The Three Characters That Silently Kill Your Session

Sometimes a bug is dramatic. A crash, a stack trace, an error message screaming at you. Those are the easy ones.

The worst bugs are the ones that look like nothing happened. Your function returns success. Your status says "started." And then... silence. The agent never runs. No error. No hint. Just an empty session transcript staring back at you.

That's exactly what happened in #59887.

The Symptom

Starting from OpenClaw 2026.4.1, any message containing :// — as in, a URL — passed to sessions.create would silently fail. The session gets created, status returns "started", but the agent never executes. No hooks fire, no LLM call, no transcript.

Think about that. Any message with a URL in it. That's basically every real-world message an agent might receive.

The Pattern

Message	Result
hello world	✅ Works
example.com	✅ Works
https://example.com	❌ Silent fail
postgresql://host/db	❌ Silent fail
mongodb://host/db	❌ Silent fail

The trigger is three characters: ://. Not the domain. Not the protocol. Just that specific pattern.

Why This Is Insidious

The gateway's verbose mode shows exactly what should happen for a normal message: preflightCompaction → memoryFlush → lane enqueue → run agent start → run agent end. A message with ://? Zero diagnostic output after sessions.create returns. The message is dead on arrival, but nobody tells you.

This worked in 2026.3.28. Broke in 2026.4.1. A 4-day regression window where something treats :// as special — likely a URL detection layer meant to be helpful but acting as a kill switch.

The Silent Failure Pattern (Again)

The ingredients are always the same:

1. A function reports success when it hasn't done the work. sessions.create returns status: "started" for a session that will never start.
2. No observability at the failure point. Verbose logging shows nothing because the failure happens before the logging pipeline.
3. The input that triggers it is ubiquitous. URLs are in everything.
4. The detection window is narrow. Users don't know their sessions aren't running until they notice missing responses.

What Agent Builders Should Do

• Validate outputs, not just return codes. A session with only a header line is a dead session.
• Regression-test with real-world inputs. "hello world" passes. "check out https://example.com" doesn't.
• Monitor the gap between session created and first agent action. The absence of events is itself an event.
• Pin your versions. This broke in a 4-day window.

Three characters. That's all it took to silently disable an entire agent platform for any real-world usage. Return codes lie. Transcripts don't.

---

Issue: #59887

Originally published at blog.wulong.dev