fix(doctor): report managed plugin version drift#90927
Conversation
|
Codex review: needs maintainer review before merge. Reviewed June 8, 2026, 11:05 AM ET / 15:05 UTC. Summary PR surface: Source +113, Tests +523. Total +636 across 9 files. Reproducibility: yes. by source inspection and linked live evidence: current main gathers plugin drift in daemon status but doctor never receives or prints that report, and the linked issue shows the before state on a real upgraded host. Review metrics: 1 noteworthy metric.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Merge the daemon-status-based doctor fix after gateway/doctor/security owners accept the SecretRef gate and plugin update/restart guidance. Do we have a high-confidence way to reproduce the issue? Yes, by source inspection and linked live evidence: current main gathers plugin drift in daemon status but doctor never receives or prints that report, and the linked issue shows the before state on a real upgraded host. Is this the best way to solve the issue? Yes, with owner/security caveats. Reusing daemon status is the best observed fix shape because it uses the running gateway context instead of duplicating local install-record policy inside doctor. AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against d46dc39b18ec. Label changesLabel changes:
Label justifications:
Evidence reviewedPR surface: Source +113, Tests +523. Total +636 across 9 files. View PR surface stats
Security concerns:
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
CI note after initial monitor:
|
|
CI context update after the final poll: The remaining visible failures still look unrelated to this PR's changed files:
This PR changes only the doctor/status/probe-auth path for managed plugin drift. The focused local tests, VPS focused tests, VPS |
f906a1e to
13280dd
Compare
|
Superseding the earlier CI notes: the PR is now clean on head What changed after the failures:
Validation after the cleanup:
GitHub CI: all visible checks are passing or intentionally skipped; |
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review Current-head VPS real behavior proof is now in the PR body for It uses a temp state/config and a short-lived local gateway from this PR head, then runs |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
|
@clawsweeper re-review Current-head proof gate is now passing for |
|
@clawsweeper re-review Current-head proof gate is now passing for |
|
🦞👀 Command router queued. I will update this comment with the next step. |
# Conflicts: # src/commands/agent-via-gateway.test.ts
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
@clawsweeper re-review Merge conflicts are resolved on current head |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
|
@clawsweeper re-review Current-main merge conflicts are resolved on head
The only remaining rank-up item should be the human owner/security acceptance for the exec SecretRef probe policy and repair advice. |
|
🦞🧹 I asked ClawSweeper to review this item again. |
|
@clawsweeper re-review The previous Current state for this exact head:
Expected remaining rank-up item: human owner/security acceptance for the exec SecretRef probe policy and repair advice. |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
|
Auto-response retry note: the latest |
|
@clawsweeper re-review Final pass request after the PR-body state line was refreshed to clear the transient auto-response failure. Current head is unchanged:
Current PR checks are clean: 132 pass, 30 skipped/neutral. GitHub reports the PR mergeable against base |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
…r-plugin-drift * origin/main: (96 commits) test: satisfy cron cancellation lint fix: unblock timed cron cancellation fix: unwind timeout-disabled cron cancellation fix: preserve cron timeout terminal state test: remove stale cron cancel harness hook fix: avoid cron cancel runtime cycle fix(cron): keep main-session cron cancel honest test(cron): type unresolved runner mock fix(cron): preserve timeout cleanup after cancel fix(cron): cancel active cron task runs fix(release): prepare ClawHub publish deps after target checkout test(release): dedupe gateway migration mock chore(release): keep main changelog release-owned test(release): align qa tool coverage gate test(release): ignore terminal docker stats samples test(release): stabilize qa runtime parity gate test(release): align kitchen sink rpc descriptors ci(release): retry Docker E2E image builds test(release): stabilize qa gateway restart readiness ci(release): retry Docker BuildKit bootstrap ... # Conflicts: # src/commands/agent-via-gateway.test.ts
|
Maintainer update: rebased this PR onto current Proof on head
|
Summary
What problem does this PR solve?
openclaw doctornow surfaces active official managed plugin version drift that was previously only visible inopenclaw gateway status --deep.--allow-execis set.Why does this matter now?
What is the intended outcome?
Plugin version driftnote with the stale plugin version, expected gateway version, and an actionableopenclaw plugins update <plugin> && openclaw gateway restartrepair.What is intentionally out of scope?
What does success look like?
What should reviewers focus on?
runWorkspaceStatusHealthnow obtains drift fromgatherDaemonStatus.status.gather.tskeeps daemon preauth probes on the stricter probe credential policy.doctor:gateway-healthkeeps the existing normal Gateway RPC credential policy and skips any exec SecretRef that could be selected unless--allow-execis set.Linked context
Which issue does this close?
Closes #90891
Which issues, PRs, or discussions are related?
Related #90917 was an overlapping contributor PR; it has now been closed. This PR carries the proofed fix.
Was this requested by a maintainer or owner?
Yes. The issue reporter/maintainer account
brokemac79owns the affected VPS proof environment and asked for this focused fix.Real behavior proof
openclaw doctor --non-interactivereports official managed plugin version drift for a stale active managed install.myvps(polymarket-mc), Ubuntu Linux, temp clone/tmp/oc-90891-latest, PR headd841d8c6232321e26b2fc4d875b4ffe1c7ca07ee./tmp/oc-90891-latest, verifiedgit rev-parse HEADwasd841d8c6232321e26b2fc4d875b4ffe1c7ca07ee, created a tempOPENCLAW_STATE_DIR/OPENCLAW_CONFIG_PATH, wrote an installed-plugin-index SQLite row for stale official managed npm plugin@openclaw/acpx@2026.5.30-beta.1, started a short-lived local gateway from this PR head withnode openclaw.mjs gateway --port <temp-port> --bind loopback --force, then rannode openclaw.mjs doctor --non-interactiveand asserted the drift note and repair command withgrep -F.Plugin version driftnote for the stale official managed plugin, showed installed version2026.5.30-beta.1, expected running gateway version2026.6.2, and the actionable repair commandopenclaw plugins update acpx && openclaw gateway restart.cbx_2113c24a2c6f/run_e119becc434ecould not sync because local Windowsrsync.exewas missing behind the shim. The live proof usedacpxinstead of the issue host's oldercodexfixture becausecodexis not present in the current official external plugin catalog at this head.gateway status --deepreported stale official managed plugin drift while doctor only showed plugin counts/errors.Tests and validation
Which commands did you run?
Observed latest-head VPS result on
d841d8c6232321e26b2fc4d875b4ffe1c7ca07ee:src/commands/agent-via-gateway.test.ts: 55 passed.What regression coverage was added or updated?
--allow-execis set.What failed before this fix, if known?
If no test was added, why not?
Risk checklist
Did user-visible behavior change? (
Yes/No)Yes. Doctor can now emit a new
Plugin version driftwarning.Did config, environment, or migration behavior change? (
Yes/No)No.
Did security, auth, secrets, network, or tool execution behavior change? (
Yes/No)Yes, narrowly. The new doctor drift probe can read daemon-context gateway auth, but exec SecretRefs are disabled by default and require
--allow-exec, matching doctor's existing exec gate.What is the highest-risk area?
Avoiding misleading local install-record drift warnings and avoiding unexpected exec SecretRef execution.
How is that risk mitigated?
The probe is skipped for remote gateway mode, drift is suppressed when auth materialization was skipped, a probed gateway version is required before doctor emits drift advice, and tests cover exec SecretRef plus local/remote credential boundaries.
Current review state
What is the next action?
Maintainer review.
What is still waiting on author, maintainer, CI, or external proof?
No author-side code/proof work is pending. CI is green on head
d841d8c6232321e26b2fc4d875b4ffe1c7ca07eewith only success/skipped/neutral checks except for a transient auto-response GitHub API 500 on label lookup, which is being retried by this body refresh. ClawSweeper re-review has completed successfully for this exact head; the remaining rank-up item is human owner/security acceptance for the exec SecretRef probe policy and repair advice.Which bot or reviewer comments were addressed?
Codex review findings were addressed locally before PR creation and during CI cleanup:
--allow-execgate.Codex review final result on merge head
d841d8c623:codex review --commit HEADreported no actionable correctness issues in the HEAD diff. It noted focused gateway approval tests passed; broader Windows agent tests hit temp cleanup/SQLite lock failures that did not indicate a changed runtime bug. A branch-widecodex review --base origin/mainretry previously timed out after 15 minutes with no findings before commit-scoped review completed cleanly.