Skip to content

fix(codex): derive terminal-idle watchdog from explicit run timeout - #85296

Merged
vincentkoc merged 3 commits into
openclaw:mainfrom
alkor2000:fix-85242-codex-terminal-idle-timeout
Jul 1, 2026
Merged

vincentkoc merged 3 commits into
openclaw:mainfrom
alkor2000:fix-85242-codex-terminal-idle-timeout

Conversation

@alkor2000

@alkor2000 alkor2000 commented May 22, 2026

Copy link
Copy Markdown
Contributor

Summary

Refs #85242. Derives the Codex app-server terminal-idle watchdog from an explicit per-run timeout instead of always using the hardcoded 30-minute default.

This addresses the early-abort half of #85242 as a focused runtime fix. The diagnostic-wording half (naming the terminal-idle watchdog and its effective timeout in surfaced guidance) remains a separate follow-up, so this PR uses Refs rather than Fixes.

The resolver lives in attempt-timeouts.ts. The call site passes params.runTimeoutOverrideMs, the existing prepared signal for a deliberate cron/CLI timeout, rather than params.timeoutMs, which also carries the implicit 48-hour agent default.

Real behavior proof

Before this patch, a scheduled Codex turn with an explicit timeout above 30 minutes could still be aborted by the 30-minute terminal-idle watchdog.

After the maintainer repair:

  • no explicit run timeout -> 30-minute terminal-idle floor remains unchanged
  • explicit 45-minute run timeout -> 45-minute terminal-idle watchdog
  • explicit 10-minute run timeout -> 30-minute floor remains unchanged
  • internal harness override -> still wins

Focused proof on the real resolver and run-attempt call path:

  • node scripts/run-vitest.mjs extensions/codex/src/app-server/attempt-timeouts.test.ts extensions/codex/src/app-server/run-attempt.turn-watches.test.ts -> 72 passed
  • Blacksmith Testbox tbx_01kwej31e1mn30y1ahjqb23pbz: corepack pnpm check:changed -> passed
  • oxfmt --check on the three changed files -> clean
  • fresh autoreview -> no findings

A live 30- or 45-minute scheduled turn was not waited out end to end; timer selection is exercised through the production resolver and the real runCodexAppServerAttempt path. The diagnostic-wording half of #85242 remains intentionally out of scope.

@openclaw-barnacle openclaw-barnacle Bot added extensions: codex size: S proof: supplied External PR includes structured after-fix real behavior proof. labels May 22, 2026
@clawsweeper

clawsweeper Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 24, 2026, 3:38 PM ET / 19:38 UTC.

Summary
The PR derives the Codex app-server terminal-idle watchdog from the effective run timeout, passes that budget from run-attempt, and adds focused resolver tests.

PR surface: Source +11, Tests +19. Total +30 across 3 files.

Reproducibility: yes. at source level: current main and v2026.6.10 resolve terminal-idle from the 30-minute constant and do not pass params.timeoutMs. I did not live-wait for a 30-minute scheduled Codex turn.

Review metrics: 1 noteworthy metric.

  • Internal timeout default: 1 changed. The terminal-idle watchdog now follows the existing effective run budget when no explicit override is set, so maintainers should notice the runtime behavior change before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #85242
Summary: This PR is the open candidate for the runtime-budget half of the canonical Codex terminal-idle timeout issue; diagnostic wording remains tracked there.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

Maintainer options:

  1. Decide the mitigation before merge
    Land the focused runtime-budget fix if maintainers accept the split scope, and keep Codex app-server terminal idle timeout is hardcoded and reports misleading config guidance #85242 open for terminal-idle-specific timeout guidance.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

  • No automated repair is indicated; maintainers should decide whether to merge this runtime-only fix while preserving the diagnostics follow-up.

Security
Cleared: The diff only changes internal Codex timeout resolution, one call site, and tests; it adds no dependency, workflow, permission, secret, package, or generated-code surface.

Review details

Best possible solution:

Land the focused runtime-budget fix if maintainers accept the split scope, and keep #85242 open for terminal-idle-specific timeout guidance.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main and v2026.6.10 resolve terminal-idle from the 30-minute constant and do not pass params.timeoutMs. I did not live-wait for a 30-minute scheduled Codex turn.

Is this the best way to solve the issue?

Yes for the early-abort half: deriving the wrapper-owned watchdog from the effective run budget is narrower than adding a new config knob or upstream protocol field. The terminal-idle guidance remains a separate follow-up.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against fa6a9509bc95.

Label changes

Label justifications:

  • P2: This is a normal-priority Codex runtime bug fix for long scheduled app-server turns being cut short by an internal terminal-idle watchdog.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal output from invoking the real resolver under Node, showing a 45-minute budget resolves to 2700000 ms while defaults and overrides are preserved.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal output from invoking the real resolver under Node, showing a 45-minute budget resolves to 2700000 ms while defaults and overrides are preserved.
Evidence reviewed

PR surface:

Source +11, Tests +19. Total +30 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 2 13 2 +11
Tests 1 19 0 +19
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 3 32 2 +30

What I checked:

Likely related people:

  • steipete: Recent history ties this account to the app-server attempt split and idle timer caps in the affected timeout/run-attempt/watch area, and PR discussion records the split-scope review note. (role: recent area contributor and reviewer; confidence: high; commits: a4c2e7f5cf1b, 62abfd3dcb9a, 4135771adfca; files: extensions/codex/src/app-server/attempt-timeouts.ts, extensions/codex/src/app-server/run-attempt.ts, extensions/codex/src/app-server/attempt-turn-watches.ts)
  • kevinslin: Recent merged work added Codex app-server completion-timeout diagnostics in the same result, watch, and attempt surfaces that own the remaining terminal-idle guidance follow-up. (role: adjacent diagnostic contributor; confidence: medium; commits: ab7c92282522; files: extensions/codex/src/app-server/attempt-results.ts, extensions/codex/src/app-server/attempt-turn-watches.ts, extensions/codex/src/app-server/run-attempt.ts)
  • fuller-stack-dev: Recent merged history preserved Codex post-tool reasoning liveness in attempt-timeouts.ts and adjacent turn-watch tests, close to this watchdog behavior. (role: recent liveness-path contributor; confidence: medium; commits: cf378e4cc8c4, 77a682c5def2; files: extensions/codex/src/app-server/attempt-timeouts.ts, extensions/codex/src/app-server/run-attempt.turn-watches.test.ts, extensions/codex/src/app-server/attempt-results.ts)
  • vincentkoc: Recent current-main history touches run-attempt.ts heavily across Codex runtime behavior and prompt/lifecycle changes, making this account a useful routing candidate for merge coordination. (role: recent area contributor; confidence: medium; commits: 258b83c4386c, 9f675920bf5a, 2b75806197ab; files: extensions/codex/src/app-server/run-attempt.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels May 22, 2026
@clawsweeper

clawsweeper Bot commented May 22, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper PR egg

✨ Hatched: 🥚 common Neon Crabkin

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

  • Merged PRs are hatchable.
  • Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
  • Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: stacks clean commits.
Image traits: location green-check meadow; accessory release bell; palette moss green and polished brass; mood celebratory; pose leaning over a miniature review desk; shell frosted glass shell; lighting clean product lighting; background delicate sparkle particles.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Neon Crabkin in ClawSweeper.

What is this egg doing here?
  • Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
  • The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
  • Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
  • The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
  • Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

@ai-hpc

ai-hpc commented May 22, 2026

Copy link
Copy Markdown
Member

This looks like the right narrow fix for the early-abort path: deriving the terminal-idle watchdog from the effective run timeout avoids cutting long scheduled Codex turns back to the internal 30m default.

One remaining issue-scope question: #85242 also asks for terminal-idle-specific user guidance. If this PR is meant to fully close the issue, I think the timeout message should name the terminal-idle watchdog and the effective timeout that fired. Otherwise this can land as the runtime fix, with diagnostics tracked separately.

@steipete

Copy link
Copy Markdown
Contributor

Reviewed the diff and I agree with @ai-hpc's scope note: the runtime fix itself looks narrow and correct, but this should not fully close #85242 as-is.

The PR derives turnTerminalIdleTimeoutMs from params.timeoutMs and covers the resolver behavior with focused tests, so the 30m early-abort path is addressed. The missing part is the second half of the issue: if this watchdog still fires, the surfaced guidance should identify the terminal-idle watchdog/effective timeout instead of only telling users to increase agents.defaults.timeoutSeconds.

So I would either:

  • add the diagnostic wording update here, then keep Fixes #85242; or
  • land this as the runtime fix and change the closure language to leave the diagnostics follow-up tracked separately.

@alkor2000
alkor2000 force-pushed the fix-85242-codex-terminal-idle-timeout branch from 6ebefb8 to 1f23f29 Compare May 30, 2026 17:28
@alkor2000

Copy link
Copy Markdown
Contributor Author

Thanks @ai-hpc @steipete for the review. Going with the second option: landing this as the focused runtime fix and tracking the diagnostics wording as a separate follow-up.

Changes since the review:

  • Rebased onto current main. The resolver moved to attempt-timeouts.ts in the app-server split, so the derivation now lives there, reusing the existing resolvePositiveIntegerTimeoutMs helper to match the neighbouring post-tool resolver. The call site in run-attempt.ts passes params.timeoutMs.
  • Changed the closure language from Fixes #85242 to Refs #85242 so the issue stays open for the diagnostics follow-up (surfacing the terminal-idle watchdog and effective timeout in the guidance, rather than only pointing at agents.defaults.timeoutSeconds).
  • Re-ran the real-resolver proof under node and added the budget-derivation unit tests in attempt-timeouts.test.ts.

Happy to open the diagnostics follow-up separately, or fold it in here if you'd prefer a single PR after all.

@clawsweeper clawsweeper Bot added rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 30, 2026
@alkor2000

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

The three failing checks are unrelated to this diff (which only touches extensions/codex/src/app-server: attempt-timeouts.ts, run-attempt.ts, and the colocated test). They are flaky/long-running shards in unrelated subsystems:

  • checks-node-agentic-agents-core: fails in src/agents/code-mode.test.ts > 'terminates hostile infinite loops outside the main event loop' (a timing-sensitive loop-termination test).
  • checks-node-agentic-commands-doctor: the shard ran ~684s before failing, in doctor config-validation tests.
  • checks-node-core-runtime-infra-state: a long-running infra-state shard.

None touch the Codex app-server timeout code. Locally the focused suites pass (attempt-timeouts.test.ts and run-attempt.test.ts, Test Files 2 passed). A CI re-run should clear these.

@clawsweeper

clawsweeper Bot commented May 30, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. labels May 30, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. labels Jun 20, 2026
@vincentkoc
vincentkoc force-pushed the fix-85242-codex-terminal-idle-timeout branch from 1f23f29 to 0408304 Compare June 23, 2026 01:44
alkor2000 and others added 3 commits July 1, 2026 03:07
Fixes the early-abort half of openclaw#85242. The Codex app-server terminal-idle
watchdog used a hardcoded 30-minute default that was not derived from the
effective run timeout, so a scheduled turn configured with a longer
timeoutSeconds could be aborted early at 30 minutes even with budget left.

resolveCodexTurnTerminalIdleTimeoutMs (now in attempt-timeouts.ts after the
upstream split) accepts the effective run timeout and, with no explicit
override, follows the run budget instead of the 30-minute default:
- explicit override always wins (advanced config / tests)
- otherwise terminal-idle = max(30min floor, run budget), so a longer run is
  no longer cut short and existing protection is never shortened
- falls back to the 30min default when no run budget is known

Reuses the existing resolvePositiveIntegerTimeoutMs helper, matching the
neighbouring post-tool resolver. Adds focused unit tests for the derivation.

The diagnostic-wording half of openclaw#85242 (naming the terminal-idle watchdog in
the surfaced guidance) is left as a separate follow-up.
@vincentkoc
vincentkoc force-pushed the fix-85242-codex-terminal-idle-timeout branch from 7159768 to 0cc6afb Compare July 1, 2026 10:08
@vincentkoc vincentkoc changed the title fix(codex): derive terminal-idle watchdog from effective run timeout fix(codex): derive terminal-idle watchdog from explicit run timeout Jul 1, 2026
@openclaw-barnacle openclaw-barnacle Bot added the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 1, 2026
@vincentkoc vincentkoc self-assigned this Jul 1, 2026
@vincentkoc

Copy link
Copy Markdown
Member

Land-ready at 0cc6afb76909565103e85b520faff92cbff3c018.

The reported bug is valid: an explicitly configured run timeout above 30 minutes could still be cut off by the Codex terminal-idle watchdog at 30 minutes. During review, the original patch was repaired so the watchdog follows only the explicit run-timeout override. Normal runs retain the 30-minute liveness guard, and explicit no-timeout remains bounded by the existing maximum idle watchdog.

Evidence:

  • node scripts/run-vitest.mjs extensions/codex/src/app-server/attempt-timeouts.test.ts extensions/codex/src/app-server/run-attempt.turn-watches.test.ts - 72 passed
  • Blacksmith Testbox tbx_01kwej31e1mn30y1ahjqb23pbz - corepack pnpm check:changed passed
  • fresh autoreview - 0 accepted/actionable findings
  • exact-head CI run 28509879614 - passed after rerunning one unrelated compact-node shard that had timed out in src/agents/tools/message-tool.test.ts
  • native scripts/pr prepare-run 85296 - passed with exact-head hosted gates

Direct Codex contract check:

  • ../codex/codex-rs/app-server-protocol/src/protocol/v2/turn.rs:68 - turn start has no timeout/deadline field
  • ../codex/codex-rs/app-server-protocol/src/protocol/v2/turn.rs:208 - interruption is a separate thread/turn operation
  • ../codex/codex-rs/app-server/src/request_processors/turn_processor.rs:157 - app-server starts the turn without a timeout contract

Issue #85242 remains open because this PR fixes timeout behavior, not the broader diagnostic wording request.

@vincentkoc
vincentkoc merged commit 4076ba0 into openclaw:main Jul 1, 2026
159 of 166 checks passed
@vincentkoc

Copy link
Copy Markdown
Member

Merged via squash.

chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 1, 2026
…penclaw#85296)

* fix(codex): derive terminal-idle watchdog from effective run timeout

Fixes the early-abort half of openclaw#85242. The Codex app-server terminal-idle
watchdog used a hardcoded 30-minute default that was not derived from the
effective run timeout, so a scheduled turn configured with a longer
timeoutSeconds could be aborted early at 30 minutes even with budget left.

resolveCodexTurnTerminalIdleTimeoutMs (now in attempt-timeouts.ts after the
upstream split) accepts the effective run timeout and, with no explicit
override, follows the run budget instead of the 30-minute default:
- explicit override always wins (advanced config / tests)
- otherwise terminal-idle = max(30min floor, run budget), so a longer run is
  no longer cut short and existing protection is never shortened
- falls back to the 30min default when no run budget is known

Reuses the existing resolvePositiveIntegerTimeoutMs helper, matching the
neighbouring post-tool resolver. Adds focused unit tests for the derivation.

The diagnostic-wording half of openclaw#85242 (naming the terminal-idle watchdog in
the surfaced guidance) is left as a separate follow-up.

* fix(codex): derive terminal-idle watchdog from effective run timeout

* fix(codex): preserve default terminal idle watchdog

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 2, 2026
…penclaw#85296)

* fix(codex): derive terminal-idle watchdog from effective run timeout

Fixes the early-abort half of openclaw#85242. The Codex app-server terminal-idle
watchdog used a hardcoded 30-minute default that was not derived from the
effective run timeout, so a scheduled turn configured with a longer
timeoutSeconds could be aborted early at 30 minutes even with budget left.

resolveCodexTurnTerminalIdleTimeoutMs (now in attempt-timeouts.ts after the
upstream split) accepts the effective run timeout and, with no explicit
override, follows the run budget instead of the 30-minute default:
- explicit override always wins (advanced config / tests)
- otherwise terminal-idle = max(30min floor, run budget), so a longer run is
  no longer cut short and existing protection is never shortened
- falls back to the 30min default when no run budget is known

Reuses the existing resolvePositiveIntegerTimeoutMs helper, matching the
neighbouring post-tool resolver. Adds focused unit tests for the derivation.

The diagnostic-wording half of openclaw#85242 (naming the terminal-idle watchdog in
the surfaced guidance) is left as a separate follow-up.

* fix(codex): derive terminal-idle watchdog from effective run timeout

* fix(codex): preserve default terminal idle watchdog

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
amittell pushed a commit to amittell/openclaw that referenced this pull request Jul 2, 2026
…penclaw#85296)

* fix(codex): derive terminal-idle watchdog from effective run timeout

Fixes the early-abort half of openclaw#85242. The Codex app-server terminal-idle
watchdog used a hardcoded 30-minute default that was not derived from the
effective run timeout, so a scheduled turn configured with a longer
timeoutSeconds could be aborted early at 30 minutes even with budget left.

resolveCodexTurnTerminalIdleTimeoutMs (now in attempt-timeouts.ts after the
upstream split) accepts the effective run timeout and, with no explicit
override, follows the run budget instead of the 30-minute default:
- explicit override always wins (advanced config / tests)
- otherwise terminal-idle = max(30min floor, run budget), so a longer run is
  no longer cut short and existing protection is never shortened
- falls back to the 30min default when no run budget is known

Reuses the existing resolvePositiveIntegerTimeoutMs helper, matching the
neighbouring post-tool resolver. Adds focused unit tests for the derivation.

The diagnostic-wording half of openclaw#85242 (naming the terminal-idle watchdog in
the surfaced guidance) is left as a separate follow-up.

* fix(codex): derive terminal-idle watchdog from effective run timeout

* fix(codex): preserve default terminal idle watchdog

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
(cherry picked from commit 4076ba0)
amittell added a commit to amittell/openclaw that referenced this pull request Jul 2, 2026
…s not persisted

The fork's fallback-no-persist gate (b8e4198) wrapped the whole
finalizeCronRun persistence block, so a fallback run also skipped
clearCliSession/setCliSessionId maintenance for the CLI provider that actually
ran, leaving stale bindings to hijack the next CLI run. Upstream runs binding
maintenance unconditionally (only aborted runs skip it); restore that shape and
keep the no-persist gate narrowly around setSessionRuntimeModel/contextTokens.

Fixes the base regression test 'clears stale CLI bindings when cron CLI
replacement is unflushed' (failing on the branch since b8e4198; bisected).
Also: repoint the openclaw#98356 test's getCliSessionBinding import to the 6.11 home
(src/agents/cli-session.ts), fix three oxlint errors (promise-executor style in
the openclaw#85296 test hunk; only-throw-error + no-shadow in the memory-lancedb
failover port).
wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026
…penclaw#85296)

* fix(codex): derive terminal-idle watchdog from effective run timeout

Fixes the early-abort half of openclaw#85242. The Codex app-server terminal-idle
watchdog used a hardcoded 30-minute default that was not derived from the
effective run timeout, so a scheduled turn configured with a longer
timeoutSeconds could be aborted early at 30 minutes even with budget left.

resolveCodexTurnTerminalIdleTimeoutMs (now in attempt-timeouts.ts after the
upstream split) accepts the effective run timeout and, with no explicit
override, follows the run budget instead of the 30-minute default:
- explicit override always wins (advanced config / tests)
- otherwise terminal-idle = max(30min floor, run budget), so a longer run is
  no longer cut short and existing protection is never shortened
- falls back to the 30min default when no run budget is known

Reuses the existing resolvePositiveIntegerTimeoutMs helper, matching the
neighbouring post-tool resolver. Adds focused unit tests for the derivation.

The diagnostic-wording half of openclaw#85242 (naming the terminal-idle watchdog in
the surfaced guidance) is left as a separate follow-up.

* fix(codex): derive terminal-idle watchdog from effective run timeout

* fix(codex): preserve default terminal idle watchdog

---------

Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>
Co-authored-by: Vincent Koc <vincentkoc@ieee.org>
(cherry picked from commit 4076ba0)
amittell added a commit to amittell/openclaw that referenced this pull request Aug 10, 2026
…s not persisted

The fork's fallback-no-persist gate (b8e4198) wrapped the whole
finalizeCronRun persistence block, so a fallback run also skipped
clearCliSession/setCliSessionId maintenance for the CLI provider that actually
ran, leaving stale bindings to hijack the next CLI run. Upstream runs binding
maintenance unconditionally (only aborted runs skip it); restore that shape and
keep the no-persist gate narrowly around setSessionRuntimeModel/contextTokens.

Fixes the base regression test 'clears stale CLI bindings when cron CLI
replacement is unflushed' (failing on the branch since b8e4198; bisected).
Also: repoint the openclaw#98356 test's getCliSessionBinding import to the 6.11 home
(src/agents/cli-session.ts), fix three oxlint errors (promise-executor style in
the openclaw#85296 test hunk; only-throw-error + no-shadow in the memory-lancedb
failover port).

(cherry picked from commit a01b392)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

extensions: codex P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants