-
-
Notifications
You must be signed in to change notification settings - Fork 69.3k
[Bug]: Isolated sessions (cron/subagents) cannot access built-in provider env vars from openclaw.json #29886
Description
Summary
Isolated sessions (cron jobs, sub-agent runs) fail to authenticate with built-in providers (e.g., OpenRouter) when credentials are configured via the env section in openclaw.json. Environment variables in the global config are only loaded for the main session, causing HTTP 404 errors.
Steps to reproduce
OpenClaw Version: 2026.2.17
Session Type: Isolated (cron sessionTarget: "isolated", sessions_spawn)
Provider Affected: OpenRouter (likely affects all built-in providers using env config)
Platform: Linux (headless server)
Steps to Reproduce
Configure OpenRouter API key in ~/.openclaw/openclaw.json:
{
"env": {
"OPENROUTER_API_KEY": "sk-or-v1-..."
}
}
Create a cron job using an OpenRouter model:
cron add daily-briefing
'{
"schedule": {"kind": "cron", "expr": "0 11 * * *"},
"sessionTarget": "isolated",
"payload": {
"kind": "agentTurn",
"message": "Generate a daily briefing",
"model": "openrouter/perplexity/sonar"
}
}'
Run the cron job and check results — HTTP 404 occurs
Expected behavior
Expected Behavior
Cron job should successfully use openrouter/perplexity/sonar and return a valid response, inheriting the OPENROUTER_API_KEY from the global config.
Actual behavior
HTTP 404: Not Found
provider: "openrouter"
model: "perplexity/sonar"
The provider is recognized but authentication fails because the env variable is not available to the isolated session.
OpenClaw version
2026.2.17
Operating system
Linux Ubuntu 24.04 (Up to date)
Install method
npm Global
Logs, screenshots, and evidence
**
Raw Context for GitHub Issue Report**
---
## Test #1: Cron Job Failure (Isolated Session)
# Cron job configuration
{
"id": "433ef9c8-ec00-46d9-96d0-d4330bb0bd6e",
"name": "Daily Briefing",
"sessionTarget": "isolated",
"payload": {
"kind": "agentTurn",
"model": "openrouter/perplexity/sonar",
"message": "Generate daily briefing..."
}
}
# Cron run result
{
"status": "error",
"error": "HTTP 404: Not Found",
"model": "perplexity/sonar",
"provider": "openrouter",
"durationMs": 1850
}
# Cron runs history (last 10 entries)
1772293500501: status=ok, summary="HTTP 404: Not Found", model="perplexity/sonar", provider="openrouter"
1772293324788: status=ok, model="glm-4.7:cloud", provider="ollama" # Worked when reverted to Ollama
1772292933576: status=error, error="HTTP 404: Not Found", model="perplexity/sonar", provider="openrouter"
---
## Test #2: Sub-Agent Failure (Isolated Session)
# Command executed
sessions_spawn \
--model "openrouter/openai/gpt-4.1-mini" \
--task "What is 2+2?" \
--cleanup delete
# Result
{
"status": "accepted",
"childSessionKey": "agent:main:subagent:9e151be1-3853-453a-ad45-beac2b4b7972"
}
# Actual outcome
[Subagent failed]: HTTP 404: Not Found
Stats: runtime 0s, tokens 0 (in 0 / out 0)
---
## Test #3: Manual curl SUCCESS (Main Session)
curl -s https://openrouter.ai/api/v1/chat/completions \
-H "Authorization: Bearer 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" \
-H "Content-Type: application/json" \
-d '{
"model": "perplexity/sonar",
"messages": [
{"role": "user", "content": "What is 2+2?"}
]
}'
# Response
{
"id": "gen-xxx",
"object": "chat.completion",
"created": 1772293550,
"model": "perplexity/sonar",
"choices": [
{
"index": 0,
"message": {
"role": "assistant",
"content": "2+2=4"
},
"finish_reason": "stop"
}
],
"citations": [...], # Full citations included
"usage": {
"prompt_tokens": 25,
"completion_tokens": 5,
"total_tokens": 30
}
}
# HTTP Status: 200 OK ✅
---
## Configuration Files
### `~/.openclaw/openclaw.json`
{
"env": {
"OPENROUTER_API_KEY": "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"
},
"models": {
"providers": {
"ollama": {
"baseUrl": "http://192.168.30.229:11434/api/chat"
}
}
},
"commands": {
"restart": true
},
"gateway": {
"pid": 339842
}
}
### Model List from OpenRouter (Verified Available)
curl -s https://openrouter.ai/api/v1/models \
-H "Authorization: Bearer sk-or-v1-..." \
| jq '.data[] | select(.id | contains("perplexity")) | {id, name}'
{
"id": "perplexity/sonar-pro-search",
"name": "Perplexity: Sonar Pro Search"
}
{
"id": "perplexity/sonar-reasoning-pro",
"name": "Perplexity: Sonar Reasoning Pro"
}
{
"id": "perplexity/sonar-pro",
"name": "Perplexity: Sonar Pro"
}
{
"id": "perplexity/sonar-deep-research",
"name": "Perplexity: Sonar Deep Research"
}
{
"id": "perplexity/sonar",
"name": "Perplexity: Sonar"
}
---
## Gateway Logs (No OpenRouter errors)
tail -100 ~/.openclaw/logs/gateway.log | grep -i -E "(openrouter|perplexity|404|error)"
# Output: (no output - no debug logs for this issue)
---
## Session Status Comparison
# Main session (WORKING)
session_status
Model: ollama/glm-4.7:cloud
Session: agent:main:main
# Isolated session (FAILING)
Session: agent:main:cron:433ef9c8-ec00-46d9-96d0-d4330bb0bd6e:run:xxx
Model: perplexity/sonar
Provider: openrouter
Error: HTTP 404: Not Found
---
## Key Observation
**Provider is recognized, but auth fails:**
- `provider: "openrouter"` ✓ (not "Unknown provider")
- API key valid ✓ (manual curl works)
- Model exists ✓ (verified via /models endpoint)
- Session isolation blocks env vars ✗
---
## Working Alternative (Ollama)
{
"payload": {
"model": "ollama/glm-4.7:cloud", // WORKS in isolated sessions ✅
"provider": "ollama" // Local provider, no env vars needed
}
}
// Result
{
"status": "ok",
"model": "glm-4.7:cloud",
"provider": "ollama",
"usage": {
"input_tokens": 82471,
"output_tokens": 540
}
}
---
## Environment Info
# OpenClaw version
openclaw --version
OpenClaw 2026.2.17 (4134875)
# System
uname -a
Linux hostname 6.8.0-100-generic x86_64
# Check for system env var (not set)
echo $OPENROUTER_API_KEY
# (empty)Impact and severity
Impact and Severity Statement for GitHub Issue
Impact
This bug blocks the use of ALL built-in providers (OpenRouter, Anthropic, OpenAI, etc.) in isolated sessions (cron jobs and sub-agent tasks). Users are forced to choose between:
- Feature loss: Reverting to local-only providers (e.g., Ollama) with limited capabilities
- Reduced isolation: Running cron jobs in main session, breaking isolation guarantees
- Security degradation: Hardcoding API keys in system-wide environment variables
Affected Use Cases
- Scheduled cron jobs with web search, citations, or advanced reasoning (e.g., Daily Briefing with Perplexity)
- Sub-agent task escalation workflows that tier models based on task complexity
- Automated monitoring requiring provider-specific features (vision, tools, structured output)
- Cost-efficient automation using cheaper provider models for background tasks
Example
A Daily Briefing cron job configured to use openrouter/perplexity/sonar for web search and citations fails with HTTP 404, forcing users to revert to local-only models without web access.
Severity
HIGH — Isolated sessions cannot authenticate with built-in providers despite correct configuration. This affects core OpenClaw automation features (cron, sub-agents) and requires non-obvious workarounds that compromise either functionality or security.
Why HIGH, Not Critical
- System remains operational with local providers (Ollama)
- Main sessions work fully with all providers
- Workarounds exist (system env vars, main session cron)
- No data loss or corruption effects
Why Not Medium/Low
- Affects ALL built-in providers, not edge cases
- Blocks common automation patterns (cron jobs, sub-agents)
- No documentation warning to prevent this issue
- Workarounds degrade security or isolation guarantees
Saved to: GITHUB_IMPACT_SEVERITY.md
Additional information
Related Documentation
- Built-in providers concept:
~/.npm-global/lib/node_modules/openclaw/docs/concepts/model-providers.md - OpenRouter provider:
~/.npm-global/lib/node_modules/openclaw/docs/providers/openrouter.md - Cron system: Built-in OpenClaw cron functionality
Complete Reproduction Script
#!/bin/bash
# reproduce-openrouter-isolated-fail.sh
echo "=== Testing OpenRouter in Isolated Sessions ==="
# Test 1: Manual curl (works)
curl -s https://openrouter.ai/api/v1/chat/completions \
-H "Authorization: Bearer sk-or-v1-..." \
-d '{"model": "perplexity/sonar", "messages": [{"role": "user", "content": "What is 2+2?"}]}'
# Test 2: Verify model exists
curl -s https://openrouter.ai/api/v1/models \
| jq '.data[] | select(.id == "perplexity/sonar")'
# Test 3: Check env var config
cat ~/.openclaw/openclaw.json | jq '.env.OPENROUTER_API_KEY'
# Test 4-6: Create, run, and clean up test cron job
# (see full script in GITHUB_ADDITIONAL_INFO.md)Verification Steps for Maintainers
- Test main session: Run curl → Should return "4" ✅
- Test isolated session: Run cron job → Should fail with 404 ❌
- Fix verification: After patch, cron job → Should return "4" ✅
Additional Testing Performed
| Test | Model | Session | Result |
|---|---|---|---|
| curl direct | perplexity/sonar | Manual | ✅ HTTP 200 |
| Cron job | perplexity/sonar | Isolated | ❌ HTTP 404 |
| Sub-agent | gpt-4.1-mini | Isolated | ❌ HTTP 404 |
| Cron job | glm-4.7:cloud | Isolated | ✅ Works (Ollama) |
Configuration Insights
Built-in vs Custom providers:
- Built-in: Require
env.OPENROUTER_API_KEYinopenclaw.json - Custom: Use
models.providers.{name}.apiKey - Only main sessions load
envsection - Isolated sessions do NOT inherit these variables
Session type matrix:
Main session (agent:main:main)
├─ Reads env vars ✅
├─ ALL providers ✅
└─ Interactive chat
Isolated session (cron/sub-agent)
├─ Reads env vars ❌
├─ Custom ✅, Local ✅, Built-in ❌
└─ Automated tasks
Potential Root Cause Areas
- Gateway session loading logic — Skips env vars for isolated sessions
- Provider authentication flow — No fallback for missing env vars
- Cron/sub-agent spawning — Creates completely isolated environments
Community Impact
Affected users:
- Cron jobs with paid/external providers
- Sub-agent workflow implementations
- Automated monitoring systems
- Cost-sensitive background tasks
Detection difficulty:
- Error message: Generic "HTTP 404: Not Found"
- Provider shows correctly:
provider: openrouter - No clear auth indication → Users waste time debugging model IDs, quotas
Timeline
09:45 - First cron failure (Unknown model)
09:50 - Switch to OpenRouter proxy
10:15 - Manual curl works (200)
10:22 - Cron still failing (404)
10:45 - Root cause identified
10:56 - GitHub issue created
11:02 - This additional info
Contact for Follow-up
- Discoverer: Rikk
- Environment: Linux 6.8.0-100-generic, OpenClaw 2026.2.17
- Available for: Testing, clarification, feature requests