Greptile Summary

This PR fixes a SIGTERM-kills-caller issue on Linux/systemd by detecting when restartSystemdService is invoked from within the target service cgroup and scheduling a detached systemd-run --user handoff instead of a synchronous systemctl restart. External restarts keep the existing synchronous path unchanged. Both paths have new regression test coverage and the cgroup-matching logic handles cgroups v1/v2 correctly.

Confidence Score: 5/5

• Safe to merge; all findings are minor style/robustness suggestions with no correctness impact.
• The core logic (cgroup detection, argument passing, handoff scheduling, error surfacing) is correct and well-tested. Both remaining comments are P2: an unbounded PID-wait loop that is operationally low-risk given normal SIGTERM handling, and an unnecessarily broad parameter type.
• No files require special attention.

This is a comment left during a code review.
Path: src/daemon/systemd.ts
Line: 125-135

Comment:
**Unbounded PID-wait loop in handoff script**

The `while kill -0 "$wait_pid"` loop has no timeout. If the gateway process ignores `SIGTERM` and never exits, the transient handoff unit will spin indefinitely, and the target service will never restart. Consider adding a deadline (e.g. 30 s) after which the loop falls through or bails with a non-zero exit so the failure is surfaced.

```suggestion
function buildSystemdRestartHandoffScript(): string {
  return `wait_pid="$1"
 target_unit="$2"
 deadline=$(( $(date +%s) + 30 ))
 if [ -n "$wait_pid" ] && [ "$wait_pid" -gt 1 ] 2>/dev/null; then
   while kill -0 "$wait_pid" >/dev/null 2>&1; do
     if [ "$(date +%s)" -ge "$deadline" ]; then
       echo "openclaw-systemd-restart-handoff: timed out waiting for pid $wait_pid to exit" >&2
       exit 1
     fi
     sleep 0.1
   done
 fi
 exec systemctl --user restart "$target_unit"
 `;
}
```

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: src/daemon/systemd.ts
Line: 80-90

Comment:
**Unnecessary `undefined` in parameter type**

`cgroupPath` is typed as `string | undefined`, but every call site passes a `string` (the elements of `string[]` from `readCurrentProcessCgroupPaths`). The `| undefined` branch is dead code. Narrowing the type keeps the signature honest.

```suggestion
function matchesSystemdCgroupUnit(cgroupPath: string, unitName: string): boolean {
  const normalizedPath = normalizeOptionalString(cgroupPath);
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(daemon): hand off systemd self-resta..." | Re-trigger Greptile}

Pushed f852688b9f with the follow-up fixes.

What changed:

• self-restart detection now uses current-process evidence instead of merged target env
• cgroup detection stays primary, with fallback limited to real systemd runtime hints plus matching gateway markers
• the detached handoff script now has a 30s deadline and warn-and-continue behavior
• narrowed matchesSystemdCgroupUnit(cgroupPath) to string
• added regression coverage for merged gateway env staying synchronous and for the runtime-hint fallback

Validation:

• node scripts/test-projects.mjs src/daemon/systemd.test.ts src/daemon/service.test.ts
• live external smoke against a disposable user unit: returned {"outcome":"completed"} and restarted immediately
• live self-restart smoke from inside a disposable user unit: returned {"outcome":"scheduled"} and restarted via detached handoff

Unrelated security-fast workflow fix is split out into #66884 so this daemon PR can stay focused. That PR hardens openclaw-cross-os-release-checks-reusable.yml against the current zizmor template-injection findings and adds explicit inputs.mode validation.

Follow-up added in 232b40df87:

• write a short-lived systemd restart expectation marker before the detached handoff restarts the unit
• treat the resulting gateway SIGTERM as restart semantics instead of a normal stop when that marker is present
• add targeted coverage in src/cli/gateway-cli/run-loop.test.ts alongside the daemon handoff tests

Local verification for the follow-up:

• corepack pnpm exec oxfmt --check src/daemon/systemd.ts src/daemon/systemd.test.ts src/cli/gateway-cli/run-loop.ts src/cli/gateway-cli/run-loop.test.ts
• corepack pnpm exec vitest run --config test/vitest/vitest.daemon.config.ts src/daemon/systemd.test.ts
• corepack pnpm exec vitest run --config test/vitest/vitest.cli.config.ts src/cli/gateway-cli/run-loop.test.ts

High-value ops fix for Linux/systemd installs: restarting from inside the managed unit can SIGTERM the caller because of KillMode=control-group. This PR only changes the self-restart path; external restarts remain unchanged. Review focus: src/daemon/systemd.ts, src/cli/gateway-cli/run-loop.ts, and the matching daemon/run-loop tests. Current branch is green, including custom-unit normalization, malformed marker rejection, and supervisor-bounded restart draining.

ProjectClownfish pushed a narrow repair to this branch so the original contributor path can stay canonical.

Source PR: #66735
Validation: pnpm check:changed
Contributor credit is preserved in the branch history and PR context.

ClawSweeper PR egg

🎁 Pass real behavior proof to wake the egg and unlock a hatchable treat.

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

ClawSweeper applied the proposed close for this PR.

• Action: closed this PR.
• Close reason: duplicate or superseded.
• Evidence: durable ClawSweeper review.