Issue Draft - OpenClaw CLI invocation 1006

Title

openclaw cron ... and non-direct CLI invocations can fail with 1006; direct gateway call via /opt/homebrew/bin/openclaw is the only stable path observed

Severity

S2

Summary

There are two overlapping bugs behind the same 1006 abnormal closure symptom:

1. cron namespace regression
2. structural CLI invocation / bootstrap failure outside the most direct launch path

The scheduler and gateway remain healthy. The failure is in the CLI path, not in cron execution itself.

User Impact

• openclaw cron status|list|run is unreliable or broken
• wrappers and subprocess-based automation can fail even when the gateway is healthy
• operators may misdiagnose the incident as "cron dead" when cron.* RPC still works

Known Good Path

/opt/homebrew/bin/openclaw gateway call cron.status --json

Broken Paths

Direct cron regression:

/opt/homebrew/bin/openclaw cron status --json

Non-direct invocation failures:

~/.openclaw/bin/openclaw-secure gateway call cron.status --json
/bin/zsh -lc '/opt/homebrew/bin/openclaw gateway call cron.status --json'
OPENCLAW_NO_RESPAWN=1 /opt/homebrew/bin/openclaw gateway call cron.status --json

Expected Result

All supported CLI invocation paths should either:

• successfully complete the same RPC call, or
• fail with a clear credential/config error

They should not collapse into 1006 abnormal closure for healthy local gateway operation.

Actual Result

Observed failure:

Error: gateway closed (1006 abnormal closure (no close frame)): no close reason
Gateway target: ws://127.0.0.1:18789
Source: local loopback
Config: /Users/danilolima/.openclaw/openclaw.json
Bind: loopback

Important Diagnosis

Bug A - cron regression

cron status fails even when the equivalent RPC succeeds via gateway call.

That means cron still has its own regression.

Bug B1 - SecretRef / credential resolution can surface as 1006

Part of the failure class is credential resolution.

gateway.auth.token is configured via env/SecretRef, and some CLI paths reach:

• missing env var "OPENCLAW_GATEWAY_TOKEN"
• GatewaySecretRefUnavailableError

Relevant code:

• call-CQ0eH9Ew.js
• credentials-DyjdApQe.js

This shows that some 1006 errors are secondary to auth materialization failure before the WebSocket request completes.

Bug B2 - Bootstrap / handshake failure remains even with token present

Even when .env is explicitly loaded and OPENCLAW_GATEWAY_TOKEN is present, the following still fails:

set -a
source .env
set +a
OPENCLAW_NO_RESPAWN=1 /opt/homebrew/bin/openclaw gateway call cron.status --json

So credential absence is not the full explanation.

The self-respawn in entry.js is part of the only consistently healthy path, but respawn alone is not sufficient to fix all wrappers and indirect launches.

Minimal Reproduction Set

Control:

/opt/homebrew/bin/openclaw gateway call cron.status --json

Repro A:

/opt/homebrew/bin/openclaw cron status --json

Repro B1 or B2, depending on credential state:

/bin/zsh -lc '/opt/homebrew/bin/openclaw gateway call cron.status --json'

Repro B2 specifically:

OPENCLAW_NO_RESPAWN=1 /opt/homebrew/bin/openclaw gateway call cron.status --json

Most Likely Root Cause

This currently looks like a layered failure:

• cron-cli path remains regressed
• some non-direct invocation paths lose or fail SecretRef materialization
• independently, the non-respawned client path can still fail during bootstrap or handshake before hello completes

Suggested Repair Order

1. Treat cron regression and structural invocation bug as separate tickets if needed
2. Instrument final auth selection in the child process of gateway call
3. Compare healthy respawned process vs OPENCLAW_NO_RESPAWN=1
4. Inspect GatewayClient connect/hello/device-auth path for the remaining non-auth 1006

Acceptance Criteria

• /opt/homebrew/bin/openclaw cron status --json succeeds when gateway call cron.status succeeds
• indirect shells and wrappers do not fail with 1006 when the local gateway is healthy
• missing SecretRef/token cases surface a direct auth/config error, not a misleading WebSocket close
• OPENCLAW_NO_RESPAWN=1 /opt/homebrew/bin/openclaw gateway call cron.status --json either works or fails with an explicit, actionable reason

Supporting Notes

Detailed local analysis and evidence:

• openclaw-cli-invocation-1006-2026-04-03.md