Severity: medium / Confidence: high / Category: bug
Triage: confirmed-bug
Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18)
Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• src/cli/update-cli/restart-helper.ts:248-270 (runRestartScript)

export async function runRestartScript(scriptPath: string): Promise<void> {
  const isWindows = process.platform === "win32";
  const file = isWindows ? "cmd.exe" : "/bin/sh";
  const args = isWindows ? ["/d", "/s", "/c", quoteCmdScriptArg(scriptPath)] : [scriptPath];

  const child = spawn(file, args, {
    detached: true,
    stdio: "ignore",
    windowsHide: true,
  });
  child.unref();
}

Reasoning

Node.js child_process.spawn() can throw synchronously (e.g. ENOENT if /bin/sh is absent on an embedded system, or EACCES if the tmp script lacks execute permission). The function has no try/catch and no error listener on the ChildProcess. A synchronous throw escapes the async wrapper as an unhandled rejection, crashing the update process at the exact moment the gateway is already stopped waiting to be restarted. The caller in update-command.ts must also handle the rejection, but defensive handling at the source is safer.

Reproduction

Force /bin/sh to be missing or remove execute permission from the prepared script path; calling runRestartScript will throw rather than silently failing.

Recommendation

Wrap the spawn call in try/catch and attach a no-op error handler on the child process to prevent unhandled rejection: try { const child = spawn(...); child.on('error', () => {}); child.unref(); } catch { /* best-effort restart; caller continues */ }

Why existing tests miss this

No tests exist for this module. The failure mode requires controlling spawn behaviour which unit tests with a mocked spawn would expose.

Suggested regression test

it('does not throw when spawn rejects', async () => { vi.spyOn(childProcess, 'spawn').mockImplementation(() => { throw new Error('ENOENT'); }); await expect(runRestartScript('/tmp/test.sh')).resolves.toBeUndefined(); });

Minimum fix scope

Single try/catch around the spawn call plus a no-op child.on('error') listener inside runRestartScript.

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-0e1f16a0ce-_d0126d3aea.