PR #70535: fix(logging): tolerate malformed subsystem labels (#70502)

• Repository: openclaw/openclaw
• Author: deepujain
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/70535

Description (problem / solution / changelog)

Summary

• Problem: the logging console filter path assumed subsystem was always a string and could throw on startsWith(...) when a malformed log entry reached it.
• Why it matters: this shows up while the gateway is already in trouble, so a logging exception can turn one bad event into a repeated error loop.
• What changed: made the console subsystem filter null-safe, normalized malformed subsystem labels inside subsystem loggers, and added regression coverage for both the filter check and console emission paths.
• What did NOT change (scope boundary): this does not change normal subsystem filtering behavior for valid labels, and it does not change log-level policy.

Change Type (select all)

• Bug fix
• Feature
• Refactor required for the fix
• Docs
• Security hardening
• Chore/infra

Scope (select all touched areas)

• Gateway / orchestration
• Skills / tool execution
• Auth / tokens
• Memory / storage
• Integrations
• API / contracts
• UI / DX
• CI/CD / infra

Linked Issue/PR

• Closes #70502
• Related #
• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: logging helpers called startsWith(...) on subsystem/message values that were typed as strings but could still be malformed at runtime during error handling.
• Missing detection / guardrail: there was no regression test for malformed subsystem labels under an active console filter or during console emission.
• Contributing context (if known): once the gateway enters an error path, logging code gets exercised repeatedly, so a small null-safety hole can keep the loop alive.

Regression Test Plan (if applicable)

• Coverage level that should have caught this:
  • Unit test
  • Seam / integration test
  • End-to-end test
  • Existing coverage already sufficient
• Target test or file: src/logging/subsystem.test.ts
• Scenario the test should lock in: missing subsystem labels do not throw when filters are active, isEnabled() stays safe, and console emission falls back to [unknown] instead of crashing.
• Why this is the smallest reliable guardrail: the failure is inside pure logging helpers, so a focused logging unit test catches it without needing a flaky gateway repro.
• Existing test that already covers this (if any): None.
• If no new test is added, why not: N/A

User-visible / Behavior Changes

Malformed subsystem labels no longer crash console logging. If one slips through, console output falls back to [unknown].

Diagram (if applicable)

Before:
bad log entry -> subsystem filter/probe suppression -> startsWith on undefined -> logging crash

After:
bad log entry -> subsystem normalized/guarded -> console logging continues -> gateway stays up

Security Impact (required)

• New permissions/capabilities? (No)
• Secrets/tokens handling changed? (No)
• New/changed network calls? (No)
• Command/tool execution surface changed? (No)
• Data access scope changed? (No)
• If any Yes, explain risk + mitigation:

Repro + Verification

Environment

• OS: macOS (local focused validation)
• Runtime/container: repo unit-fast Vitest harness
• Model/provider: N/A
• Integration/channel (if any): N/A
• Relevant config (redacted): console subsystem filter enabled

Steps

1. Enable a console subsystem filter.
2. Route a malformed or missing subsystem label through subsystem logging.
3. Check whether the logging helper throws or safely ignores/emits the line.

Expected

• Logging should not throw. Filter checks should treat missing subsystem labels as non-matches, and console output should stay stable.

Actual

• Before this patch, a malformed subsystem label could hit startsWith(...) and crash inside the logging path.

Evidence

• Failing test/log before + passing after
• Trace/log snippets
• Screenshot/recording
• Perf numbers (if relevant)

Focused validation:

• OPENCLAW_VITEST_INCLUDE_FILE=/tmp/openclaw-70502-vitest-include.json pnpm exec vitest run --config test/vitest/vitest.unit-fast.config.ts
• Passed:
  • src/logging/subsystem.test.ts

Issue evidence:

• Reported repeated gateway failure: TypeError: Cannot read properties of undefined (reading 'startsWith')

Human Verification (required)

• Verified scenarios: exercised filter checks and subsystem logger emission with malformed subsystem labels; both paths now stay non-throwing.
• Edge cases checked: active console filter, isEnabled(..., "console"), and warn-level console emission with a missing subsystem label.
• What you did not verify: I did not reproduce the original long-running gateway failure loop end to end, and I did not run the full repo test suite in this environment.

Review Conversations

• I replied to or resolved every bot review conversation I addressed in this PR.
• I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

• Backward compatible? (Yes)
• Config/env changes? (No)
• Migration needed? (No)
• If yes, exact upgrade steps:

Risks and Mitigations

• Risk: malformed subsystem labels now render as [unknown], which is less specific than a real label.
  • Mitigation: the fallback is only used for invalid input, and it keeps the logging path alive instead of crashing.

Changed files

• src/logging/console.ts (modified, +17/-2)
• src/logging/subsystem.test.ts (modified, +27/-1)
• src/logging/subsystem.ts (modified, +34/-17)
• src/plugins/contracts/plugin-sdk-package-contract-guardrails.test.ts (modified, +1/-0)