fix: update managed macOS Gateways from runtime snapshots#104946
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8aad71f48
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| writeFileSync(temporaryPath, original, { | ||
| flag: "wx", | ||
| mode: statSync(deployment.plistPath).mode, | ||
| }); |
There was a problem hiding this comment.
When the updater runs under a restrictive umask such as 077, this writeFileSync(..., { mode: stat.mode }) creates the temporary plist with the requested mode masked, so the existing 0644 LaunchAgent can be renamed back as 0600. The launchd installer explicitly chmods these plists back to world-readable because current macOS rejects unreadable user LaunchAgents; in that environment the subsequent bootstrap can fail after the old service has already been booted out. Chmod the temp file or final plist to the original readable mode before bootstrapping.
Useful? React with 👍 / 👎.
| verifyGatewayReadiness(runCommand, checkout, expectedSha, sleep, deployment); | ||
| } catch (error) { | ||
| verificationError = error; | ||
| } |
There was a problem hiding this comment.
This path now verifies status/health through the selected managed deployment, but the restart-window log audit below still calls auditGatewayLogs(checkout, sinceMs) without the deployment's port/config/service environment. When the operator's normal CLI config points at a remote Gateway (the scenario the new overlay handling is meant to isolate), openclaw logs can audit the remote or unrelated local fallback instead of the just-restarted LaunchAgent, allowing post-restart errors from the managed Gateway to be missed.
Useful? React with 👍 / 👎.
|
Codex review: stale review; fresh review needed. Summary Next step |
|
Land-ready at exact head Proof:
Live clawmac preflight confirms the managed Gateway is currently running the clean detached |
|
Merged via squash.
|
…04946) * fix(updater): migrate validated gateway snapshots * test(updater): declare snapshot maintenance helpers
1 participant
Closes #104945
What Problem This Solves
Fixes an issue where operators updating a managed macOS Gateway could fail to update or restart the intended service when its LaunchAgent was running a clean detached runtime snapshot.
Why This Change Was Made
The updater now validates snapshot provenance, the loaded LaunchAgent arguments, service wrappers, environment, ownership, modes, and listener identity before control or mutation. It drains through a trusted source build, stops the exact managed service, rebuilds and retargets its plist atomically, then proves the restarted source deployment owns the configured port; snapshot code is never executed.
User Impact
Managed macOS Gateways can be updated safely from validated runtime snapshots, including busy retry, custom state, direct-service environment, and wrapper-service configurations. Invalid, stale, or ambiguous service state continues to fail closed. No release or version change is included.
Evidence
node scripts/run-vitest.mjs test/scripts/openclaw-live-updater.test.ts— 43 passedgit diff --check— cleanmain.Local focused-test fallback was used because the remote Testbox provider sync failed earlier in the session. The mandatory landing workflow will run with
OPENCLAW_TESTBOX=1against this exact PR head.