fix(cron): preserve auth prompts in truncated command results by qingminglong · Pull Request #96370 · openclaw/openclaw

qingminglong · 2026-06-24T10:05:24Z

What Problem This Solves

Cron command output can be truncated before an interactive auth/setup prompt reaches the visible result. That makes device-code login flows hard to complete because the operator may lose the login URL, code, or next-action instruction.

Why This Change Was Made

This PR was rewritten as a minimal fix on top of current main. It keeps the normal command output cap, but lets the process runner preserve a small bounded set of important auth/setup lines when truncation happens.

The cron command runner uses those preserved lines only for the interactive/operator summary. Non-interactive delivery paths keep using a separate delivery summary so webhook, announce, and plugin hook messages stay bounded and do not inherit the expanded interactive text. Failed completion webhooks keep the existing omission boundary and do not include command summaries, diagnostics, or embedded diagnostic state.

User Impact

Interactive cron command results keep device-code/login prompts visible even when noisy command output is truncated.
Non-critical noisy output is still truncated as before.
Webhook/announce/plugin-hook delivery continues to use the compact delivery summary rather than the interactive result summary.
Failed completion webhooks continue to omit command summaries and diagnostics.

Evidence

node scripts/run-vitest.mjs src/gateway/server-cron.test.ts src/cron/command-runner.test.ts -> passed, 2 Vitest shards, 62 tests total.
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test-local-pr96370.tsbuildinfo --pretty false -> passed.
node_modules/.bin/oxfmt.CMD --check --threads=1 src/gateway/server-cron-notifications.ts src/gateway/server-cron.ts src/gateway/server-cron.test.ts -> passed.
node_modules/.bin/oxlint.CMD --tsconfig config/tsconfig/oxlint.core.json src/gateway/server-cron-notifications.ts src/gateway/server-cron.ts src/gateway/server-cron.test.ts -> passed.
git diff --check -> passed.

Redacted behavior proof from the focused cron command run:

command cron child process output included an early auth prompt:
  Open [REDACTED_LOGIN_URL] and enter the code [REDACTED_CODE].
  ... noisy output omitted by outputMaxBytes ...
  tail marker

operator/run-history state after the successful run:
  lastDiagnosticSummary contains [REDACTED_LOGIN_URL] and [REDACTED_CODE]

successful webhook payload after the run:
  summary contains: tail marker
  summary does not contain: [REDACTED_LOGIN_URL]
  diagnostics.summary contains: tail marker
  diagnostics.entries[0].message: command result details summarized for external delivery
  embedded job.state.lastDiagnostics: omitted
  embedded job.state.lastDiagnosticSummary: omitted

cron_changed hook event after the run:
  summary contains: hook tail marker
  summary does not contain: [REDACTED_LOGIN_URL]

failed command completion webhook after the run:
  summary: omitted
  diagnostics: omitted
  embedded job.state.lastDiagnostics: omitted
  embedded job.state.lastDiagnosticSummary: omitted
  stored operator/run-history state still contains [REDACTED_LOGIN_URL] and [REDACTED_CODE]

Note: corepack pnpm exec oxfmt --check ... was replaced with the direct local oxfmt.CMD binary in the Codex worktree because pnpm attempted dependency reconciliation and aborted without a TTY before running oxfmt.

clawsweeper · 2026-06-24T10:20:14Z

Thanks for the context here. I swept through the related work, and this is now duplicate or superseded.

Close as superseded: this branch is useful and the current head fixed the earlier failed-webhook blocker, but the open sibling PR is the stronger canonical landing path because it covers the same preservation bug plus external delivery redaction with exact-head proof.

Root-cause cluster
Relationship: superseded
Canonical: #96393
Summary: This PR is a useful duplicate fix candidate for the cron command truncation bug, but the sibling PR is the viable canonical branch with stronger proof and external delivery redaction.

Members:

canonical: fix(cron): preserve action-required command output #96393 - Open, mergeable, proof-positive sibling PR that covers the same preservation bug and the redacted external delivery boundary.
fixed_by_candidate: Async/cron command results can drop action-critical auth/setup prompt lines during output truncation #96346 - The open issue describes the exact cron command auth/setup prompt truncation behavior fixed by the canonical PR.
duplicate: Async/cron command results can drop action-critical auth/setup prompt lines during output truncation #96343 - Earlier closed report with the same body class and same device-code truncation behavior.
same_root_cause: fix(cron): preserve action-critical command output #96358 - Open draft sibling PR for the same action-critical cron command output preservation root cause.
same_root_cause: fix(exec): preserve action-critical auth/setup prompt lines during output truncation #96365 - Open sibling PR targeting the same runCommandWithTimeout truncation behavior with a preservation classifier.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Canonical path: Use the proof-positive sibling PR as the canonical fix if maintainers accept its operator-history versus redacted-external-delivery boundary, then close the remaining duplicate preservation PRs.

So I’m closing this here because the remaining work is already tracked in the canonical issue.

Review details

Best possible solution:

Use the proof-positive sibling PR as the canonical fix if maintainers accept its operator-history versus redacted-external-delivery boundary, then close the remaining duplicate preservation PRs.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main tail-truncates command output in src/process/exec.ts and runCronCommandJob summarizes only the retained tail, while the linked issue gives a concrete synthetic device-code repro.

Is this the best way to solve the issue?

No for this PR as the landing path. It is a plausible fix, but the sibling PR is the better canonical solution because it keeps the bounded preservation behavior and adds explicit redaction for external delivery.

Security review:

Security review cleared: No concrete supply-chain defect was found in this branch; the security-boundary reason to close is that the canonical sibling has stronger external redaction coverage.

AGENTS.md: found and applied where relevant.

What I checked:

Repository policy read: Root AGENTS.md was read fully; its deep PR review, best-fix, proof, compatibility, and delivery-boundary rules affected this review. (AGENTS.md:18, 4010b81a77f4)
Scoped gateway policy read: The scoped gateway guide was read fully because the PR changes cron webhook and hook delivery paths. (src/gateway/AGENTS.md:1, 4010b81a77f4)
Current main source reproduction: Current main tail-truncates process output in appendCapturedOutput and runCronCommandJob builds the summary from that already-truncated stdout/stderr, so early auth/setup prompt lines can be lost. (src/process/exec.ts:255, 4010b81a77f4)
This PR's current diff: The current PR head adds preserved output lines and a deliverySummary split, and its latest patch restores the failed error webhook omission path noted in the previous review. (src/gateway/server-cron-notifications.ts:105, dd9d611865b8)
Canonical sibling diff: The sibling PR adds a shared cron command summary helper and redacts action-required URLs, codes, and token assignments for external delivery rather than relying only on a tail-only deliverySummary projection. (src/cron/command-output-summary.ts:1, 024cb8d120c1)
Canonical sibling viability: Live GitHub metadata shows the sibling PR is open, mergeable, maintainer-editable, labeled proof sufficient, and has clean merge state. (024cb8d120c1)

Likely related people:

mbelinky: Introduced command-backed cron jobs and the command runner/process execution surface affected by the truncation behavior. (role: feature introducer; confidence: high; commits: b8adc11977ab; files: src/cron/command-runner.ts, src/process/exec.ts, src/gateway/server-cron.ts)
joshavant: Added the failed cron webhook summary omission boundary that both this branch and the canonical sibling need to preserve. (role: recent webhook boundary contributor; confidence: high; commits: 1d172637d6dd; files: src/gateway/server-cron-notifications.ts)
vincentkoc: Recent commits touched process timeout behavior and adjacent cron failure-destination delivery paths near the affected surfaces. (role: recent process and cron delivery contributor; confidence: medium; commits: 1425bb3a0318, 28b374a8a7f6; files: src/process/exec.ts, src/gateway/server-cron-notifications.ts)

Codex review notes: model internal, reasoning high; reviewed against 4010b81a77f4.

qingminglong · 2026-06-27T14:34:44Z

@clawsweeper re-review

clawsweeper · 2026-06-27T14:34:47Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

qingminglong · 2026-06-27T14:46:07Z

@clawsweeper re-review

clawsweeper · 2026-06-27T14:46:10Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

qingminglong · 2026-06-27T14:52:57Z

@clawsweeper re-review

clawsweeper · 2026-06-27T14:53:00Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

clawsweeper · 2026-06-27T15:02:57Z

ClawSweeper applied the proposed close for this PR.

Action: closed this PR.
Close reason: duplicate or superseded.
Evidence: durable ClawSweeper review.
Coverage proof: PR B clearly implements the same core cron truncation fix and is the better current canonical review target because it also covers PR A's remaining compatibility, message-delivery, and security-boundary concerns with stronger redaction and proof. Covering PR: fix(cron): preserve action-required command output #96393.

openclaw-barnacle Bot added gateway Gateway runtime size: M labels Jun 24, 2026

clawsweeper Bot mentioned this pull request Jun 24, 2026

fix(cron): preserve action-required command output #96393

Merged

clawsweeper Bot added the merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. label Jun 25, 2026

qingminglong force-pushed the fix/96343-preserve-auth-prompts branch from 245166e to ff44a30 Compare June 25, 2026 14:03

fix(cron): preserve auth prompts in truncated output

8cce141

qingminglong force-pushed the fix/96343-preserve-auth-prompts branch from ff44a30 to 8cce141 Compare June 25, 2026 15:06

openclaw-barnacle Bot added the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jun 25, 2026

clawsweeper Bot added status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. and removed status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 27, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jun 27, 2026

qingminglong force-pushed the fix/96343-preserve-auth-prompts branch from ffa752e to 9d6c8e7 Compare June 27, 2026 14:45

fix(cron): sanitize command delivery summaries

dd9d611

qingminglong force-pushed the fix/96343-preserve-auth-prompts branch from 9d6c8e7 to dd9d611 Compare June 27, 2026 14:52

openclaw-barnacle Bot removed the size: M label Jun 27, 2026

openclaw-barnacle Bot added the size: L label Jun 27, 2026

clawsweeper Bot closed this Jun 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(cron): preserve auth prompts in truncated command results#96370

fix(cron): preserve auth prompts in truncated command results#96370
qingminglong wants to merge 2 commits into
openclaw:mainfrom
qingminglong:fix/96343-preserve-auth-prompts

qingminglong commented Jun 24, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

qingminglong commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

clawsweeper Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

qingminglong commented Jun 27, 2026

Uh oh!

clawsweeper Bot commented Jun 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented Jun 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

qingminglong commented Jun 24, 2026 •

edited

Loading

clawsweeper Bot commented Jun 24, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 27, 2026 •

edited

Loading