openclaw - ✅(Solved) Fix Windows restart script builds ProcessStartInfo.Arguments via string concatenation without quoting embedded double-quotes [1 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#83890Fetched 2026-05-20 03:47:28
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
1
Timeline (top)
commented ×1cross-referenced ×1

Fix Action

Fix / Workaround

Severity: medium / Confidence: medium / Category: security Triage: risk Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Reasoning

ProcessStartInfo.Arguments accepts a raw Win32 command-line string. Join-OpenClawProcessArguments wraps space-containing tokens in double quotes but does not escape any embedded double-quote characters (") within those tokens. If a future caller passes an argument containing " (e.g. a path with embedded quotes) the generated command line would be malformed or injectable. Currently the task name is guarded by isWindowsTaskNameSafe (which rejects "), but the function is generic and reused for arbitrary schtasks arguments (/Run, /End, /Query), so a future argument added to those call sites could bypass the protection silently. The mitigation gap is that no existing argument source today produces ", giving medium confidence overall.


Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-0e1f16a0ce-_5f78528d40.

PR fix notes

PR #74163: WORKING: All Microsoft Issues and PRs (refresh)

Description (problem / solution / changelog)

Microsoft Ecosystem Issues & PRs Tracker

Purpose: Living checklist for maintainers to track all open Microsoft-related issues and PRs (Teams, Windows, WSL, Azure, M365/SharePoint).

How to use:

  • Mark items resolved by editing this PR body and changing [ ] to [x]
  • Claim items by adding your GitHub handle to the Assignee column
  • Priority guide: P0 = crash/blocker/security, P1 = significant bug/regression, P2 = minor bug/enhancement, P3 = nice-to-have/stale
  • Items marked (stale) have been flagged by the stale bot due to inactivity

Last updated: 2026-05-20 (closed #84395; refreshed Microsoft tracker counts)


Summary

CategoryIssuesPRsTotalClosedRemaining
MS Teams (channel plugin)64551942
Windows platform67381051788
WSL7411110
Azure8614212
SharePoint / M36500000
Total889318129152

1. MS Teams Channel Plugin — Issues

Bugs / Crashes

Resolved?Priority#TitleLabelsAssignee
[ ]P1#67177[msteams] Inbound file attachments silently fail in DMs — file.download.info downloadUrl not rewritten to Graph shares endpoint
[ ]P1#65329bug(msteams): DM inline images and file attachments silently dropped
[ ]P1#62765msteams dmPolicy=pairing silently drops unpaired senders with HTTP 200, no log line, no auto-reply
[ ]P2#42099fix(plugins): false-positive duplicate plugin ID warning on gateway start (msteams)P2 clawsweeper:no-new-fix-pr clawsweeper:needs-product-decision clawsweeper:source-repro clawsweeper:linked-pr-open issue-rating: 🦞 diamond lobster

Feature Requests

Resolved?Priority#TitleLabelsAssignee
[ ]P2#81084[Feature]: MSTeams channel-bound agents need opt-out from per-thread sessions

2. MS Teams Channel Plugin — PRs

Resolved?Priority#TitleSizeAssignee
[ ]P0#81729Remove system event trust metadataS
[ ]P0#81402refactor: move runtime state to SQLiteXL
[ ]P0#79972feat: add SQLite transcript frontier and delta APIXL
[ ]P0#79970feat: expose durable session id match selection helpersXL
[ ]P0#79925feat: context-pressure-aware continuation (continue_work / continue_delegate / request_compaction)XL
[ ]P0#63827fix(security): preserve dmPolicy settings during wizard runsXL
[ ]P0#60643feat(agents): cognitive processing scaffolding and structured memory promptS
[ ]P0#57511feat(msteams): Teams live voice support with .NET media workerXL
[ ]P0#55485Config: plumb opt-in SSRF policy for web fetch, citation redirects, and remote mediaL
[ ]P0#50875feat: add before_identity_resolve plugin hookM
[ ]P0#43190MS Teams: add channel archive persistence and deleted-channel cleanupXL
[ ]P0#37656feat: load workspace .env per-agent at exec timeS
[ ]P1#78172feat(tts): add skipEmojiSymbols option to prevent TTS from reading emoji/symbolsM
[ ]P1#77784Add Teams delegated auth for plugin toolsXL
[ ]P1#76262fix(msteams): rebase TeamsSDK patterns to simplify Teams IntegrationXL@BradGroux
[ ]P1#75043Add provider-aware automatic TTS emotion mappingXL
[x]P2#83973fix(msteams): mark external system events as non-ownerS@LaPhilosophie
[x]P2#84395fix(msteams,voice-call): large-file resumable upload + hang up rejected inbound callsXL@JorgeAlan
[ ]P2#82354fix(msteams): emit message:sent hook on reply deliveryM
[ ]P2#79609Show session cleanup dry-run counts by labelL
[ ]P2#79185fix(tts/xiaomi): support Token Plan TTS endpointS
[ ]P2#78839[codex] Add Teams member-info action gateS
[ ]P2#77921feat(inworld): default to inworld-tts-2 (Realtime TTS-2)XS
[ ]P2#76560feat(plugins): allow community plugins to use openKeyedStore with man…L@vincentkoc
[ ]P2#70287fix(msteams): drop unsupported $search on msteams:search (AI-assisted)M
[ ]P2#69428fix(msteams): paginate thread replies and keep recent contextS
[ ]P2#69417fix(mcp): allow SecretRef values in mcp.servers env and headers [AI-assisted]XL
[ ]P2#67761fix: remove truncated preview from inbound system eventsXS
[ ]P2#67460feat(mention-gating): suppress always-on agent when another agent is explicitly mentionedM
[ ]P2#67174Teams: support separate graphTenantId for cross-tenant Graph API accessM
[ ]P2#66327feat(msteams): implement sendPayload for interactive approval cardsM
[ ]P2#64503fix(msteams): forward messageBack card actions (Action.Submit) to agent (#60952)S
[ ]P2#63347feat(msteams): support webhook host bindingS
[ ]P2#60630fix(ci): Windows task tests and Telegram setup promotion surfaceL
[ ]P2#59986refactor(plugins): add lane-oriented channel interfaceXL
[ ]P2#59294fix(msteams): isolate thread sessions, outbound targeting, and attachment resolutionL
[ ]P2#57366fix(msteams): extract emoji unicode from Teams CDN img tags instead of treating as image attachmentsS
[ ]P2#57364fix(msteams): delete FileConsentCard after user accepts, declines, or upload expiresS
[ ]P2#55828feat(msteams): add native plugin interactivity parityXL

3. Windows Platform — Issues

Bugs / Crashes

Resolved?Priority#TitleLabelsAssignee
[ ]P0#48780[Bug]: [Windows] exec() and read() commands corrupted with </arg_value>> suffixbug bug:behavior P1 clawsweeper:no-new-fix-pr clawsweeper:needs-security-review clawsweeper:source-repro +4
[ ]P1#84001Windows: openclaw status / status --json hangs in 2026.5.18 while status --all succeedsP2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-live-repro impact:crash-loop issue-rating: 🐚 platinum hermit
[ ]P1#83943[Bug]: Session resource loader grows unbounded across warm turns — 5.x regression vs 4.23 baseline (Windows + Feishu + MiniMax OAuth)bug
[ ]P1#83277WhatsApp channel: "web login provider is not available" on Windows despite wacli installed and authenticatedbug bug:behavior P2 clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro +1
[ ]P1#80416[Bug] core-plugin-tools ~3.5s overhead on every embedded run persists after #75520 fix — Windows + Node 24 + isolated cron jobsP2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-live-repro impact:crash-loop
[ ]P1#80344[Bug]: Discord voice /vc join fails on Windows with AggregateError + gateway heartbeat timeout / event loop starvationbug bug:crash
[ ]P1#79437Prebuilt node-llama-cpp Windows binaries crash (0xC0000005) on Intel Alder Lake-N (N95) — qmd LLM half unusable
[ ]P1#77443[Bug]: WhatsApp event loop blocked (eventLoopDelayMaxMs=12088ms) on first inbound message — 2026.5.3-1 Windowsbug regression
[ ]P1#74378[Bug]: OpenClaw CLI commands remain alive as node.exe processes after execution on Windowsbug regression
[ ]P1#71865Auth login blocked by size-drop guard when openclaw.json was created by PowerShell (verbose/BOM format)
[ ]P1#71699[Bug]: Gateway hard-crashes with 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN) on Windows during Mattermost streaming reply; auto-respawn frequently wedges
[ ]P1#70788fix(windows): suppress startup-folder cmd window flash via wscript silent launcher
[ ]P1#68493[Bug]: Editing openclaw.json while gateway is running triggers hot-reload crash loop on Windows (stale lock file + EADDRINUSE)@vincentkoc
[ ]P1#67035[Bug]: 2026.4.14 Windows chat UI regression: input text swallowed, streamed replies often invisible until refresh, typing indicator flashes then blanks
[ ]P1#63257Windows Gateway Feishu API timeout 30s at startup
[ ]P1#62099EPERM on auth-profiles.json causes full gateway failure cascade (Windows)P1 clawsweeper:no-new-fix-pr clawsweeper:source-repro clawsweeper:linked-pr-open impact:auth-provider impact:crash-loop +1
[ ]P1#62055Windows: CLI crashes with stack overflow / heap OOM on v2026.4.5 (large ESM module graph exceeds V8 default stack)P1 clawsweeper:needs-live-repro impact:crash-loop issue-rating: 🐚 platinum hermit
[ ]P1#59362[Bug]: Windows: exec tool causes console window flash when spawning commandsbug regression P1 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review +3
[ ]P1#59281[Bug]: Windows plugin TS source-loading via jiti is pathologically slow in real production call sitesbug bug:behavior P2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-live-repro +2
[ ]P1#54669[Field Report] Chrome 136+ binds CDP to [::1] (IPv6) on Windows — portproxy v4tov4 breaks silentlyP1 clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro issue-rating: 🦞 diamond lobster
[ ]P1#44559[Bug]: Windows: Gateway 关闭 PowerShell 窗口后断连bug bug:behavior P2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review +4
[ ]P2#83890Windows restart script builds ProcessStartInfo.Arguments via string concatenation without quoting embedded double-quotes
[ ]P2#82594[Bug]: openclaw onboard extremely slow on Windows during model loading
[ ]P2#81673Build official OpenClaw companion downloads for Windows and Linux
[ ]P2#80650[Bug]: [Bug] openclaw backup create 在Windows上失败(退出代码255)bug
[ ]P2#79899DefaultResourceLoader.reload() blocks event loop for 12-15s on Windows due to synchronous filesystem scanningP2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:needs-live-repro +1
[ ]P2#79099Windows gateway probe still reports unreachable while gateway health is OK on 2026.5.6
[ ]P2#78640fix(memory): EPERM on Windows persists after 64187 retry — needs copyFile/unlink fallback (was in closed PR 71611)
[ ]P2#78435[Bug]: channels.slack.start-account phase blocks event loop 5+ minutes while a model_call is in flight (Windows, 2026.5.4)
[ ]P2#77730[Bug]: file-transfer plugin nodeHostCommands not advertised by Windows node host on live handshake (2026.5.3-1)
[ ]P2#76884[Bug]: OpenClaw on native Windows getting notably slower and slower with each new version???bug
[ ]P2#76702Windows + Feishu DM becomes very slow after upgrade to 2026.5.2; latency appears in agent/session processing, likely amplified by large session context
[ ]P2#76553[Bug]: Windows: Claude Code not detected by OpenClaw, Gateway in restart loop after PATH workaroundbug bug:behavior
[ ]P2#73859[Bug]: Built-in plugins (minimax, google, talk-voice) fail with RangeError: Maximum call stack size exceeded on Windows
[ ]P2#73059[Bug]: Windows linked source install can skip Control UI auto-build through junction-launched scripts/ui.js
[ ]P2#72922[Bug]: Sluggish response time and unstable Web GUI and CLI on Windows Server 2022bug
[ ]P2#71717exec tool returns EPERM on Windows, all commands failbug
[ ]P2#70451[Bug]: CLI hooks enable times out / SIGKILL on Windows
[ ]P2#66746[Bug] Windows memory indexing falls back to FTS-only in 2026.4.14 even though direct node:sqlite + sqlite-vec works
[ ]P2#66479Windows: skill not discovered due to UTF-8 BOM injected by PowerShell WriteAllText
[ ]P2#64443OpenClaw chat interface causes very high WindowServer CPU on Intel Retina iMac
[ ]P2#64253Gateway becomes unresponsive under subagent load on Windows - completion announcements timeout
[ ]P2#63491[Bug]: Windows Scheduled Task gateway restart/health becomes inconsistent after ready
[ ]P2#58433[Bug]: [Windows] Path character loss bug - "system" becomes "ystem" in file pathsbug bug:behavior P2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-info +1
[ ]P2#58139[Bug]: memory-lancedb plugin fails with Windows Docker bind mountbug bug:behavior P2 clawsweeper:no-new-fix-pr clawsweeper:source-repro clawsweeper:linked-pr-open +2
[ ]P2#56284Windows: gateway restart does not wait for active tasks and loses session stateP1 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:needs-live-repro +4
[ ]P2#56106Transcript JSONL encoding corrupted on Windows (GBK/UTF-8 mix)P2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-info impact:session-state impact:data-loss +1
[ ]P2#44293Make pnpm check:docs work in native PowerShellP2 clawsweeper:no-new-fix-pr clawsweeper:source-repro clawsweeper:linked-pr-open issue-rating: 🦞 diamond lobster
[ ]P2#44291Add native PowerShell smoke coverage for contributor commandsP2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision issue-rating: 🌊 off-meta tidepool
[ ]P2#40694Browser-opened temporary tabs/windows should close automatically after task completionP2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:source-repro +2
[ ]P2#40540[Bug]: openclaw update command fails with EBUSY error on Windowsbug bug:behavior P1 clawsweeper:source-repro issue-rating: 🦞 diamond lobster

Feature Requests

Resolved?Priority#TitleLabelsAssignee
[ ]P0#75Linux/Windows Clawdbot Appsenhancement help wanted P2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision +4
[ ]P1#82125[Feature] Windows: crash auto-restart parity with systemd Restart=always / launchd KeepAlive
[ ]P2#72595[Feature]: Feishu channel needs per-channel proxy bypass for mixed Windows proxy setupsenhancement
[ ]P2#57775Windows headless node host supports exec approvals via CLI, but nodes describe / Control UI do not advertise system.execApprovals.get/setP2 clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro issue-rating: 🦞 diamond lobster
[ ]P2#46590Feature Request: Add cron field to Agent configuration for Agent-owned scheduled tasksP2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision issue-rating: 🌊 off-meta tidepool
[ ]P2#18985[Feature]: Supports Windows 11 MSYS environment and Fishshell.enhancement P2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision +2
[ ]P2#7057Flaky tests on Windows/WSL: timeouts and ENOENT in pi-tools workspace-paths & safe-binsenhancement P2 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-live-repro issue-rating: 🐚 platinum hermit

4. Windows Platform — PRs

Resolved?Priority#TitleSizeAssignee
[ ]P0#81443fix: resolve QMD Windows shims and guard image URL downloadsM
[ ]P0#50116fix: handle Windows-style session paths when running on POSIXXS
[ ]P0#46956feat(cli): add trust windows for time-bounded exec approvalXL
[ ]P0#44215fix(path): add Windows PATH bootstrap dirsS
[ ]P0#38932docs(gateway): add Windows no-Docker hardening fallback guideXS
[ ]P2#81330fix(windows): suppress persistent cmd window from scheduled-task node launchXS
[ ]P2#80683fix(memory-lancedb): add retry mechanism for Windows Docker bind mount sync delaysS
[ ]P2#79694fix(update): hide post-core update and completion cache child windows on WindowsXS
[ ]P2#76245[codex] Fallback when Windows gateway task exits earlyS
[ ]P2#75649fix(windows): preserve staged update handoffXL
[ ]P2#74425fix: ensure CLI processes exit after command completion on WindowsS
[ ]P2#73889fix(cli): stabilize Windows scheduled-task restart health after readyS
[ ]P2#73751fix(exec): decode Windows command output with codepage-aware streamingM
[ ]P2#70762refactor(agents): share hook history windowsXL@vincentkoc
[ ]P2#69059fix: retry sqlite-vec load without .dll suffix on WindowsS
[ ]P2#68819fix: resolve Windows .cmd shims to underlying .exe before spawnM
[ ]P2#68725feat(amazon-bedrock-mantle): add known context windows for open-weight Mantle modelsS
[ ]P2#68149feat(daemon): use PowerShell Register-ScheduledTask for Windows auto-startM
[ ]P2#67655fix(exec): fail closed on Windows shell wrappers in allowlist modeXS
[ ]P2#64110feat: Deleting scheduled tasks also clears tasks in the queue.L
[ ]P2#63651fix: remove duplicate restart message on Windows (schtasks)S
[ ]P2#59705[codex] improve parallels windows smoke loggingM
[ ]P2#59013fix: tolerate EPERM in session write-lock on WindowsS
[ ]P2#51486fix(daemon): query Windows task runtime directlyS
[ ]P2#50136fix(windows): stabilize gateway restart and avoid false stale cleanup [AI-assisted]M
[ ]P2#48887Fix/docs format check windows cleanM
[ ]P2#48130fix: correct Windows Chrome executable path extraction regexXS
[ ]P2#45380Make env-prefixed npm scripts work on WindowsS
[ ]P2#44228fix(reply): normalize Windows media paths for dedupeXS
[ ]P2#39644fix(windows): PowerShell completion install and time-format detectionS

5. WSL (Windows Subsystem for Linux) — Issues

Bugs / Crashes

Resolved?Priority#TitleLabelsAssignee
[ ]P1#68966[Bug]: [WSL] openclaw browser command terminated by SIGKILL causing timeoutbug bug:crash
[ ]P1#61616[Bug]: [WSL2] Global 30-min gateway stall (:29/:59) affects Telegram + Control UIbug P1 clawsweeper:no-new-fix-pr clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision clawsweeper:needs-info +3
[ ]P1#59209Misleading CDP "Empty reply from server" in WSL2 caused by portproxy self-loop (svchost/iphlpsvc), not Chromebug regression P2 clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro +1
[ ]P2#81873Bug: browser user profile (existing-session / Chrome MCP) ignores cdpUrl config in WSL environment
[ ]P2#80336[Bug]: placeholder.openclaw.cloud unreachable on WSL2 with custom gateway portbug bug:behavior
[ ]P2#73602[Bug]: WhatsApp flaps and Telegram polling stalls on WSL2 in 2026.4.26
[ ]P2#73152Docs/doctor request: clarify gateway reachability for OrbStack/WSL/VM/Tailscale setups

Feature Requests

No currently open items found.


6. WSL (Windows Subsystem for Linux) — PRs

Resolved?Priority#TitleSizeAssignee
[ ]P1#46698fix(auth): fix GitHub device flow polling and add --wait flag for WSL…S
[ ]P2#68400daemon/systemd: distinguish WSL user D-Bus socket missing from missing systemctlS
[ ]P2#58853feat(doctor): add WSL environment diagnostics check [AI-assisted]L

7. Azure (Provider / Infrastructure) — Issues

Bugs / Crashes

Resolved?Priority#TitleLabelsAssignee
[ ]P1#84109Azure AI Foundry Responses API: type: "message" missing from input items causes 400 errorP2 clawsweeper:fix-shape-clear clawsweeper:queueable-fix clawsweeper:source-repro impact:auth-provider issue-rating: 🦞 diamond lobster
[ ]P1#60546[Bug]: microsoft-foundry provider selects Claude deployments but routes them through OpenAI Foundry endpointsP2 clawsweeper:no-new-fix-pr clawsweeper:source-repro clawsweeper:linked-pr-open impact:auth-provider issue-rating: 🦞 diamond lobster
[ ]P1#48793feat: centralized PluginResourceManager interface for consistent async cleanup across all channel pluginsP2 clawsweeper:no-new-fix-pr clawsweeper:fix-shape-clear clawsweeper:needs-maintainer-review clawsweeper:needs-product-decision impact:crash-loop +1
[ ]P2#80926Azure OpenAI Responses stalls before first event when memory tools are exposedmaintainer
[ ]P2#79570openai-responses adapter is unusable against Azure OpenAI: every turn returns a synthetic 0-token refusal (openai-completions works)
[ ]P2#48788feat: centralized filename encoding utility for multi-encoding Content-Disposition handlingP2 clawsweeper:no-new-fix-pr clawsweeper:needs-product-decision impact:data-loss issue-rating: 🌊 off-meta tidepool

Feature Requests

Resolved?Priority#TitleLabelsAssignee
[ ]P2#71058[Feature]: Support for multiple Azure/Teams bots on a single Openclaw Gatewayenhancement

8. Azure (Provider / Infrastructure) — PRs

Resolved?Priority#TitleSizeAssignee
[ ]P1#55395fix: centralize plugin command auth requirementsM
[ ]P1#47285feat(memory-lancedb): native Azure OpenAI supportS
[ ]P1#47181feat: add Azure Claude (AI Foundry) onboarding pathL
[ ]P2#70922refactor(whatsapp): centralize account policyL
[ ]P2#55211fix: prevent re-entrant loop in internal hook triggerS

9. Microsoft 365 / SharePoint — Issues

Bugs / Crashes

No currently open items found.

Feature Requests

No currently open items found.


10. Microsoft 365 / SharePoint — PRs

No currently open items found.


Appendix: P0 Blockers (Start Here)

CategoryTypePriority#Title
MS Teams (channel plugin)prP0#81729Remove system event trust metadata
MS Teams (channel plugin)prP0#81402refactor: move runtime state to SQLite
MS Teams (channel plugin)prP0#79972feat: add SQLite transcript frontier and delta API
MS Teams (channel plugin)prP0#79970feat: expose durable session id match selection helpers
MS Teams (channel plugin)prP0#79925feat: context-pressure-aware continuation (continue_work / continue_delegate / request_compaction)
MS Teams (channel plugin)prP0#63827fix(security): preserve dmPolicy settings during wizard runs
MS Teams (channel plugin)prP0#60643feat(agents): cognitive processing scaffolding and structured memory prompt
MS Teams (channel plugin)prP0#57511feat(msteams): Teams live voice support with .NET media worker
MS Teams (channel plugin)prP0#55485Config: plumb opt-in SSRF policy for web fetch, citation redirects, and remote media
MS Teams (channel plugin)prP0#50875feat: add before_identity_resolve plugin hook
MS Teams (channel plugin)prP0#43190MS Teams: add channel archive persistence and deleted-channel cleanup
MS Teams (channel plugin)prP0#37656feat: load workspace .env per-agent at exec time
Windows platformissueP0#48780[Bug]: [Windows] exec() and read() commands corrupted with </arg_value>> suffix
Windows platformissueP0#75Linux/Windows Clawdbot Apps
Windows platformprP0#81443fix: resolve QMD Windows shims and guard image URL downloads
Windows platformprP0#50116fix: handle Windows-style session paths when running on POSIX
Windows platformprP0#46956feat(cli): add trust windows for time-bounded exec approval
Windows platformprP0#44215fix(path): add Windows PATH bootstrap dirs
Windows platformprP0#38932docs(gateway): add Windows no-Docker hardening fallback guide

Appendix: High-Priority Bugs / Regressions

CategoryTypePriority#Title
MS Teams (channel plugin)issueP1#67177[msteams] Inbound file attachments silently fail in DMs — file.download.info downloadUrl not rewritten to Graph shares endpoint
MS Teams (channel plugin)issueP1#65329bug(msteams): DM inline images and file attachments silently dropped
MS Teams (channel plugin)issueP1#62765msteams dmPolicy=pairing silently drops unpaired senders with HTTP 200, no log line, no auto-reply
MS Teams (channel plugin)prP1#78172feat(tts): add skipEmojiSymbols option to prevent TTS from reading emoji/symbols
MS Teams (channel plugin)prP1#77784Add Teams delegated auth for plugin tools
MS Teams (channel plugin)prP1#76262fix(msteams): rebase TeamsSDK patterns to simplify Teams Integration
MS Teams (channel plugin)prP1#75043Add provider-aware automatic TTS emotion mapping
Windows platformissueP1#84001Windows: openclaw status / status --json hangs in 2026.5.18 while status --all succeeds
Windows platformissueP1#83943[Bug]: Session resource loader grows unbounded across warm turns — 5.x regression vs 4.23 baseline (Windows + Feishu + MiniMax OAuth)
Windows platformissueP1#83277WhatsApp channel: "web login provider is not available" on Windows despite wacli installed and authenticated
Windows platformissueP1#82125[Feature] Windows: crash auto-restart parity with systemd Restart=always / launchd KeepAlive
Windows platformissueP1#80416[Bug] core-plugin-tools ~3.5s overhead on every embedded run persists after #75520 fix — Windows + Node 24 + isolated cron jobs
Windows platformissueP1#80344[Bug]: Discord voice /vc join fails on Windows with AggregateError + gateway heartbeat timeout / event loop starvation
Windows platformissueP1#79437Prebuilt node-llama-cpp Windows binaries crash (0xC0000005) on Intel Alder Lake-N (N95) — qmd LLM half unusable
Windows platformissueP1#77443[Bug]: WhatsApp event loop blocked (eventLoopDelayMaxMs=12088ms) on first inbound message — 2026.5.3-1 Windows
Windows platformissueP1#74378[Bug]: OpenClaw CLI commands remain alive as node.exe processes after execution on Windows
Windows platformissueP1#71865Auth login blocked by size-drop guard when openclaw.json was created by PowerShell (verbose/BOM format)
Windows platformissueP1#71699[Bug]: Gateway hard-crashes with 0xC0000409 (STATUS_STACK_BUFFER_OVERRUN) on Windows during Mattermost streaming reply; auto-respawn frequently wedges
Windows platformissueP1#70788fix(windows): suppress startup-folder cmd window flash via wscript silent launcher
Windows platformissueP1#68493[Bug]: Editing openclaw.json while gateway is running triggers hot-reload crash loop on Windows (stale lock file + EADDRINUSE)
Windows platformissueP1#67035[Bug]: 2026.4.14 Windows chat UI regression: input text swallowed, streamed replies often invisible until refresh, typing indicator flashes then blanks
Windows platformissueP1#63257Windows Gateway Feishu API timeout 30s at startup
Windows platformissueP1#62099EPERM on auth-profiles.json causes full gateway failure cascade (Windows)
Windows platformissueP1#62055Windows: CLI crashes with stack overflow / heap OOM on v2026.4.5 (large ESM module graph exceeds V8 default stack)
Windows platformissueP1#59362[Bug]: Windows: exec tool causes console window flash when spawning commands
Windows platformissueP1#59281[Bug]: Windows plugin TS source-loading via jiti is pathologically slow in real production call sites
Windows platformissueP1#54669[Field Report] Chrome 136+ binds CDP to [::1] (IPv6) on Windows — portproxy v4tov4 breaks silently
Windows platformissueP1#44559[Bug]: Windows: Gateway 关闭 PowerShell 窗口后断连
WSLissueP1#68966[Bug]: [WSL] openclaw browser command terminated by SIGKILL causing timeout
WSLissueP1#61616[Bug]: [WSL2] Global 30-min gateway stall (:29/:59) affects Telegram + Control UI
WSLissueP1#59209Misleading CDP "Empty reply from server" in WSL2 caused by portproxy self-loop (svchost/iphlpsvc), not Chrome
WSLprP1#46698fix(auth): fix GitHub device flow polling and add --wait flag for WSL…
AzureissueP1#84109Azure AI Foundry Responses API: type: "message" missing from input items causes 400 error
AzureissueP1#60546[Bug]: microsoft-foundry provider selects Claude deployments but routes them through OpenAI Foundry endpoints
AzureissueP1#48793feat: centralized PluginResourceManager interface for consistent async cleanup across all channel plugins
AzureprP1#55395fix: centralize plugin command auth requirements
AzureprP1#47285feat(memory-lancedb): native Azure OpenAI support
AzureprP1#47181feat: add Azure Claude (AI Foundry) onboarding path

Appendix: Stale Items (Consider Closing)

No matching items found.

Audit Notes

  • Rebuilt from the format of PR #49126 after the issue/PR purge.
  • Source set is current open GitHub issues and PRs from openclaw/openclaw, plus cumulative closed/merged tracker rows recorded in maintainer update comments through 2026-05-20 and verified closed live.
  • Closed counts exclude rows explicitly removed as non-Microsoft false positives by the Microsoft-scope scrub comments.
  • Included title/label matches for msteams, Microsoft Teams, Windows, WSL, Azure, Entra/AAD, MSAL, managed identity, DefaultAzureCredential, Microsoft Graph, SharePoint, OneDrive, and Microsoft 365.
  • Scope note: broad multi-channel PRs stay in this tracker only when the Microsoft surface is primary or independently reviewable. #83348 remains open outside this tracker queue; #82873 was closed as superseded by #83348. #84395 was closed because it conflicted with main, failed Real behavior proof, and mixed Teams upload work with unrelated voice-call/docs changes.
  • Generated with node scripts/generate-microsoft-tracker.mjs so the tracker and PR body can be refreshed after future triage passes.

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • MICROSOFT_TRACKER.md (added, +361/-0)
  • scripts/generate-microsoft-tracker.mjs (added, +428/-0)

Code Example

function Join-OpenClawProcessArguments {
  param([string[]]$Arguments)
  ($Arguments | ForEach-Object {
    if ($_ -match "\\s") {
      '"' + $_ + '"'
    } else {
      $_
    }
  }) -join " "
}

---

$startInfo.Arguments = Join-OpenClawProcessArguments -Arguments $Arguments
RAW_BUFFERClick to expand / collapse

Severity: medium / Confidence: medium / Category: security Triage: risk Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

  • src/cli/update-cli/restart-helper.ts:152-175 (Join-OpenClawProcessArguments)
function Join-OpenClawProcessArguments {
  param([string[]]$Arguments)
  ($Arguments | ForEach-Object {
    if ($_ -match "\\s") {
      '"' + $_ + '"'
    } else {
      $_
    }
  }) -join " "
}
  • src/cli/update-cli/restart-helper.ts:176-195 (Invoke-OpenClawSchtasksWithTimeout)
$startInfo.Arguments = Join-OpenClawProcessArguments -Arguments $Arguments

Reasoning

ProcessStartInfo.Arguments accepts a raw Win32 command-line string. Join-OpenClawProcessArguments wraps space-containing tokens in double quotes but does not escape any embedded double-quote characters (") within those tokens. If a future caller passes an argument containing " (e.g. a path with embedded quotes) the generated command line would be malformed or injectable. Currently the task name is guarded by isWindowsTaskNameSafe (which rejects "), but the function is generic and reused for arbitrary schtasks arguments (/Run, /End, /Query), so a future argument added to those call sites could bypass the protection silently. The mitigation gap is that no existing argument source today produces ", giving medium confidence overall.

Reproduction

Pass a task name containing " directly to Invoke-OpenClawSchtasksWithTimeout (bypassing isWindowsTaskNameSafe) to observe argument injection via the raw Arguments string.

Recommendation

Replace ProcessStartInfo.Arguments (raw string) with ProcessStartInfo.ArgumentList (string collection, available since .NET 5 / PowerShell 7) which avoids the quoting problem entirely: foreach ($a in $Arguments) { $startInfo.ArgumentList.Add($a) }. Alternatively, properly escape embedded double-quotes in Join-OpenClawProcessArguments: replace " with \" inside quoted tokens.

Why existing tests miss this

No tests exist for the generated PowerShell script content.

Suggested regression test

Unit test Join-OpenClawProcessArguments with an argument containing an embedded double-quote and assert the output escapes it correctly.

Minimum fix scope

Replace ProcessStartInfo.Arguments with ProcessStartInfo.ArgumentList in Invoke-OpenClawSchtasksWithTimeout, or add double-quote escaping to Join-OpenClawProcessArguments.


Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-0e1f16a0ce-_5f78528d40.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING