openclaw - ✅(Solved) Fix [Bug]: Lobster workflow calling llm-task fails with “No callable tools remain” when tools.alsoAllow includes lobster/llm-task [4 pull requests, 1 comments, 2 participants]

Q: Expected behavior

`llm-task` should be able to run its JSON-only embedded model call with tools disabled, without the explicit tool allowlist guard treating that as a configuration failure.

openclaw2026-04-29 03:00:44

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#74019•Fetched 2026-04-30 06:29:46

View on GitHub

Comments

Participants

Timeline

Reactions

Author

technicallysecure

Participants

clawsweeper[bot]

technicallysecure

Timeline (top)

cross-referenced ×8commented ×1labeled ×1mentioned ×1

Running a .lobster workflow through /tools/invoke works until the workflow calls llm-task. llm-task appears to start an embedded model run with tools intentionally disabled, but the explicit tool allowlist from tools.alsoAllow / agents.main.tools.alsoAllow is still checked and causes the run to fail.

Error Message

Observed error message:

{"subsystem":"diagnostic"} lane task error: lane=session:agent:main:explicit:llm-task-... durationMs=306 error="Error: No callable tools remain after resolving explicit tool allowlist (tools.allow: , lobster, llm-task; agents.main.tools.allow:, lobster, llm-task); tools are disabled for this run. Fix the allowlist or enable the plugin that registers the requested tool."

Root Cause

Fix Action

Fixed

Fixed by PR: fix(tools): skip allowlist guard when tools are explicitly disabled (https://github.com/openclaw/openclaw/pull/74139)
Fixed by PR: fix(telegram): honor ALL_PROXY and OPENCLAW_PROXY_URL in transport (https://github.com/openclaw/openclaw/pull/74151)
Fixed by PR: fix: catch croner errors in cron gateway handlers and fix false-positive allowlist error (https://github.com/openclaw/openclaw/pull/74306)

PR fix notes

PR #74139: fix(tools): skip allowlist guard when tools are explicitly disabled

Repository: openclaw/openclaw
Author: SymbolStar
State: open | merged: False
Link: https://github.com/openclaw/openclaw/pull/74139

Description (problem / solution / changelog)

Summary

When an embedded model run (e.g. llm-task invoked from a Lobster workflow) intentionally disables tools, the explicit tool allowlist guard from the parent session's tools.alsoAllow config should not fire.

Root Cause

buildEmptyExplicitToolAllowlistError in src/agents/tool-allowlist-guard.ts would see:

sources.length > 0 (from parent config's alsoAllow entries like lobster, llm-task)
callableToolNames.length === 0 (tools are intentionally disabled for the embedded run)

This combination triggered the error: "No callable tools remain after resolving explicit tool allowlist ... tools are disabled for this run".

Fix

Early-return null from the guard when disableTools === true, since disabling tools is an intentional choice that should not be treated as a configuration failure. Removed the now-unreachable disableTools branch from the error reason.

Fixes #74019

Changed files

src/agents/tool-allowlist-guard.test.ts (modified, +2/-3)
src/agents/tool-allowlist-guard.ts (modified, +6/-6)

PR #74151: fix(telegram): honor ALL_PROXY and OPENCLAW_PROXY_URL in transport

Repository: openclaw/openclaw
Author: SymbolStar
State: closed | merged: False
Link: https://github.com/openclaw/openclaw/pull/74151

Description (problem / solution / changelog)

Root Cause

Telegram's undici-based transport (introduced ~v2026.4.24) creates its own EnvHttpProxyAgent dispatcher, but the env-proxy gate hasEnvHttpProxyConfigured('https') only checks HTTP_PROXY/HTTPS_PROXY — it ignores ALL_PROXY/all_proxy. Additionally, in installed-service environments (e.g. macOS launchd), the service env policy strips ambient proxy vars and only persists OPENCLAW_PROXY_URL, which Telegram's transport never consulted.

This caused proxy-dependent environments (e.g. mainland China) to get ETIMEDOUT/EHOSTUNREACH/UND_ERR_CONNECT_TIMEOUT errors after upgrading from v2026.4.22 to v2026.4.26.

Changes

extensions/telegram/src/fetch.ts

Switch env-proxy detection from hasEnvHttpProxyConfigured('https') → hasEnvHttpProxyAgentConfigured() which also considers ALL_PROXY/all_proxy
Pass resolveEnvHttpProxyAgentOptions() to EnvHttpProxyAgent constructor so undici receives explicit httpProxy/httpsProxy values derived from ALL_PROXY (undici's EnvHttpProxyAgent does not natively read ALL_PROXY)
Fall back to OPENCLAW_PROXY_URL env var as an explicit proxy when no standard proxy env vars are available — covers installed-service environments

src/plugin-sdk/fetch-runtime.ts

Export hasEnvHttpProxyAgentConfigured and resolveEnvHttpProxyAgentOptions from the plugin SDK so extensions can use the ALL_PROXY-aware helpers

Fixes #74014
#74086 (Windows variant of same root cause) may also benefit from this fix

Changed files

extensions/telegram/src/fetch.ts (modified, +15/-4)
src/agents/tool-allowlist-guard.test.ts (modified, +2/-3)
src/agents/tool-allowlist-guard.ts (modified, +6/-6)
src/plugin-sdk/fetch-runtime.ts (modified, +2/-0)

PR #74306: fix: catch croner errors in cron gateway handlers and fix false-positive allowlist error

Repository: openclaw/openclaw
Author: w-sss
State: closed | merged: False
Link: https://github.com/openclaw/openclaw/pull/74306

Description (problem / solution / changelog)

Problem

#74066 — Invalid cron expressions return `UNAVAILABLE` instead of `INVALID_REQUEST`

When a user passes an invalid --cron expression (e.g. "not-a-cron-expr" or "99 * * * *"), the croner library throws a raw TypeError (bad shape) or RangeError (out-of-range field) from inside context.cron.add(...) / context.cron.update(...). The throw escapes the handler, is caught by the WS dispatcher's catch-all, and mapped to ErrorCodes.UNAVAILABLE — a false-positive ERROR-level log that looks like a real gateway crash.

The same gap exists in cron.remove, cron.list, and cron.status.

#74019 — Lobster `llm-task` fails with "No callable tools remain"

When tools.alsoAllow is configured (e.g. ["lobster", "llm-task"]) but the caller sets disableTools: true (as the llm-task plugin does), the allowlist guard falsely reports an error because config-level allowlists exist but all tools are intentionally disabled.

Fix

Cron handlers (`src/gateway/server-methods/cron.ts`)

Wraps context.cron.add/update/remove/list/status calls in try/catch blocks, converting any thrown errors to INVALID_REQUEST responses with descriptive error messages.

Tool allowlist guard (`src/agents/tool-allowlist-guard.ts`)

When disableTools: true and no runtime toolsAllow is passed, the empty tool set is intentional — the guard now returns null instead of an error, even when config-level allowlists exist.

Tests

tool-allowlist-guard.test.ts: Added test case for disableTools without runtime toolsAllow

Changed files

src/agents/tool-allowlist-guard.test.ts (modified, +12/-0)
src/agents/tool-allowlist-guard.ts (modified, +10/-0)
src/cli/capability-cli.test.ts (modified, +23/-0)
src/cli/capability-cli.ts (modified, +5/-1)
src/gateway/server-methods/cron.ts (modified, +75/-13)

PR #74841: fix(agents): skip tool allowlist empty guard for LLM-only runs

Repository: openclaw/openclaw
Author: andyliu
State: closed | merged: False
Link: https://github.com/openclaw/openclaw/pull/74841

Description (problem / solution / changelog)

Summary

Targeted single-fix PR.

Closes #74810

🤖 Generated with Claude Code

Changed files

src/agents/tool-allowlist-guard.ts (modified, +4/-0)

Code Example

"tools": {
  "alsoAllow": ["lobster", "llm-task"]
}

---

"agents": {
  "list": [
    {
      "id": "main",
      "tools": {
        "alsoAllow": ["lobster", "llm-task"]
}
    }
  ]
}

---

- id: debug_openclaw
    pipeline: >
      openclaw.invoke --tool llm-task --action json --args-json '{"prompt":"What is the purpose of a rubber duck?", "timeoutMs": 600000}'
    timeout_ms: 6000000

---

curl -sS http://127.0.0.1:18789/tools/invoke \
  -H "Authorization: Bearer $OPENCLAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "args": {
      "action": "run",
      "pipeline": "debug-workflow.lobster",
      "timeoutMs": 600000
    }
  }'

---

RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

Summary

Steps to reproduce

Config:

"tools": {
  "alsoAllow": ["lobster", "llm-task"]
}

If agent-level config is present:

"agents": {
  "list": [
    {
      "id": "main",
      "tools": {
        "alsoAllow": ["lobster", "llm-task"]
}
    }
  ]
}

step in .lobster:

- id: debug_openclaw
    pipeline: >
      openclaw.invoke --tool llm-task --action json --args-json '{"prompt":"What is the purpose of a rubber duck?", "timeoutMs": 600000}'
    timeout_ms: 6000000

Invoke:

curl -sS http://127.0.0.1:18789/tools/invoke \
  -H "Authorization: Bearer $OPENCLAW_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "args": {
      "action": "run",
      "pipeline": "debug-workflow.lobster",
      "timeoutMs": 600000
    }
  }'

Expected behavior

llm-task should be able to run its JSON-only embedded model call with tools disabled, without the explicit tool allowlist guard treating that as a configuration failure.

Actual behavior

Observed error message:

{"subsystem":"diagnostic"} lane task error: lane=session:agent:main:explicit:llm-task-... durationMs=306 error="Error: No callable tools remain after resolving explicit tool allowlist (tools.allow: , lobster, llm-task; agents.main.tools.allow:, lobster, llm-task); tools are disabled for this run. Fix the allowlist or enable the plugin that registers the requested tool."

OpenClaw version

OpenClaw 2026.4.26 (be8c246)

Operating system

macOS 26.4

Install method

npm global

Model

anthropic sonnet 4.6 / ollama gemma4:26b

Provider / routing chain

localhost (curl command)

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

This blocks using Lobster workflows with llm-task from the main agent/workspace. A separate workflow agent can work around it, but that is awkward when workflows need to operate in the main agent workspace/session context.

Additional information

No response

extent analysis

TL;DR

The llm-task fails due to the explicit tool allowlist check, even though tools are intentionally disabled for the embedded model run.

Guidance

Review the tools.alsoAllow and agents.main.tools.alsoAllow configurations to ensure they are correctly set to allow llm-task and lobster.
Verify that the llm-task is correctly configured to disable tools for the embedded model run.
Check if there are any other allowlist configurations that might be overriding the tools.alsoAllow and agents.main.tools.alsoAllow settings.
Consider creating a separate workflow agent to work around the issue, as mentioned in the impact and severity section.

Example

No code snippet is provided as it is not clearly supported by the issue.

Notes

The issue seems to be related to the configuration of the llm-task and the allowlist settings. The provided information is not sufficient to determine the exact cause of the issue, but reviewing the configurations and verifying the llm-task setup should help identify the problem.

Recommendation

Apply workaround: Create a separate workflow agent to work around the issue, as this is mentioned as a possible solution in the impact and severity section. This will allow workflows to operate in a separate context, avoiding the allowlist check issue.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

llm-task should be able to run its JSON-only embedded model call with tools disabled, without the explicit tool allowlist guard treating that as a configuration failure.

#prompt template #agent execution #callback error #memory management #API rate limit

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

openclaw - ✅(Solved) Fix [Bug]: Lobster workflow calling llm-task fails with “No callable tools remain” when tools.alsoAllow includes lobster/llm-task [4 pull requests, 1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Error Message

Root Cause

Fix Action

Fixed

PR fix notes

PR #74139: fix(tools): skip allowlist guard when tools are explicitly disabled

Description (problem / solution / changelog)

Summary

Root Cause

Fix

Changed files

PR #74151: fix(telegram): honor ALL_PROXY and OPENCLAW_PROXY_URL in transport

Description (problem / solution / changelog)

Root Cause

Changes

Related

Changed files

PR #74306: fix: catch croner errors in cron gateway handlers and fix false-positive allowlist error

Description (problem / solution / changelog)

Problem

#74066 — Invalid cron expressions return UNAVAILABLE instead of INVALID_REQUEST

#74019 — Lobster llm-task fails with "No callable tools remain"

Fix

Cron handlers (src/gateway/server-methods/cron.ts)

Tool allowlist guard (src/agents/tool-allowlist-guard.ts)

Tests

Changed files

PR #74841: fix(agents): skip tool allowlist empty guard for LLM-only runs

Description (problem / solution / changelog)

Summary

Changed files

Code Example

Bug type

Beta release blocker

Summary

Steps to reproduce

Expected behavior

Actual behavior

OpenClaw version

Operating system

Install method

Model

Provider / routing chain

Additional provider/model setup details

Logs, screenshots, and evidence

Impact and severity

Additional information

extent analysis

TL;DR

Guidance

Example

Notes

Recommendation

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING

#74066 — Invalid cron expressions return `UNAVAILABLE` instead of `INVALID_REQUEST`

#74019 — Lobster `llm-task` fails with "No callable tools remain"

Cron handlers (`src/gateway/server-methods/cron.ts`)

Tool allowlist guard (`src/agents/tool-allowlist-guard.ts`)