/tool-only payload path plus focused transport proof. The exact qwen-long/qwen3-coder-plus provider error was not reproduced with the available DashScope account.

Is this the best way to solve the issue?

Yes: the PR checks the final payload after transport transforms and scopes the behavior to ModelStudio-like endpoints instead of making a global OpenAI-compatible invariant. A compatibility override is only needed if maintainers decide known-working system-only ModelStudio traffic must remain supported.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against f0bfb3fc338a.

Label changes

Label justifications:

P1: The PR addresses a broken agent/provider workflow where compacted Qwen/ModelStudio chat requests can reach the provider with invalid conversation payloads.
merge-risk: 🚨 compatibility: The new guard can stop existing ModelStudio/DashScope requests locally before they reach a provider, even when a specific endpoint might have accepted that payload shape.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (live_output): The source PR body carries after-fix local transport/SSE proof, focused command output, and redacted remote DashScope observations that directly cover the changed behavior.
proof: sufficient: Contributor real behavior proof is sufficient. The source PR body carries after-fix local transport/SSE proof, focused command output, and redacted remote DashScope observations that directly cover the changed behavior.

Evidence reviewed

PR surface:

Source +83, Tests +298, Docs +1. Total +382 across 10 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	4	84	1	+83
Tests	5	298	0	+298
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	10	383	1	+382

What I checked:

Repository policy read and applied: Root AGENTS.md was read fully and its provider-routing/fallback compatibility guidance applies because this PR intentionally adds a fail-closed provider payload guard; the scoped agents guides were also checked for touched paths. (AGENTS.md:21, f0bfb3fc338a)
Current main lacks the final payload invariant: Current main builds the OpenAI chat-completions params, applies payload hooks and code-mode checks, then sends the request without checking that the final messages contain a usable user or assistant turn. (src/agents/openai-transport-stream.ts:2408, f0bfb3fc338a)
PR adds the scoped stream-time guard: The PR adds a final check before the network call and throws locally when a ModelStudio-like payload has no non-empty user or assistant message. (src/agents/openai-transport-stream.ts:2419, e16a3fe9f22f)
Provider scope matches current attribution: Current attribution classifies DashScope/Qwen native endpoints as modelstudio-native, and the PR scopes the new default to known ModelStudio/default qwen/dashscope/modelstudio routes rather than all OpenAI-compatible routes. (src/agents/provider-attribution.ts:731, f0bfb3fc338a)
Regression coverage checks both sides of the boundary: The diff adds transport coverage that refuses a ModelStudio system-only payload and separately proves a generic local OpenAI-compatible endpoint can still receive a system-only request. (src/agents/openai-transport-stream.test.ts:1028, e16a3fe9f22f)
Source PR proof is sufficient: The source PR body reports focused Vitest proof, local HTTP/SSE transport proof, normal-payload pass-through, and redacted remote DashScope observations; the exact qwen-long/qwen3-coder-plus error text was not reproduced with the available account. (a13f5b15f8a0)

Likely related people:

steipete: Recent history shows repeated work across OpenAI completions compatibility, prompt helpers, and compaction-adjacent agent surfaces. (role: recent area contributor; confidence: medium; commits: 3fad770510e9, 5e35112d21dd, 0b8ee4616df1; files: src/agents/openai-completions-compat.ts, src/agents/pi-embedded-runner/run/attempt.prompt-helpers.ts, src/agents/pi-hooks/compaction-safeguard.ts)
rendrag-git: Recent merged commits changed OpenAI chat-completions payload shaping and proxy-compatible request behavior in the same transport file. (role: recent payload-shaping contributor; confidence: medium; commits: 1d1a7c26d886, 75081569b047; files: src/agents/openai-transport-stream.ts)
yelog: The blank prompt submission guard that this PR refines for system/tool-only replay appears in the history as their prior fix. (role: introduced related prompt-skip behavior; confidence: medium; commits: adc20fed0d15; files: src/agents/pi-embedded-runner/run/attempt.prompt-helpers.ts)
TurboTheTurtle: Besides authoring the source PR, prior merged history shows related compaction/session work in the broad affected area. (role: recent compaction contributor; confidence: low; commits: e7c784f7a8d5; files: src/agents/pi-embedded-runner/run/attempt.prompt-helpers.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-25T13:42:06Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Cosmic Lint Imp

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: finds missing screenshots.
Image traits: location artifact grotto; accessory commit compass; palette seafoam, black, and opal; mood proud; pose standing beside its cracked shell; shell soft velvet shell; lighting golden review-room light; background gentle dashboard dots.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Cosmic Lint Imp in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

clawsweeper · 2026-05-25T13:42:20Z

🦞🧹
ClawSweeper automerge is enabled.

Head: e16a3fe9f22f
Label: clawsweeper:automerge
Action: exact-head review queued (workflow sweep.yml, event repository_dispatch).
Flow: review this head, repair/rebase only if needed, then re-review the exact repaired head before merge.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

2026-05-25 13:49:52 UTC Codex edit 1 e95029f381d5 (complete) in 5m 32s Run: https://github.com/openclaw/clawsweeper/actions/runs/26403541830 exit 0

2026-05-25 13:50:45 UTC validation and review 1 bfcdb10dd79e (base moved) in 6m 25s Run: https://github.com/openclaw/clawsweeper/actions/runs/26403541830 rebased

2026-05-25 13:50:22 UTC review queued 1cca62f8650d (queued)

2026-05-25 13:51:17 UTC repair finished bfcdb10dd79e (opened) in 6m 57s Run: https://github.com/openclaw/clawsweeper/actions/runs/26403541830 open_fix_pr

2026-05-25 14:00:49 UTC review passed bfcdb10dd79e (structured ClawSweeper verdict: pass (sha=bfcdb10dd79eb64066c52d4783cd401c25fe5...)

2026-05-25 14:03:54 UTC repair queued bfcdb10dd79e (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116

2026-05-25 14:06:25 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 automerge-openclaw-openclaw-86177

2026-05-25 14:06:41 UTC validation plan (passed) in 17s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-05-25 14:06:54 UTC Codex write preflight (passed) in 30s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 danger-full-access

2026-05-25 14:14:56 UTC Codex edit 1 e16a3fe9f22f (complete) in 8m 32s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 exit 0

2026-05-25 14:18:05 UTC validation and review 1 e16a3fe9f22f (complete) in 11m 41s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 already-current

2026-05-25 14:18:10 UTC repair completed e16a3fe9f22f (branch updated) in 11m 46s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 initial automerge rebase is delegated to Codex repair

2026-05-25 14:18:10 UTC review queued e16a3fe9f22f (after repair)

2026-05-25 14:28:05 UTC automerge wait e16a3fe9f22f (ready) in 21m 40s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 checks and exact-head review are ready

2026-05-25 14:28:06 UTC repair finished e16a3fe9f22f (pushed) in 21m 42s Run: https://github.com/openclaw/clawsweeper/actions/runs/26404477116 repair_contributor_branch

2026-05-25 14:28:09 UTC review queued e16a3fe9f22f (queued)

osolmaz · 2026-05-25T13:49:52Z

@clawsweeper automerge

clawsweeper · 2026-05-25T13:49:56Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Summary: - Adds a scoped ModelStudio/DashScope OpenAI-compatible guard for chat payloads with no non-empty user or assi ... turn, shared turn-detection helper coverage, prompt-skip handling, regression tests, and a changelog entry. - PR surface: Source +83, Tests +298, Docs +1. Total +382 across 10 files. - Reproducibility: yes. source-reproducible for the OpenClaw-side malformed payload shape: current main has no ... he exact qwen-long/qwen3-coder-plus provider error was not reproduced with the available DashScope account. Automerge notes: - PR branch already contained follow-up commit before automerge: fix: make OpenAI payload guard content-aware - PR branch already contained follow-up commit before automerge: fix: scope openai payload turn guard - PR branch already contained follow-up commit before automerge: Guard OpenAI chat payload turns Validation: - ClawSweeper review passed for head e16a3fe. - Required merge gates passed before the squash merge. Prepared head SHA: e16a3fe Review: openclaw#86497 (comment) Co-authored-by: Andy Ye <35905412+TurboTheTurtle@users.noreply.github.com> Co-authored-by: Onur Solmaz <2453968+osolmaz@users.noreply.github.com> Co-authored-by: clawsweeper <274271284+clawsweeper[bot]@users.noreply.github.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: osolmaz Co-authored-by: osolmaz <2453968+osolmaz@users.noreply.github.com>

clawsweeper Bot mentioned this pull request May 25, 2026

Guard OpenAI chat payload turns #86177

Closed

openclaw-barnacle Bot removed the proof: supplied External PR includes structured after-fix real behavior proof. label May 25, 2026

clawsweeper Bot added status: 🚀 automerge armed This PR is in ClawSweeper's automerge lane. and removed status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 25, 2026

osolmaz force-pushed the clawsweeper/automerge-openclaw-openclaw-86177 branch from be26fde to e95029f Compare May 25, 2026 13:42

clawsweeper Bot force-pushed the clawsweeper/automerge-openclaw-openclaw-86177 branch from 1cca62f to bfcdb10 Compare May 25, 2026 13:50

clawsweeper Bot added proof: supplied External PR includes structured after-fix real behavior proof. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 25, 2026

openclaw-barnacle Bot removed the proof: supplied External PR includes structured after-fix real behavior proof. label May 25, 2026

clawsweeper Bot removed the status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. label May 25, 2026

TurboTheTurtle and others added 4 commits May 25, 2026 14:12

Guard OpenAI chat payload turns

b25d9a0

fix: make OpenAI payload guard content-aware

2681395

fix: scope openai payload turn guard

4ebaf4f

Guard OpenAI chat payload turns

e16a3fe

clawsweeper Bot force-pushed the clawsweeper/automerge-openclaw-openclaw-86177 branch from bfcdb10 to e16a3fe Compare May 25, 2026 14:18

clawsweeper Bot merged commit 489e415 into main May 25, 2026
98 checks passed

clawsweeper Bot deleted the clawsweeper/automerge-openclaw-openclaw-86177 branch May 25, 2026 14:28

github-actions Bot mentioned this pull request May 25, 2026

📡 Upstream Digest — 2026-05-25 16:16 UTC curtismercier/openclaw-mods#944

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Guard OpenAI chat payload turns#86497

Guard OpenAI chat payload turns#86497
clawsweeper[bot] merged 4 commits into
mainfrom
clawsweeper/automerge-openclaw-openclaw-86177

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

osolmaz commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

clawsweeper Bot commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 25, 2026

Hatch command

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

osolmaz commented May 25, 2026

Uh oh!

clawsweeper Bot commented May 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented May 25, 2026 •

edited

Loading

clawsweeper Bot commented May 25, 2026 •

edited

Loading