Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

After upgrade from Openclaw 2026.5.4 to 2026.6.1 (2e08f0f)

Summary

After upgrading to OpenClaw 2026.6.1 (2e08f0f), an isolated cron job using the default OpenAI/Codex-backed model path reports exec tool unavailable, even though sandbox explain for the actual cron run session shows exec is allowed. A temporary isolated cron smoke test using Google succeeds with exec, so this appears specific to the OpenAI/Codex cron execution path rather than cron/tool policy globally.

Environment

• OpenClaw version: 2026.6.1 (2e08f0f)
• Host: Linux VM
• Cron job type: isolated cron
• Agent: main
• Global tools profile: coding
• Sandbox runtime: direct
• Sandbox mode: off
  Krill 🦐:lobster:
  APP
  — 11:02 AM
• Delivery: Telegram announce target, redacted
• Default model path: OpenAI/Codex-backed default model

Affected Job

text
id: 7c999f7e-585b-4991-b91b-0d4cc99ab24a
name: Blogwatcher Daily Signal Report
enabled: yes
schedule: cron 30 7 * * * @ America/Los_Angeles (exact)
session: isolated
agent: main
model: -
delivery: announce -> telegram:redacted(explicit)
status: ok
Krill 🦐:lobster:
APP
— 11:02 AM
The job has no per-job tools / toolsAllow entry.

Actual Behavior

The cron run sends/reports:
text
Cron watchdog failed: exec tool unavailable
This continues after re-authenticating OpenAI OAuth and confirming model auth is usable.

Expected Behavior

Krill 🦐:lobster:
APP
— 11:02 AM
The isolated cron run should have access to exec, because the effective policy for the actual cron run session allows it.

Effective Sandbox / Tool Policy For Failing Cron Session

Command run:
bash
openclaw sandbox explain --session 'agent:main:cron:7c999f7e-585b-4991-b91b-0d4cc99ab24a:run:'
Relevant output:
text
Effective sandbox:
agentId: main
sessionKey: agent:main:cron:7c999f7e-585b-4991-b91b-0d4cc99ab24a:run:
Krill 🦐:lobster:
APP
— 11:02 AM
mainSessionKey: agent:main:main
runtime: direct
mode: off scope: agent
workspaceAccess: none

Sandbox tool policy:
allow (default): exec, process, read, write, edit, apply_patch, image, sessions_list, sessions_history, sessions_send, sessions_spawn, sessions_yield, subagents, session_status
deny (default): browser, canvas, nodes, cron, gateway, feishu, googlechat, nostr, msteams, mattermost, nextcloud-talk, matrix, line, zalo, clickclack, zalouser, sms, synology-chat, tlon, discord, imessage, irc, qqbot, signal, slack, telegram, twitch, whatsapp
Provider/global/agent-specific tool policy checks were absent:
text
Config path not found: tools.byProvider
Config path not found: agents.defaults.tools
Config path not found: agents.list[0].tools
Krill 🦐:lobster:
APP
— 11:02 AM

Control Test That Succeeds

Created a temporary isolated cron smoke test using Google:
bash
openclaw cron add
--name "exec smoke temp"
--at "1m"
--session isolated
--message "Use exec to run: echo openclaw-exec-ok. Reply with the output only."
--model "google/gemini-flash-latest"
--no-deliver
--delete-after-run

Krill 🦐:lobster:
APP
— 11:02 AM
Latest run output:
json
{
"entries": [
{
"jobId": "33a0879f-3807-4e87-863a-7d8d7b291b79",
"action": "finished",
"status": "ok",
"summary": "openclaw-exec-ok",
"model": "gemini-flash-latest",
"provider": "google",
"deliveryStatus": "not-requested",
"sessionKey": "agent:main:cron:33a0879f-3807-4e87-863a-7d8d7b291b79:run:"
}
Krill 🦐:lobster:
APP
— 11:02 AM
]
}
This confirms isolated cron can use exec on the same host/config when using the Google provider.

Workaround

Pinning the affected cron job to the Google model/provider appears to be the likely workaround:
bash
openclaw cron edit 7c999f7e-585b-4991-b91b-0d4cc99ab24a --model "google/gemini-flash-latest"

Notes

Krill 🦐:lobster:
APP
— 11:02 AM
Doctor also reported a legacy plugin install index warning and a disabled WhatsApp config warning, but neither appears related to this issue. OpenAI auth was re-authenticated successfully before retesting.

Before submitting, replace any remaining concrete run UUIDs, Telegram IDs, email addresses, hostnames, local usernames, auth codes, API key snippets, and delivery targets with .

Steps to reproduce

Steps to Reproduce

1. Install/run OpenClaw 2026.6.1 (2e08f0f) with an agent using the default OpenAI/Codex-backed model path.

2. Confirm the agent has the default coding tool profile and no explicit tool policy overriding exec:

bash
openclaw config get tools.profile
openclaw config get tools.byProvider
openclaw config get agents.defaults.tools
openclaw config get agents.list[0].tools

Krill 🦐:lobster:
APP
— 11:08 AM
In my case:

text
tools.profile = coding
tools.byProvider = not found
agents.defaults.tools = not found
agents.list[0].tools = not found

3. Create or use an isolated cron job whose prompt requires exec, with no per-job --tools / toolsAllow restriction:

bash
openclaw cron add
--name "exec cron repro"
--cron "/15 * * *"
--session isolated
Krill 🦐:lobster:
APP
— 11:08 AM
--message "Use exec to run: echo openclaw-exec-ok. Reply with the output only."
--announce
--channel telegram
--to ""

4. Confirm the job has no tools entry:

bash
openclaw cron show

5. Force a run:

bash
openclaw cron run
openclaw cron runs --id --limit 1
Krill 🦐:lobster:
APP
— 11:08 AM
6. Observe that the cron run reports/falls back to text equivalent to:

text
Cron watchdog failed: exec tool unavailable

7. Confirm the actual cron run session allows exec:

bash
openclaw sandbox explain --session ''

Relevant output shows:

text
Krill 🦐:lobster:
APP
— 11:08 AM
runtime: direct
mode: off
allow (default): exec, process, read, write, edit, apply_patch, ...

8. Create a control cron job using the same host/config but a Google model:

bash
openclaw cron add
--name "exec smoke temp"
--at "1m"
--session isolated
--message "Use exec to run: echo openclaw-exec-ok. Reply with the output only."
--model "google/gemini-flash-latest"
--no-deliver
--delete-after-run
Krill 🦐:lobster:
APP
— 11:08 AM
9. Check the smoke run:

bash
openclaw cron runs --id --limit 1

The smoke run succeeds with:

json
{
"status": "ok",
"summary": "openclaw-exec-ok",
"provider": "google",
"model": "gemini-flash-latest"
}

Expected behavior

Expected

The OpenAI/Codex-backed isolated cron run should be able to use exec because the effective tool policy allows it.

Actual behavior

Actual

The OpenAI/Codex-backed isolated cron run reports exec tool unavailable, while the Google isolated cron run succeeds with the same exec task.

OpenClaw version

2026.6.1

Operating system

Debian GNU/Linux 12 (bookworm)

Install method

npm

Model

openai gpt 5.5. oauth

Provider / routing chain

openclaw->openai through oauth

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response