Summary

Async/cron command results can drop action-critical auth/setup prompt lines during output truncation. When a command emits a Microsoft device-code login prompt, the login URL may survive in the delivered result but the short device code and next-action instruction are lost, making the prompt unactionable.

This is the interactive complement to PR #95809 (cron broadcast delivery redaction). Same class of sensitive/action-critical output, opposite requirement by context: interactive command results the user is awaiting should preserve these lines; broadcast delivery should redact them.

Environment

• OpenClaw 2026.6.8 (also reproduced on 2026.6.6)
• Cron command payload with timeoutSeconds, outputMaxBytes
• Async command delivery via openclaw cron run --wait / process poll/log / approval follow-up summaries

Reproduction (synthetic example only)

Create a cron command job that prints a Microsoft device-code prompt followed by enough filler output to trigger the 200 KB default output cap:

{
  "name": "test-async-preservation",
  "schedule": { "kind": "at", "at": "2099-01-01T00:00:00Z" },
  "payload": {
    "kind": "command",
    "timeoutSeconds": 30,
    "outputMaxBytes": 900
  },
  "deleteAfterRun": true
}

openclaw cron create --json '{"command":"echo \"To sign in, use a web browser to open https://login.microsoft.com/device and enter the code FAKE-CODE-270 to authenticate.\"; for i in $(seq 1 50); do echo \"CRON-FILLER-270-line-$i\"; done; echo \"DONE\"","shell":"bash"}'
openclaw cron run --id <job-id> --wait

Expected behaviour

The delivered run result includes:

• The full device-login URL: https://login.microsoft.com/device
• The device code line: enter the code FAKE-CODE-270 to authenticate
• A next-action instruction with recovery pointer if output is truncated
• A truncation note such as [output truncated: stdout omitted ... Recovery: openclaw cron runs --id <job> --run-id <run>]

Actual behaviour

The delivered summary contains only the filler tail lines and the truncation note. The login URL and device code are absent from the user-facing result.

Impact

• Device-code auth prompts become unactionable — the user sees the login URL but cannot enter the code
• Blocks Microsoft 365 / cb365 auth recovery paths
• One-time setup codes, callback URLs, and explicit next-action instructions can similarly be lost

Suggested Fix

Introduce a shared action-critical output classifier that identifies lines matching:

• Device-login URLs (login.microsoft.com/device, microsoft.com/devicelogin)
• Device/setup/verification code lines (e.g. code: XXXX-XXXX, enter the code ...)
• Localhost/device/callback URLs
• Explicit "enter/use/copy/paste this next-action" instructions

The classifier should be shared by two call sites:

1. Async/interactive truncation (preserve mode): Always keep flagged lines in the delivered result regardless of output cap. Include head + tail + preserved lines + recovery pointer.
2. Cron broadcast delivery (redact mode, PR fix(cron): redact command output in delivery #95809): Redact the same value class before announce/webhook delivery. Keep full unredacted output in run history for authorized inspection.

Acceptance Criteria

1. When an async/cron command outputs a Microsoft device-code prompt, the delivered interactive result includes both the login URL and the code line.
2. Truncation never removes short auth codes, one-time setup codes, callback URLs, or explicit next-action instructions.
3. When output is truncated, the interactive result includes a visible truncation notice and a pointer/command to retrieve the full captured output.
4. SIGTERM/timeout summaries include enough context to identify the command and recover captured output.
5. When no auth/setup prompt is present, output capture remains bounded — the fix must not switch to unbounded stdout/stderr retention.

Related Work

• PR fix(cron): redact command output in delivery #95809 fix(cron): redact command output in delivery — addresses the broadcast/cron delivery half using the same value class. This issue covers the interactive/async preservation half.
• Local investigation and mitigation history documented at nz365guy/cloverbase-dev-team#270.

Verification

Tested locally with identical fake/synthetic device-code prompt data only. The local mitigation (installed runtime hotfix on [email protected]) was verified by:

• Fresh-load Node unit tests (15 test cases across 3 affected modules)
• Live cron stdout/stderr truncation tests after controlled service restart
• Live no-output-timeout and SIGTERM signal tests
  All passed with synthetic data. The hotfix was overwritten by the subsequent v2026.6.8 package upgrade, confirming the need for a durable source fix.