OpenClaw
OpenClaw bounds credential refresh without surrendering token ownership
OpenClaw proposes a 360-second runtime deadline for stuck OAuth refreshes while retaining the cross-agent lock until uncancellable provider work settles. Companion changes centralize diagnostic redaction and add a guarded kill-switch for Codex native-hook relay fan-out.
openclaw/openclaw PR #93952 is the inspected primary source: “fix(agents): bound auth refresh without releasing token ownership.” The related records below were inspected as supporting context rather than independent confirmation.
The facts
- openclaw/openclaw PR #93952 was created 2026-06-17T05:24:27Z and was open at inspection; its title is “fix(agents): bound auth refresh without releasing token ownership.” - openclaw/openclaw PR #121599 was created 2026-08-10T13:16:42Z and was open at inspection; its title is “fix(security): centralize provider diagnostic redaction.” - openclaw/openclaw PR #121668 was created 2026-08-10T17:03:15Z and was open at inspection; its title is “feat(codex): config kill-switch for the native hook relay.” - The repository reported 385827 stars, 5677 open issues, default branch main, and last push 2026-08-11T01:03:41Z. - The latest tagged-release baseline checked was v2026.7.1-2 published 2026-08-04T00:41:26Z.
What changed
openclaw/openclaw PR #93952 reports: What Problem This Solves A provider OAuth refresh can hang while OpenClaw's gateway process and port still look healthy. Before this PR, that one pending operation could leave runtimeAuthState.refreshInFlight unresolved forever, so every later model turn waited on the same promise and produced no reply until the gateway was restarted. The same deadlock class also existed on cold-start/profile rotation and inside the cross-agent OAuth refresh lock: provider hooks, keychain reads, and token exchange work have no shared cancellation contract. A timeout that merely returned to the caller was not sufficient, because releasing the file lock while the provider still held a rotating refresh token would let a successor reuse that token concurrently. Observed in production: a long-running gateway froze immediately after token expiry. The process remained alive and listening, but agent work stopped; a fresh process loaded the same on-disk credential in about 0.7 seconds. The deadline patch has also soaked on the mac-mini.lan and rh-bot.lan fork deployments without recurrence. That soak predates this exact rebased head, so exact-head proof is listed separately below. Summary
openclaw/openclaw PR #121599 reports: What Problem This Solves Fixes an issue where diagnostics emitted after provider or transport terminal failures could retain unbounded or sensitive data. Duplicate and incomplete extraction and egress policy could execute hostile accessors, expand binary or media payloads, retain credentials and URI references, exceed worker schema bounds, or bypass redaction through structured or malformed JSON and field-name variants. Why This Change Was Made The diagnostic safety invariant now lives in one package-owned, bounded, descriptor-safe projector before optional host strengthening. All built-in provider and transport terminal paths use it, while core worker, transcript, and live egress reuse it through a narrow internal policy for hashes and providerReplay; the duplicate transport and core redaction policy is removed. Shipped public assignTransportErrorDetails compatibility remains, while temporary unshipped projector exports were removed. This is the second independent, net-negative replacement slice extracted from the superseded monolith context in #120499; #121490 landed the first replacement. It adds no native-video capability by itself. There are no config, schema, protocol, or migration changes. User Impact Provider failure diagnostics remain useful for troubleshooting while being
openclaw/openclaw PR #121668 reports: **Supersedes #111205.** Same single commit (ae63c5e4ae); that thread accumulated three weeks of review iterations across a since-removed larger surface, so it is closed in favor of this clean one. Its final state: proof: sufficient with proof confidence 5/6 on the identical evidence attached below; the last review's only actionable finding (strengthen the live-lane assertions, P2) is implemented here and validated by a fresh five-mode live run. Full history preserved in the closed thread. What problem this solves The Codex app-server harness hardcodes nativeHookRelay: { enabled: true } for every attempt and side question — both call sites are on current main. Operators hit by the relay fan-out described in #91009 have no supported way to turn the relay off or narrow it to specific events, even though the downstream machinery already supports both (buildCodexNativeHookRelayDisabledConfig, CodexRunAttemptOptions.nativeHookRelay.events). This PR wires those existing knobs to plugin config; it adds no new relay logic. Two related changes shipped while this PR was open, and neither closes the gap: **#97224** shipped appServer.loopDetectionPreToolUseRelay. Its own help text states the remaining
Why it matters
Availability fixes become security bugs when a timeout releases ownership before an uncancellable token rotation finishes. The same discipline belongs in diagnostics and hook relays: bounded waits, bounded data and explicit policy floors. The operator test is whether visible output, retained state and authority still describe the same event after retries, background work or restart.
Current
The primary record was open when captured on 2026-08-11. The tagged-release baseline was v2026.7.1-2 published 2026-08-04T00:41:26Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.
Evidence
The primary URL is https://github.com/openclaw/openclaw/pull/93952. Supporting records are https://github.com/openclaw/openclaw/pull/121599 and https://github.com/openclaw/openclaw/pull/121668. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.
Source boundary
Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.
Operator take
Keep caller deadlines separate from resource ownership, discard abandoned writebacks by generation, and expose escape hatches only where active approval policy still wins. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.
Caveat
Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.
Source inspected; source state, environment and release boundary remain explicit.