[Lightheartdevs]

Problem

The run-progress budget charges every non-zero exit as a failure, and its 12-failure total never resets. grep, rg and git grep exit 1 when nothing matched. A coding run that searches for a name, learns "not here" and looks elsewhere spends that total on answers, and the guard then stops the run mid-task.

Seen on an RTX Spark laptop running Portal with Qwen3.8-Flash-Next, fixing bugs in a canvas browser game:

• Round 1: 289 model calls, 21 good edits, stopped by the guard. The last three counted failures were greps for a function in the wrong file (exit 1, no output). Portal showed each one as "Failed".
• Round 2 (fresh task): 268 calls, 12 edits, stopped again mid-diagnosis. Five of its counted failures were searches that found nothing; four of those were short read-only chains such as sed -n '860,900p' ui.js; echo ===; grep -n "function showScreen" -A 15 ui.js.
• Round 3: 176 calls, 17 edits, stopped the same way.

Fix

lookupFoundNothing() decides whether an exec receipt is an empty search:

• Single lookups: a grep, egrep, fgrep, rg, git grep or which (optionally after one literal cd DIR &&) that completed with exit 1. These exit 1 only when nothing matched (which: a name did not resolve); their errors exit 2 (git 128).
• Chains: a list joined by ; or && in which every step is a lookup, an echo or sed -n 'N,Mp', optionally piped into head, tail, cat, wc, sort or uniq, and the last step is a bare lookup. None of those other steps can exit 1, so exit 1 still means a search found nothing.
• Output: OpenClaw merges stdout and stderr; any error line disqualifies the command (GNU grep's warnings and binary-match notices are not errors). rg 13 prints some errors without a prefix, so rg may only be the last step, where its exit status decides.
• Parsing: the command is scanned word by word with quotes removed, as dash would see it. ||, a lone &, redirection, grouping, substitution, comments, escapes outside quotes, $ or backticks inside double quotes and newlines all disqualify it. Options that run programs or write files are rejected however they are quoted: rg --pre/--hostname-bin, git grep -O/--open-files-in-pager, sort -o/-c, and any sed operand that starts with -.

The receipt must be bound to the exact pending call: run, transport (direct or Tool Search), session and deep-equal executed params. The model's own command comes from that call's record, never from the result. A match goes through the existing free-correction path as discovery: not charged, resets nothing, at most FREE_EMPTY_LOOKUPS_PER_RUN (12) per run, after which it is an ordinary failure again. Discovery never resets the rounds fuse, so a run that only searches still stops after roundsWithoutProgress. RUN_PROGRESS_LIMITS is unchanged.

Tests

• tests/empty_lookup_progress.test.mjs (new) replays OpenClaw's hook sequence (before, after, persist) for each call, in both the direct and the Tool Search transport. It checks that:
  • empty searches and empty search chains between edits no longer stop a run;
  • the allowance is bounded;
  • real errors, chains that printed an error, and compound commands still trip the fuse;
  • an empty search never erases earlier failures;
  • a search-only run still stops on the rounds fuse;
  • a receipt that does not match the recorded call is charged.
• tests/run_progress_budget.test.mjs has table tests over the chains from the Spark run plus dozens of rejected commands and receipts: rg 13's unprefixed errors, quoted -i to sed, sort -o, git grep -O'cmd', rg --pre, scanner edge cases and more.
• Mutation checks: with the classifier reverted to each earlier version, the new tests fail.
• The change went through two rounds of adversarial review: probing the scanner against dash quoting and the tools' option parsing and exit codes. Every finding is fixed in this PR.
• Local run on Windows: the touched suites pass. The full plugin suite was compared against main on the same machine, and no test fails only on this branch. One timing test flaked once under load and passes in isolation on both branches. pixel_ingress.test.mjs hangs on Windows on both branches; CI runs it on Linux.

Follow-ups (not in this PR)

• The task activity panel still labels an exit-1 search "Failed" even though it is no longer charged.
• Reading a missing file (read ENOENT) is the other common "answer, not failure" case. It is worth the same treatment, with its own bound.
• A JavaScript runtime in the agent sandbox. For web projects the model repeatedly tries to run or syntax-check what it wrote (node --check, node -e). With only python3 available those attempts fail and are charged, and it also tried to emulate JS through Python. Related: fix(pixel): tell sandboxed Pixel what its exec sandbox provides #6763. Changing the sandbox image needs a Pixel bump and a bundle repin (see fix(pixel): provide python alongside python3 in the agent sandbox #7640).
• /workspace/.openclaw/tmp is not writable from the sandbox, but the model reaches for it to stage helper scripts.

🤖 Generated with Claude Code