fix(gateway): resolve macOS App node shell command probing timeouts

htjworld · htjworld · commit a2da03e05991 · 2026-05-18T13:20:46.000+09:00
diff --git a/src/gateway/node-command-policy.ts b/src/gateway/node-command-policy.ts
@@ -260,10 +260,21 @@ export function isForegroundRestrictedPluginNodeCommand(command: string): boolea
 }
 
 type NodeCommandPolicyNode = Pick<NodeSession, "platform" | "deviceFamily"> &
-  Partial<Pick<NodeSession, "caps" | "commands" | "connId" | "nodeId">> & {
+  Partial<Pick<NodeSession, "caps" | "commands" | "connId" | "nodeId" | "clientId" | "clientMode">> & {
     approvedCommands?: readonly string[];
   };
 
+function isAppNode(node?: NodeCommandPolicyNode): boolean {
+  if (!node) {
+    return false;
+  }
+  return (
+    node.clientMode === "app" ||
+    node.clientId === "openclaw-macos" ||
+    node.clientId === "openclaw-windows"
+  );
+}
+
 function isDesktopPlatformId(platformId: PlatformId): boolean {
   return platformId === "macos" || platformId === "windows" || platformId === "linux";
 }
@@ -337,6 +348,13 @@ function resolveNodeCommandAllowlistInternal(
       .map((cmd) => cmd.trim())
       .filter((cmd) => cmd && !dangerousPluginCommands.has(cmd)),
   );
+
+  if (isAppNode(node)) {
+    for (const cmd of NODE_SYSTEM_RUN_COMMANDS) {
+      allow.delete(cmd);
+    }
+  }
+
   for (const cmd of extra) {
     const trimmed = cmd.trim();
     if (trimmed) {
@@ -363,8 +381,13 @@ export function resolveNodePairingCommandAllowlist(
   cfg: OpenClawConfig,
   node?: NodeCommandPolicyNode,
 ): Set<string> {
+  // App nodes must never get system.run even in the pairing allowlist, because
+  // the declared commands from this allowlist are stored in the pairing record
+  // and later treated as approved on reconnect. Passing includeDesktopHostCommands
+  // to resolveNodeCommandAllowlistInternal is still correct for non-app desktop
+  // nodes that legitimately need system.run at pairing time.
   return resolveNodeCommandAllowlistInternal(cfg, node, {
-    includeDesktopHostCommands: true,
+    includeDesktopHostCommands: !isAppNode(node),
   });
 }
 
diff --git a/src/gateway/node-connect-reconcile.ts b/src/gateway/node-connect-reconcile.ts
@@ -150,6 +150,8 @@ export async function reconcileNodePairingOnConnect(params: {
     deviceFamily: params.connectParams.client.deviceFamily,
     caps: params.connectParams.caps,
     commands: params.connectParams.commands,
+    clientId: params.connectParams.client.id,
+    clientMode: params.connectParams.client.mode,
   };
   const pairingAllowlist = resolveNodePairingCommandAllowlist(params.cfg, policyNode);
   const declared = normalizeDeclaredNodeCommands({
diff --git a/src/gateway/server-methods/nodes.ts b/src/gateway/server-methods/nodes.ts
@@ -346,6 +346,8 @@ function resolveAllowedPendingNodeActions(params: {
     deviceFamily: connect?.client?.deviceFamily,
     caps: connect?.caps,
     commands: declaredCommands,
+    clientId: connect?.client?.id,
+    clientMode: connect?.client?.mode,
   });
   const allowed = pending.filter((entry) => {
     const result = isNodeCommandAllowed({
@@ -775,6 +777,8 @@ export const nodeHandlers: GatewayRequestHandlers = {
         deviceFamily: approvedNode.deviceFamily,
         caps: approvedNode.caps,
         commands: approvedNode.commands,
+        clientId: approvedNode.clientId,
+        clientMode: approvedNode.clientMode,
         approvedCommands: approvedNode.commands,
       });
       const currentAllowedCommands = normalizeDeclaredNodeCommands({
diff --git a/test/app-node-probe.e2e.test.ts b/test/app-node-probe.e2e.test.ts
@@ -0,0 +1,59 @@
+import { afterAll, describe, expect, it } from "vitest";
+import { GatewayClient } from "../src/gateway/client.js";
+import {
+  type GatewayInstance,
+  connectNode,
+  spawnGatewayInstance,
+  stopGatewayInstance,
+  waitForNodeStatus,
+} from "./helpers/gateway-e2e-harness.js";
+
+const E2E_TIMEOUT_MS = 30_000;
+
+describe("gateway app node probe", () => {
+  const instances: GatewayInstance[] = [];
+  const nodeClients: GatewayClient[] = [];
+
+  afterAll(async () => {
+    for (const client of nodeClients) {
+      client.stop();
+    }
+    for (const inst of instances) {
+      await stopGatewayInstance(inst);
+    }
+  });
+
+  it(
+    "does not timeout probing an app node",
+    { timeout: E2E_TIMEOUT_MS },
+    async () => {
+      const gw = await spawnGatewayInstance("app-probe-test");
+      instances.push(gw);
+
+      // Connect an app node with no declared commands: gateway policy must not
+      // assign system.run to app nodes, so probing should be skipped entirely.
+      const startTime = Date.now();
+      const node = await connectNode(gw, "macos-app", {
+        platform: "macos",
+        deviceFamily: "Mac",
+        mode: "node",
+        clientId: "openclaw-macos",
+        commands: [],
+      });
+      nodeClients.push(node.client);
+
+      // waitForNodeStatus returns the matched node entry from node.list once
+      // connected and paired — use it directly to verify commands.
+      const nodeStatus = await waitForNodeStatus(gw, node.nodeId);
+
+      const duration = Date.now() - startTime;
+
+      // Without probing suppression this would take ~10–15 s per timed-out
+      // probe. With the fix it should complete well within 5 s.
+      expect(duration).toBeLessThan(5000);
+
+      // App nodes must not have system.run assigned by the gateway policy.
+      expect((nodeStatus as any).commands ?? []).not.toContain("system.run");
+    },
+  );
+});
diff --git a/test/helpers/gateway-e2e-harness.ts b/test/helpers/gateway-e2e-harness.ts
@@ -87,22 +87,30 @@ export async function postJson(
 export async function connectNode(
   inst: GatewayInstance,
   label: string,
+  opts?: {
+    platform?: string;
+    mode?: string;
+    clientId?: string;
+    deviceFamily?: string;
+    commands?: string[];
+  }
 ): Promise<{ client: GatewayClient; nodeId: string }> {
   const identityPath = path.join(inst.homeDir, `${label}-device.json`);
   const deviceIdentity = loadOrCreateDeviceIdentity(identityPath);
   const nodeId = deviceIdentity.deviceId;
   const client = await connectGatewayClient({
     url: `ws://127.0.0.1:${inst.port}`,
     token: inst.gatewayToken,
-    clientName: GATEWAY_CLIENT_NAMES.NODE_HOST,
+    clientName: (opts?.clientId as any) ?? GATEWAY_CLIENT_NAMES.NODE_HOST,
     clientDisplayName: label,
     clientVersion: "1.0.0",
-    platform: "ios",
-    mode: GATEWAY_CLIENT_MODES.NODE,
+    platform: opts?.platform ?? "ios",
+    deviceFamily: opts?.deviceFamily,
+    mode: (opts?.mode as any) ?? GATEWAY_CLIENT_MODES.NODE,
     role: "node",
     scopes: [],
     caps: ["system"],
-    commands: ["system.run"],
+    commands: opts?.commands ?? [],
     deviceIdentity,
     timeoutMessage: `timeout waiting for ${label} to connect`,
   });
@@ -171,9 +179,9 @@ export async function waitForNodeStatus(
   try {
     while (Date.now() < deadline) {
       const list = await client.request("node.list", {});
-      const match = list.nodes?.find((n) => n.nodeId === nodeId);
+      const match = list.nodes?.find((n: any) => n.nodeId === nodeId);
       if (match?.connected && match?.paired) {
-        return;
+        return match;
       }
       await sleep(GATEWAY_NODE_STATUS_POLL_MS);
     }
