fix: defer approval index cleanup until after successful resume

Addresses Codex review feedback on PR openclaw#48. Previously, the approval
ID index was deleted before executing the resumed pipeline/workflow.
If execution failed with a transient error, the state was still
resumable by --token but the --id alias was already gone.

Now: index cleanup happens after successful completion or explicit
denial. On runtime_error, the index is preserved so the user can
retry with the same --id.

Author: coolmanns

package-lock.json

@@ -339,15 +339,17 @@ async function handleResume({ argv, registry }) {
     return;
   }
 
-  // Clean up approval ID index after use
-  if (resolvedApprovalId) {
-    await deleteApprovalId({ env: process.env, approvalId: resolvedApprovalId });
-  } else if (payload.stateKey) {
-    // --token path: clean up any orphaned approval index for this stateKey
-    await cleanupApprovalIndexByStateKey({ env: process.env, stateKey: payload.stateKey });
-  }
+  // Helper: clean up approval ID index after successful use
+  const cleanupIndex = async () => {
+    if (resolvedApprovalId) {
+      await deleteApprovalId({ env: process.env, approvalId: resolvedApprovalId });
+    } else if (payload.stateKey) {
+      await cleanupApprovalIndexByStateKey({ env: process.env, stateKey: payload.stateKey });
+    }
+  };
 
   if (!approved) {
+    await cleanupIndex();
     if (payload.kind === 'workflow-file' && payload.stateKey) {
       await deleteStateJson({ env: process.env, key: payload.stateKey });
     }
@@ -384,9 +386,11 @@ async function handleResume({ argv, registry }) {
         return;
       }
 
+      await cleanupIndex();
       writeToolEnvelope({ ok: true, status: 'ok', output: output.output, requiresApproval: null });
       return;
     } catch (err) {
+      // Don't clean up index on error — allow retry by --id
       writeToolEnvelope({ ok: false, error: { type: 'runtime_error', message: err?.message ?? String(err) } });
       process.exitCode = 1;
       return;
@@ -428,6 +432,7 @@ async function handleResume({ argv, registry }) {
         prompt: approval.prompt,
         createdAt: new Date().toISOString(),
       });
+      await cleanupIndex();
       await deleteStateJson({ env: process.env, key: previousStateKey });
 
       const nextAid = generateApprovalId();
@@ -449,9 +454,11 @@ async function handleResume({ argv, registry }) {
       return;
     }
 
+    await cleanupIndex();
     await deleteStateJson({ env: process.env, key: previousStateKey });
     writeToolEnvelope({ ok: true, status: 'ok', output: output.items, requiresApproval: null });
   } catch (err) {
+    // Don't clean up index on error — allow retry by --id
     writeToolEnvelope({ ok: false, error: { type: 'runtime_error', message: err?.message ?? String(err) } });
     process.exitCode = 1;
   }

src/cli.ts

@@ -195,15 +195,17 @@ export async function resumeToolRequest({
     return errorEnvelope('parse_error', err?.message ?? String(err));
   }
 
-  // Clean up approval ID index after use
-  if (resolvedApprovalId) {
-    await deleteApprovalId({ env: runtime.env, approvalId: resolvedApprovalId });
-  } else if (payload?.stateKey) {
-    // --token path: clean up any orphaned approval index for this state key
-    await cleanupApprovalIndexByStateKey({ env: runtime.env, stateKey: payload.stateKey });
-  }
+  // Helper: clean up approval ID index after successful use
+  const cleanupIndex = async () => {
+    if (resolvedApprovalId) {
+      await deleteApprovalId({ env: runtime.env, approvalId: resolvedApprovalId });
+    } else if (payload?.stateKey) {
+      await cleanupApprovalIndexByStateKey({ env: runtime.env, stateKey: payload.stateKey });
+    }
+  };
 
   if (!approved) {
+    await cleanupIndex();
     if (payload.kind === 'workflow-file' && payload.stateKey) {
       await deleteStateJson({ env: runtime.env, key: payload.stateKey });
     }
@@ -223,13 +225,16 @@ export async function resumeToolRequest({
       });
 
       if (output.status === 'needs_approval') {
+        // Don't clean up index — next gate will issue a new approvalId
         return okEnvelope('needs_approval', [], output.requiresApproval ?? null);
       }
+      await cleanupIndex();
       if (output.status === 'cancelled') {
         return okEnvelope('cancelled', [], null);
       }
       return okEnvelope('ok', output.output, null);
     } catch (err: any) {
+      // Don't clean up index on error — allow retry by --id
       return errorEnvelope('runtime_error', err?.message ?? String(err));
     }
   }
@@ -273,6 +278,7 @@ export async function resumeToolRequest({
         createdAt: new Date().toISOString(),
       });
       await writeApprovalIndex({ env: runtime.env, stateKey: nextStateKey, approvalId: nextAid });
+      await cleanupIndex();
       await deleteStateJson({ env: runtime.env, key: payload.stateKey });
 
       const resumeToken = encodeToken({
@@ -289,9 +295,11 @@ export async function resumeToolRequest({
       });
     }
 
+    await cleanupIndex();
     await deleteStateJson({ env: runtime.env, key: payload.stateKey });
     return okEnvelope('ok', output.items, null);
   } catch (err: any) {
+    // Don't clean up index on error — allow retry by --id
     return errorEnvelope('runtime_error', err?.message ?? String(err));
   }
 }