OpenClaw Issue Digest: Gateway Stability, ACP Runtime Failures, and Channel Routing Bugs
Open Issues
Recent activity in the OpenClaw repository reveals several critical stability issues, ranging from process-level crashes in the gateway to severe authorization bypasses in channel integrations.
Critical Stability and Runtime Failures
One of the most severe reports involves the openclaw-gateway process crashing entirely due to unhandled WebSocket errors in the Slack channel plugin (#81010). A non-critical plugin is currently capable of triggering a process.exit(1), taking down the LLM proxy and all other active channels. This highlights a significant lack of isolation between the main gateway process and its plugins.
Similarly, the ACPX runtime is experiencing a high-severity bug where sessions_spawn fails for non-Codex ACP agents (#81005). The runtime incorrectly forwards a timeout config option that agents like Claude reject, leading to an ACP_TURN_FAILED error. This effectively breaks multi-agent orchestration for a large subset of ACP-backed agents.
Channel Routing and UX Regressions
Several regressions have been noted in the Telegram and Discord integrations:
- Telegram Routing: Group mention replies are being incorrectly routed to a user's Direct Message (DM) instead of the group chat (#80990). Additionally, session auto-replies in forum groups are landing in the "General" topic because the
message_thread_idis being dropped during delivery (#78724). - Discord Authorization: A high-severity authorization bypass allows any guild member to trigger bot-privileged guild-admin mutations (e.g., deleting channels or modifying roles) because the requester authorization checks are missing for these specific actions (#68703).
- UX Feedback: Slash commands like
/newin Telegram fail to trigger the standard "ack" reactions and typing indicators, leaving users in a silent gap during session initialization (#68955).
Memory and Dreaming System Issues
The memory-core dreaming system is suffering from identity contamination in multi-agent setups (#65374). Because session snippets from all agents are pooled into a shared corpus without agent-specific boundaries, agents are "dreaming" experiences that actually belonged to other agents, leading to fabricated first-person narratives.
Furthermore, the session-memory hook is causing autonomous re-execution of prior tasks (#68751). By persisting raw user turns without untrusted-data markers, the system treats historical commands as current input upon session reset, leading the agent to repeat mutations (like API provisioning) that the user had already completed or explicitly stopped.
Key Themes
1. Process Isolation and Error Boundaries
The recurring theme of "plugin-induced crashes" (#81010) and "runtime-level failures" (#81005) suggests a need for stronger error boundaries. The proposed fix for the gateway crash involves treating channel plugins as sidecars or wrapping event handlers in process-level boundaries to prevent a single plugin failure from cascading into a full system outage.
2. Identity and Attribution Integrity
There is a systemic struggle with identity across different layers:
- Model Identity: Agents can emit self-tagged output claiming to be one model while actually running on another due to a lack of verification in delivery hooks (#69110).
- User Attribution: In multi-user shared sessions, the gateway lacks a first-class way to attribute messages to specific authors, defaulting to the install-class ID (#68353).
- Agent Identity: The dreaming system's shared corpus leads to cross-agent memory leakage (#65374).
3. Configuration and Migration Fragility
Several issues point to a fragile configuration lifecycle. The doctor --fix command is reportedly deleting unrecognized but valid config fields (#78858), and schema changes are causing service crash loops because validation occurs before legacy migrations can run (#68664).
Action Required
High Severity / Immediate Attention
- #81010 (Gateway Crash): Immediate implementation of error boundaries for channel plugins to prevent single-plugin failures from crashing the entire gateway.
- #68703 (Discord Auth Bypass): Critical fix required to implement requester authorization for guild-admin actions to prevent unauthorized channel/role mutations.
- #81005 (ACPX Runtime Failure): Fix the
set_config_optionforwarding logic to preventACP_TURN_FAILEDfor non-Codex agents.
Blocked or High-Impact Issues
- #68751 (Autonomous Re-execution): The
session-memoryhook needs urgent wrapping of historical content in untrusted-data markers to prevent agents from repeating old commands. - #80960 (Unbounded Backups): The
session-file-repairlogic is creating gigabytes of redundant.bakfiles; a rotation or cleanup policy is required. - #68664 (Config Crash Loop): Reorder the startup sequence to apply migrations before validation to prevent update-induced crash loops.