Skip to content

fix(daemon): normalise whitespace in checkTokenDrift to prevent false-positive warning#39108

Merged
vincentkoc merged 1 commit intoopenclaw:mainfrom
ademczuk:fix-token-drift-false-positive-trim
Mar 7, 2026
Merged

fix(daemon): normalise whitespace in checkTokenDrift to prevent false-positive warning#39108
vincentkoc merged 1 commit intoopenclaw:mainfrom
ademczuk:fix-token-drift-false-positive-trim

Conversation

@ademczuk
Copy link
Copy Markdown
Contributor

@ademczuk ademczuk commented Mar 7, 2026

Summary

  • Problem: `checkTokenDrift` compares service and config gateway tokens with raw `!==`. Service-file parsers on Linux (systemd) and macOS (launchd) return token values with trailing newlines or whitespace. This causes a false-positive "Config token differs from service token" warning even when tokens are identical.
  • Why it matters: Users on Linux/systemd see the warning on every `openclaw doctor` run and every gateway restart. Multiple reporters confirmed on the issue thread.
  • What changed: Both tokens are now `.trim()`'d inside `checkTokenDrift` before comparison. Three test cases added covering trailing newline, surrounding spaces, and mixed CRLF padding.
  • What did NOT change: The sibling `auditGatewayToken` function already trimmed both sides correctly. This fix brings `checkTokenDrift` in line with that pattern. No changes to lifecycle-core.ts, token resolution, or any other path.

Change Type

  • Bug fix

Scope

  • Gateway / orchestration
  • Auth / tokens

Linked Issue/PR

User-visible / Behavior Changes

The false-positive "Config token differs from service token" warning no longer fires when the tokens are logically identical but differ only in whitespace. No config changes, no new CLI flags.

Security Impact

  • New permissions/capabilities? No
  • Secrets/tokens handling changed? No (tokens trimmed for comparison only, never modified in storage)
  • New/changed network calls? No
  • Command/tool execution surface changed? No
  • Data access scope changed? No

Evidence

All 14 tests pass (11 existing + 3 new):
```
✓ src/daemon/service-audit.test.ts (14 tests) 11ms
Test Files 1 passed (1)
Tests 14 passed (14)
```

Human Verification

  • Verified: all existing checkTokenDrift tests still pass, new tests cover trailing `\n`, surrounding spaces, mixed `\r\n`
  • Edge cases: empty string after trim converts to undefined via `|| undefined`, CRLF line endings
  • Not verified: end-to-end on a running systemd service (unit test coverage is thorough for the comparison logic)

Compatibility / Migration

  • Backward compatible? Yes
  • Config/env changes? No
  • Migration needed? No

Risks and Mitigations

None. Whitespace-only token differences are never intentional. Both `auditGatewayToken` and the systemd parser already trim.

…-positive warning

Service-file parsers (systemd, launchd) can return token values with
trailing newlines or whitespace. The raw string comparison in
checkTokenDrift treated these as mismatches, producing a spurious
'Config token differs from service token' warning.

Trim both tokens before comparing. Adds three test cases covering
trailing newline, surrounding spaces, and mixed CRLF padding.

Fixes openclaw#26624
@openclaw-barnacle openclaw-barnacle bot added gateway Gateway runtime size: XS labels Mar 7, 2026
@ademczuk
Copy link
Copy Markdown
Contributor Author

ademczuk commented Mar 7, 2026

@vincentkoc - this could use a review when you've got a moment.

Context: checkTokenDrift compares tokens without trimming whitespace, while auditGatewayToken trims both sides. Service-file parsers (systemd, launchd) return trailing newlines, causing a false-positive "Config token differs" warning on every openclaw doctor run. XS PR, 2 files (+26/-2), all 14 tests green.

The "Changes at a glance" table: service-audit.ts:359-382 (trim before compare) and service-audit.test.ts:118-135 (3 new whitespace test cases).

@vincentkoc vincentkoc merged commit 70be8ce into openclaw:main Mar 7, 2026
31 of 32 checks passed
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Mar 7, 2026

Greptile Summary

This PR fixes a false-positive token-drift warning in the checkTokenDrift function by trimming whitespace from both the service token and config token before comparison. Service-file parsers (systemd, launchd) can return values with trailing newlines or surrounding whitespace, causing identical tokens to appear mismatched.

  • service-audit.ts: Implements ?.trim() || undefined normalization for both tokens before all comparisons in checkTokenDrift — correctly handles undefined, empty strings, whitespace-only values, and CRLF-suffixed values.
  • service-audit.test.ts: Adds three new test cases covering trailing \n, surrounding spaces, and mixed \r\n padding — all real-world parser output variants that triggered the false positive.

The implementation is minimal, correct, and well-tested. Both files are in good shape for merge.

Note: The PR description appears to have been copied from a different branch (feat/tui-inline-image-rendering) and describes a large TUI image rendering feature across 25 files. The PR title correctly describes what was actually changed. The description should be updated before merging to reflect these actual daemon service audit changes.

Confidence Score: 4/5

  • The code changes are correct and safe to merge once the misleading PR description is corrected.
  • The code change is minimal, correct, and well-tested with comprehensive coverage of edge cases (trailing newlines, surrounding whitespace, CRLF). The implementation is sound with no logic, syntax, or security issues. The only concern is the entirely mismatched PR description (copied from a different feature branch), which could confuse reviewers and future git historians. This confusion warrants dropping the score from 5 to 4, though the actual code quality is excellent.
  • No files require special attention — both changed files are in good shape. The PR description should be corrected before merging.

Last reviewed commit: e9af9f1

@ademczuk ademczuk deleted the fix-token-drift-false-positive-trim branch March 7, 2026 19:16
mrosmarin added a commit to mrosmarin/openclaw that referenced this pull request Mar 7, 2026
* main: (133 commits)
  reduce image size, offer slim image (openclaw#38479)
  fix(security): harden install base drift cleanup
  fix(agents): respect explicit provider baseUrl in merge mode (openclaw#39103)
  fix(agents): apply contextTokens cap for compaction threshold (openclaw#39099)
  fix(exec): block dangerous override-only env pivots
  fix(security): stage installs before publish
  fix(daemon): normalise whitespace in checkTokenDrift to prevent false-positive warning (openclaw#39108)
  fix(security): harden fs-safe copy writes
  refactor: dedupe bluebubbles webhook auth test setup
  refactor: dedupe discord native command test scaffolding
  refactor: dedupe anthropic probe target test setup
  refactor: dedupe minimax provider auth test setup
  refactor: dedupe runtime snapshot test fixtures
  fix: harden zip extraction writes
  fix(tests): stabilize diffs localReq headers (supersedes openclaw#39063)
  fix: harden workspace skill path containment
  fix(agents): land openclaw#38935 from @MumuTW
  fix(models): land openclaw#38947 from @davidemanuelDEV
  fix(gateway): land openclaw#39064 from @Narcooo
  fix(models-auth): land openclaw#38951 from @MumuTW
  ...
vincentkoc pushed a commit to BryanTegomoh/openclaw-fork that referenced this pull request Mar 8, 2026
openperf pushed a commit to openperf/moltbot that referenced this pull request Mar 8, 2026
mcaxtr pushed a commit to mcaxtr/openclaw that referenced this pull request Mar 8, 2026
Saitop pushed a commit to NomiciAI/openclaw that referenced this pull request Mar 8, 2026
GordonSH-oss pushed a commit to GordonSH-oss/openclaw that referenced this pull request Mar 9, 2026
jenawant pushed a commit to jenawant/openclaw that referenced this pull request Mar 10, 2026
dhoman pushed a commit to dhoman/chrono-claw that referenced this pull request Mar 11, 2026
senw-developers pushed a commit to senw-developers/va-openclaw that referenced this pull request Mar 17, 2026
V-Gutierrez pushed a commit to V-Gutierrez/openclaw-vendor that referenced this pull request Mar 17, 2026
alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 21, 2026
alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gateway Gateway runtime size: XS

Projects

None yet

Development

Successfully merging this pull request may close these issues.

False positive warning: 'Config token differs from service token' when tokens match

2 participants