Suppress expired exec approval followup warnings#2508
Open
BingqingLyu wants to merge 839 commits into
Open
Conversation
Harden the macOS CodeQL SARIF filter to drop only findings whose primary location is SwiftPM build output. Verified with workflow sanity, local jq filtering, full PR CI, and profile=macos-security branch proof in 18m44s.
Allow the memory index suite to exceed the global 120s test timeout when it runs inside a packed extension shard. The scoped Vitest config is reset after the file.
Fixes openclaw#72283. - Redacts Control UI tool start args, partial/final result payloads, derived exec output, and patch summaries before event emission. - Forces tool/UI payload redaction to include built-in patterns plus configured custom `logging.redactPatterns`. - Covers object, details-only, primitive string, and top-level array tool-result shapes. Tests: - `pnpm test src/agents/pi-embedded-subscribe.tools.test.ts src/agents/pi-embedded-subscribe.handlers.tools.test.ts` - `pnpm check:changed` Co-authored-by: volcano303 <[email protected]> Co-authored-by: Val Alexander <[email protected]>
Document the redaction surface added in f3e8c50: custom logging.redactPatterns now apply to Control UI tool start args, partial/final result payloads, derived exec output, and patch summaries on top of the built-in defaults.
* fix: pass directories to provider stream wrappers * fix: pass directories to provider stream wrappers --------- Co-authored-by: neilofneils404 <[email protected]> Co-authored-by: vincentkoc <[email protected]>
Conservatively filter macOS CodeQL SARIF by dropping only findings where every location is SwiftPM build output. Verified with workflow sanity, local jq filtering, PR CI, and a failed-job rerun for an unrelated stalled Vitest shard.
* docs: clarify messaging vs full tool profiles * docs: normalize tools.profile references * docs: clarify messaging and full tool profiles --------- Co-authored-by: vincentkoc <[email protected]>
* fix(agents): resolve model aliases in sessions_spawn normalizeModelSelection() only trims the input — it never resolves aliases through the model alias index. When a user passes an alias like 'opus' to sessions_spawn, the child session gets patched with the raw string, which the gateway cannot match to any provider. Add resolveModelThroughAliases() to check bare strings against the configured alias map before returning from resolveSubagentSpawnModelSelection(). Fixes openclaw#57532 Refs openclaw#50736 * refactor: address review feedback on alias resolution - Accept pre-built ModelAliasIndex instead of rebuilding per call - Narrow helper signature to (string, ModelAliasIndex) → string - Remove unreachable ?? raw fallback Co-Authored-By: greptile-apps[bot] * fix(agents): resolve sessions_spawn model aliases --------- Co-authored-by: HowdyDooToYou <[email protected]> Co-authored-by: vincentkoc <[email protected]>
A local containment profile uses plugins.enabled=false to stop plugin and channel runtime churn. The previous startup path still built plugin lookup tables and doctor stale scans despite the global disable, which made the switch noisy and slow. Constraint: plugins.enabled=false must leave channel blocker warnings intact while treating stale plugin config as inert. Rejected: Clear user plugin config automatically | would mutate a reversible containment setting. Confidence: high Scope-risk: narrow Directive: Do not reintroduce plugin registry discovery before checking plugins.enabled. Tested: pnpm test src/gateway/server-startup-plugins.test.ts src/config/plugin-auto-enable.core.test.ts src/commands/doctor/shared/stale-plugin-config.test.ts src/commands/doctor/shared/preview-warnings.test.ts Tested: pnpm check:changed Tested: pnpm build
Raise the Bonjour stuck-announcing watchdog threshold from 8s to 20s and align watchdog timer coverage so healthy 12-13s LAN announcements do not trigger false-positive advertiser teardown.
BingqingLyu
added
the
independent-review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Suppress exec approval followup warning logs when the approval id is already gone (
unknown or expired approval id).Why
During investigation of openclaw#66675, I repeatedly saw restart/reporting flows where the gateway came back healthy but log noise included:
exec approval followup dispatch failedunknown or expired approval idThis patch does not claim to fully solve the false non-zero restart on its own, but it removes one clearly benign error path that can fire after approval lifecycle completion and muddy the operator signal.
OpenClaw already has
isApprovalNotFoundError(...)for this exact class of benign approval lookup failure in other paths, so this makes followup dispatch handling consistent with the rest of the codebase.Change
isApprovalNotFoundError(...)insendExecApprovalFollowupResult(...)Test
Added targeted coverage in:
src/agents/bash-tools.exec-host-shared.test.tsNew assertion:
unknown or expired approval iddoes not emit a warning logI also ran:
and the targeted test file passes.
Issue