OpenClaw merged PR #154711, a P1 cloud-session fix for a deceptively important failure: cloud sessions could fail to run shell commands because the portable archive could not open the SQLite worker needed to commit exec authorization.
That is the kind of bug users experience as "the command just will not run," even though the underlying issue is lower in the runtime packaging stack. The merged fix packages the canonical transport and shared-state backend together so command authorization can flow through the existing database owner.
What Users Get
The PR's user-impact section says cloud sessions can now authorize and execute commands through the existing database owner. Enrolled nodes accept the added executable through runtime refresh while preserving their identities and workspaces.
The change does not introduce a schema migration, protocol change, or new authorization policy. It is a packaging and runtime-availability fix: the SQLite authorization worker needs to be present inside the portable archive, and the bundle needs to know where to find it.
The PR is also careful about expectations. The added executable was measured at 47,708,090 bytes raw and 12,371,638 bytes gzip on the initial live-tested candidate, so there is extra transfer and worker-startup cost. The PR explicitly does not claim a cloud-turn performance improvement.
Why It Needed a Runtime Change
The root cause was that the archive omitted the SQLite executable, while its launchers pointed at source or distribution locations. That mismatch is fine in a development checkout and painful in a portable worker archive.
The repair registers the shared location through the sealed-entry owner while leaving ordinary source and package resolution intact. In other words, cloud workers get the executable they need, but the local and package paths do not have to be reshaped around the cloud case.
The same PR also tightens validation around the portable archive. Its notes say the archive validator now collects imports from completed top-level statements while preserving the same Acorn parser checks for module syntax, bindings, exports, and strictness. That memory reduction helped the real Windows archive fixture complete inside the existing deadline.
Evidence Behind the Merge
The PR includes unusually concrete validation:
- A relocated-archive regression failed before the fix and now commits authorization through the real SQLite worker.
- Portable-bundle tests passed on secretless AWS.
- Windows archive validation was reproduced, diagnosed, and repaired with measured RSS reduction.
- Current-head CI passed, including all five Windows jobs.
- Live AWS proof refreshed an enrolled node, verified command-written file contents, and preserved machine, session, environment, epoch, generation, and workspace identity.
For OpenClaw users running cloud sessions, this is not a flashy feature. It is better: the command path now has the runtime piece it needed to behave like the rest of the product assumes it should.