[Bug]: Zeroclaw unable to file write or edit files when prompted in Discord

[BraydenGibson-Git]

Summary

zeroclaw whilst daemon is active fails to file write. Fails with zeroclaw agent.

Affected component

runtime/daemon

Severity

S1- Workflow blocked.

Current behavior

Whilst messaged in discord, Zeroclaw states it is unable to file write, edit or delete files despite these present in allowed commands (autonomy is full). Fails in zeroclaw agent and specifies it is unable to undertake this process.

Expected behavior

Should be able to file edit, write, and delete.

Steps to reproduce

Using the following config

default_provider = "ollama"
default_model = "qwen3.5:9b"
default_temperature = 0.7
model_routes = []
embedding_routes = []

[model_providers]

[observability]
backend = "none"
runtime_trace_mode = "none"
runtime_trace_path = "state/runtime-trace.jsonl"
runtime_trace_max_entries = 200

[autonomy]
level = "full"
workspace_only = true
# Added PowerShell file manipulation commands
allowed_commands = [
    "powershell",
    "pwsh",
    "cmd",
    "python",
    "python3",
    "pip",
    "git",
    "dir",
    "type",
    "findstr",
    "echo",
    "cd",
    "mkdir",
    "copy",
    "move",
    "New-Item",
    "Set-Content",
    "Add-Content",
    "Get-Content",
    "Out-File",
    "Write-Output",
    "Select-String",
    "Test-Path",
    "Copy-Item",
    "Move-Item",
    "Rename-Item",
    "Join-Path",
    "Resolve-Path",
]
forbidden_paths = [
    "C:\\Windows",
    "C:\\Program Files",
    "C:\\Program Files (x86)",
    "C:\\Users\\Default",
    "C:\\Users\\Public",
]
max_actions_per_hour = 20
max_cost_per_day_cents = 500
require_approval_for_medium_risk = true
block_high_risk_commands = true
shell_env_passthrough = []
auto_approve = [
    "file_read",
    "memory_recall",
    "file_write",
    "file_edit",
    "shell",
    "browser",
    "http_request",
    "web_search",
    "web_fetch",
]
always_ask = ["file_delete", "file_remove", "Remove-Item", "del", "rm", "rmdir"]
allowed_roots = []
non_cli_excluded_tools = []

[security.sandbox]
backend = "auto"
firejail_args = []

[security.resources]
max_memory_mb = 512
max_cpu_time_seconds = 60
max_subprocesses = 10
memory_monitoring = true

[security.audit]
enabled = true
log_path = "audit.log"
max_size_mb = 100
sign_events = false

[security.otp]
enabled = false
method = "totp"
token_ttl_secs = 30
cache_valid_secs = 300
gated_actions = [
    "shell",
    "file_write",
    "browser_open",
    "browser",
    "memory_forget",
]
gated_domains = []
gated_domain_categories = []

[security.estop]
enabled = false
state_file = "~/.zeroclaw/estop-state.json"
require_otp_to_resume = true

[runtime]
kind = "native"

[runtime.docker]
image = "alpine:3.20"
network = "none"
memory_limit_mb = 512
cpu_limit = 1.0
read_only_rootfs = true
mount_workspace = true
allowed_workspace_roots = []

[reliability]
provider_retries = 2
provider_backoff_ms = 500
fallback_providers = []
api_keys = []
channel_initial_backoff_secs = 2
channel_max_backoff_secs = 60
scheduler_poll_secs = 15
scheduler_retries = 2

[reliability.model_fallbacks]

[scheduler]
enabled = true
max_tasks = 64
max_concurrent = 4

[agent]
compact_context = false
max_tool_iterations = 10
max_history_messages = 50
parallel_tools = false
tool_dispatcher = "native"

[skills]
open_skills_enabled = true
prompt_injection_mode = "full"

[query_classification]
enabled = false
rules = []

[heartbeat]
enabled = false
interval_minutes = 30

[cron]
enabled = true
max_run_history = 50

[channels_config]
cli = true
message_timeout_secs = 300

[channels_config.discord]
bot_token = "x"
allowed_users = ["x"]
listen_to_bots = false
mention_only = false

[memory]
backend = "sqlite"
auto_save = true
hygiene_enabled = true
archive_after_days = 7
purge_after_days = 30
conversation_retention_days = 30
embedding_provider = "none"
embedding_model = "text-embedding-3-small"
embedding_dimensions = 1536
vector_weight = 0.7
keyword_weight = 0.3
min_relevance_score = 0.4
embedding_cache_size = 10000
chunk_max_tokens = 512
response_cache_enabled = false
response_cache_ttl_minutes = 60
response_cache_max_entries = 5000
snapshot_enabled = false
snapshot_on_hygiene = false
auto_hydrate = true

[memory.qdrant]
collection = "zeroclaw_memories"

[storage.provider.config]
provider = ""
schema = "public"
table = "memories"

[tunnel]
provider = "none"

[gateway]
port = 42617
host = "127.0.0.1"
require_pairing = true
allow_public_bind = false
paired_tokens = []
pair_rate_limit_per_minute = 10
webhook_rate_limit_per_minute = 60
trust_forwarded_headers = false
rate_limit_max_keys = 10000
idempotency_ttl_secs = 300
idempotency_max_keys = 10000

[composio]
enabled = false
entity_id = "default"

[secrets]
encrypt = false

[browser]
enabled = true
allowed_domains = ["*"]
backend = "agent_browser"
native_headless = true
native_webdriver_url = "http://127.0.0.1:9515  "

[browser.computer_use]
endpoint = "http://127.0.0.1:8787/v1/actions  "
timeout_ms = 15000
allow_remote_endpoint = false
window_allowlist = []

[http_request]
enabled = true
allowed_domains = ["*"]
max_response_size = 1000000
timeout_secs = 30

[multimodal]
max_images = 4
max_image_size_mb = 5
allow_remote_fetch = false

[web_fetch]
enabled = true
allowed_domains = ["*"]
blocked_domains = []
max_response_size = 500000
timeout_secs = 30

[web_search]
enabled = true
provider = "duckduckgo"
max_results = 5
timeout_secs = 15

[proxy]
enabled = false
no_proxy = []
scope = "zeroclaw"
services = []

[identity]
format = "openclaw"

[cost]
enabled = false
daily_limit_usd = 10.0
monthly_limit_usd = 100.0
warn_at_percent = 80
allow_override = false

[cost.prices."openai/o1-preview"]
input = 15.0
output = 60.0

[cost.prices."google/gemini-2.0-flash"]
input = 0.1
output = 0.4

[cost.prices."anthropic/claude-3-haiku"]
input = 0.25
output = 1.25

[cost.prices."anthropic/claude-3.5-sonnet"]
input = 3.0
output = 15.0

[cost.prices."openai/gpt-4o-mini"]
input = 0.15
output = 0.6

[cost.prices."google/gemini-1.5-pro"]
input = 1.25
output = 5.0

[cost.prices."anthropic/claude-sonnet-4-20250514"]
input = 3.0
output = 15.0

[cost.prices."openai/gpt-4o"]
input = 5.0
output = 15.0

[cost.prices."anthropic/claude-opus-4-20250514"]
input = 15.0
output = 75.0

[peripherals]
enabled = false
boards = []

[agents]

[hooks]
enabled = true

[hooks.builtin]
command_logger = false

[hardware]
enabled = false
transport = "None"
baud_rate = 115200
workspace_datasheets = false

[transcription]
enabled = false
api_url = "https://api.groq.com/openai/v1/audio/transcriptions  "
model = "whisper-large-v3-turbo"
max_duration_secs = 120

Impact

Discord integrated users.

Logs / stack traces

PS C:\WINDOWS\system32> zeroclaw agent -m "create a text file in your directory called test.txt"
←[2m2026-03-05T09:36:40.775730900+11:00←[0m ←[32m INFO←[0m ←[2mzeroclaw::config::schema←[0m←[2m:←[0m Config loaded ←[3mpath←[0m←[2m=←[0mC:\Users\x\.zeroclaw\config.toml ←[3mworkspace←[0m←[2m=←[0mC:\Users\x\.zeroclaw\workspace ←[3msource←[0m←[2m=←[0m"default" ←[3minitialized←[0m←[2m=←[0mfalse
←[2m2026-03-05T09:36:40.786914100+11:00←[0m ←[32m INFO←[0m ←[2mzeroclaw::agent::loop_←[0m←[2m:←[0m Memory initialized ←[3mbackend←[0m←[2m=←[0m"sqlite"
←[2m2026-03-05T09:36:40.809404800+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\bulk-github-star: SKILL.md: markdown link escapes skill root (../random-contributor/SKILL.md).; SKILL.md: markdown link escapes skill root (../file-tracker/SKILL.md).
←[2m2026-03-05T09:36:40.819121700+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\chat-logger: SKILL.md: markdown link escapes skill root (../file-tracker/SKILL.md).; SKILL.md: markdown link escapes skill root (../web-search-api/SKILL.md).
←[2m2026-03-05T09:36:40.823028900+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\database-query-and-export: SKILL.md: markdown link escapes skill root (../json-and-csv-data-transformation/SKILL.md).; SKILL.md: markdown link escapes skill root (../file-tracker/SKILL.md).; SKILL.md: markdown link escapes skill root (../chat-logger/SKILL.md).
←[2m2026-03-05T09:36:40.823661700+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\file-tracker: SKILL.md: markdown link escapes skill root (../chat-logger/SKILL.md).
←[2m2026-03-05T09:36:40.824515600+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\free-geocoding-and-maps: SKILL.md: markdown link escapes skill root (../city-distance/SKILL.md).; SKILL.md: markdown link escapes skill root (../free-weather-data/SKILL.md).; SKILL.md: markdown link escapes skill root (../json-and-csv-data-transformation/SKILL.md).
←[2m2026-03-05T09:36:40.825266600+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\free-translation-api: SKILL.md: markdown link escapes skill root (../web-search-api/SKILL.md).; SKILL.md: markdown link escapes skill root (../send-email-programmatically/SKILL.md).; SKILL.md: markdown link escapes skill root (../json-and-csv-data-transformation/SKILL.md).
←[2m2026-03-05T09:36:40.826319+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\free-weather-data: SKILL.md: markdown link escapes skill root (../free-geocoding-and-maps/SKILL.md).; SKILL.md: markdown link escapes skill root (../send-email-programmatically/SKILL.md).; SKILL.md: markdown link escapes skill root (../using-telegram-bot/SKILL.md).
←[2m2026-03-05T09:36:40.828573100+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\humanizer: SKILL.md: markdown link escapes skill root (../web-interface-guidelines-review/SKILL.md).; SKILL.md: markdown link escapes skill root (../json-and-csv-data-transformation/SKILL.md).
←[2m2026-03-05T09:36:40.829797500+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\json-and-csv-data-transformation: SKILL.md: markdown link escapes skill root (../database-query-and-export/SKILL.md).; SKILL.md: markdown link escapes skill root (../web-search-api/SKILL.md).; SKILL.md: markdown link escapes skill root (../using-web-scraping/SKILL.md).
←[2m2026-03-05T09:36:40.832247400+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\phone-specs-scraper: SKILL.md: markdown link escapes skill root (../using-web-scraping/SKILL.md).; SKILL.md: markdown link escapes skill root (../web-search-api/SKILL.md).
←[2m2026-03-05T09:36:40.832918100+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\presenton: SKILL.md: markdown link escapes skill root (../browser-automation-agent/SKILL.md).; SKILL.md: markdown link escapes skill root (../pdf-manipulation/SKILL.md).; SKILL.md: markdown link escapes skill root (../static-assets-hosting/SKILL.md).
←[2m2026-03-05T09:36:40.834114300+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\send-email-programmatically: SKILL.md: markdown link escapes skill root (../using-telegram-bot/SKILL.md).; SKILL.md: markdown link escapes skill root (../nostr-logging-system/SKILL.md).
←[2m2026-03-05T09:36:40.837031300+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\static-assets-hosting: SKILL.md: markdown link escapes skill root (../anonymous-file-upload/SKILL.md).
←[2m2026-03-05T09:36:40.838098300+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\user-ask-for-report: SKILL.md: detected high-risk command pattern (phishing-credential-harvest).
←[2m2026-03-05T09:36:40.839356+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\using-scrapy: SKILL.md: markdown link escapes skill root (../using-web-scraping/SKILL.md).; SKILL.md: markdown link escapes skill root (../phone-specs-scraper/SKILL.md).; SKILL.md: markdown link escapes skill root (../web-search-api/SKILL.md).
←[2m2026-03-05T09:36:40.841359300+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\open-skills\skills\web-interface-guidelines-review: SKILL.md: markdown link escapes skill root (../using-web-scraping/SKILL.md).; SKILL.md: markdown link escapes skill root (../city-tourism-website-builder/SKILL.md).
←[2m2026-03-05T09:36:40.850209400+11:00←[0m ←[33m WARN←[0m ←[2mzeroclaw::skills←[0m←[2m:←[0m skipping insecure skill directory C:\Users\x\.zeroclaw\workspace\skills\self-improving-agent: .git\hooks\applypatch-msg.sample: script-like files are blocked by skill security policy.; .git\hooks\commit-msg.sample: script-like files are blocked by skill security policy.; .git\hooks\post-update.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-applypatch.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-commit.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-merge-commit.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-push.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-rebase.sample: script-like files are blocked by skill security policy.; .git\hooks\pre-receive.sample: script-like files are blocked by skill security policy.; .git\hooks\prepare-commit-msg.sample: script-like files are blocked by skill security policy.; .git\hooks\push-to-checkout.sample: script-like files are blocked by skill security policy.; .git\hooks\sendemail-validate.sample: script-like files are blocked by skill security policy.; .git\hooks\update.sample: script-like files are blocked by skill security policy.; scripts\activator.sh: script-like files are blocked by skill security policy.; scripts\error-detector.sh: script-like files are blocked by skill security policy.; scripts\extract-skill.sh: script-like files are blocked by skill security policy.
I apologize, but I don't have access to a file creation tool in my current set of available functions. The tools I can use are primarily for:

- Web browsing and fetching (web_fetch, http_request)
- File reading (pdf_read, docx_read, pptx_read, xlsx_read)
- Image operations (screenshot, image_info)
- Background task management (bg_run, bg_status)
- Browser automation (browser_action)
- Web searches (web_search_tool)

Unfortunately, there's no write_file or file_create tool available to me. If you need to create a text file with "hello" in it, you might be able to:

1. Use a terminal/command line tool directly
2. Upload the file if you have access to one already created
3. Check if there's another way your system handles file creation

ZeroClaw version

v0.1.7

Rust version

cargo 1.93.1 rustc 1.93.1

Operating system

Windows 11

Regression?

No, first-time setup

Pre-flight checks

• I reproduced this on the latest main branch or latest release.
• I redacted secrets/tokens from logs.
• I removed personal identifiers and replaced identity-specific data with neutral placeholders.

[github-actions]

Thanks for opening this issue.

Before maintainers triage it, please confirm:

• Repro steps are complete and run on latest main
• Environment details are included (OS, Rust version, ZeroClaw version)
• Sensitive values are redacted

This helps us keep issue throughput high and response latency low.

[theonlyhennygod]

Root cause confirmed: in some non-CLI/channel turns, the model returned text claiming file tools were unavailable even when file_write/file_edit were runtime-available; loop handling did not provide a targeted corrective retry path.

Fix in PR #2789:

• detect false "missing file tool" claims when file tools are in runtime tool specs
• issue targeted corrective retry prompt listing runtime-available tools
• strengthen runtime tool-visibility prompt to explicitly forbid claiming listed tools are unavailable
• add regression tests for retry-and-recover behavior

Validation:

• cargo fmt --all -- --check
• cargo test (full suite passing)

PR: #2789

[theonlyhennygod]

Update: addressed in PR #2836 (target dev) — #2836

Root cause

• Some model replies falsely claimed file tools were unavailable even when runtime policy exposed file_write/file_edit, causing bad follow-through behavior.

Fix

• Added explicit false-unavailability detection in tool loop.
• Added specialized retry prompt that includes authoritative runtime tool list.
• Added runtime tool-availability notice to system prompts and channel visibility prompt with explicit instruction not to claim unavailable tools when listed.
• Added regression tests for false missing-tool claims and retry behavior.

Validation

• cargo test run_tool_call_loop_retries_when_model_claims_missing_file_tools -- --nocapture
• cargo test looks_like_tool_unavailability_claim_detects_false_missing_tool_replies -- --nocapture
• channel visibility prompt regression tests in PR description.