Skip to content

harden update restart script creation [AI]#84088

Merged
pgondhi987 merged 3 commits into
openclaw:mainfrom
pgondhi987:fix/fix-667
May 19, 2026
Merged

harden update restart script creation [AI]#84088
pgondhi987 merged 3 commits into
openclaw:mainfrom
pgondhi987:fix/fix-667

Conversation

@pgondhi987

@pgondhi987 pgondhi987 commented May 19, 2026

Copy link
Copy Markdown
Contributor

AI-assisted.

Summary

  • Problem: update restart handoff scripts used a predictable shared-temp path and default write behavior.
  • Solution: create a generated temp subdirectory for each handoff script and write the script with exclusive creation.
  • What changed: POSIX and Windows restart scripts now also remove their generated temp directory on best-effort cleanup.
  • What did NOT change (scope boundary): restart command logic, service names, task names, logging destinations, and update flow behavior are unchanged.

Change Type (select all)

  • Bug fix
  • Feature
  • Refactor required for the fix
  • Docs
  • Security hardening
  • Chore/infra

Scope (select all touched areas)

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens
  • Memory / storage
  • Integrations
  • API / contracts
  • UI / DX
  • CI/CD / infra

Linked Issue/PR

  • Related: private maintainer context
  • This PR addresses a bug or regression

Motivation

  • The restart helper prepares a detached script during update handoff. That script should be created in an isolated temp location and should not overwrite or follow a preexisting shared-temp path.

Real behavior proof (required for external PRs)

  • Behavior or issue addressed: restart handoff script creation now avoids the old predictable shared-temp candidate path and uses exclusive creation in a generated temp subdirectory.
  • Real environment tested: Not run in this handoff.
  • Exact steps or command run after this patch: Not run in this handoff.
  • Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): Regression coverage was added in src/cli/update-cli/restart-helper.test.ts; execution is pending maintainer verification.
  • Observed result after fix: Pending maintainer verification.
  • What was not tested: Real detached update restart execution and local test execution.
  • Before evidence (optional but encouraged): N/A

Root Cause (if applicable)

  • Root cause: the helper derived the script path directly from os.tmpdir() plus a timestamped filename, then wrote with default write semantics.
  • Missing detection / guardrail: there was no regression test keeping a preexisting shared-temp candidate path untouched.
  • Contributing context (if known): the restart script needs to survive the parent process and is intentionally written outside the installed package files.

Regression Test Plan (if applicable)

  • Coverage level that should have caught this:
    • Unit test
    • Seam / integration test
    • End-to-end test
    • Existing coverage already sufficient
  • Target test or file: src/cli/update-cli/restart-helper.test.ts
  • Scenario the test should lock in: a preexisting old shared-temp candidate path remains untouched, and the generated script lives under a fresh temp subdirectory with exclusive file creation.
  • Why this is the smallest reliable guardrail: the behavior is contained in prepareRestartScript and can be validated without running a real update or service restart.
  • Existing test that already covers this (if any): N/A
  • If no new test is added, why not: N/A

User-visible / Behavior Changes

None expected.

Diagram (if applicable)

N/A

Security Impact (required)

  • New permissions/capabilities? (Yes/No) No
  • Secrets/tokens handling changed? (Yes/No) No
  • New/changed network calls? (Yes/No) No
  • Command/tool execution surface changed? (Yes/No) Yes
  • Data access scope changed? (Yes/No) No
  • If any Yes, explain risk + mitigation: the generated restart script now includes best-effort temp directory cleanup in addition to existing self-deletion. No new privileged command path is introduced.

Repro + Verification

Environment

  • OS: Not run in this handoff
  • Runtime/container: Not run in this handoff
  • Model/provider: N/A
  • Integration/channel (if any): N/A
  • Relevant config (redacted): N/A

Steps

  1. Run the focused restart helper test file.
  2. Confirm the regression case leaves the old shared-temp candidate untouched.
  3. Confirm generated restart scripts are written in a generated temp subdirectory with exclusive creation.

Expected

  • Focused tests pass.
  • Restart script path is under a generated temp subdirectory, not directly under the shared temp root.
  • Existing candidate path contents are unchanged.

Actual

  • Pending maintainer verification.

Evidence

  • Failing test/log before + passing after
  • Trace/log snippets
  • Screenshot/recording
  • Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

  • Verified scenarios: Static review of the changed helper and regression test logic.
  • Edge cases checked: unsupported platforms still return null; invalid Windows task names still return null; write failure still returns null after best-effort temp directory cleanup.
  • What you did not verify: local test execution, real update flow, and detached service restart behavior.

Review Conversations

  • I replied to or resolved every bot review conversation I addressed in this PR.
  • I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

  • Backward compatible? (Yes/No) Yes
  • Config/env changes? (Yes/No) No
  • Migration needed? (Yes/No) No
  • If yes, exact upgrade steps: N/A

Risks and Mitigations

  • Risk: temp directory cleanup may fail if the directory is no longer empty or already removed.
    • Mitigation: cleanup is best-effort and does not affect restart exit status.

@openclaw-barnacle openclaw-barnacle Bot added cli CLI command changes size: S maintainer Maintainer-authored PR labels May 19, 2026
@clawsweeper

clawsweeper Bot commented May 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR moves update restart handoff scripts into generated temp subdirectories, writes them with exclusive creation, cleans up those directories, and adds focused regression coverage.

Reproducibility: yes. Source inspection shows current main derives the script path from os.tmpdir() plus a timestamp and writes without an exclusive flag; a focused unit repro can precreate or symlink that candidate path with Date.now mocked, though I did not run it because this review is read-only.

PR rating
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Summary: Patch quality is solid, but the external-PR proof gate is unmet because no after-fix behavior was actually run.

Rank-up moves:

  • Attach redacted output from the focused restart-helper test run.
  • Attach redacted terminal/log proof from a real detached update restart handoff on at least one supported OS.
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

PR egg
🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?
  • The egg game starts only after the PR passes the real-behavior proof check.
  • Before that, no creature, rarity, or ASCII portrait is rolled. The treat waits for real proof.
  • This is still just collectible flavor: proof affects review readiness, not creature quality.

Real behavior proof
Needs real behavior proof before merge: The PR body says no real environment or test command was run; before merge, add redacted terminal/log/live output or a recording and update the PR body so ClawSweeper can re-review.

Risk before merge
Why this matters: - The PR body says no local test run, real detached update restart, or runtime proof was performed after the patch.

  • The helper controls a detached update restart path across Linux, macOS, and Windows, so a path or cleanup mistake could leave an updated gateway unrestarted even if unit coverage looks right.

Maintainer options:

  1. Require real restart proof (recommended)
    Before merge, get redacted terminal/log output from a focused test run plus at least one real detached update restart handoff showing the gateway restarts successfully.
  2. Accept unit-only hardening
    Maintainers can choose to merge based on code review and focused regression coverage if they accept that the detached runtime path was not exercised in this PR.

Next step before merge
Needs maintainer handling because the PR is protected by the maintainer label and lacks after-fix real behavior proof; there is no narrow code defect for ClawSweeper to repair.

Security
Cleared: The diff reduces a predictable-temp-script overwrite risk and does not add dependencies, network calls, secrets handling, or broader permissions.

Review details

Best possible solution:

Land the mkdtemp plus exclusive-write hardening after focused test output and a real detached update restart smoke, or have a maintainer explicitly accept the remaining runtime proof gap.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main derives the script path from os.tmpdir() plus a timestamp and writes without an exclusive flag; a focused unit repro can precreate or symlink that candidate path with Date.now mocked, though I did not run it because this review is read-only.

Is this the best way to solve the issue?

Yes. The PR fixes the owning helper by creating an isolated temp directory and using exclusive file creation, which is the narrow maintainable fix; the missing piece is runtime proof, not a different implementation approach.

Label justifications:

  • P2: This is a focused CLI update security hardening with limited blast radius but a security-sensitive command execution path.
  • merge-risk: 🚨 availability: The patch changes detached update restart script creation and cleanup, and an unproven runtime path could prevent the gateway from restarting after update.

What I checked:

  • Current vulnerable path on main: Current main builds the restart script path directly under os.tmpdir() with a timestamped filename and writes it with default fs.writeFile semantics. (src/cli/update-cli/restart-helper.ts:373, 5e0850fc548c)
  • PR hardening diff: The PR replaces the shared-temp path with fs.mkdtemp(path.join(os.tmpdir(), "openclaw-restart-")), writes the script with { flag: "wx", mode: 0o755 }, and removes the private directory on write failure. (src/cli/update-cli/restart-helper.ts:375, 79b96b1d2fa8)
  • Focused regression coverage: The added test precreates or symlinks the old timestamped candidate path, verifies the generated script uses a private temp directory, checks exclusive write options, and confirms the preexisting candidate remains untouched. (src/cli/update-cli/restart-helper.test.ts:140, 79b96b1d2fa8)
  • Runtime call path: The update command prepares the restart script before completion and later hands that exact path to the detached restart runner, so this helper is the owning boundary for the script-creation hardening. (src/cli/update-cli/update-command.ts:3339, 5e0850fc548c)
  • Proof gap from PR body: The PR body states Real environment tested: Not run in this handoff, Exact steps or command run after this patch: Not run in this handoff, and Observed result after fix: Pending maintainer verification. (79b96b1d2fa8)
  • Protected review label: Live PR metadata shows labels cli, maintainer, and size: S; the protected maintainer label means this PR should stay open for explicit maintainer handling. (79b96b1d2fa8)

Likely related people:

  • artale: Introduced the standalone update restart helper and update-command handoff path in b1d5c716..., including the temp-script creation pattern this PR hardens. (role: introduced behavior; confidence: high; commits: b1d5c71609c3; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts, src/cli/update-cli/update-command.ts)
  • steipete: Recent commits on the same helper and update-command path include launchd, Windows startup, scheduling, and logging hardening work. (role: recent area contributor; confidence: high; commits: 1ace6a0d6a0d, 81390c643b96, d1e5f4bd3c62; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts, src/cli/update-cli/update-command.ts)
  • hclsys: Authored prior macOS restart-helper hardening and regression coverage around restart script logging and exit behavior. (role: adjacent security-hardening contributor; confidence: medium; commits: 4a870300ddc5; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 5e0850fc548c.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 19, 2026
@pgondhi987

pgondhi987 commented May 19, 2026

Copy link
Copy Markdown
Contributor Author

Not applicable to this automation stage; changelog/release-note and external real behavior proof requirements are handled outside auto-pr stages.

Quoted comment from @clawsweeper:

Codex review: needs real behavior proof before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible ``@clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper` re-review` or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment ``@clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper` autofix`, @clawsweeper automerge, @clawsweeper` fix ci`, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper` explain` to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR moves update restart handoff scripts into generated temp subdirectories, writes them with exclusive creation, cleans up those directories, and adds focused regression coverage.

Reproducibility: yes. Source inspection shows current main derives the script path from os.tmpdir() plus a timestamp and writes without an exclusive flag; a focused unit repro can precreate or symlink that candidate path with Date.now mocked, though I did not run it because this review is read-only.

PR rating
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Summary: Patch quality is solid, but the external-PR proof gate is unmet because no after-fix behavior was actually run.

Rank-up moves:

  • Attach redacted output from the focused restart-helper test run.
  • Attach redacted terminal/log proof from a real detached update restart handoff on at least one supported OS.
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

PR egg
🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

Where did the egg go?
  • The egg game starts only after the PR passes the real-behavior proof check.
  • Before that, no creature, rarity, or ASCII portrait is rolled. The treat waits for real proof.
  • This is still just collectible flavor: proof affects review readiness, not creature quality.

Real behavior proof
Needs real behavior proof before merge: The PR body says no real environment or test command was run; before merge, add redacted terminal/log/live output or a recording and update the PR body so ClawSweeper can re-review.

Risk before merge
Why this matters: - The PR body says no local test run, real detached update restart, or runtime proof was performed after the patch.

  • The helper controls a detached update restart path across Linux, macOS, and Windows, so a path or cleanup mistake could leave an updated gateway unrestarted even if unit coverage looks right.

Maintainer options:

  1. Require real restart proof (recommended)
    Before merge, get redacted terminal/log output from a focused test run plus at least one real detached update restart handoff showing the gateway restarts successfully.
  2. Accept unit-only hardening
    Maintainers can choose to merge based on code review and focused regression coverage if they accept that the detached runtime path was not exercised in this PR.

Next step before merge
Needs maintainer handling because the PR is protected by the maintainer label and lacks after-fix real behavior proof; there is no narrow code defect for ClawSweeper to repair.

Security
Cleared: The diff reduces a predictable-temp-script overwrite risk and does not add dependencies, network calls, secrets handling, or broader permissions.

Review details

Best possible solution:

Land the mkdtemp plus exclusive-write hardening after focused test output and a real detached update restart smoke, or have a maintainer explicitly accept the remaining runtime proof gap.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main derives the script path from os.tmpdir() plus a timestamp and writes without an exclusive flag; a focused unit repro can precreate or symlink that candidate path with Date.now mocked, though I did not run it because this review is read-only.

Is this the best way to solve the issue?

Yes. The PR fixes the owning helper by creating an isolated temp directory and using exclusive file creation, which is the narrow maintainable fix; the missing piece is runtime proof, not a different implementation approach.

Label justifications:

  • P2: This is a focused CLI update security hardening with limited blast radius but a security-sensitive command execution path.
  • merge-risk: 🚨 availability: The patch changes detached update restart script creation and cleanup, and an unproven runtime path could prevent the gateway from restarting after update.

What I checked:

  • Current vulnerable path on main: Current main builds the restart script path directly under os.tmpdir() with a timestamped filename and writes it with default fs.writeFile semantics. (src/cli/update-cli/restart-helper.ts:373, 5e0850fc548c)
  • PR hardening diff: The PR replaces the shared-temp path with fs.mkdtemp(path.join(os.tmpdir(), "openclaw-restart-")), writes the script with { flag: "wx", mode: 0o755 }, and removes the private directory on write failure. (src/cli/update-cli/restart-helper.ts:375, 79b96b1d2fa8)
  • Focused regression coverage: The added test precreates or symlinks the old timestamped candidate path, verifies the generated script uses a private temp directory, checks exclusive write options, and confirms the preexisting candidate remains untouched. (src/cli/update-cli/restart-helper.test.ts:140, 79b96b1d2fa8)
  • Runtime call path: The update command prepares the restart script before completion and later hands that exact path to the detached restart runner, so this helper is the owning boundary for the script-creation hardening. (src/cli/update-cli/update-command.ts:3339, 5e0850fc548c)
  • Proof gap from PR body: The PR body states Real environment tested: Not run in this handoff, Exact steps or command run after this patch: Not run in this handoff, and Observed result after fix: Pending maintainer verification. (79b96b1d2fa8)
  • Protected review label: Live PR metadata shows labels cli, maintainer, and size: S; the protected maintainer label means this PR should stay open for explicit maintainer handling. (79b96b1d2fa8)

Likely related people:

  • artale: Introduced the standalone update restart helper and update-command handoff path in b1d5c716..., including the temp-script creation pattern this PR hardens. (role: introduced behavior; confidence: high; commits: b1d5c71609c3; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts, src/cli/update-cli/update-command.ts)
  • steipete: Recent commits on the same helper and update-command path include launchd, Windows startup, scheduling, and logging hardening work. (role: recent area contributor; confidence: high; commits: 1ace6a0d6a0d, 81390c643b96, d1e5f4bd3c62; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts, src/cli/update-cli/update-command.ts)
  • hclsys: Authored prior macOS restart-helper hardening and regression coverage around restart script logging and exit behavior. (role: adjacent security-hardening contributor; confidence: medium; commits: 4a870300ddc5; files: src/cli/update-cli/restart-helper.ts, src/cli/update-cli/restart-helper.test.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 5e0850fc548c.

@pgondhi987 pgondhi987 merged commit 48acdd3 into openclaw:main May 19, 2026
23 checks passed
@github-actions github-actions Bot mentioned this pull request May 19, 2026
Open
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request May 21, 2026
@eleboucher
fix(container): update image ghcr.io/openclaw/openclaw (2026.5.19 ➔ 2…
ab94676 
…026.5.20) (#615)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` |

---

> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information.

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520)

[Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20)

##### Changes

- Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed.
- Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#&#8203;84264](openclaw/openclaw#84264)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#&#8203;84499](openclaw/openclaw#84499)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog.
- CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#&#8203;80407](openclaw/openclaw#80407)) Thanks [@&#8203;giodl73-repo](https://github.com/giodl73-repo).
- Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally.
- Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#&#8203;84005](openclaw/openclaw#84005)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@&#8203;amknight](https://github.com/amknight).

##### Fixes

- CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#&#8203;84691](openclaw/openclaw#84691)) Thanks [@&#8203;efpiva](https://github.com/efpiva).
- Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#&#8203;84736](openclaw/openclaw#84736)) Thanks [@&#8203;JARVIS-Glasses](https://github.com/JARVIS-Glasses).
- Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#&#8203;84508](openclaw/openclaw#84508). Thanks [@&#8203;neeravmakwana](https://github.com/neeravmakwana).
- Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#&#8203;84699](openclaw/openclaw#84699)) Thanks [@&#8203;nxmxbbd](https://github.com/nxmxbbd).
- WhatsApp: update Baileys to `7.0.0-rc12`.
- Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@&#8203;romneyda](https://github.com/romneyda).
- CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#&#8203;84684](openclaw/openclaw#84684)) Thanks [@&#8203;TurboTheTurtle](https://github.com/TurboTheTurtle).
- Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired.
- Mac app: update the About settings copyright year to 2026. ([#&#8203;84385](openclaw/openclaw#84385)) Thanks [@&#8203;pejmanjohn](https://github.com/pejmanjohn).
- Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS.
- Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@&#8203;romneyda](https://github.com/romneyda).
- Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#&#8203;84595](openclaw/openclaw#84595))
- Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#&#8203;77803](openclaw/openclaw#77803).
- Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#&#8203;84718](openclaw/openclaw#84718)) Thanks [@&#8203;lukaIvanic](https://github.com/lukaIvanic).
- Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`.
- WebChat: clear stale typing indicators when session change events mark the active chat run complete.
- Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports.
- macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows.
- Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed.
- fix(mattermost): fail closed on missing channel type \[AI]. ([#&#8203;84091](openclaw/openclaw#84091)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Recheck rebuilt system.run argv \[AI]. ([#&#8203;84090](openclaw/openclaw#84090)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#&#8203;84519](openclaw/openclaw#84519))
- CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#&#8203;83856](openclaw/openclaw#83856). ([#&#8203;83989](openclaw/openclaw#83989))
- Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#&#8203;84289](openclaw/openclaw#84289))
- Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#&#8203;83477](openclaw/openclaw#83477)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#&#8203;82930](openclaw/openclaw#82930). ([#&#8203;82933](openclaw/openclaw#82933)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#&#8203;84269](openclaw/openclaw#84269)) Thanks [@&#8203;Kaspre](https://github.com/Kaspre).
- Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#&#8203;84254](openclaw/openclaw#84254)) Thanks [@&#8203;moritzmmayerhofer](https://github.com/moritzmmayerhofer).
- Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#&#8203;82937](openclaw/openclaw#82937)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#&#8203;84191](openclaw/openclaw#84191)) Thanks [@&#8203;100menotu001](https://github.com/100menotu001).
- Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#&#8203;60799](openclaw/openclaw#60799). ([#&#8203;84433](openclaw/openclaw#84433)) Thanks [@&#8203;IWhatsskill](https://github.com/IWhatsskill).
- Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#&#8203;84355](openclaw/openclaw#84355); refs [#&#8203;57835](openclaw/openclaw#57835)) Thanks [@&#8203;luoyanglang](https://github.com/luoyanglang).
- Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#&#8203;84303](openclaw/openclaw#84303)) Thanks [@&#8203;VACInc](https://github.com/VACInc).
- Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#&#8203;84153](openclaw/openclaw#84153))
- Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#&#8203;84188](openclaw/openclaw#84188)) Thanks [@&#8203;100menotu001](https://github.com/100menotu001).
- Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#&#8203;83887](openclaw/openclaw#83887). ([#&#8203;84244](openclaw/openclaw#84244)) Thanks [@&#8203;hclsys](https://github.com/hclsys).
- Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#&#8203;82766](openclaw/openclaw#82766). ([#&#8203;82767](openclaw/openclaw#82767)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#&#8203;84067](openclaw/openclaw#84067)) Thanks [@&#8203;abnershang](https://github.com/abnershang).
- Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#&#8203;84045](openclaw/openclaw#84045)) Thanks [@&#8203;abnershang](https://github.com/abnershang).
- Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@&#8203;SebTardif](https://github.com/SebTardif).
- harden update restart script creation \[AI]. ([#&#8203;84088](openclaw/openclaw#84088)) Thanks [@&#8203;pgondhi987](https://github.com/pgondhi987).
- Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#&#8203;83613](openclaw/openclaw#83613). ([#&#8203;83626](openclaw/openclaw#83626)) Thanks [@&#8203;YuanHanzhong](https://github.com/YuanHanzhong).
- CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`.
- Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#&#8203;84057](openclaw/openclaw#84057))
- CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#&#8203;83995](openclaw/openclaw#83995)) Thanks [@&#8203;ThiagoCAltoe](https://github.com/ThiagoCAltoe).
- Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@&#8203;bdjben](https://github.com/bdjben).
- CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#&#8203;83904](openclaw/openclaw#83904). ([#&#8203;84080](openclaw/openclaw#84080))
- Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#&#8203;84055](openclaw/openclaw#84055)) Thanks [@&#8203;dutifulbob](https://github.com/dutifulbob).
- Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering.
- CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@&#8203;amknight](https://github.com/amknight).
- CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#&#8203;56222](openclaw/openclaw#56222). Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#&#8203;83858](openclaw/openclaw#83858)) Thanks [@&#8203;brokemac79](https://github.com/brokemac79).
- CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#&#8203;84392](openclaw/openclaw#84392)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#&#8203;84387](openclaw/openclaw#84387)) Thanks [@&#8203;samzong](https://github.com/samzong).
- Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#&#8203;82961](openclaw/openclaw#82961). ([#&#8203;82962](openclaw/openclaw#82962)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#&#8203;83699](openclaw/openclaw#83699). ([#&#8203;83700](openclaw/openclaw#83700)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#&#8203;84040](openclaw/openclaw#84040). ([#&#8203;84357](openclaw/openclaw#84357)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#&#8203;84222](openclaw/openclaw#84222). ([#&#8203;84374](openclaw/openclaw#84374)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#&#8203;83979](openclaw/openclaw#83979)) Thanks [@&#8203;yujiawei](https://github.com/yujiawei).
- Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#&#8203;83836](openclaw/openclaw#83836). ([#&#8203;84367](openclaw/openclaw#84367)) Thanks [@&#8203;joshavant](https://github.com/joshavant).
- Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#&#8203;82964](openclaw/openclaw#82964)) Thanks [@&#8203;galiniliev](https://github.com/galiniliev).
- CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#&#8203;83931](openclaw/openclaw#83931)) Thanks [@&#8203;honor2030](https://github.com/honor2030).
- Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#&#8203;84050](openclaw/openclaw#84050). ([#&#8203;84052](openclaw/openclaw#84052)) Thanks [@&#8203;jbetala7](https://github.com/jbetala7).
- WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#&#8203;83846](openclaw/openclaw#83846)) Thanks [@&#8203;neeravmakwana](https://github.com/neeravmakwana).
- WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#&#8203;79083](openclaw/openclaw#79083)) Thanks [@&#8203;Oviemudiaga](https://github.com/Oviemudiaga).
- CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#&#8203;83640](openclaw/openclaw#83640)) Thanks [@&#8203;se7en-agent](https://github.com/se7en-agent).
- Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#&#8203;83684](openclaw/openclaw#83684)) Thanks [@&#8203;ngutman](https://github.com/ngutman).
- iOS: repair Release archive compilation for the TestFlight build. ([#&#8203;84255](openclaw/openclaw#84255)) Thanks [@&#8203;ngutman](https://github.com/ngutman).
- Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#&#8203;84083](openclaw/openclaw#84083)) Thanks [@&#8203;100yenadmin](https://github.com/100yenadmin).
- Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#&#8203;42197](openclaw/openclaw#42197)) Thanks [@&#8203;Rain120](https://github.com/Rain120).
- Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#&#8203;84386](openclaw/openclaw#84386). ([#&#8203;84412](openclaw/openclaw#84412)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#&#8203;81561](openclaw/openclaw#81561)) Thanks [@&#8203;moeedahmed](https://github.com/moeedahmed).
- Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#&#8203;79396](openclaw/openclaw#79396). ([#&#8203;79489](openclaw/openclaw#79489)) Thanks [@&#8203;aayushprsingh](https://github.com/aayushprsingh).

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
534caba 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
b6480cb 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 24, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
b52e80b 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@pgondhi987
harden update restart script creation [AI] (openclaw#84088)
aba5348 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
galiniliev pushed a commit to galiniliev/openclaw that referenced this pull request May 25, 2026
@pgondhi987
harden update restart script creation [AI] (openclaw#84088)
0af777a 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
059da59 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
fdefc42 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request May 26, 2026
@pgondhi987 @SebTardif
harden update restart script creation [AI] (openclaw#84088)
5956dc6 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@pgondhi987
harden update restart script creation [AI] (openclaw#84088)
0a13c88 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
SYU8384 pushed a commit to SYU8384/openclaw that referenced this pull request Jun 3, 2026
@pgondhi987
harden update restart script creation [AI] (openclaw#84088)
ffaeab2 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@pgondhi987
harden update restart script creation [AI] (openclaw#84088)
df8a33b 
* fix: harden update restart script creation

* docs: add changelog entry for PR merge
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

cli CLI command changes maintainer Maintainer-authored PR rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: S status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pgondhi987