fix: preserve Mac bundle during live builds (#104376)

steipete · web-flow · commit c702719eda74 · 2026-07-11T03:06:50.000-07:00
diff --git a/.agents/skills/openclaw-live-updater/SKILL.md b/.agents/skills/openclaw-live-updater/SKILL.md
@@ -30,7 +30,7 @@ Keep `/Users/steipete/openclaw` a read-only-to-the-agent deployment mirror: clea
    - Every successful update sets `actions.gatewayBuild` and rebuilds exact new `main` before any restart.
    - Missing, invalid, or stale build output also forces a build, even when Git did not move.
    - A dependency-input change, absent `node_modules`, or missing/invalid build provenance first runs `pnpm install --frozen-lockfile`.
-   - Stop the managed Gateway immediately before `pnpm build` by invoking the existing `dist/index.js` directly; source launchers can auto-build stale output before dispatching the stop. Never mutate the live `dist` tree while an old Gateway can dynamically import from it. `pnpm build` must leave both canonical stamp heads and `dist/build-info.json.commit` equal to post-update `afterSha`; any missing/mismatched stamp or required artifact blocks restart.
+   - Stop the managed Gateway immediately before `pnpm build` by invoking the existing `dist/index.js` directly; source launchers can auto-build stale output before dispatching the stop. Preserve `dist/OpenClaw.app` outside `dist` for the build and restore it even when the build fails, because the JS build cleans `dist` regardless of Mac impact classification. Never mutate the live `dist` tree while an old Gateway can dynamically import from it. `pnpm build` must leave both canonical stamp heads and `dist/build-info.json.commit` equal to post-update `afterSha`; any missing/mismatched stamp or required artifact blocks restart.
    - Only after exact-SHA build proof may it restart the managed Gateway and require `gateway status --deep --require-rpc --json` plus `health --verbose --json`.
    - After every managed restart, query Gateway logs through RPC, restrict the audit to entries emitted since that restart began, report warning summaries, and fail the pass on any error/fatal entry. If RPC verification or log retrieval fails, still inspect the local structured log for that restart window. Never accept supervisor or RPC health without this restart-window log audit.
 
diff --git a/.agents/skills/openclaw-live-updater/scripts/update-main.mjs b/.agents/skills/openclaw-live-updater/scripts/update-main.mjs
@@ -522,6 +522,45 @@ function assertExactBuild(checkout, expectedSha) {
   return state;
 }
 
+function runBuildWithPreservedMacApp(runCommand, checkout) {
+  const appBundle = path.join(checkout, "dist/OpenClaw.app");
+  if (!existsSync(appBundle)) {
+    runCommand("pnpm", ["build"], checkout);
+    return;
+  }
+  const appStat = lstatSync(appBundle);
+  if (!appStat.isDirectory() || appStat.isSymbolicLink()) {
+    throw new UpdateInvariantError(
+      "unsafe_mac_bundle",
+      `refusing to preserve unsafe Mac app bundle: ${appBundle}`,
+    );
+  }
+  const preservedBundle = path.join(
+    checkout,
+    ".git",
+    `.openclaw-live-mac-${process.pid}-${randomUUID()}.app`,
+  );
+  renameSync(appBundle, preservedBundle);
+  try {
+    runCommand("pnpm", ["build"], checkout);
+  } finally {
+    if (!existsSync(preservedBundle)) {
+      throw new UpdateInvariantError(
+        "missing_preserved_mac_bundle",
+        `preserved Mac app bundle disappeared: ${preservedBundle}`,
+      );
+    }
+    if (existsSync(appBundle)) {
+      throw new UpdateInvariantError(
+        "mac_bundle_restore_conflict",
+        `build unexpectedly created ${appBundle}; preserved bundle remains at ${preservedBundle}`,
+      );
+    }
+    mkdirSync(path.dirname(appBundle), { recursive: true });
+    renameSync(preservedBundle, appBundle);
+  }
+}
+
 function restartGateway(runCommand, checkout, expectedSha) {
   assertExactBuild(checkout, expectedSha);
   const startedAtMs = Date.now();
@@ -750,7 +789,7 @@ export function maintainMain(options, dependencies = {}) {
       // Use the existing built CLI directly. Source launchers may auto-build a
       // stale dist before dispatching `gateway stop`, recreating the live-import race.
       runCommand(process.execPath, ["dist/index.js", "gateway", "stop"], update.checkout);
-      runCommand("pnpm", ["build"], update.checkout);
+      runBuildWithPreservedMacApp(runCommand, update.checkout);
       assertExactBuild(update.checkout, update.afterSha);
       const restartStartedAt = restartGateway(runCommand, update.checkout, update.afterSha);
       gatewayLogAudit = verifyAndAuditGateway({
diff --git a/test/scripts/openclaw-live-updater.test.ts b/test/scripts/openclaw-live-updater.test.ts
@@ -5,6 +5,7 @@ import {
   mkdirSync,
   mkdtempSync,
   readFileSync,
+  readdirSync,
   realpathSync,
   renameSync,
   rmSync,
@@ -426,6 +427,57 @@ describe("openclaw live updater", () => {
     ]);
   });
 
+  test("preserves the signed Mac bundle while a Gateway build replaces dist", () => {
+    const { root, mirror } = makeFixture();
+    mkdirSync(path.join(mirror, "node_modules"));
+    const appBundle = path.join(mirror, "dist/OpenClaw.app");
+    const appMarker = path.join(appBundle, "Contents/signature-marker");
+    mkdirSync(path.dirname(appMarker), { recursive: true });
+    writeFileSync(appMarker, "signed\n");
+    const commands = fakeCommands(mirror);
+
+    maintainFixture(
+      { checkout: mirror, remote: "origin", lockPath: path.join(root, "maintenance.lock") },
+      {
+        runCommand(command: string, args: string[]) {
+          if (command === "pnpm" && args[0] === "build") {
+            expect(existsSync(appBundle)).toBe(false);
+          }
+          commands.runCommand(command, args);
+        },
+      },
+    );
+
+    expect(readFileSync(appMarker, "utf8")).toBe("signed\n");
+    expect(
+      readdirSync(path.join(mirror, ".git")).filter((entry) =>
+        entry.startsWith(".openclaw-live-mac-"),
+      ),
+    ).toEqual([]);
+  });
+
+  test("restores the Mac bundle when the Gateway build fails", () => {
+    const { root, mirror } = makeFixture();
+    mkdirSync(path.join(mirror, "node_modules"));
+    const appMarker = path.join(mirror, "dist/OpenClaw.app/Contents/signature-marker");
+    mkdirSync(path.dirname(appMarker), { recursive: true });
+    writeFileSync(appMarker, "signed\n");
+
+    expect(() =>
+      maintainFixture(
+        { checkout: mirror, remote: "origin", lockPath: path.join(root, "maintenance.lock") },
+        {
+          runCommand(command: string, args: string[]) {
+            if (command === "pnpm" && args[0] === "build") {
+              throw new Error("build failed");
+            }
+          },
+        },
+      ),
+    ).toThrow("build failed");
+    expect(readFileSync(appMarker, "utf8")).toBe("signed\n");
+  });
+
   test("proves a current exact-SHA Gateway on a no-op heartbeat", () => {
     const { root, mirror } = makeFixture();
     mkdirSync(path.join(mirror, "node_modules"));
