[AI] fix(update-cli): warn+continue on Windows schtasks access-denied

xydt-tanshanshan · xydt-tanshanshan · commit 601ce90abbbe · 2026-07-20T19:41:17.000+08:00
When schtasks /Change /DISABLE fails with a Windows access-denied error (reported in localized text such as 'ERROR: Access is denied.', '错误: 拒绝访问。', or 'Zugriff verweigert'), the package update no longer hard-exits. The task remains in its prior enabled state and the update proceeds with a warning telling the user to run 'openclaw gateway restart' from an elevated shell if the gateway fails to restart after the update. Other schtasks disable failures (timeouts, malformed output, etc.) stay fatal so real environmental problems are not masked. Related to #111756
diff --git a/src/cli/update-cli.test.ts b/src/cli/update-cli.test.ts
@@ -4318,6 +4318,79 @@ describe("update-cli", () => {
     },
   );
 
+  it.each([
+    { label: "en", detail: "ERROR: Access is denied." },
+    { label: "zh", detail: "错误: 拒绝访问。" },
+    { label: "de", detail: "Zugriff verweigert" },
+  ])(
+    "continues a no-restart package update when Windows Scheduled Task disable reports access denied ($label)",
+    async ({ detail }) => {
+      const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+      mockPackageInstallStatus(createCaseDir("openclaw-update-task-access-denied"));
+      serviceReadCommand.mockResolvedValue({
+        programArguments: ["openclaw", "gateway", "run"],
+        environment: {
+          OPENCLAW_SERVICE_MARKER: "openclaw",
+          OPENCLAW_SERVICE_KIND: "gateway",
+        },
+      });
+      serviceReadRuntime.mockResolvedValue({ status: "stopped", state: "stopped" });
+      suspendScheduledTaskAutoStartForUpdate.mockRejectedValueOnce(
+        new Error(`schtasks disable failed: ${detail}`),
+      );
+
+      await updateCommand({ yes: true, restart: false });
+      platformSpy.mockRestore();
+
+      // Hard-fail path is bypassed: update proceeds with package install and
+      // never reaches the access-restricted exit branch.
+      expect(defaultRuntime.exit).not.toHaveBeenCalledWith(1);
+      expect(packageInstallCommandCall()).toBeDefined();
+      // The task was never actually suspended, so the resume path must not run.
+      expect(resumeScheduledTaskAutoStartAfterUpdate).not.toHaveBeenCalled();
+      const warnLog = vi
+        .mocked(defaultRuntime.log)
+        .mock.calls.map((call) => String(call[0]))
+        .find((line) =>
+          line.includes("Could not disable the Windows Scheduled Task before update"),
+        );
+      expect(warnLog).toBeDefined();
+      expect(warnLog).toContain(detail);
+      expect(warnLog).toContain("openclaw gateway restart");
+    },
+  );
+
+  it("still hard-fails a no-restart package update when Windows Scheduled Task disable fails for a non-access reason", async () => {
+    const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    mockPackageInstallStatus(createCaseDir("openclaw-update-task-non-access-failure"));
+    serviceReadCommand.mockResolvedValue({
+      programArguments: ["openclaw", "gateway", "run"],
+      environment: {
+        OPENCLAW_SERVICE_MARKER: "openclaw",
+        OPENCLAW_SERVICE_KIND: "gateway",
+      },
+    });
+    serviceReadRuntime.mockResolvedValue({ status: "stopped", state: "stopped" });
+    suspendScheduledTaskAutoStartForUpdate.mockRejectedValueOnce(
+      new Error("schtasks disable failed: schtasks timed out after 15000ms"),
+    );
+
+    await updateCommand({ yes: true, restart: false });
+    platformSpy.mockRestore();
+
+    // Non-access failures stay fatal: exit(1) is invoked, the package install
+    // never runs, and the resume path stays untouched.
+    expect(defaultRuntime.exit).toHaveBeenCalledWith(1);
+    expect(packageInstallCommandCall()).toBeUndefined();
+    expect(resumeScheduledTaskAutoStartAfterUpdate).not.toHaveBeenCalled();
+    const errorLog = vi
+      .mocked(defaultRuntime.error)
+      .mock.calls.map((call) => String(call[0]))
+      .find((line) => line.includes("Failed to stop managed gateway service before update"));
+    expect(errorLog).toBeDefined();
+    expect(errorLog).toContain("schtasks timed out after 15000ms");
+  });
+
   it("stops a running managed gateway when git checkout rebuild starts", async () => {
     const serviceEntrypoint = path.join(process.cwd(), "dist", "index.js");
     serviceReadCommand.mockResolvedValue({
diff --git a/src/cli/update-cli/update-command-service.ts b/src/cli/update-cli/update-command-service.ts
@@ -429,6 +429,24 @@ async function abortWindowsTaskUpdateIfInterrupted(
   throw new UpdateCommandAbort();
 }
 
+// Windows schtasks /Change /DISABLE surfaces access-denied failures with
+// locale-localized text. The patterns below cover the localizations observed
+// in issue reports and existing tests so we can degrade to a warn+continue path
+// instead of blocking the update with a hard exit. Add new locales here when a
+// real report surfaces them; do not speculatively expand the list.
+const WINDOWS_ACCESS_DENIED_PATTERNS: readonly RegExp[] = [
+  /access(?:\s+is)?\s+denied/iu,
+  /拒绝访问/u,
+  /zugriff\s+verweigert/iu,
+];
+
+function isWindowsAccessDeniedError(err: unknown): boolean {
+  if (!(err instanceof Error)) {
+    return false;
+  }
+  return WINDOWS_ACCESS_DENIED_PATTERNS.some((pattern) => pattern.test(err.message));
+}
+
 async function maybeSuspendWindowsTaskAutoStartForPackageUpdate(params: {
   updateInstallKind: "git" | "package";
   serviceEnv: NodeJS.ProcessEnv | undefined;
@@ -447,6 +465,20 @@ async function maybeSuspendWindowsTaskAutoStartForPackageUpdate(params: {
   } catch (err) {
     await recovery.restore().catch(() => undefined);
     recovery.complete();
+    // A user-permission gap on /Change /DISABLE (task owned by another identity
+    // or an elevated shell required) leaves the task in its prior enabled state.
+    // Let the package update proceed; warn the user that the gateway may need a
+    // manual restart from an elevated shell after the update. Other schtasks
+    // failures stay fatal so real environmental problems are not masked.
+    if (isWindowsAccessDeniedError(err)) {
+      const restartCommand = replaceCliName(formatCliCommand("openclaw gateway restart"), CLI_NAME);
+      defaultRuntime.log(
+        theme.warn(
+          `Could not disable the Windows Scheduled Task before update (${String(err)}); leaving it enabled and continuing. Run \`${restartCommand}\` from an elevated shell if the gateway fails to restart after update.`,
+        ),
+      );
+      return undefined;
+    }
     throw err;
   }
   await abortWindowsTaskUpdateIfInterrupted(recovery);
