$ the-wire · showcase
OpenClaw fixes cron false-success and secrets validation
By RepoJournal · Filed · About OpenClaw
OpenClaw's cron jobs now record real delivery outcomes, preventing false-success completions that have been silently hiding failed deliveries.
The cron scheduler in openclaw/openclaw no longer records a job as completed when its delivery failed. Delivery outcomes are now recorded at their owners, with whole-run completion, delivery failure alerts, and one-shot retention derived from those facts; execution status stays separate from delivery failure, and undelivered jobs and transcripts are retained for inspection. Requested delivery is now required unless explicitly marked best-effort, a change that could surface previously hidden failures in jobs that assumed best-effort semantics. [1]
A secrets preflight now validates exec SecretRef command paths before config acceptance. Schema validation and config writes previously accepted paths that gateway cold start rejects (symlink, missing, unsafe permissions/ownership), so a config that printed "Config valid" could crash the gateway on the next restart; the fix shares one non-executing validator to catch these issues upfront. [2] Worktree tasks now inherit configured permission defaults instead of falling back to a worktree-only Workspace fallback, while preserving explicit permission selections and recorded session roots. [3]
In Crabbox, failure bundles are no longer lost when the working directory is read-only or unwritable. The normal project-local destination `.crabbox/captures/` is kept, but when creating it fails specifically because it is unwritable, the bundle is saved in the existing private user-state directory and its actual path is reported; if both destinations fail, both errors are reported. [4] Also, a Daytona cloud sandbox plugin was reverted as unshipped in OpenClaw, with Crabbox and standalone Daytona hosting documentation preserved. [5]
Action items
- → Review cron jobs for delivery assumptions after the false-success fix; jobs relying on best-effort delivery may now alert. openclaw/openclaw [plan]
- → Update exec SecretRef command paths to use valid absolute paths that pass the new preflight validation. openclaw/openclaw [immediate]
- → Check whether any configured permission defaults were masked by the old worktree fallback and confirm the new inheritance behavior. openclaw/openclaw [plan]
- → If you relied on the Daytona cloud sandbox plugin, note it has been reverted. openclaw/openclaw [monitor]
References
- [1] fix(cron): record real delivery outcomes and stop false-success completions (#131228) ↗ openclaw/openclaw
- [2] fix(secrets): preflight exec provider command paths before config acceptance (#117128) ↗ openclaw/openclaw
- [3] fix: worktree tasks inherit configured permission defaults (#131547) ↗ openclaw/openclaw
- [4] fix: save failure bundles from unwritable directories ↗ openclaw/crabbox
- [5] fix(sandbox): revert Daytona cloud sandbox plugin (#130996) ↗ openclaw/openclaw
