Bug type

Crash (process/app exits or hangs)

Beta release blocker

No

Summary

Environment

• OpenClaw version: 2026.4.24 (cbcfdf6)
• Node: 22.22.0
• OS: macOS Tahoe 26.x (Apple Silicon, ARM64)
• Install method: npm install -g openclaw (Homebrew npm)

Summary

@openclaw/bonjour already has the right defenses against ciao's "CIAO PROBING/ANNOUNCEMENT CANCELLED" unhandled rejections — but the handler is never installed, because registerUnhandledRejectionHandler is not passed into startGatewayBonjourAdvertiser. Result: the watchdog's own teardown path crashes the gateway.

Affected version: 2026.4.24. File: extensions/bonjour/index.js (and the extensions/bonjour/src/... sources it builds from).

Suggested fix

Two changes to extensions/bonjour/index.js:

-import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
+import { isTruthyEnvValue, registerUnhandledRejectionHandler } from "openclaw/plugin-sdk/runtime-env";

-   }, { logger: api.logger })).stop };
+   }, { logger: api.logger, registerUnhandledRejectionHandler })).stop };

Verified locally — three watchdog teardowns post-patch produced zero unhandled rejections, zero stability bundles, gateway stayed up.

Secondary issue: STUCK_ANNOUNCING_MS = 8000 is too tight

Even with the rejection swallowed, the watchdog still tears down the advertiser on every restart in our environment (announce phase consistently takes 12–13s). Suggest raising the default to 2e4 (20s) — eliminates the false-positive teardown without weakening the stuck-state recovery.

Steps to reproduce

On a LAN with normal mDNS probe latency (~10–13s for the announce phase), the bonjour watchdog at line ~227 fires recreateAdvertiser(...) after STUCK_ANNOUNCING_MS = 8000. The teardown calls responder.shutdown() which cancels in-flight ciao promises, producing:

[plugins] bonjour: restarting advertiser (service stuck in announcing for 12925ms ...) [openclaw] Unhandled promise rejection: CIAO ANNOUNCEMENT CANCELLED [openclaw] wrote stability bundle: ~/.openclaw/logs/stability/openclaw-stability-...-unhandled_rejection.json

Process exits. Three reproductions in 24h on a single mac-mini host.

Root cause

The plugin defines handleCiaoUnhandledRejection at index.js:102 with the correct classification logic, and uses deps.registerUnhandledRejectionHandler at index.js:153 to install it — if that dep is provided. But the plugin entry at line 287 invokes startGatewayBonjourAdvertiser({...}, { logger: api.logger }) and never passes registerUnhandledRejectionHandler. So cleanupUnhandledRejection resolves to undefined, the handler is never installed, and ciao's teardown rejection escapes to the host's process-level handler which calls process.exit(1).

For comparison: extensions/telegram/probe-ChPXZhx2.js and extensions/whatsapp/monitor-BifLJ1dl.js import registerUnhandledRejectionHandler directly from openclaw/plugin-sdk/runtime-env and install handlers themselves.

Suggested fix

Two changes to extensions/bonjour/index.js:

-import { isTruthyEnvValue } from "openclaw/plugin-sdk/runtime-env";
+import { isTruthyEnvValue, registerUnhandledRejectionHandler } from "openclaw/plugin-sdk/runtime-env";

-   }, { logger: api.logger })).stop };
+   }, { logger: api.logger, registerUnhandledRejectionHandler })).stop };

Verified locally — three watchdog teardowns post-patch produced zero unhandled rejections, zero stability bundles, gateway stayed up.

Secondary issue: STUCK_ANNOUNCING_MS = 8000 is too tight

Even with the rejection swallowed, the watchdog still tears down the advertiser on every restart in our environment (announce phase consistently takes 12–13s). Suggest raising the default to 2e4 (20s) — eliminates the false-positive teardown without weakening the stuck-state recovery.

Expected behavior

The watchdog should be able to tear down and restart the advertiser without crashing the gateway. The plugin already contains the correct classification logic in handleCiaoUnhandledRejection — it just isn't wired up because registerUnhandledRejectionHandler isn't passed through to the entry point. Either the handler is installed (so cancellation rejections are swallowed by design), or the watchdog's teardown path doesn't produce them in the first place. Either outcome leaves the gateway running across watchdog-triggered restarts.

Actual behavior

The bonjour watchdog detects the mDNS advertiser stuck in the announcing phase (typical on LANs where ciao's announce takes 12–13s but STUCK_ANNOUNCING_MS = 8000), calls recreateAdvertiser(), which calls responder.shutdown(), which cancels in-flight ciao promises. Those produce "CIAO ANNOUNCEMENT CANCELLED" rejections. Because the bonjour plugin's unhandled-rejection handler is never installed (registerUnhandledRejectionHandler is not passed into startGatewayBonjourAdvertiser), the rejection escapes to the host process handler, a stability bundle is written, and the gateway exits with code 1. Reproduced three times in 24 hours on a single Mac Mini host running 2026.4.24.

OpenClaw version

2026.4.24 (cbcfdf6)

Operating system

OS: macOS Tahoe 26.x

Install method

npm install -g openclaw (Homebrew npm)

Model

claude-sonnet 4.6

Provider / routing chain

Not on a model request path. This bug is in the local mDNS service advertiser — the path is: bonjour plugin (extensions/bonjour) → ciao library → mDNS over UDP 5353 (LAN multicast) No HTTP gateway, no proxy, no LLM provider, no model router involved. The crash originates from a cancelled promise in ciao when the watchdog tears down the advertiser; LLM routing is unrelated.

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response