Gate the managed-local provenance probe so it cannot start wsl.exe during Windows session teardown #1572

Activity

1. github-project-automation

   added this to Windows Companion Appon Oct 1, 2026
2. github-project-automation

   moved this to Backlog in Windows Companion Appon Oct 1, 2026
3. clawsweeper

   added

   P2Normal priority bug or improvement with limited blast radius.Normal priority bug or improvement with limited blast radius.

   clawsweeper:fix-shape-clearClawSweeper found a clear likely implementation shape for this issue.ClawSweeper found a clear likely implementation shape for this issue.

   clawsweeper:queueable-fixClawSweeper marked this issue as an existing queue_fix_pr work candidate.ClawSweeper marked this issue as an existing queue_fix_pr work candidate.

   clawsweeper:source-reproClawSweeper found a high-confidence source-level issue reproduction.ClawSweeper found a high-confidence source-level issue reproduction.

   impact:ux-frictionUser-facing flow adds avoidable confusion or support burden without fully blocking progress.User-facing flow adds avoidable confusion or support burden without fully blocking progress.

   issue-rating: 🦞 diamond lobsterVery strong issue quality with high-confidence source-level or clear reproduction.Very strong issue quality with high-confidence source-level or clear reproduction.

   no-staleExempts this issue from stale automation.Exempts this issue from stale automation.

   on Oct 1, 2026
4. clawsweeper commented on Oct 1, 2026

   

   clawsweeperbot

   on Oct 1, 2026 – with ClawSweeper

   More actions

   Codex review: this still needs some work. Reviewed October 1, 2026, 9:02 AM ET / 13:02 UTC.

   Summary
   The process-start guard remains absent on current main and in v2026.9.4. This narrowly scoped prerequisite is still useful; no open PR was found owning the shutdown guard.

   Likely related people: bkudiess and shanselman are medium-confidence routing candidates from merged connection work.

   Reproducibility: yes. for the source-level admission gap: reachable reconnect authorization invokes a platform that starts processes without observing session teardown. The Windows 0xc0000142 race was reported with event timelines but was not independently reproduced.

   Root-cause cluster
   Relationship: partial_overlap
   Canonical: #1571
   Summary: The parent retains the evidence for session-teardown launches; this issue owns one deliberately separated process-start boundary.

   Members:

   • canonical: Tray spawns wsl.exe during session teardown, producing an "Application Error 0xc0000142" popup on every shutdown/restart #1571 - Open evidence umbrella explicitly delegates this narrower production boundary.
   • partial_overlap: Tray keep-alive can still start during Windows session end and its repair adapter ignores the cancellation token #1573 - Tracks keepalive admission and cancellation, sharing the planned lifecycle signal but requiring separate caller changes.
   • partial_overlap: Reconnect retry loop invokes reconnect authorization with no Windows session-ending check #1574 - Tracks stopping reconnect authorization before it reaches this probe.
   • adjacent_distinct: fix(connection): a cached wslrelay proof allows a token after the listener changes #1510 - Repairs listener-identity revalidation during credential proof rather than session-teardown launch admission.

   Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

   Next step
   A focused launch-admission repair has clear source boundaries and deterministic validation; establish failing regression coverage before implementing the seam.

   Review details

   Best possible solution:

   Gate both launch boundaries through injected lifecycle state, preserve failed-proof semantics, and connect the shared production signal in a separate focused follow-up.

   Do we have a high-confidence way to reproduce the issue?

   Yes for the source-level admission gap: reachable reconnect authorization invokes a platform that starts processes without observing session teardown. The Windows 0xc0000142 race was reported with event timelines but was not independently reproduced.

   Is this the best way to solve the issue?

   Yes as a staged boundary repair: injected lifecycle and process-start seams allow deterministic zero-launch regression coverage within the requested scope. Real shutdown protection still needs the separately deferred production signal.

   AGENTS.md: found and applied where relevant.

   Remaining risk / open question:

   • Concrete Windows session-end detection and production wiring are explicitly deferred; landing this seam alone cannot establish that real shutdown popups are fixed.

   Codex review notes: model internal, reasoning medium; reviewed against f4122a8927e7.

   Label changes

   Label changes:

   • add P2: The reported shutdown dialogs are alarming but do not prevent the gateway from working after reboot.
   • add impact:ux-friction: Background process launches can produce confusing Windows application-error dialogs during ordinary shutdown.
   • add issue-rating: 🦞 diamond lobster: Current issue advisory state selects this label.
   • add clawsweeper:source-repro: Current issue advisory state selects this label.
   • add clawsweeper:queueable-fix: Current issue advisory state selects this label.
   • add clawsweeper:fix-shape-clear: Current issue advisory state selects this label.

   Label justifications:

   • P2: The reported shutdown dialogs are alarming but do not prevent the gateway from working after reboot.
   • impact:ux-friction: Background process launches can produce confusing Windows application-error dialogs during ordinary shutdown.

   Evidence reviewed

   Acceptance criteria:

   • ./build.ps1
   • dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore
   • dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore
   • dotnet test ./tests/OpenClaw.Connection.Tests/OpenClaw.Connection.Tests.csproj --no-restore
   • Establish a failing regression before the fix; assert zero injected process-start invocations for both launch boundaries when session-ending is true.

   What I checked:

   • Current main still launches without a lifecycle guard: IsExpectedWslGatewayListening builds the WSL probe and directly calls Process.Start at line 102. RunSchtasks directly starts another process at line 213; that executable is schtasks.exe, not a second WSL probe. Neither boundary observes session-ending state. (src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs:102, f4122a8927e7)
   • Reachable reconnect path and security invariant: GatewayConnectionManager installs reconnect authorization at line 719 and invokes the provenance probe during managed-loopback credential authorization. The service also probes when Windows has no listener, at line 389. Refusal must retain unsuccessful proof semantics rather than authorize credentials or bypass ownership checks. (src/OpenClaw.Connection/GatewayConnectionManager.cs:719, f4122a8927e7)
   • Existing shutdown and ownership contracts: Connection architecture states that shutdown wins over recovery and that unknown ownership cannot receive strong credentials or destructive remediation. The architecture ledger assigns provenance to this service and ordered application shutdown to AppShutdownCoordinator; the proposed boundary repair should preserve both owners. (docs/CONNECTION_ARCHITECTURE.md:628, f4122a8927e7)
   • Regression coverage boundary: Existing tests check probe arguments and guest ownership, while FakePlatform replaces IsExpectedWslGatewayListening entirely. Those tests do not exercise the real platform's process-start boundary; the new regression must inject the start operation there and assert zero invocations for both WSL and scheduled-task launches. (tests/OpenClaw.Connection.Tests/ManagedLocalGatewayPortProvenanceServiceTests.cs:95, f4122a8927e7)
   • Latest release also lacks the guard: GitHub identifies v2026.9.4 as the latest release, published September 15, 2026. Its source contains the same unguarded starts at lines 102 and 213, matching the reported Companion version. (src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs:102, 3c43751b2bac)
   • Reporter evidence and intentional split: The parent discussion supplies 92 WSL Event 26 records across 35 bursts, retracts the fixed two-dialog claim, identifies mid-session exceptions, and explains why popup suppression is not proof of recovery: Tray spawns wsl.exe during session teardown, producing an "Application Error 0xc0000142" popup on every shutdown/restart #1571 (comment). The later split comment retains the parent as evidence and assigns separate production boundaries to the three child issues: Tray spawns wsl.exe during session teardown, producing an "Application Error 0xc0000142" popup on every shutdown/restart #1571 (comment). This issue expressly defers concrete Windows session-source wiring.

   Likely related people:

   • bkudiess: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
   • shanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

   How this review workflow works

   • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
   • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
   • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
   • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
   • Maintainers can also comment @clawsweeper review to request a fresh review only.
   • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
   • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
   • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
5. petruslin commented on Oct 1, 2026

   

   petruslin

   on Oct 1, 2026

   Author

   More actions

   There is now a shared session-ending contract to code against

   Filed as reporter: #1575 — Provide one shared Windows session-ending signal and wire it for production use.

   This issue's text asks for an injected session-ending abstraction and then explicitly puts the concrete Windows source out of scope, deferring it to a follow-up. #1575 is that follow-up. It owns the contract, the Windows implementation, and the production wiring; it deliberately does not touch any of the three consumer call sites (#1572, #1573, #1574).

   So the shape of this one is unchanged but its dependency is now concrete:

   • Still one production file: src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs.
   • Take the signal from Provide one shared Windows session-ending signal and wire it for production use #1575's abstraction rather than defining a local interface or re-deriving the state here. A locally invented seam would compile and pass its own tests while being wired to nothing in a released build — the failure mode Provide one shared Windows session-ending signal and wire it for production use #1575's required-wiring test exists to prevent.
   • The second start at the second Process.Start is the point that actually creates the process. Both starts, and every in-file caller that can reach them, should decline once the session-end transition has been observed.

   #1575 also asks for the transition and not only a latched state, which matters here: declining as early as possible is preferable, and a latched flag that only becomes visible after teardown has begun may be read too late.

   Nothing here requires a maintainer decision, so this one can proceed as soon as #1575 lands.