xmanrui/OpenClaw-bot-review

Every scenario DeepQA drove in the browser, in plan order, with the 30 screenshots it captured along the way. A passing scenario is evidence too.

1. S1

   Toggle global alert state

   2 steps, 3 screenshots

   high✓ pass

   

   

   

   • Navigated to the Alert Center page where Enable Alerts and rule configurations are displayed.
   • Clicked the Enable Alerts toggle button, which disabled alert controls, marked rules as disabled, and showed '✓ Saved'.
   • Toggled Enable Alerts back on, restoring the Check Interval selector, Check Now button, and active rule toggles with confirmation.
   • Navigated to /alerts and verified the presence of the 'Enable Alerts' toggle.
   • Interacting with the toggle successfully disabled all alert controls and rules, displayed '✓ Saved' feedback, and updated the UI state.
   • Interacting with the toggle again successfully re-enabled alerts and restored interval settings and active rule toggles.
2. S2

   Alert settings persistence

   4 steps, 3 screenshots

   high✓ pass

   

   

   

   • Configured alert settings: Enable Alerts is on and Bot Long Time No Response timeout set to 30.
   • After reloading the page, Enable Alerts remains enabled and the Bot Long Time No Response timeout value retains 30.
   • Navigated to http://localhost:3000/alerts.
   • Toggled Enable Alerts to on and enabled the 'Bot Long Time No Response' rule.
   • Entered '30' into the 'Bot Long Time No Response' Timeout (s) input field.
   • Reloaded the /alerts page and observed that Enable Alerts remained on and the Timeout (s) field retained the value '30'.
3. S3

   Validate negative timeout values

   3 steps, 2 screenshots

   high✕ fail

   

   

   • Navigated to Alert Center at /alerts with rule 'Bot Long Time No Response' timeout field initialized to 30.
   • Entered '-10' into the Timeout (s) spinbutton for 'Bot Long Time No Response' rule; the app displayed '✓ Saved' and kept value='-10' without any validation error or rejection.
   • Entered '-10' into the 'Bot Long Time No Response Timeout (s)' field on /alerts and observed that the form accepted and automatically saved '-10' without any validation error or reversion.
4. S4

   Validate maximum failure rate boundary

   3 steps, 2 screenshots

   high✕ fail

   

   

   • Navigated to /alerts and observed alert rules configuration with Message Failure Rate High disabled by default.
   • Entered 150 into Message Failure Rate High (%) spinbutton and blurred the field; the application silently accepted 150 without showing an error or clamping to 100.
   • Navigated to /alerts and toggled Message Failure Rate High rule on.
   • Entered 150 into the Failure rate (%) number input and blurred the input.
   • The input retained 150 without validation errors, bounds clamping, or max attribute enforcement.
5. S5

   Validate non-numeric input in numeric fields

   3 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to Alerts page and located the Cron Continuous Failure rule.
   • Attempting to type non-numeric text 'abc' into 'Cron Continuous Failure Max Failures' (type=number input) was rejected by the input control, maintaining valid numeric value.
   • Navigated to http://localhost:3000/alerts.
   • Located the numeric input for 'Cron Continuous Failure Max Failures' which is implemented as an HTML5 number input (type=number).
   • Attempted to enter non-numeric characters 'abc' into the Max Failures input.
   • The input field rejected the non-numeric keystrokes, preserving the valid numeric value without accepting invalid text.
6. S6

   Receive Alert Agent selection

   2 steps, 2 screenshots

   medium✕ fail

   

   

   • Navigated to /alerts and observed the Alert Center layout including heading 'Receive Alert Agent'.
   • Under the 'Receive Alert Agent' section on /alerts, no input field, dropdown, or interactive control is rendered for selecting or typing an agent name.
   • Navigated to /alerts and verified the presence of the 'Receive Alert Agent' heading.
   • Confirmed that no input, select, or interactive field is rendered beneath 'Receive Alert Agent'.
7. S7

   Model Unavailable alert toggle

   2 steps, 4 screenshots

   medium✓ pass

   

   

   

   

   • Navigated to /alerts where Alert Center is displayed with global alerts toggle and specific alert rules.
   • Enabled global alerts, making alert rules including 'Model Unavailable' interactive.
   • Clicked the 'Model Unavailable' toggle switch, updating its state and triggering a '✓ Saved' confirmation.
   • Verified the 'Model Unavailable' alert rule control responds to toggling and updates state correctly.
   • Navigated to http://localhost:3000/alerts.
   • Enabled global alerts to make rule switches interactive.
   • Clicked the 'Model Unavailable' alert rule toggle and observed that it updated its state and displayed '✓ Saved'.
   • Toggled the 'Model Unavailable' alert rule switch again to confirm bidirectional state transitions work properly.
8. S8

   Validate zero failure rate

   2 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to /alerts and located the Message Failure Rate High (%) spinbutton.
   • Entered 0 into Failure rate (%), and the input accepted 0 without any validation errors or rejection.
   • Navigated to http://localhost:3000/alerts and located the Failure rate (%) input under Message Failure Rate High.
   • Entered 0 into the Failure rate (%) spinbutton field.
   • The field accepted the value 0 without any error messages or rejection.
9. S9

   Validate empty threshold behavior

   3 steps, 2 screenshots

   medium✓ pass

   

   

   • Navigated to http://localhost:3000/alerts and observed the Alert Rules form.
   • Navigated to the Alerts configuration page at http://localhost:3000/alerts.
   • Located the 'Bot Long Time No Response' timeout number input field.
   • Cleared the timeout value so that the input was completely empty.
   • Observed that upon clearing and blurring the input field, the application gracefully reverted the value to a default numeric value ('0') and confirmed with a '✓ Saved' status indicator.
10. S10

    Dependent field enablement

    3 steps, 3 screenshots

    medium✓ pass

    

    

    

    • Navigated to Alert Center at /alerts where Enable Alerts toggle and Alert Rules are displayed.
    • Attempted to interact with 'Message Failure Rate High (%)' input while Enable Alerts is toggled off, but the input is disabled and rejects input.
    • Toggling Enable Alerts back on restores active state and re-enables threshold inputs and controls.
    • Navigated to /alerts and observed Alert Center configuration.
    • Toggled 'Enable Alerts' off and verified that all threshold fields including 'Message Failure Rate High (%)' became disabled.
    • Attempted interaction with the disabled 'Message Failure Rate High (%)' input, which correctly rejected input due to the disabled attribute.
    • Toggled 'Enable Alerts' back on, which successfully re-enabled all threshold fields.
11. S11

    Validate decimal inputs for discrete counts

    3 steps, 3 screenshots

    low✕ fail

    

    

    

    • Navigated to Alert Center at /alerts.
    • Entered decimal '3.5' into Max Failures field under Cron Continuous Failure; the application saved '3.5' with '✓ Saved' and did not validate or round to an integer.
    • Navigated to /alerts and inspected the Cron Continuous Failure alert rule.
    • Entered '3.5' into the Max failures spinbutton input field.
    • The application immediately accepted '3.5' and showed '✓ Saved' without validation or integer conversion.
12. S12

    Validate extremely large timeout values

    3 steps, 2 screenshots

    low✓ pass

    

    

    • Navigated to /alerts and located the Bot Long Time No Response Timeout (s) spinbutton input.
    • Entered 999999999 into Bot Long Time No Response Timeout (s) and clicked outside; the application saved and handled the input gracefully without crashing or displaying NaN/overflow.
    • Navigated to /alerts and entered 999999999 into the Bot Long Time No Response Timeout (s) field.
    • Clicked outside the input field; the application saved the value gracefully without crashing or showing NaN/overflow.

Findings that survived the Critic's audit. Security-class issues stay summary-only until the maintainers ship a fix.

mediumconfirmed ✓functionalF1 · S3

Negative timeout value accepted without validation in Bot Long Time No Response alert rule

The tester explicitly verified that entering -10 into the timeout field bypassed validation and showed a '✓ Saved' confirmation. The page reported 1 console error during the scenario.

Expected

The application should display a validation error, revert the value, or prevent saving a negative timeout.

Actual

The application silently accepted '-10' as the timeout value and automatically saved it (showing '✓ Saved') without any validation error or value correction.

Repro · 4 steps

1. Navigate to http://localhost:3000/alerts
2. Locate the 'Bot Long Time No Response' rule under Alert Rules
3. Enter '-10' into the 'Timeout (s):' number input
4. Click outside or blur the input field

S3-6.png

mediumconfirmed ✓functionalF2 · S4

Message Failure Rate High accepts out-of-bounds percentage value exceeding 100%

The evidence shows that an out-of-bounds percentage (150) was silently accepted by the input field without triggering an error or clamping to a maximum of 100. The page reported 1 console error during the scenario.

Expected

The application should show an error message that the percentage must not exceed 100, or auto-correct the value to 100.

Actual

The application silently accepts 150 as a valid failure rate percentage without displaying an error message or clamping/capping the value to 100.

Repro · 4 steps

1. Navigate to http://localhost:3000/alerts
2. Enable the 'Message Failure Rate High' rule toggle if it is disabled.
3. Enter '150' into 'Failure rate (%)' under 'Message Failure Rate High'.
4. Click outside the input field to trigger blur/validation.

S4-8.png

lowconfirmed ✓dataF4 · S11

Alert Center silently accepts decimal values for Cron Continuous Failure Max Failures count

The tester observed that entering a decimal value (3.5) into a discrete count field was saved without triggering a validation error or rounding to an integer. The page reported 1 console error during the scenario.

Expected

The application should flag decimal inputs as invalid or automatically round/coerce discrete count values to an integer.

Actual

The Max failures field accepted '3.5' and displayed '✓ Saved' without any validation error or rounding to an integer.

Repro · 4 steps

1. Navigate to http://localhost:3000/alerts
2. Locate the 'Cron Continuous Failure' alert rule
3. Enter '3.5' into the 'Max failures' spinbutton input
4. Observe the field value and save status

S11-2.pngS11-7.pngS11-12.png

highwithdrawnfunctionalF3 · S6

Missing agent input or dropdown control in Receive Alert Agent section on /alerts

I navigated to http://localhost:3000/alerts and observed the 'Receive Alert Agent' section. Underneath the level 2 heading for 'Receive Alert Agent', there is no input field, dropdown, or any control rendered to specify or select an agent. Instead, it immediately proceeds to the 'Alert Rules' section. The page reported 1 console error during the scenario.

Expected

The 'Receive Alert Agent' section should provide an input field or dropdown selection control allowing administrators to specify or select which agent receives alert notifications.

Actual

The 'Receive Alert Agent' section only displays a level 2 heading with no input field, dropdown, or selectable control rendered beneath it, making it impossible to configure or view the recipient agent.

Repro · 3 steps

1. Navigate to http://localhost:3000/alerts
2. Inspect the 'Receive Alert Agent' section
3. Attempt to locate and interact with any agent selection or input field

S6-2.pngS6-6.png