fix: land ten small reliability fixes by steipete · Pull Request #100483 · openclaw/openclaw

steipete · 2026-07-05T22:40:33Z

What Problem This Solves

Lands ten small reliability fixes that were individually proposed in #100450, #100435, #100439, #100413, #100032, #99942, #99849, #99840, #99913, #99812, and #99892:

fail LSP/install-policy requests deterministically on child-process stream failures and treat blank numeric tool parameters as unset;
report the actual sandbox workspace, runtime workdir, and Docker mounts, including persisted spawned-session overrides;
encode Android all-day calendar events with UTC-midnight bounds;
serialize iOS push-to-talk transitions and preserve Voice Wake ownership across overlapping operations;
reject prototype-chain Talk provider names at all schema/runtime boundaries;
stop Android continuous, one-shot, and gateway PTT capture when the app backgrounds;
keep isolated cron fallback result classification aligned with the canonical runtime;
bound both raw and decompressed Vertex ADC streaming responses;
retain the self-hosted provider label and parse cause for malformed discovery JSON.

Closes #100423.

Why This Change Was Made

The source PRs identified real, narrow failures, but several needed broader sibling-path coverage or a cleaner owner-boundary fix before landing. This stack preserves contributor credit while using shared runtime helpers, fail-closed lifecycle handling, and regression tests for the complete bug classes rather than copying each patch verbatim.

User Impact

Users get clearer sandbox diagnostics, correct all-day calendar creation, safer voice/PTT lifecycle behavior, bounded provider responses, and deterministic errors instead of hangs or misleading fallback behavior. No new configuration or compatibility surface is introduced.

Evidence

AutoReview: clean after all accepted findings were fixed.
node_modules/.bin/oxfmt --check on all touched TypeScript files.
swiftformat --lint --config config/swiftformat --unexclude 'apps/ios/Sources,apps/ios/Tests' on the touched Swift files.
git diff --check origin/main...HEAD.
Exact-head sanitized AWS Crabbox and hosted CI/Testbox proof will be posted before merge.

Source: #100450 Co-authored-by: morluto <[email protected]>

Sources: #100435, #100439 Co-authored-by: Aniruddha Adak <[email protected]> Co-authored-by: ZengWen-DT <[email protected]>

Source: #100413 Co-authored-by: 陈宪彪0668000387 <[email protected]>

Source: #100032 Co-authored-by: NianJiuZst <[email protected]>

Source: #99942 Co-authored-by: NianJiuZst <[email protected]>

Source: #99849 Co-authored-by: zenglingbiao <[email protected]>

Source: #99840 Co-authored-by: xialonglee <[email protected]>

Source: #99913 Co-authored-by: jincheng-xydt <[email protected]>

Source: #99812 Co-authored-by: 黄剑雄0668001315 <[email protected]>

Source: #99892 Co-authored-by: 陈宪彪0668000387 <[email protected]>

clawsweeper · 2026-07-05T22:47:02Z

Codex review: needs real behavior proof before merge. Reviewed July 5, 2026, 7:00 PM ET / 23:00 UTC.

Summary
The PR batches reliability fixes across Android/iOS voice and calendar paths, sandbox diagnostics, Google/self-hosted provider handling, cron fallback classification, install-policy stream errors, LSP request failures, and talk provider validation.

PR surface: Source +181, Tests +633, Docs +2, Other +248. Total +1064 across 34 files.

Reproducibility: yes. at source level for the reviewed bug classes: the patched paths map directly to the linked failures and regression tests cover the intended behavior. I did not execute the test suite in this read-only pass.

Review metrics: 1 noteworthy metric.

Sandbox explain JSON fields: 5 added. The PR adds user-visible diagnostic output fields, so maintainers should treat the CLI JSON shape as a documented diagnostic surface before merge.

Stored data model
Persistent data-model change detected: serialized state: extensions/google/transport-stream.test.ts, serialized state: src/commands/sandbox-explain.test.ts, serialized state: src/plugins/provider-self-hosted-setup.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Wait for exact-head hosted CI/Testbox/mobile lanes to finish on the current head.
[P2] If any mobile or auth/security lane fails, split or repair that subsystem before landing the full batch.

Risk before merge

[P1] The PR intentionally changes fail-closed behavior in install policy streams and auth/provider response parsing, so maintainers should confirm those security/auth boundaries are acceptable for existing operator environments.
[P1] The batch spans mobile, agents, commands, plugins, providers, and security code; exact-head hosted CI/Testbox/mobile validation was still not complete in the live status observed during review.

Maintainer options:

Wait for exact-head proof (recommended)
Land only after the hosted CI/Testbox/mobile lanes complete on 68063a6502c5cd132a071534e3e668956beec4aa and show the auth/provider/security-sensitive paths still behave as intended.
Accept fail-closed behavior explicitly
Maintainers may choose to accept the one-megabyte Google OAuth cap and install-policy stream-error blocking as deliberate security hardening even if rare operator environments see new failures.
Split on proof failure
If exact-head validation fails in a mobile or provider/security lane, split that subsystem out instead of landing the whole batch with unresolved proof.

Next step before merge

[P1] Protected maintainer-labeled PR with broad auth/security/mobile/runtime scope; no automated repair is indicated, but maintainers should wait for exact-head proof and make the landing decision.

Maintainer decision needed

Question: Should maintainers land this broad maintainer-labeled reliability batch after exact-head proof completes, or split/rework any subsystem whose mobile/auth/security validation does not finish cleanly?
Rationale: The patch appears technically sound in source review, but it touches protected maintainer-owned surfaces with auth-provider and security-boundary behavior that automation should not accept without final human ownership.
Likely owner: steipete — steipete authored the batch and is the strongest current cross-surface owner in the file and PR history sampled.
Options:
- Land after exact-head proof (recommended): Wait for hosted CI/Testbox/mobile proof on this head, then land the batch if the proof remains green and the fail-closed boundaries are accepted.
- Split risky subsystems: If mobile or provider/security validation fails, split the affected subsystem into a narrower PR and keep the clean fixes moving separately.
- Pause the batch: Pause this PR if maintainers decide the combined review blast radius is too high for one landing candidate.

Security
Cleared: Dedicated security review found no concrete security regression in the diff; the security-sensitive changes fail closed or bound untrusted reads but still need maintainer acceptance before merge.

Review details

Best possible solution:

Keep the shared-helper and owner-boundary fixes, then land only after exact-head hosted CI/Testbox/mobile proof is green and a maintainer accepts the fail-closed auth/security behavior.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level for the reviewed bug classes: the patched paths map directly to the linked failures and regression tests cover the intended behavior. I did not execute the test suite in this read-only pass.

Is this the best way to solve the issue?

Yes, with validation still pending: the PR mostly reuses existing runtime helpers and owner boundaries rather than adding parallel systems. The best landing path is to keep the batch intact only if exact-head CI/Testbox/mobile proof completes cleanly.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a905eb42acda.

Label changes

Label changes:

add P1: The batch addresses active reliability failures in agent runtime, mobile voice capture, cron fallback, provider auth, and security install-policy paths.
add merge-risk: 🚨 auth-provider: The Google Vertex ADC token path now rejects raw or decompressed OAuth responses above the one-megabyte cap, changing provider auth failure behavior.
add merge-risk: 🚨 security-boundary: Install-policy child stream errors now fail closed and kill the policy process, which changes plugin/skill install security-boundary behavior.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external contributor proof gate is not applied because this is a protected maintainer-labeled PR, but the PR should still wait for the promised exact-head hosted CI/Testbox proof before landing.

Label justifications:

P1: The batch addresses active reliability failures in agent runtime, mobile voice capture, cron fallback, provider auth, and security install-policy paths.
merge-risk: 🚨 auth-provider: The Google Vertex ADC token path now rejects raw or decompressed OAuth responses above the one-megabyte cap, changing provider auth failure behavior.
merge-risk: 🚨 security-boundary: Install-policy child stream errors now fail closed and kill the policy process, which changes plugin/skill install security-boundary behavior.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The external contributor proof gate is not applied because this is a protected maintainer-labeled PR, but the PR should still wait for the promised exact-head hosted CI/Testbox proof before landing.

Evidence reviewed

PR surface:

Source +181, Tests +633, Docs +2, Other +248. Total +1064 across 34 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	13	273	92	+181
Tests	9	635	2	+633
Docs	2	3	1	+2
Config	0	0	0	0
Generated	0	0	0	0
Other	10	284	36	+248
Total	34	1195	131	+1064

What I checked:

Live PR state: Live GitHub metadata shows this PR is open, not draft, has the protected maintainer label, closes the sandbox diagnostics issue, and currently has an unstable merge state with some CI lanes still in progress. (68063a6502c5)
Sandbox diagnostics implementation: The patched sandbox explain now derives effective host workspace, runtime workdir, workspace source, and Docker mount output from the same sandbox layout and mount helpers used by runtime setup. (src/commands/sandbox-explain.ts:221, 68063a6502c5)
Android voice background path: The Android foreground transition now calls stopActiveVoiceSession(), which clears TalkMode, mic, foreground-service, voice mode, and external-audio state; TalkModeManager.stopAllCapture() also clears PTT capture even when continuous mode is disabled. (apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt:1373, 68063a6502c5)
iOS PTT ownership path: The iOS patch adds shared Voice Wake leases and serializes start/stop/cancel commands so failed starts release suspension and overlapping PTT owners do not resume Voice Wake until the final release. (apps/ios/Sources/Model/NodeAppModel.swift:1809, 68063a6502c5)
Security and provider boundary changes: Install-policy child stream errors now fail closed and kill the policy process, while Google Vertex ADC token reads use bounded response reads and bounded gzip output before JSON parsing. (src/security/install-policy.ts:564, 68063a6502c5)
Dependency behavior probe: A read-only Node probe confirmed gunzipSync(..., { maxOutputLength }) throws ERR_BUFFER_TOO_LARGE when decompressed output exceeds the configured one-megabyte cap used by the PR. (extensions/google/vertex-adc.ts:300, 68063a6502c5)

Likely related people:

steipete: Authored this batch and appears repeatedly in recent live history for the LSP runtime, Android runtime, Talk config, Google Vertex ADC, and sandbox/session surfaces touched here. (role: recent area contributor and likely follow-up owner; confidence: high; commits: 68063a6502c5, b22c36f1125c, 77575d74f68c; files: src/agents/agent-bundle-lsp-runtime.ts, apps/android/app/src/main/java/ai/openclaw/app/NodeRuntime.kt, src/config/talk.ts)
jalehman: Recent live history on sandbox-explain.ts routes command session reads through a seam, which is adjacent to the PR's session-aware sandbox explain changes. (role: adjacent command/session seam contributor; confidence: medium; commits: e1744184b8c0; files: src/commands/sandbox-explain.ts)
vincentkoc: Recent live history includes install-policy timeout process-tree handling and related provider/config runtime work, adjacent to the PR's install-policy stream failure behavior. (role: adjacent security/runtime contributor; confidence: medium; commits: 39dc92efb76a, 2b75806197ab; files: src/security/install-policy.ts, src/config/talk.ts)
liaoandi: Introduced compressed Vertex ADC token response handling on the same Google provider file that this PR now bounds for raw and decompressed response size. (role: adjacent Google Vertex ADC contributor; confidence: medium; commits: 97d68b69027f; files: extensions/google/vertex-adc.ts)
NianJiuZst: Co-authored the iOS PTT and Android calendar fixes incorporated by this batch and appears in recent iOS Watch/mobile history as a co-author. (role: source-fix and adjacent mobile contributor; confidence: medium; commits: f195649e6db5, d14de947f6ff, 70f2bef6b4cf; files: apps/ios/Sources/Model/NodeAppModel.swift, apps/android/app/src/main/java/ai/openclaw/app/node/CalendarHandler.kt)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete · 2026-07-05T23:08:55Z

Merged via squash.

Prepared head SHA: 68063a6502c5cd132a071534e3e668956beec4aa
Landed commit: aaf5ab910cbe35c9cbd491c0d1755aa25b413be9

Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]>

* fix(android): serialize background PTT lifecycle Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]> * docs(changelog): note Android PTT lifecycle hardening * fix(android): order PTT ownership transitions * test(android): opt in to coroutine scheduler API * fix(android): serialize voice capture ownership * test(android): drive PTT ordering with test dispatcher * test(android): isolate PTT ordering preferences * test(android): control PTT invoke dispatchers * test(android): isolate PTT coroutine dispatchers * test(android): use current Robolectric resolver API * test(android): register speech service without deprecated APIs * test(android): control stale PTT cleanup dispatch * test(android): isolate voice mode reassertion * fix(android): clean voice capture on permission loss * fix(android): invalidate PTT before cancel wait * test(android): preserve starts queued after cancel * fix(android): keep one-shot PTT retries idempotent --------- Co-authored-by: xialonglee <[email protected]>

* fix(agents): harden LSP process failures Source: openclaw#100450 Co-authored-by: morluto <[email protected]> * fix(sandbox): report effective workspace layout Sources: openclaw#100435, openclaw#100439 Co-authored-by: Aniruddha Adak <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> * fix(security): fail install checks on stream errors Source: openclaw#100413 Co-authored-by: 陈宪彪0668000387 <[email protected]> * fix(android): normalize all-day calendar events Source: openclaw#100032 Co-authored-by: NianJiuZst <[email protected]> * fix(ios): serialize push-to-talk lifecycle Source: openclaw#99942 Co-authored-by: NianJiuZst <[email protected]> * fix(talk): reject inherited provider names Source: openclaw#99849 Co-authored-by: zenglingbiao <[email protected]> * fix(android): stop voice capture in background Source: openclaw#99840 Co-authored-by: xialonglee <[email protected]> * fix(cron): preserve fallback result classification Source: openclaw#99913 Co-authored-by: jincheng-xydt <[email protected]> * fix(google): bound Vertex response decompression Source: openclaw#99812 Co-authored-by: 黄剑雄0668001315 <[email protected]> * fix(plugins): report malformed discovery JSON Source: openclaw#99892 Co-authored-by: 陈宪彪0668000387 <[email protected]> * test(sandbox): configure non-default workspace fixture * test: fix small-fix batch validation --------- Co-authored-by: morluto <[email protected]> Co-authored-by: ZengWen-DT <[email protected]> Co-authored-by: 陈宪彪0668000387 <[email protected]> Co-authored-by: NianJiuZst <[email protected]> Co-authored-by: zenglingbiao <[email protected]> Co-authored-by: xialonglee <[email protected]> Co-authored-by: jincheng-xydt <[email protected]> Co-authored-by: 黄剑雄0668001315 <[email protected]>

* fix(android): serialize background PTT lifecycle Follow-up hardening for openclaw#99840 after the initial fix landed in openclaw#100483. Co-authored-by: xialonglee <[email protected]> * docs(changelog): note Android PTT lifecycle hardening * fix(android): order PTT ownership transitions * test(android): opt in to coroutine scheduler API * fix(android): serialize voice capture ownership * test(android): drive PTT ordering with test dispatcher * test(android): isolate PTT ordering preferences * test(android): control PTT invoke dispatchers * test(android): isolate PTT coroutine dispatchers * test(android): use current Robolectric resolver API * test(android): register speech service without deprecated APIs * test(android): control stale PTT cleanup dispatch * test(android): isolate voice mode reassertion * fix(android): clean voice capture on permission loss * fix(android): invalidate PTT before cancel wait * test(android): preserve starts queued after cancel * fix(android): keep one-shot PTT retries idempotent --------- Co-authored-by: xialonglee <[email protected]>

Partial prerequisite backport from aaf5ab9 (openclaw#100483). (cherry picked from commit 8a7a6ac)

steipete requested a review from a team as a code owner July 5, 2026 22:40

steipete and others added 10 commits July 5, 2026 18:40

fix(agents): harden LSP process failures

1ef5114

Source: #100450 Co-authored-by: morluto <[email protected]>

fix(sandbox): report effective workspace layout

c58c3eb

Sources: #100435, #100439 Co-authored-by: Aniruddha Adak <[email protected]> Co-authored-by: ZengWen-DT <[email protected]>

fix(security): fail install checks on stream errors

48e039a

Source: #100413 Co-authored-by: 陈宪彪0668000387 <[email protected]>

fix(android): normalize all-day calendar events

f195649

Source: #100032 Co-authored-by: NianJiuZst <[email protected]>

fix(ios): serialize push-to-talk lifecycle

d14de94

Source: #99942 Co-authored-by: NianJiuZst <[email protected]>

fix(talk): reject inherited provider names

a023d7e

Source: #99849 Co-authored-by: zenglingbiao <[email protected]>

fix(android): stop voice capture in background

0d04c3f

Source: #99840 Co-authored-by: xialonglee <[email protected]>

fix(cron): preserve fallback result classification

66e4bf3

Source: #99913 Co-authored-by: jincheng-xydt <[email protected]>

fix(google): bound Vertex response decompression

d0f5167

Source: #99812 Co-authored-by: 黄剑雄0668001315 <[email protected]>

fix(plugins): report malformed discovery JSON

fd5d775

Source: #99892 Co-authored-by: 陈宪彪0668000387 <[email protected]>

steipete force-pushed the codex/land-small-fixes-batch-6 branch from 6714fd2 to fd5d775 Compare July 5, 2026 22:41

test(sandbox): configure non-default workspace fixture

26def90

This comment has been minimized.

Sign in to view

test: fix small-fix batch validation

68063a6

steipete merged commit aaf5ab9 into main Jul 5, 2026
136 of 144 checks passed

steipete deleted the codex/land-small-fixes-batch-6 branch July 5, 2026 23:08

steipete added a commit that referenced this pull request Jul 6, 2026

fix(android): serialize background PTT lifecycle

ff8deec

Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]>

clawsweeper Bot mentioned this pull request Jul 6, 2026

fix(cron): engage model fallback on embedded result-level failures (reasoning-only / empty / incomplete_turn) #96529

Closed

steipete added a commit that referenced this pull request Jul 6, 2026

fix(android): serialize background PTT lifecycle

f809fe9

Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]>

steipete added a commit that referenced this pull request Jul 6, 2026

fix(android): serialize background PTT lifecycle

b96217a

Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]>

AmirF194 mentioned this pull request Jul 6, 2026

fix(cron): retry fallback on empty embedded cron results #99911

Open

steipete added a commit that referenced this pull request Jul 6, 2026

fix(android): serialize background PTT lifecycle

b673a6f

Follow-up hardening for #99840 after the initial fix landed in #100483. Co-authored-by: xialonglee <[email protected]>

Hackerismydream mentioned this pull request Jul 6, 2026

[Bug]: isolated cron model-fallback chain never engages on result-level failures (reasoning-only / empty / incomplete_turn), silently dropping the answer #96525

Closed

This was referenced Jul 9, 2026

fix(ios): make Talk audio lifecycle-safe #103072

Merged

fix(google-vertex-adc): bound token response body read to prevent OOM #98507

Closed

wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026

fix(google): bound Vertex token response bodies

95dcba5

Partial prerequisite backport from aaf5ab9 (openclaw#100483). (cherry picked from commit 8a7a6ac)

zenglingbiao mentioned this pull request Jul 19, 2026

fix(plugins): decode self-hosted discovery JSON with fatal UTF-8 validation #111113

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: land ten small reliability fixes#100483

fix: land ten small reliability fixes#100483
steipete merged 12 commits into
mainfrom
codex/land-small-fixes-batch-6

steipete commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 5, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

Uh oh!

steipete commented Jul 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading