fix(mantis): stop Crabbox setup hanging on stalled checkout by zhangguiping-xydt · Pull Request #108940 · openclaw/openclaw

zhangguiping-xydt · 2026-07-16T11:19:32Z

What Problem This Solves

Fixes an issue where Mantis Discord, Slack, and Telegram live-proof jobs could remain stuck in Crabbox setup until their 2–6 hour job timeout when the Git checkout transport stalled.

Why This Change Was Made

All five repeated Install Crabbox CLI steps now run their existing clone or fetch through the repository's bounded process pattern: a 120-second deadline, followed by a 10-second termination grace period. Ref selection, shallow checkout, build, warmup, and proof behavior are unchanged.

User Impact

Maintainers get a prompt, actionable checkout failure instead of losing a live-proof runner for hours before the requested proof begins.

Evidence

Regression: node scripts/run-vitest.mjs test/scripts/package-acceptance-workflow.test.ts --run --testNamePattern="bounds Mantis Crabbox source retrieval" — 1 passed.
Controlled runtime proof extracted each of the five production workflow steps, scaled the production deadline to one second, and injected a Git transport that stalls until TERM. Every step returned 124 in about 1.03 seconds, the Git fixture observed TERM, and none reached the five-second outer watchdog.
pnpm exec oxfmt --check passed for all six changed files; git diff --check passed.
The complete workflow test file was also attempted: 72 tests passed, while seven unrelated environment-dependent cases failed because the isolated host lacked GitHub CLI authentication/clean login-shell state, and one unrelated existing case reached its 120-second test timeout. The affected focused regression is green.

clawsweeper · 2026-07-16T12:32:44Z

Codex review: needs maintainer review before merge. Reviewed July 16, 2026, 7:25 AM ET / 11:25 UTC.

Summary
Bounds Crabbox Git clone or fetch commands in five Mantis workflows with a 120-second TERM/KILL timeout and adds a regression assertion covering every changed workflow.

PR surface: Tests +17, Config 0. Total +17 across 6 files.

Reproducibility: yes. Injecting a Git transport that stalls until TERM reproduces the unbounded setup condition, and the controlled after-fix run exercises all five extracted production steps.

Review metrics: 1 noteworthy metric.

Bounded retrieval paths: 5 commands changed. Every identified Mantis Crabbox source checkout now fails within roughly 130 seconds instead of consuming a two-to-six-hour workflow budget.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Next step before merge

No repair lane is needed; the patch is correct and only requires ordinary maintainer review and completion of required checks.

Security
Cleared: The patch adds no new action, dependency, permission, secret access, download source, or executable payload and preserves the existing trusted Crabbox source.

Review details

Best possible solution:

Land the bounded TERM-then-KILL retrieval behavior after normal required checks complete, keeping the existing refs, shallow checkout, build, and proof semantics unchanged.

Do we have a high-confidence way to reproduce the issue?

Yes. Injecting a Git transport that stalls until TERM reproduces the unbounded setup condition, and the controlled after-fix run exercises all five extracted production steps.

Is this the best way to solve the issue?

Yes. Applying the repository’s existing bounded-process pattern directly to the only fallible network retrieval command is narrower and safer than adding retries, fallback sources, or new workflow configuration.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 122c6e4439cf.

Label changes

Label changes:

add P2: This is a focused maintainer-automation reliability fix with substantial wasted-runner impact but no end-user product outage.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR provides after-fix controlled terminal proof across all five production workflow steps, including timing, exit status, TERM observation, and watchdog avoidance.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR provides after-fix controlled terminal proof across all five production workflow steps, including timing, exit status, TERM observation, and watchdog avoidance.

Label justifications:

P2: This is a focused maintainer-automation reliability fix with substantial wasted-runner impact but no end-user product outage.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR provides after-fix controlled terminal proof across all five production workflow steps, including timing, exit status, TERM observation, and watchdog avoidance.
proof: sufficient: Contributor real behavior proof is sufficient. The PR provides after-fix controlled terminal proof across all five production workflow steps, including timing, exit status, TERM observation, and watchdog avoidance.

Evidence reviewed

PR surface:

Tests +17, Config 0. Total +17 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	0	0	0	0
Tests	1	17	0	+17
Docs	0	0	0	0
Config	5	5	5	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	22	5	+17

What I checked:

Current-main behavior: Current main still executes the Slack Crabbox shallow fetch without a process deadline, confirming that the reported automation hang remains possible. (.github/workflows/mantis-slack-desktop-smoke.yml:203, 122c6e4439cf)
Patch implementation: The PR applies timeout --signal=TERM --kill-after=10s 120s consistently to all five identified Crabbox clone or fetch commands without changing ref selection, checkout, build, or proof execution. (.github/workflows/mantis-telegram-live.yml:350, 0afcaa68799b)
Runner contract: The affected jobs run on Ubuntu 24.04 or Blacksmith Ubuntu 24.04 runners, where the GNU Coreutils timeout options used by the patch are appropriate. (.github/workflows/mantis-telegram-desktop-proof.yml:2258, 122c6e4439cf)
Regression coverage: The added assertion enumerates the two Discord, Slack, and two Telegram jobs and requires the bounded Git command in each Install Crabbox CLI step. (test/scripts/package-acceptance-workflow.test.ts:2735, 0afcaa68799b)
Real behavior proof: The PR body reports a controlled stalled-Git transport run for every production step: each received TERM, exited 124 in about 1.03 seconds under a scaled deadline, and avoided the outer watchdog; the repository Real behavior proof check also succeeded. (0afcaa68799b)
Repository precedent: Repository release history documents the same policy of sending KILL after a TERM grace period for wedged manual checkout fetches, supporting this fix shape rather than an unbounded retry or fallback. (appcast.xml, 122c6e4439cf)

Likely related people:

steipete: Recent repository history connects this person to checkout timeout hardening, release automation, and adjacent Mantis workflow maintenance. (role: recent CI timeout-pattern contributor; confidence: medium; files: .github/workflows/mantis-discord-status-reactions.yml, .github/workflows/mantis-discord-thread-attachment.yml, .github/workflows/mantis-slack-desktop-smoke.yml)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete · 2026-07-16T14:48:13Z

Maintainer review complete for head 2bf8f8fd5f63b7cd7730aef5fbde6f44c691bafd.

Best-fix verdict: the direct timeout around each fallible Crabbox Git retrieval is the clean owner-boundary fix. It preserves refs, build/install destinations, and proof behavior; a shared action or retry/fallback stack would add more surface without improving the hard bound.

Proof:

node scripts/run-vitest.mjs test/scripts/package-acceptance-workflow.test.ts --run --testNamePattern='bounds Mantis Crabbox source retrieval' — 1 passed, 79 skipped.
actionlint on all five changed Mantis workflows — passed.
git diff --check origin/main...HEAD — passed.
GNU timeout shell smoke — TERM case returned 124 in 1s; TERM-ignoring case returned 137 after KILL in 2s.
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main — clean; no accepted/actionable findings.
Exact-head CI — green: https://github.com/openclaw/openclaw/actions/runs/29507606720
Workflow Sanity — green: https://github.com/openclaw/openclaw/actions/runs/29507606963
Testbox check — green: https://github.com/openclaw/openclaw/actions/runs/29507606769
Testbox build artifacts — green: https://github.com/openclaw/openclaw/actions/runs/29507606817
ARM Testbox — green: https://github.com/openclaw/openclaw/actions/runs/29507606559

Known proof gaps: none for this workflow-only change.

steipete · 2026-07-16T14:49:13Z

Merged via squash.

Prepared head SHA: 2bf8f8fd5f63b7cd7730aef5fbde6f44c691bafd
Landed commit: 16c2bbb540ddbae6f9717797e41641cc24d223d0

…eout Cover all git fetch commands in the npm release workflow with a 120-second deadline and 10-second termination grace period, matching the pattern already applied to Mantis Crabbox workflows in openclaw#108940 (commit 16c2bbb). This includes the previously unbounded SHA-pinned origin/main fetch that ClawSweeper flagged as incomplete coverage. Fixes openclaw#109176

…eout Wrap all six git fetch commands with a 120-second deadline and 10-second termination grace period, matching the pattern established in openclaw#108940. Fixes openclaw#109176

## Summary - Problem: The `git clone` of `openclaw/docs.git` in `docs-sync-publish.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in #108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git clone` command. - What changed: Wrapped the `git clone` command with timeout, matching the bounded pattern from #108940. - What did NOT change: All retry logic, publish sync steps, and non-network operations remain unchanged. ## Real behavior proof - **Behavior addressed:** CI docs-sync-publish workflow could hang indefinitely during git clone of external docs repo. - **Real environment tested:** Pattern analysis and cross-reference with already-merged Crabbox fix (#108940 / 16c2bbb). - **Exact change:** `if timeout --signal=TERM --kill-after=10s 120s git clone \` replaces `if git clone \`. - **Evidence after fix:** Same `timeout --signal=TERM --kill-after=10s 120s` wrapper applied to Crabbox source retrieval. - **What was not tested:** Live CI run. ## Root Cause - The git clone was added before the timeout-bounding pattern was standardized across CI workflows. Missing automated check for unbounded external git operations.

## Summary - Problem: The `git fetch` in `macos-release.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in #108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git fetch` command. - What changed: Wrapped the `git fetch --no-tags origin` command with timeout. - What did NOT change: All release logic remains unchanged. ## Real behavior proof - **Behavior addressed:** CI macos-release could hang during git fetch. - **Evidence:** Same timeout pattern as merged Crabbox fix (#108940 / 16c2bbb). - **Change:** `timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags origin` replaces `git fetch --no-tags origin`. ## Root Cause - The git fetch was added before the timeout-bounding pattern was standardized across CI workflows.

## Summary - Problem: The `git clone` of `openclaw/docs.git` in `docs-sync-publish.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in openclaw#108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git clone` command. - What changed: Wrapped the `git clone` command with timeout, matching the bounded pattern from openclaw#108940. - What did NOT change: All retry logic, publish sync steps, and non-network operations remain unchanged. ## Real behavior proof - **Behavior addressed:** CI docs-sync-publish workflow could hang indefinitely during git clone of external docs repo. - **Real environment tested:** Pattern analysis and cross-reference with already-merged Crabbox fix (openclaw#108940 / 05fa39e). - **Exact change:** `if timeout --signal=TERM --kill-after=10s 120s git clone \` replaces `if git clone \`. - **Evidence after fix:** Same `timeout --signal=TERM --kill-after=10s 120s` wrapper applied to Crabbox source retrieval. - **What was not tested:** Live CI run. ## Root Cause - The git clone was added before the timeout-bounding pattern was standardized across CI workflows. Missing automated check for unbounded external git operations.

## Summary - Problem: The `git fetch` in `macos-release.yml` had no timeout bound, risking indefinite CI hangs on network stalls. Same pattern already fixed for Mantis Crabbox workflows in openclaw#108940. - Solution: Add `timeout --signal=TERM --kill-after=10s 120s` before the `git fetch` command. - What changed: Wrapped the `git fetch --no-tags origin` command with timeout. - What did NOT change: All release logic remains unchanged. ## Real behavior proof - **Behavior addressed:** CI macos-release could hang during git fetch. - **Evidence:** Same timeout pattern as merged Crabbox fix (openclaw#108940 / 05fa39e). - **Change:** `timeout --signal=TERM --kill-after=10s 120s git fetch --no-tags origin` replaces `git fetch --no-tags origin`. ## Root Cause - The git fetch was added before the timeout-bounding pattern was standardized across CI workflows.

…#109176) * fix(ci): bound all openclaw-npm-release git fetch operations with timeout Wrap all six git fetch commands with a 120-second deadline and 10-second termination grace period, matching the pattern established in #108940. Fixes #109176 * test(ci): cover npm release fetch deadlines Co-authored-by: wanyongstar <[email protected]> * ci: raise Control UI startup budget Unblock exact-head builds after the compressed startup bundle reached the previous 370 KiB ratchet. * ci: drop superseded Control UI budget bump Current main now carries the smaller 340 KiB startup ratchet from #110528, so remove the temporary 372 KiB adjustment while keeping the PR head conflict-free. --------- Co-authored-by: Peter Steinberger <[email protected]>

…openclaw#109176) * fix(ci): bound all openclaw-npm-release git fetch operations with timeout Wrap all six git fetch commands with a 120-second deadline and 10-second termination grace period, matching the pattern established in openclaw#108940. Fixes openclaw#109176 * test(ci): cover npm release fetch deadlines Co-authored-by: wanyongstar <[email protected]> * ci: raise Control UI startup budget Unblock exact-head builds after the compressed startup bundle reached the previous 370 KiB ratchet. * ci: drop superseded Control UI budget bump Current main now carries the smaller 340 KiB startup ratchet from openclaw#110528, so remove the temporary 372 KiB adjustment while keeping the PR head conflict-free. --------- Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added the size: XS label Jul 16, 2026

steipete self-assigned this Jul 16, 2026

fix(mantis): bound Crabbox source checkout

2bf8f8f

steipete force-pushed the fix/problem-mantis-crabbox-checkout-deadline branch from 0afcaa6 to 2bf8f8f Compare July 16, 2026 14:39

steipete merged commit 16c2bbb into openclaw:main Jul 16, 2026
100 checks passed

github-actions Bot mentioned this pull request Jul 16, 2026

📡 Upstream Digest — 2026-07-16 15:27 UTC curtismercier/openclaw-mods#1313

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 17, 2026

fix(mantis): bound Crabbox source checkout (openclaw#108940)

05fa39e

This was referenced Jul 17, 2026

fix(ci): bound docs-agent git fetch operations with timeout #110026

Merged

fix(ci): bound linux-app-release git fetch with timeout #110027

Merged

fix(ci): bound release-checks git fetch operations with timeout #110028

Merged

This was referenced Jul 18, 2026

fix(ci): bound plugin-npm-release git fetch and npm publish with timeout #110279

Merged

fix(ci): bound ci.yml git fetch operations with timeout #110281

Merged

wanyongstar mentioned this pull request Jul 18, 2026

fix(ci): bound qa-profile-evidence git fetch operations with timeout #110282

Merged

This was referenced Jul 18, 2026

fix(ci): bound plugin-clawhub-release git fetch with timeout #110736

Open

fix(ci): bound mantis-discord-smoke git fetches with timeout #110851

Open

wanyongstar mentioned this pull request Jul 19, 2026

fix(ci): bound qa-live-transports-convex git fetch with timeout #111357

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(mantis): stop Crabbox setup hanging on stalled checkout#108940

fix(mantis): stop Crabbox setup hanging on stalled checkout#108940
steipete merged 1 commit into
openclaw:mainfrom
zhangguiping-xydt:fix/problem-mantis-crabbox-checkout-deadline

zhangguiping-xydt commented Jul 16, 2026

Uh oh!

clawsweeper Bot commented Jul 16, 2026

Uh oh!

steipete commented Jul 16, 2026

Uh oh!

Uh oh!

steipete commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

zhangguiping-xydt commented Jul 16, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jul 16, 2026

Uh oh!

steipete commented Jul 16, 2026

Uh oh!

Uh oh!

steipete commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants