openclaw - 💡(How to fix) Fix [Bug]: fire-and-forget async flush() calls in draft-stream-loop lack error handling [1 pull requests]

Severity Assessment

CVSS Assessment

Threat Model Alignment

Classification: security-specific

The issue crosses a documented trust boundary because attacker-controlled input can trigger behavior that the protected component should reserve for authorized callers. This is exploitable vulnerability behavior rather than advisory hardening because the current implementation permits a concrete security property violation.

Impact

The flush() async function is called with void (fire-and-forget) in the schedule() callback without a .catch() handler. If flush() throws or returns a rejected promise (e.g., if sendOrEditStreamMessage fails), the rejection becomes an unhandled promise rejection, potentially causing streaming messages to be silently lost.

Affected Component

File: src/channels/draft-stream-loop.ts:60 and 75

// Line 60 - inside schedule()
timer = setTimeout(() => {
  void flush();  // <-- no .catch() handler
}, delay);

// Line 75 - inside update()
if (!timer && Date.now() - lastSentAt >= params.throttleMs) {
  void flush();  // <-- no .catch() handler
  return;
}

Technical Reproduction

1. Use any OpenClaw channel that sends streaming messages (e.g., Slack, Discord, Webchat)
2. The channel uses createDraftStreamLoop to throttle streaming updates
3. If flush() encounters an error (e.g., sendOrEditStreamMessage rejects due to network failure), the error propagates as an unhandled rejection
4. The rejection is discarded by void with no error handler, and the streaming message may be silently lost

Demonstrated Impact

The flush async function (lines 20-52):

• Awaits inFlightPromise — can reject if previous send failed
• Awaits params.sendOrEditStreamMessage(text) — network/file operations can throw

If sendOrEditStreamMessage rejects, the await current at line 42 throws, and the resulting promise from flush() is discarded by void. This can cause streaming message delivery to silently fail without the caller knowing.

Environment

Verified against OpenClaw release v2026.5.12 published at 2026-05-14T18:28:04Z, with source commit target main, at src/channels/draft-stream-loop.ts.

Remediation Advice

Add a .catch() handler to the void flush() calls, or modify the schedule() function to handle errors from flush(). Consider logging errors for debugging while not blocking the streaming flow. Alternatively, use a pattern where errors are captured and reported through a callback mechanism.