PR #73566: fix(cli): handle closed plugin uninstall prompt

• Repository: openclaw/openclaw
• Author: ai-hpc
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/73566

Description (problem / solution / changelog)

Summary

• Problem: openclaw plugins uninstall <id> could leave the confirmation prompt await unsettled when stdin closed before an answer, causing Node to exit 13 with Detected unsettled top-level await.
• Why it matters: CI/scripts/detached shells get an internal Node crash instead of a clear CLI error; operators do not learn to use --force for non-interactive uninstall.
• What changed: promptYesNo() now detects readline close/EOF before an answer and throws a typed prompt-closed error; plugins uninstall catches that case and exits 1 with an actionable message.
• What did NOT change (scope boundary): Piped y / n answers and plugins uninstall --force remain supported; this does not change install records, uninstall planning, or plugin deletion semantics.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #73562
• Related #73551
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: promptYesNo() awaited readline.question() without handling readline close / EOF, so closed stdin could leave the top-level CLI await unsettled.
• Missing detection / guardrail: Existing prompt and uninstall tests covered normal answers and --force, but not EOF-before-answer.
• Contributing context (if known): plugins uninstall already supports --force, but the interactive path did not fail cleanly when no confirmation input was possible.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/cli/prompt.test.ts, src/cli/plugins-cli.uninstall.test.ts
• Scenario the test should lock in: readline close before an answer rejects with PromptInputClosedError; plugins uninstall converts that specific prompt failure into exit 1 without config/index/file mutation.
• Why this is the smallest reliable guardrail: The bug is in the prompt helper and uninstall command handler; focused tests cover both the shared primitive and command-level UX.
• Existing test that already covers this (if any): None.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

openclaw plugins uninstall <id> < /dev/null now fails with a clear CLI error instead of surfacing Node's unsettled top-level-await warning. Users can rerun interactively, pipe y/n, or pass --force for non-interactive uninstall.

Diagram (if applicable)

Before:
closed stdin -> readline question never answers -> unsettled top-level await -> Node exit 13

After:
closed stdin -> prompt close detected -> plugins uninstall exits 1 with --force guidance

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

• OS: Ubuntu/Linux
• Runtime/container: Node 22.22.1, pnpm dev checkout
• Model/provider: N/A
• Integration/channel (if any): Plugins CLI
• Relevant config (redacted): A managed plugin entry or install record for the uninstall target

Steps

1. Ensure plugins uninstall <id> targets a managed plugin entry or install record.
2. Run openclaw plugins uninstall <id> < /dev/null without --force.
3. Observe the command result.

Expected

• CLI exits 1 with an actionable confirmation-input error.
• No config, install index, or plugin file mutation occurs.

Actual

• Before this change, the prompt path could surface Node's Detected unsettled top-level await and exit 13.
• After this change, the closed-input case is detected and handled before mutation.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Local verification:

• pnpm test src/cli/prompt.test.ts src/cli/plugins-cli.uninstall.test.ts -- --reporter=verbose
• pnpm check:changed -- --base upstream/main
• git diff --check HEAD
• Direct closed-stdin smoke against patched promptYesNo(): returns PromptInputClosedError with process exit 0 in the harness instead of Node exit 13.

Human Verification (required)

• Verified scenarios: Prompt close before answer; uninstall prompt-close command path; existing --force uninstall path; normal prompt default/y/n behavior.
• Edge cases checked: The fix avoids a blanket non-TTY ban, so piped answers remain supported by design.
• What you did not verify: Full packaged pnpm openclaw plugins uninstall <id> < /dev/null against a real installed plugin, because the focused prompt and CLI seams directly cover the root cause.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: promptYesNo() is shared by a few CLI flows, so changing EOF handling can affect other confirmation prompts.
  • Mitigation: The new behavior only triggers when readline closes before an answer; normal answers, defaults, and global --yes remain covered by existing prompt tests.

Changed files

• src/cli/plugins-cli-test-helpers.ts (modified, +7/-0)
• src/cli/plugins-cli.ts (modified, +20/-2)
• src/cli/plugins-cli.uninstall.test.ts (modified, +52/-0)
• src/cli/prompt.test.ts (modified, +35/-3)
• src/cli/prompt.ts (modified, +35/-2)

PR #73654: fix(cli): make crestodian exit non-zero on no-TTY (#73646)

• Repository: openclaw/openclaw
• Author: hclsys
• State: closed | merged: False
• Link: https://github.com/openclaw/openclaw/pull/73654

Description (problem / solution / changelog)

What

Fixes #73646. pnpm openclaw crestodian < /dev/null (and node ./dist/index.js crestodian < /dev/null) currently:

1. Detects no TTY
2. Prints Crestodian needs an interactive TTY. Use --message for one command. to stderr
3. Returns from runCrestodian cleanly — no thrown error, no process.exitCode set
4. The CLI wrapper runCommandWithRuntime only sets runtime.exit(1) in its catch path, so the silent return falls through and Node exits 0

Shell scripts and CI flows reading $? see success and proceed as if Crestodian ran. The two in-tree sibling subcommands for the same condition (models auth login, secrets configure) both throw new Error("…") and exit non-zero. The bare-root crestodian path at cli/run-main.ts:399-404 also already sets process.exitCode = 1 directly. Crestodian-as-subcommand is the lone outlier.

Fix

Replace the silent runtime.error(...) + return in src/crestodian/crestodian.ts:93-96 with a throw new Error(...). The CLI wrapper's catch then runs runtime.error + exit(1) and the process exits non-zero. Behavior matches the bare-root path and the models auth login / secrets configure precedents.

if (!interactive || !inputIsTty || !outputIsTty) {
  throw new Error("Crestodian needs an interactive TTY. Use --message for one command.");
}

Verified locally

npx oxlint src/crestodian/crestodian.ts src/crestodian/crestodian.test.ts
# Found 0 warnings and 0 errors.

npx vitest run src/crestodian/crestodian.test.ts
# Tests  4 passed (4)

The new test pins the regression: runCrestodian({ input: { isTTY: false }, output: { isTTY: false } }) rejects with /needs an interactive TTY/ so the CLI wrapper's catch fires.

Pre-implement audit

1. Existing-helper check. Error message + pattern reused verbatim from sibling subcommands (models auth login, secrets configure); setup-token uses the identical throw new Error("… requires an interactive TTY.") shape. ✅
2. Shared-helper caller check. runCrestodian is called from 4 sites — cli/run-main.ts:423,433, cli/program/register.onboard.ts:182, cli/program/register.crestodian.ts:30 — all wrapped in runCommandWithRuntime (or runCommandWithRuntime-style catch in run-main.ts). All four catch paths surface the thrown error and exit non-zero. ✅
3. Broader-fix rival scan. Zero rival PRs reference #73646. ✅

Note

#73562 (plugins uninstall < /dev/null exits 13) is a separate bug filed by the same reporter — wrong exit code there, but at least non-zero. Not addressed here.

lobster-biscuit: 73646-crestodian-no-tty-exit

Sign-Off:

• I have read and agree to the OpenClaw Contributor License Agreement.

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/crestodian/crestodian.test.ts (modified, +21/-0)
• src/crestodian/crestodian.ts (modified, +6/-2)