remoteclaw
diff --git a/‎apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift‎
Lines changed: 3 additions & 3 deletions b/‎apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎src/agents/auth-profiles/types.ts‎
Lines changed: 1 addition & 0 deletions b/‎src/agents/auth-profiles/types.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎src/agents/cli-runner.test.ts‎
Lines changed: 44 additions & 0 deletions b/‎src/agents/cli-runner.test.ts‎
Lines changed: 44 additions & 0 deletions
@@ -22,17 +22,17 @@ enum HostEnvSecurityPolicy {
         "PS4",
         "GCONV_PATH",
         "IFS",
-        "SSLKEYLOGFILE",
+        "SSLKEYLOGFILE"
     ]
 
     static let blockedOverrideKeys: Set<String> = [
         "HOME",
-        "ZDOTDIR",
+        "ZDOTDIR"
     ]
 
     static let blockedPrefixes: [String] = [
         "DYLD_",
         "LD_",
-        "BASH_FUNC_",
+        "BASH_FUNC_"
     ]
 }
@@ -43,6 +43,7 @@ export type AuthProfileFailureReason =
   | "billing"
   | "timeout"
   | "model_not_found"
+  | "session_expired"
   | "unknown";
 
 /** Per-profile usage statistics for round-robin and cooldown tracking */
 
@@ -153,6 +153,50 @@ describe("runCliAgent with process supervisor", () => {
     ).rejects.toThrow("exceeded timeout");
   });
 
+  it("rethrows the retry failure when session-expired recovery retry also fails", async () => {
+    supervisorSpawnMock.mockResolvedValueOnce(
+      createManagedRun({
+        reason: "exit",
+        exitCode: 1,
+        exitSignal: null,
+        durationMs: 150,
+        stdout: "",
+        stderr: "session expired",
+        timedOut: false,
+        noOutputTimedOut: false,
+      }),
+    );
+    supervisorSpawnMock.mockResolvedValueOnce(
+      createManagedRun({
+        reason: "exit",
+        exitCode: 1,
+        exitSignal: null,
+        durationMs: 150,
+        stdout: "",
+        stderr: "rate limit exceeded",
+        timedOut: false,
+        noOutputTimedOut: false,
+      }),
+    );
+
+    await expect(
+      runCliAgent({
+        sessionId: "s1",
+        sessionKey: "agent:main:subagent:retry",
+        sessionFile: "/tmp/session.jsonl",
+        workspaceDir: "/tmp",
+        prompt: "hi",
+        provider: "codex-cli",
+        model: "gpt-5.2-codex",
+        timeoutMs: 1_000,
+        runId: "run-retry-failure",
+        cliSessionId: "thread-123",
+      }),
+    ).rejects.toThrow("rate limit exceeded");
+
+    expect(supervisorSpawnMock).toHaveBeenCalledTimes(2);
+  });
+
   it("falls back to per-agent workspace when workspaceDir is missing", async () => {
     const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "openclaw-cli-runner-"));
     const fallbackWorkspace = path.join(tempDir, "workspace-main");
Original file line number	Diff line number	Diff line change
`@@ -22,17 +22,17 @@ enum HostEnvSecurityPolicy {`
`22`	`22`	`"PS4",`
`23`	`23`	`"GCONV_PATH",`
`24`	`24`	`"IFS",`
`25`		`- "SSLKEYLOGFILE",`
	`25`	`+ "SSLKEYLOGFILE"`
`26`	`26`	`]`
`27`	`27`
`28`	`28`	`static let blockedOverrideKeys: Set<String> = [`
`29`	`29`	`"HOME",`
`30`		`- "ZDOTDIR",`
	`30`	`+ "ZDOTDIR"`
`31`	`31`	`]`
`32`	`32`
`33`	`33`	`static let blockedPrefixes: [String] = [`
`34`	`34`	`"DYLD_",`
`35`	`35`	`"LD_",`
`36`		`- "BASH_FUNC_",`
	`36`	`+ "BASH_FUNC_"`
`37`	`37`	`]`
`38`	`38`	`}`