fix: improve gateway upgrade diagnostics and recovery#28990
fix: improve gateway upgrade diagnostics and recovery#28990ogenev wants to merge 13 commits intoopenclaw:mainfrom
Conversation
openclaw-barnacle
bot
added
docs
Greptile SummaryThis PR improves gateway upgrade diagnostics and backward compatibility for operators upgrading from older versions. The implementation adds three key capabilities:
The changes include comprehensive test coverage (107 new test cases in Confidence Score: 5/5
Last reviewed commit: 4bc4ac3 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f775acf84
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fa4d972293
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b7c7d97989
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f5a4f8cfc0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4bc4ac3a65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0f2d3f527
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| runtime.log( | ||
| theme.muted( | ||
| `Tunnel: ssh -L ${nonceRecovery.tunnelPort}:127.0.0.1:${nonceRecovery.tunnelPort} <user>@<host>`, |
There was a problem hiding this comment.
When nonce recovery derives tunnelPort from a wss:///ws:// URL without an explicit port, it can become 443 or 80, and this line uses that value for both sides of ssh -L (local:remote). On typical Linux/macOS setups, non-root users cannot bind local privileged ports, so the recommended recovery command fails immediately even though the remote target may be correct. Keep the remote port derived from the URL, but choose a non-privileged local port (for example the configured gateway/default port) for the left-hand side.
Useful? React with 👍 / 👎.
|
This pull request has been automatically marked as stale due to inactivity. |
|
This pull request has been automatically marked as stale due to inactivity. |
1 participant
Summary
Describe the problem and fix in 2–5 bullets:
openclaw-gatewaylaunch mismatch, opaque plugin dependency failures, and unclear nonce-handshake recovery guidance).openclaw-gatewaywrapper entrypoint and hardened legacy argv normalization inrun-main.process.argvso preAction/config-guard/lazy command registration all see the same command path.update,--update,-v,-V,--version,-h,--help) and made rewrite logic root-flag aware (--no-color,--log-level,--profile,--dev).gatewaystartup +openclaw plugins doctor) with actionable install guidance.127/8and IPv4-mapped IPv6 loopback).Change Type (select all)
Scope (select all touched areas)
Linked Issue/PR
User-visible / Behavior Changes
openclaw-gatewaylegacy launch paths are now compatible across shim/wrapper variants.openclaw-gatewayroot update/version/help invocations now remain valid even with leading root flags.openclaw statusnonce recovery guidance now provides more accurate tunnel commands across loopback, custom-port, and proxy-facing scenarios.Security Impact (required)
Yes/No): NoYes/No): NoYes/No): NoYes/No): YesYes/No): NoYes, explain risk + mitigation:Repro + Verification
Environment
Steps
openclaw-gateway ...) and root passthrough behavior.Expected
Actual
Evidence
Attach at least one:
Human Verification (required)
What you personally verified (not just CI), and how:
pnpm exec vitest run src/cli/run-main.test.tspnpm exec vitest run src/commands/status.test.tspnpm exec vitest run src/infra/infra-parsing.test.tspnpm check--no-color --update,--log-level debug --update)-v)127.0.0.1,127.0.0.2,[::1],[::ffff:127.0.0.1])Compatibility / Migration
Yes/No): YesYes/No): NoYes/No): NoFailure Recovery (if this breaks)
src/cli/run-main.tssrc/commands/status.command.tssrc/plugins/load-error-hints.tssrc/gateway/server/ws-connection/message-handler.tssrc/gateway/server-plugins.tsopenclaw-gatewaycommands mapping to invalidgateway updatepathsRisks and Mitigations
List only real risks for this PR. Add/remove entries as needed. If none, write
None.