PR #70937: fix(qqbot): schedule reminders through cron gateway

• Repository: openclaw/openclaw
• Author: GaosCode
• State: open | merged: False
• Link: https://github.com/openclaw/openclaw/pull/70937

Description (problem / solution / changelog)

Summary

• Problem: QQ Bot reminder requests used qqbot_remind to build cronParams, then instructed the agent to call the generic cron tool.
• Why it matters: cron is owner-only and can be hidden from QQ Bot channel runs, so reminder requests could stall after qqbot_remind returned.
• What changed: qqbot_remind now executes Gateway cron actions directly for owner-authorized senders, while keeping QQ delivery target/account resolution inside the QQ Bot tool boundary.
• What did NOT change (scope boundary): No generic cron behavior, Gateway cron schema, QQ Bot config, or channel docs were changed.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #70865
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: qqbot_remind returned cronParams and instructed the model to make a second call to the generic cron tool, but that tool is owner-only and can be filtered out for channel-originated QQ Bot runs.
• Missing detection / guardrail: There was no bridge-level test proving the QQ Bot reminder tool schedules directly from channel delivery context without depending on model-visible cron.
• Contributing context (if known): The QQ Bot skill instructions still described the old two-tool flow.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file:
  • extensions/qqbot/src/engine/tools/remind-logic.test.ts
  • extensions/qqbot/src/bridge/tools/remind.test.ts
• Scenario the test should lock in: qqbot_remind calls the cron scheduler directly for add/list/remove, uses QQ delivery context fallback, rejects non-owner sender context, and returns a clear Gateway cron error.
• Why this is the smallest reliable guardrail: It covers the QQ Bot tool bridge and reminder engine seam where the broken two-step contract lived, without requiring a live QQ Bot or Gateway process.
• Existing test that already covers this (if any): Existing engine tests covered cronParams construction only, not direct scheduling through the bridge.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

QQ Bot reminders now complete through a single qqbot_remind tool call for owner-authorized senders. Agents should no longer ask for or attempt a follow-up generic cron tool call after successful qqbot_remind execution.

Diagram (if applicable)

Before:
[QQ reminder request] -> [qqbot_remind returns cronParams] -> [agent must call hidden cron] -> [may stall]

After:
[QQ reminder request] -> [qqbot_remind calls Gateway cron directly] -> [scheduled/listed/removed result]

Security Impact (required)

• New permissions/capabilities? (Yes/No) Yes
• Secrets/tokens handling changed? (Yes/No) No
• New/changed network calls? (Yes/No) Yes
• Command/tool execution surface changed? (Yes/No) Yes
• Data access scope changed? (Yes/No) No
• If any Yes, explain risk + mitigation: qqbot_remind now performs the same Gateway cron operations that the agent was previously instructed to perform via cron. The tool is marked ownerOnly and also rejects execution unless senderIsOwner === true, preserving the owner-only boundary while avoiding a model-visible second tool call.

Repro + Verification

Environment

• OS: macOS
• Runtime/container: Node 22 / pnpm workspace
• Model/provider: N/A
• Integration/channel (if any): QQ Bot
• Relevant config (redacted): QQ Bot channel run where qqbot_remind is available and generic cron may be filtered by owner-only policy

Steps

1. Start from a QQ Bot reminder request such as “5分钟后提醒我喝水”.
2. Agent calls qqbot_remind with { "action": "add", "content": "喝水", "time": "5m" }.
3. qqbot_remind resolves QQ delivery context and schedules the Gateway cron job directly.

Expected

• Reminder scheduling succeeds without requiring a follow-up generic cron tool call.

Actual

• Before this fix, qqbot_remind returned cronParams and instructed the agent to call cron; in QQ Bot channel runs, cron could be hidden, so the flow could stall.

Evidence

Attach at least one:

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

pnpm test extensions/qqbot/src/engine/tools/remind-logic.test.ts extensions/qqbot/src/bridge/tools/remind.test.ts

Human Verification (required)

What you personally verified (not just CI), and how:

• Verified scenarios:
  • qqbot_remind is owner-only.
  • Owner-authorized bridge context schedules cron.add directly with QQ delivery target/account.
  • Missing owner context does not call cron.
  • Engine-level add/list/remove calls invoke the scheduler directly.
  • Validation failures do not invoke the scheduler.
  • Gateway cron failures return a clear error.
• Edge cases checked:
  • Missing add content.
  • Remove action with Gateway failure.
  • Ambient QQ delivery context fallback.
• What you did not verify:
  • Live QQ Bot delivery against Tencent QQ.
  • Live Gateway cron execution outside unit/seam tests.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes/No) Yes
• Config/env changes? (Yes/No) No
• Migration needed? (Yes/No) No
• If yes, exact upgrade steps: N/A

Risks and Mitigations

• Risk: Moving cron execution into qqbot_remind could accidentally widen scheduling access.
  • Mitigation: The tool is marked ownerOnly and performs an explicit senderIsOwner === true runtime check before scheduling.

Changed files

• extensions/qqbot/skills/qqbot-remind/SKILL.md (modified, +4/-8)
• extensions/qqbot/src/bridge/tools/remind.test.ts (added, +66/-0)
• extensions/qqbot/src/bridge/tools/remind.ts (modified, +87/-26)
• extensions/qqbot/src/engine/tools/remind-logic.test.ts (modified, +77/-1)
• extensions/qqbot/src/engine/tools/remind-logic.ts (modified, +78/-8)