fix(daemon): normalise whitespace in checkTokenDrift to prevent false-positive warning#39108
Conversation
…-positive warning Service-file parsers (systemd, launchd) can return token values with trailing newlines or whitespace. The raw string comparison in checkTokenDrift treated these as mismatches, producing a spurious 'Config token differs from service token' warning. Trim both tokens before comparing. Adds three test cases covering trailing newline, surrounding spaces, and mixed CRLF padding. Fixes openclaw#26624
|
@vincentkoc - this could use a review when you've got a moment. Context: The "Changes at a glance" table: |
Greptile SummaryThis PR fixes a false-positive token-drift warning in the
The implementation is minimal, correct, and well-tested. Both files are in good shape for merge. Note: The PR description appears to have been copied from a different branch ( Confidence Score: 4/5
Last reviewed commit: e9af9f1 |
* main: (133 commits) reduce image size, offer slim image (openclaw#38479) fix(security): harden install base drift cleanup fix(agents): respect explicit provider baseUrl in merge mode (openclaw#39103) fix(agents): apply contextTokens cap for compaction threshold (openclaw#39099) fix(exec): block dangerous override-only env pivots fix(security): stage installs before publish fix(daemon): normalise whitespace in checkTokenDrift to prevent false-positive warning (openclaw#39108) fix(security): harden fs-safe copy writes refactor: dedupe bluebubbles webhook auth test setup refactor: dedupe discord native command test scaffolding refactor: dedupe anthropic probe target test setup refactor: dedupe minimax provider auth test setup refactor: dedupe runtime snapshot test fixtures fix: harden zip extraction writes fix(tests): stabilize diffs localReq headers (supersedes openclaw#39063) fix: harden workspace skill path containment fix(agents): land openclaw#38935 from @MumuTW fix(models): land openclaw#38947 from @davidemanuelDEV fix(gateway): land openclaw#39064 from @Narcooo fix(models-auth): land openclaw#38951 from @MumuTW ...
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108)
…-positive warning (openclaw#39108) (cherry picked from commit 70be8ce)
…-positive warning (openclaw#39108) (cherry picked from commit 70be8ce)
Summary
Change Type
Scope
Linked Issue/PR
User-visible / Behavior Changes
The false-positive "Config token differs from service token" warning no longer fires when the tokens are logically identical but differ only in whitespace. No config changes, no new CLI flags.
Security Impact
Evidence
All 14 tests pass (11 existing + 3 new):
```
✓ src/daemon/service-audit.test.ts (14 tests) 11ms
Test Files 1 passed (1)
Tests 14 passed (14)
```
Human Verification
Compatibility / Migration
Risks and Mitigations
None. Whitespace-only token differences are never intentional. Both `auditGatewayToken` and the systemd parser already trim.