OpenClaw Issue Digest: Auth Regressions, Sandbox Escapes, and Memory Reliability

Open Issues

The recent activity window for the OpenClaw repository reveals a concentration of high-severity regressions and architectural gaps, particularly surrounding the transition to version 2026.5.19 and 2026.5.20. The most pressing issues involve critical security boundaries in the Codex runtime and silent data loss during configuration updates.

Critical Security & Stability Failures

Several reports highlight a breakdown in the system's security posture. Most notably, issue #83796 describes a critical sandbox escape where the Codex runtime bypasses the per-agent Docker sandbox, executing native shell commands directly in the gateway container. This effectively nullifies the isolation boundary for any agent using the Codex harness.

Simultaneously, the system is facing severe stability issues on newer Node.js runtimes. Issue #84820 reports a chronic crash cadence on Node 24+ due to unclosed FileHandle references on session lock files, which V8 now treats as a fatal error rather than a deprecation warning.

Authentication and Update Regressions

Updating the gateway has become a high-risk operation. Issue #85080 reports that openclaw update silently reverts user-customized agents.defaults.model and plugins.entries blocks to distribution defaults, causing immediate authentication failures for users who have migrated to OAuth lanes. This is compounded by issue #84893, where users on headless VPS environments find the Codex provider unusable after upgrading to 2026.5.19, citing auth binding failures and Cloudflare 403 errors.

Memory and Cron Reliability

Reliability gaps in long-running operations are also prominent. Issue #26772 highlights a critical flaw in the memory indexer: the use of an atomic temp-file-swap pattern means that any crash during a multi-hour indexing process results in total progress loss. Similarly, issue #84912 describes a recurring pattern where cron jobs lose access to essential local tools (file/shell/mail) after updates, yet continue to report an ok status, leading to silent automation failures.

Key Themes

1. The "Update Fragility" Pattern

There is a recurring theme of "silent regressions" following version updates. Whether it is the erasure of custom config (#85080), the breaking of Codex auth on VPS (#84893), or the loss of tool capabilities in cron jobs (#84912), the update process currently lacks the necessary safeguards to preserve user state and verify runtime health.

2. Runtime Isolation Disparity

There is a growing gap between the PI runtime and the Codex runtime. While the PI runtime is well-integrated with the Docker sandbox, the Codex runtime operates as a separate entity that often bypasses these boundaries (#83796) or fails to resolve correctly in embedded helper paths (#38212).

3. Determinism in Autonomous Workflows

Users are pushing for more deterministic verification of agent outcomes. This is evident in the request for postconditions for cron jobs (#12398) to prevent "non-deterministic early termination" and the need for a native checkpoint engine (#17211) to ensure complex tasks can be resumed without drift.

Action Required

Immediate contributor attention is required for the following high-severity items:

• Critical Security Fix: Resolve the Codex runtime sandbox escape (#83796) to ensure all shell/code execution is contained within the per-agent Docker sandbox.
• Stability Patch: Audit FileHandle usage in the session-store layer to prevent fatal crashes on Node 24+ (#84820).
• Update Logic Overhaul: Implement a mechanism to preserve user-customized config blocks during openclaw update to prevent silent auth regressions (#85080).
• Memory Reliability: Implement a checkpoint/resume capability for the memory indexer to prevent total data loss during crashes on large codebases (#26772).
• Auth Resolution: Fix the openai-codex auth binding failure on headless VPS environments to restore service for Codex users (#84893).