openclaw - ✅(Solved) Fix `btw spawn` with invalid bearer token triggers gateway/session disconnect [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#72574Fetched 2026-04-28 06:34:18
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
Participants
Timeline (top)
cross-referenced ×1

Running btw spawn codex 5.5 with an invalid or expired bearer token returns a 401 (expected), but also appears to destabilize the active OpenClaw gateway session, leading to a disconnect (gateway disconnected: closed | idle). This requires a manual openclaw gateway restart to recover.

Error Message

btw failed: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid bearer token"}}

gateway disconnected: closed | idle

Root Cause

Running btw spawn codex 5.5 with an invalid or expired bearer token returns a 401 (expected), but also appears to destabilize the active OpenClaw gateway session, leading to a disconnect (gateway disconnected: closed | idle). This requires a manual openclaw gateway restart to recover.

Fix Action

Fixed

PR fix notes

PR #72812: Fix helper Codex app-server auth failures from tearing down the shared client

Description (problem / solution / changelog)

Fixes #72574

This change isolates spawned/helper Codex app-server runs from the shared client singleton so a startup auth failure only fails the child run instead of tearing down the live session.

What changed:

  • Use an isolated app-server client when spawnedBy is present.
  • Keep shared-client teardown limited to non-isolated runs.
  • Close isolated clients explicitly during cleanup.
  • Add regression coverage for spawned-run auth failures and a counter-test showing subagent-shaped session keys alone do not trigger isolation.

Verification:

  • git diff --check
  • Focused vitest run is still blocked by an unrelated workspace dependency issue: missing typebox in src/gateway/protocol/schema/agent.ts.

Changed files

  • extensions/codex/src/app-server/run-attempt.test.ts (modified, +82/-0)
  • extensions/codex/src/app-server/run-attempt.ts (modified, +54/-19)
  • extensions/codex/src/app-server/shared-client.test.ts (modified, +16/-0)
  • extensions/codex/src/app-server/shared-client.ts (modified, +45/-6)

Code Example

401 authentication_error: Invalid bearer token

---

gateway disconnected: closed | idle

---

openclaw gateway restart

---

btw spawn codex 5.5

---

btw failed: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid bearer token"}}

gateway disconnected: closed | idle
RAW_BUFFERClick to expand / collapse

Summary

Running btw spawn codex 5.5 with an invalid or expired bearer token returns a 401 (expected), but also appears to destabilize the active OpenClaw gateway session, leading to a disconnect (gateway disconnected: closed | idle). This requires a manual openclaw gateway restart to recover.

Expected Behavior

  • btw command fails gracefully with authentication error
  • Active agent session and gateway remain stable
  • No disconnect or need for restart

Actual Behavior

  • btw returns:

    401 authentication_error: Invalid bearer token
  • Immediately followed by:

    gateway disconnected: closed | idle
  • Session becomes unusable until:

    openclaw gateway restart

Environment

  • OpenClaw version: 2026.4.9
  • OS: Linux Mint (Ubuntu/Debian-based)
  • Hardware: ThinkPad X1 Carbon
  • Active agent: github-copilot/claude-opus-4.7
  • Running via terminal (local install, systemd service)

Steps to Reproduce

  1. Start OpenClaw normally (openclaw or agent session active)

  2. Ensure bearer token for btw/Codex route is invalid or expired

  3. Run:

    btw spawn codex 5.5
  4. Observe:

    • 401 error
    • gateway disconnect

Logs

btw failed: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid bearer token"}}

gateway disconnected: closed | idle

Impact

  • Breaks active session unexpectedly
  • Requires manual gateway restart
  • Makes btw unsafe to test/debug in live sessions
  • Poor failure isolation between auxiliary agent spawning and core gateway

Hypothesis

btw spawn may be:

  • Sharing or mutating the same gateway client/session
  • Not isolating failed auth paths
  • Triggering a teardown on error instead of failing locally

Suggested Fix

  • Isolate btw spawn calls from main gateway session
  • Ensure auth failures do not propagate to gateway lifecycle
  • Add retry-safe or sandboxed execution for helper agents

Additional Notes

This feels like a boundary violation between auxiliary agent execution (btw) and core session stability. Even with invalid credentials, the main agent should remain unaffected.

extent analysis

TL;DR

Isolate btw spawn calls from the main gateway session to prevent authentication errors from destabilizing the active OpenClaw gateway session.

Guidance

  • Verify the hypothesis that btw spawn is sharing or mutating the same gateway client/session by checking the implementation details of btw and its interaction with the OpenClaw gateway.
  • Investigate the authentication failure handling in btw to ensure it does not trigger a teardown of the gateway session on error.
  • Consider adding retry-safe or sandboxed execution for helper agents like btw to prevent propagation of auth failures to the gateway lifecycle.
  • Review the OpenClaw gateway session management to ensure it can handle auxiliary agent execution failures without requiring a manual restart.

Example

No code snippet is provided as the issue does not contain sufficient implementation details to create a concrete example.

Notes

The suggested fix requires a deeper understanding of the btw implementation and its interaction with the OpenClaw gateway. The provided information implies a boundary violation between auxiliary agent execution and core session stability, but the exact cause and solution may depend on the specific implementation details.

Recommendation

Apply a workaround by isolating btw spawn calls from the main gateway session, as this is the most likely cause of the issue and can help prevent the gateway session from becoming unstable due to authentication errors in auxiliary agent execution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix `btw spawn` with invalid bearer token triggers gateway/session disconnect [1 pull requests, 1 participants]