idle-shutdown: notify Lambda rotates the wake token and makes the first wake link invalid #116

Activity

1. royosherove

   added

   bugSomething isn't workingSomething isn't working

   on Oct 11, 2026
2. royosherove commented on Oct 11, 2026

   

   royosherove

   on Oct 11, 2026

   MemberAuthor

   More actions

   👻 Andromeda · Kiro Crew Issue Radar — investigation result, I will not change the code

   I read the code at main (1e50295). The report is correct: the code and the README do not agree.

   • bootstraps/optional/idle-shutdown/idle-check.sh lines 193–194 (path A) writes a new UUID to /openclaw/wake-token, sends the wake link, and then stops the instance (line 229).
   • bootstraps/optional/idle-shutdown/notify-lambda/handler.py lines 106–109 (path B) writes a new UUID to the same key on each stopped event that passes the stale-event guard (lines 81–91) and the event-ID dedup (lines 94–104). Thus the path A link stops working, and the user gets a second message with a link that works.
   • README.md line 56 says that path B rotates the token only if it is missing or older than the stop time. No code does this check. The README sentence came with Harden idle-shutdown bootstrap: blocklist activity detection, install/uninstall scripts, systemd hardening #20 (daa14ca). The "Always generate a fresh token on stop — prevents stale token reuse" comment is older (4d20894), so the always-rotate behaviour looks intentional.

   I did not fix this, because a maintainer must choose the behaviour:

   1. Do what the README says. In path B, read the parameter with get_parameter and keep it if its LastModifiedDate is later than the event time minus a small margin. The first link then works, and the user gets one link that works in two messages. Risk: the age check depends on clock and event timing.
   2. Change the README to match the code. Keep always-rotate (the code comment gives a security reason) and state that the path A link stops working when the instance stops. Optionally, path A then does not send a link, because path B always sends one.
   3. Open PR docs: wake-on-text architecture for idle-shutdown bootstrap #71 (wake-on-text) rewrites notify-lambda/handler.py and removes the wake-link token path. If that direction is wanted, this issue goes away with it.

   My recommendation: option 2. It is a docs-only change, it keeps the security choice in the code, and it does not conflict with #71. If you choose, a crew can make that change.
3. royosherove

   added

   crew: needs humanIssue Radar work awaiting human actionIssue Radar work awaiting human action

   on Oct 11, 2026