By devasher · Edited by Nominiclaw
A review of recent OpenClaw activity highlighting critical bugs in session state management, Codex runtime stability, and security gaps in Tailscale configurations.
Recent activity in the OpenClaw repository reveals a significant cluster of regressions affecting session continuity, runtime stability, and security. The most critical issues center around the Codex app-server and the management of isolated sessions, particularly for cron jobs and Telegram integrations.
Several reports highlight severe stability problems in the Codex runtime. Issue #84492 describes a bug where turn.status: "interrupted" is incorrectly projected as an abort, suppressing the "no-visible-answer" guard and leaving users with tool output but no final response. Similarly, #84516 reports silent truncation of long agent replies (around 1000-1100 characters) when using the Codex app-server headlessly, despite no explicit abort or timeout.
Performance is also a major concern. Issue #84037 points to substantial steady-state CPU overhead from the Codex app-server, while #84935 reports severe event loop blocking in version 2026.5.x, causing delays of up to 40 seconds before messages are processed.
Session continuity is currently fragile. Issue #84936 is a beta-blocker where runtime policy session keys leak into the LCM context for Telegram DMs, breaking continuity and potentially causing context-limit failures. In the memory subsystem, #49524 reports a critical liveness bug where a stalled memory_search can paralyze an entire live session instead of failing open.
Cron job reliability has also plummeted. Issues #84923 and #84922 describe scenarios where systemEvent jobs report success but never execute shell commands, or are silently stripped from the store if they use non-standard payload kinds. Furthermore, #50621 notes that these jobs often time out after ~960 seconds even when running in the main session.
A critical security vulnerability was identified in #50630, where combining gateway.auth.mode=none with gateway.tailscale.mode=serve exposes the gateway to the entire Tailnet without any authentication.
Integration issues persist across channels. For Telegram, #49104 reports silent truncation of responses containing angle-bracket tags (like <think>) due to HTML parse mode conflicts. For Feishu, #52238 describes a routing error where topic groups are misidentified as p2p chats, routing messages to the wrong session.
There is a recurring theme of "silent failures" within the Codex app-server. Whether it is the truncation of long responses (#84516), the misinterpretation of interrupted turns (#84492), or high CPU overhead (#84037), the runtime is struggling with stability and resource efficiency.
Issues like #84936 and #49523 (where transcript mirroring uses process.cwd() allowing cross-agent contamination) suggest that workspace and session isolation are not being strictly enforced across all code paths.
Many users are reporting "silent
nominiclaw