fix(state): gateway starts when WSL chmod returns EROFS (#108258)

goutamadwant · steipete · web-flow · commit 154d53c4f6fc · 2026-07-15T18:55:49.000-07:00
* fix(state): tolerate guarded EROFS chmod failures

* fix(state): keep EROFS mode handling fail-closed

---------

Co-authored-by: Peter Steinberger &lt;peter@steipete.me&gt;
Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/src/infra/private-mode.ts b/src/infra/private-mode.ts
@@ -41,6 +41,11 @@ function canIgnorePrivateChmodError(target: string, code: string | undefined): b
   if (code && CHMOD_UNSUPPORTED_CODES.has(code)) {
     return true;
   }
+  if (code === "EROFS") {
+    // WSL can report EROFS for chmod on an already-private path. Never waive
+    // broad permissions for this anomalous code.
+    return hasRestrictivePermissions(target);
+  }
   if (code !== "EPERM") {
     return false;
   }
diff --git a/src/state/openclaw-state-db.permissions.test.ts b/src/state/openclaw-state-db.permissions.test.ts
@@ -93,6 +93,27 @@ describe("state database permission hardening without chmod support", () => {
     expect(database.db.isOpen).toBe(true);
   });
 
+  it("opens when EROFS leaves existing permissions restrictive", () => {
+    stateDir = fs.mkdtempSync(join(tmpdir(), "openclaw-state-chmod-"));
+    openOpenClawStateDatabase({ env: { OPENCLAW_STATE_DIR: stateDir } });
+    closeOpenClawStateDatabaseForTest();
+    chmodFailHook.error = chmodError("EROFS");
+
+    const database = openOpenClawStateDatabase({ env: { OPENCLAW_STATE_DIR: stateDir } });
+
+    expect(database.db.isOpen).toBe(true);
+  });
+
+  it("rethrows EROFS when existing permissions are too broad", () => {
+    stateDir = fs.mkdtempSync(join(tmpdir(), "openclaw-state-chmod-"));
+    fs.chmodSync(stateDir, 0o755);
+    chmodFailHook.error = chmodError("EROFS");
+
+    expect(() => openOpenClawStateDatabase({ env: { OPENCLAW_STATE_DIR: stateDir } })).toThrow(
+      /EROFS/,
+    );
+  });
+
   it("opens when the filesystem probe also rejects chmod with EPERM", () => {
     stateDir = fs.mkdtempSync(join(tmpdir(), "openclaw-state-chmod-"));
     fs.chmodSync(stateDir, 0o755);

Original file line number	Diff line number	Diff line change
`@@ -41,6 +41,11 @@ function canIgnorePrivateChmodError(target: string, code: string \| undefined): b`
`41`	`41`	`if (code && CHMOD_UNSUPPORTED_CODES.has(code)) {`
`42`	`42`	`return true;`
`43`	`43`	`}`
	`44`	`+ if (code === "EROFS") {`
	`45`	`+ // WSL can report EROFS for chmod on an already-private path. Never waive`
	`46`	`+ // broad permissions for this anomalous code.`
	`47`	`+ return hasRestrictivePermissions(target);`
	`48`	`+ }`
`44`	`49`	`if (code !== "EPERM") {`
`45`	`50`	`return false;`
`46`	`51`	`}`