Skip to content

fix(cron): preserve action-required command output#96393

Merged
obviyus merged 3 commits into
openclaw:mainfrom
snowzlmbot:fix/cron-action-critical-summary
Jul 1, 2026
Merged

fix(cron): preserve action-required command output#96393
obviyus merged 3 commits into
openclaw:mainfrom
snowzlmbot:fix/cron-action-critical-summary

Conversation

@snowzlmbot

@snowzlmbot snowzlmbot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

What Problem This Solves

Fixes #96346.

Cron command jobs currently keep only the tail of captured stdout/stderr when outputMaxBytes is exceeded. That is usually fine for failures, but it breaks command flows where the actionable line appears near the start and the command later emits noisy output. Device-login and setup commands commonly print a URL/code first, then verbose logs; the cron run summary, run log, announce delivery, and completion webhook can then lose the only line the operator needs.

Summary

  • Adds an opt-in output preservation hook to runCommandWithTimeout() without changing default exec capture behavior.
  • Uses that hook only for cron command jobs to preserve action-required lines such as device/login/auth code instructions even when the tail capture truncates them.
  • Builds cron command summaries with an action-required output preserved: block before the bounded stdout/stderr tail.
  • Keeps run logs and diagnostics useful for operator recovery.
  • Redacts preserved action-required URLs/codes before command summaries are sent through cron announce, successful completion webhook, or cron_changed hook delivery.
  • Preserves the current failed completion webhook security boundary: failed webhook payloads omit summary, diagnostics, job.state.lastDiagnosticSummary, and job.state.lastDiagnostics.
  • Keeps the fix cron-scoped: ordinary exec/tool calls still use the existing tail-bound capture behavior unless they explicitly opt into preserved lines.

Maintainer Decision Boundary

This branch is proposed as the canonical fix for #96346.

  • Behavior change is scoped to cron command jobs.
  • Operator-facing cron run history and diagnostics retain unredacted preserved action-required lines for recovery.
  • External delivery projections redact command action-required output for announce, successful completion webhook payloads, completion webhook diagnostics entries, and cron_changed hook summaries.
  • Successful command completion webhook payloads also strip persisted command diagnostic state from embedded job snapshots.
  • Failed completion webhook payloads continue to omit summaries and diagnostics entirely, including persisted diagnostic state on embedded job snapshots.
  • Non-command cron summaries remain unchanged.
  • The exec helper API change is additive and opt-in; existing callers retain the previous tail-only capture behavior.
  • After this PR lands, sibling preservation candidates for Async/cron command results can drop action-critical auth/setup prompt lines during output truncation #96346 can be closed or superseded in favor of this canonical branch.

Security / Delivery Boundary

The preserved action lines are intended for operator-facing cron history and diagnostics. They may include setup URLs or auth/device codes, so this PR does not blindly broadcast the unredacted text through cron delivery:

  • cron run summary / diagnostics keep the actionable line for operator recovery
  • cron announce delivery uses a redacted command summary
  • successful cron completion webhook payloads use a redacted command summary, diagnostics summary, and diagnostics entries, and omit persisted command diagnostic state from embedded job snapshots
  • failed cron completion webhook payloads omit summary and diagnostics, and also omit persisted diagnostic state from embedded job snapshots
  • cron_changed hook events use a redacted command summary for command jobs
  • non-command cron jobs are unchanged

Evidence

Current head: 024cb8d120c197ffee5a663a552abbd9ca0b44c8

Latest focused validation:

Earlier focused validation after rebasing on upstream/main at head 4b142a7f262ad5eef78714e8a2c96f1afaadd4c6:

  • pnpm docs:list — passed
  • git diff --check — passed
  • node scripts/run-vitest.mjs src/gateway/server-cron-notifications.test.ts src/cron/command-output-summary.test.ts — passed
    • src/gateway/server-cron-notifications.test.ts: 8 tests passed across gateway shards
    • src/cron/command-output-summary.test.ts: 4 tests passed

Regression coverage added or retained:

  • src/process/exec.test.ts verifies preserved lines survive tail truncation and long no-newline output remains bounded.
  • src/cron/command-runner.test.ts verifies an early Visit ... enter code ... line appears in cron command summary even when outputMaxBytes keeps only the final tail.
  • src/cron/command-output-summary.test.ts verifies summary prepending plus external redaction for URLs, separated codes, numeric codes, unseparated codes, and token/password/secret assignments, including webhook diagnostics entries.
  • src/gateway/server-cron-notifications.test.ts verifies successful command completion webhooks redact URL/code/token material from summary, diagnostics.summary, and diagnostics.entries[].message.
  • src/gateway/server-cron-notifications.test.ts verifies successful command completion webhooks strip embedded job.state.lastDiagnostics and job.state.lastDiagnosticSummary before external delivery.
  • src/gateway/server-cron-notifications.test.ts verifies failed command completion webhooks omit preserved action lines, diagnostics entries, raw codes, token assignments, and persisted job diagnostic state.
  • src/gateway/server-cron.test.ts verifies cron_changed plugin hook events receive a delivery-safe redacted command summary for command jobs and keep non-command summaries unchanged.

Real Behavior Proof

Current exact-head cron behavior proof: https://github.com/snowzlmbot/openclaw/actions/runs/28211403445

Head: 024cb8d120c197ffee5a663a552abbd9ca0b44c8

Artifact: cron-action-critical-summary-proof-024cb8d120c197ffee5a663a552abbd9ca0b44c8

This proof checks out the exact PR head, runs an actual cron command job with an early device-login style line, numeric verification code, and token assignment plus noisy tail output, then verifies both operator summary preservation and external-delivery redaction for the preserved URL/code/token material. It also runs the focused gateway/cron/process regression set on the exact head.

Proof summary:

targetSha=024cb8d120c197ffee5a663a552abbd9ca0b44c8
status=ok
summaryContainsActionLine=true
redactedContainsRawUrl=false
redactedContainsRawCode=false
redactedContainsRawToken=false
PASS: exact PR head SHA is recorded
PASS: cron command exits successfully
PASS: summary preserves early action-required output
PASS: summary keeps bounded captured tail
PASS: diagnostics mark truncated output
PASS: external delivery summary redacts URL
PASS: external delivery summary redacts code
PASS: external delivery summary omits raw URL
PASS: external delivery summary omits raw code
PASS: external delivery summary masks token assignment
PASS: external delivery summary omits raw token value

Focused regression proof log:

src/gateway/server-cron.test.ts — 54 tests passed across gateway shards
src/gateway/server-cron-notifications.test.ts — 8 tests passed across gateway shards
src/cron/command-runner.test.ts — 8 tests passed
src/cron/command-output-summary.test.ts — 4 tests passed
src/process/exec.test.ts — 17 tests passed

The repository PR proof gate also passed for the same head: https://github.com/openclaw/openclaw/actions/runs/28191420047

Risk

Low-to-moderate. The exec API grows an optional preservation hook, but default behavior is unchanged. The behavior change is scoped to cron command jobs, and both captured output plus preserved partial-line scanning remain bounded. External-delivery redaction is command-job gated and covers URL, separated-code, numeric-code, unseparated-code, and token/password/secret assignment shapes, so non-command cron summaries remain unchanged. Failed completion webhook payloads keep the stricter current-main omission behavior for summaries and diagnostics.

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: M labels Jun 24, 2026
@clawsweeper

clawsweeper Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 25, 2026, 9:51 PM ET / 01:51 UTC.

Summary
The PR adds a bounded opt-in preserved-output hook for cron command jobs and redacts preserved action-required output before cron announce, completion webhook, and cron_changed delivery.

PR surface: Source +300, Tests +435. Total +735 across 10 files.

Reproducibility: yes. source inspection gives a high-confidence current-main reproduction path: command output is tail-truncated in runCommandWithTimeout and runCronCommandJob summarizes only that tail. I did not run a failing current-main cron job in this read-only review, but the linked issue and exact-head proof cover the same synthetic device-code flow.

Review metrics: 2 noteworthy metrics.

  • Exec Capture API Expansion: 2 option fields added, 2 result fields added. runCommandWithTimeout gains opt-in preservation inputs and outputs, so maintainers should confirm existing callers remain default tail-only.
  • External Delivery Projections: 4 projections changed. Announce, completion webhook summary/diagnostics, embedded job diagnostic state, and cron_changed summaries now receive delivery-safe command output.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #96346
Summary: This PR is a strong candidate fix for the open canonical cron command truncation issue; sibling PRs address the same root cause but remain unmerged and weaker proof-wise.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster ✨ media proof bonus
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] Merging intentionally changes existing cron command announce, completion webhook, diagnostics-entry, and cron_changed payload text by replacing action-required URLs/codes/tokens with placeholders for external consumers.
  • [P1] The fix intentionally keeps raw action-required command output in operator run history and diagnostics while redacting external delivery, so maintainers should explicitly accept that security boundary before merge.
  • [P1] Several open sibling PRs target the same canonical cron truncation issue; maintainers should choose this branch or another canonical branch before closing/superseding the rest.

Maintainer options:

  1. Land As Canonical After Boundary Sign-Off (recommended)
    Maintainers can accept this PR as the canonical fix, land it with the documented redaction/operator-history boundary, and then close or supersede the sibling preservation PRs.
  2. Require A Narrow Boundary Adjustment
    If maintainers want different raw-output retention or external redaction semantics, ask for that concrete adjustment before merge because the current code otherwise appears repair-complete.
  3. Pause For Canonical Branch Selection
    If the branch choice is not settled, pause this PR and compare it against the sibling preservation PRs before changing public delivery behavior.

Next step before merge

  • [P2] Human maintainer review is needed to accept the security/delivery boundary and canonical branch choice; there is no narrow automated repair left.

Security
Cleared: No concrete security or supply-chain defect was found in the diff; the remaining security-boundary question is maintainer acceptance of raw operator diagnostics versus redacted external delivery.

Review details

Best possible solution:

Land this branch only after a maintainer accepts it as the canonical fix and explicitly owns the operator-visible raw diagnostics versus redacted external delivery boundary.

Do we have a high-confidence way to reproduce the issue?

Yes, source inspection gives a high-confidence current-main reproduction path: command output is tail-truncated in runCommandWithTimeout and runCronCommandJob summarizes only that tail. I did not run a failing current-main cron job in this read-only review, but the linked issue and exact-head proof cover the same synthetic device-code flow.

Is this the best way to solve the issue?

Yes, this looks like the best current fix shape: the preservation hook is bounded and opt-in, cron command summaries own the preserved block, and external redaction is applied at the delivery boundaries. A global exec-output behavior change or a redaction-only branch would be either too broad or incomplete.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 6830aa39eaa1.

Label changes

Label justifications:

  • P1: The PR addresses a user-facing cron command workflow where auth/setup prompts can become unactionable when early command output is truncated.
  • merge-risk: 🚨 compatibility: External consumers of cron command summaries may observe placeholders instead of raw action-required URL/code/token text after merge.
  • merge-risk: 🚨 message-delivery: The diff changes cron announce, completion webhook, diagnostics-entry, and cron_changed payload text for command jobs.
  • merge-risk: 🚨 security-boundary: The PR intentionally separates raw operator diagnostics from redacted external delivery for potentially sensitive auth/setup output.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (linked_artifact): The PR body links an exact-head GitHub Actions proof, and the downloaded artifact shows a real cron command job preserving early action-required output while redacting URL/code/token material for external delivery.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body links an exact-head GitHub Actions proof, and the downloaded artifact shows a real cron command job preserving early action-required output while redacting URL/code/token material for external delivery.
Evidence reviewed

PR surface:

Source +300, Tests +435. Total +735 across 10 files.

View PR surface stats
Area Files Added Removed Net
Source 5 321 21 +300
Tests 5 437 2 +435
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 10 758 23 +735

What I checked:

  • Repository policy read: Root AGENTS.md and the scoped gateway AGENTS.md were read fully; their deep PR review, Gateway boundary, proof, and merge-risk guidance shaped this review. (AGENTS.md:18, 6830aa39eaa1)
  • Current main root cause: Current main keeps only the newest bytes in appendCapturedOutput and runCronCommandJob builds the summary directly from result.stdout/result.stderr, so early action-required command output can be lost before cron presentation. (src/process/exec.ts:255, 6830aa39eaa1)
  • PR preserves bounded action lines: At PR head, runCommandWithTimeout adds preserveOutputLine/maxPreservedOutputLines and returns preserved stdout/stderr lines while still retaining the existing tail capture; runCronCommandJob opts in only for cron command jobs. (src/process/exec.ts:236, 024cb8d120c1)
  • PR redacts external delivery: At PR head, command cron events are projected through redactCommandCronEventForExternalDelivery for completion webhooks, announce delivery uses the redacted command summary, and cron_changed hook events receive the redacted summary for command jobs. (src/gateway/server-cron-notifications.ts:55, 024cb8d120c1)
  • Focused regression coverage: PR-head tests cover preserved early command output, URL/code/token redaction, webhook diagnostics entries, nested job diagnostic stripping, failed webhook omission, cron_changed redaction, and bounded no-newline preservation. (src/gateway/server-cron-notifications.test.ts:124, 024cb8d120c1)
  • Real behavior proof: The downloaded proof artifact records targetSha 024cb8d, a successful real cron command run preserving the early action-required line, external summary redaction of URL/code/token material, and 91 focused tests passing across gateway, cron, and process shards. (024cb8d120c1)

Likely related people:

  • mbelinky: Introduced command-backed cron jobs and the cron command runner in the merged feature commit that created the affected command-job surface. (role: feature introducer; confidence: high; commits: b8adc11977ab; files: src/cron/command-runner.ts, src/process/exec.ts, src/gateway/server-cron.ts)
  • vincentkoc: Recent path history shows multiple process timeout/output-capture changes and a cron webhook/failure-destination fix near the affected execution and delivery surfaces. (role: recent process and cron delivery contributor; confidence: high; commits: 8ba71e4afffc, 1425bb3a0318, 28b374a8a7f6; files: src/process/exec.ts, src/gateway/server-cron-notifications.ts)
  • joshavant: Recent server-cron-notifications history includes the failed-webhook summary omission commit that defines part of the security boundary this PR preserves. (role: recent webhook security-boundary contributor; confidence: medium; commits: 1d172637d6dd; files: src/gateway/server-cron-notifications.ts)
  • steipete: Path history shows earlier cron notification routing and SQLite runtime refactors that shape the current cron run history and notification boundaries. (role: cron storage and notification refactor contributor; confidence: medium; commits: 85148f3b2099, 2bd07eead7e7; files: src/gateway/server-cron-notifications.ts, src/gateway/server-cron.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jun 24, 2026
@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from 31332d0 to 32660cd Compare June 24, 2026 12:05
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 24, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 24, 2026
Closed
@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from 32660cd to 533af0b Compare June 24, 2026 12:12
@clawsweeper clawsweeper Bot added status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 24, 2026
@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from 533af0b to 7b3338f Compare June 24, 2026 12:24
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 24, 2026
@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from 7b3338f to d2bee62 Compare June 24, 2026 12:32
@snowzlmbot

snowzlmbot commented Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Updated the branch for the two remaining review blockers and refreshed exact-head proof.

Changes since the previous review:

  • Redacts www. action URLs with the same external-delivery sanitizer used for http(s) URLs.
  • Projects cron_changed hook events through the delivery-safe redacted command summary, while preserving unredacted operator run history/diagnostics.
  • Added focused coverage for cron_changed hook redaction and www. URL redaction.
  • Fixed changed-file check-test-types failure.

Latest head: d2bee628cc426f34b483843e565ec5aa82e14d49

Proof run: https://github.com/snowzlmbot/openclaw/actions/runs/28098700552
Artifact: cron-action-critical-summary-proof-d2bee628cc426f34b483843e565ec5aa82e14d49

The proof records the exact head, preserves the early www. action-required output, redacts the preserved URL/code for external delivery, and includes the focused regression log covering:

  • src/gateway/server-cron.test.ts
  • src/gateway/server-cron-notifications.test.ts
  • src/process/exec.test.ts
  • src/cron/command-runner.test.ts
  • src/cron/command-output-summary.test.ts

The PR body has been updated with the latest head/proof details.

@clawsweeper review-pr

@clawsweeper

clawsweeper Bot commented Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from d2bee62 to 3ae423e Compare June 24, 2026 12:53
@clawsweeper clawsweeper Bot added status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 24, 2026
@snowzlmbot

snowzlmbot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Updated the PR body to make the remaining maintainer decision boundary explicit.

Added a focused Maintainer Decision Boundary section covering:

No production code changes in this update; this addresses the latest review's remaining compatibility/security-boundary and canonical-branch-selection decision points in the PR body.

@clawsweeper review-pr

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 25, 2026
@snowzlmbot
snowzlmbot force-pushed the fix/cron-action-critical-summary branch from f53f72f to 4b142a7 Compare June 25, 2026 06:02
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jun 25, 2026
@snowzlmbot

snowzlmbot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Updated the branch for the latest review blocker and refreshed the PR body for the rebased head.

Changes in head 4b142a7f262ad5eef78714e8a2c96f1afaadd4c6:

  • Rebases cleanly on latest upstream/main; GitHub reports the PR mergeable after the push.
  • Preserves current-main failed completion webhook security behavior by sending completion webhooks through buildCronFinishedWebhookPayload() after command-summary redaction, so failed payloads still omit summary, diagnostics, and persisted job diagnostic state.
  • Adds focused unit coverage proving failed command completion webhooks do not include preserved action lines, diagnostics entries, raw codes, or token assignments.
  • Updates the PR body with the new head, the failed-webhook boundary, and the latest exact-head proof run.

Validation:

@clawsweeper review-pr

@clawsweeper

clawsweeper Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

@clawsweeper

clawsweeper Bot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jun 25, 2026
@snowzlm

snowzlm commented Jun 25, 2026

Copy link
Copy Markdown
Contributor

Fixed the remaining blocker: successful command completion webhooks now strip nested job.state.lastDiagnostics and job.state.lastDiagnosticSummary for command jobs too.

Validation:

  • node scripts/run-vitest.mjs src/gateway/server-cron-notifications.test.ts
  • git diff --check

@clawsweeper review-pr

@snowzlmbot

snowzlmbot commented Jun 25, 2026

Copy link
Copy Markdown
Contributor Author

Updated the branch for the remaining ClawSweeper P1 security blocker and refreshed the PR body for the new head.

Changes in head 024cb8d120c197ffee5a663a552abbd9ca0b44c8:

  • Successful command completion webhooks now strip embedded job.state.lastDiagnostics and job.state.lastDiagnosticSummary from evt.job.state before external delivery.
  • The existing failed-webhook boundary remains intact: failed payloads still omit top-level summary / diagnostics and nested persisted diagnostic state.
  • Added focused coverage with a successful evt.job.state snapshot containing preserved action-required output, numeric code, and token-like material.

Validation:

@clawsweeper review-pr

@clawsweeper

clawsweeper Bot commented Jun 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@snowzlmbot

snowzlmbot commented Jun 26, 2026

Copy link
Copy Markdown
Contributor Author

Updated the PR body with the current exact-head cron behavior proof requested in the latest review.

Added evidence for head 024cb8d120c197ffee5a663a552abbd9ca0b44c8:

No code changes in this update; this is the requested proof/body refresh for the current head.

@clawsweeper review-pr

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 26, 2026
@obviyus

obviyus commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Landed via rebase onto main.

  • Scoped tests: node scripts/run-vitest.mjs src/process/exec.test.ts src/cron/command-runner.test.ts src/cron/command-output-summary.test.ts src/gateway/server-cron-notifications.test.ts src/gateway/server-cron.test.ts — passed
  • Diff check: git diff --check origin/main...HEAD — passed
  • Autoreview: clean, no accepted/actionable findings
  • Changelog: skipped; release generation owns CHANGELOG.md
  • Land commit: 13be30a
  • Merge commit: fc5ba0e

Thanks @snowzlmbot!

This was referenced Jul 1, 2026
Closed
Closed
This was referenced Jul 1, 2026
Merged
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@obviyus obviyus

Labels

gateway Gateway runtime merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P1 High-priority user-facing bug, regression, or broken workflow. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Async/cron command results can drop action-critical auth/setup prompt lines during output truncation

3 participants

@snowzlmbot @snowzlm @obviyus