Skip to content

fix(postinstall): skip EACCES/EPERM compile cache prune warnings#76362

Merged
obviyus merged 1 commit into
openclaw:mainfrom
neeravmakwana:fix/postinstall-compile-cache-eacces-76353
May 5, 2026
Merged

fix(postinstall): skip EACCES/EPERM compile cache prune warnings#76362
obviyus merged 1 commit into
openclaw:mainfrom
neeravmakwana:fix/postinstall-compile-cache-eacces-76353

Conversation

@neeravmakwana

@neeravmakwana neeravmakwana commented May 3, 2026 •
edited by obviyus
Loading

Copy link
Copy Markdown
Contributor

Root cause

pruneOpenClawCompileCache removes Node version-shaped directories under $NODE_COMPILE_CACHE and under the default $TMPDIR/node-compile-cache. On shared hosts, those bases can belong to another user (for example after a root-owned global install, then manual postinstall as a normal user). rmSync / readdirSync then fail with EACCES or EPERM. Postinstall still succeeds, but the catch block always emitted [postinstall] could not prune OpenClaw compile cache, which reads like a correctness problem.

Linked issue

Fixes #76353.

Why this fix is safe

Only the diagnostic path changes: permission-denied errors are treated as an expected outcome for shared cache layouts. Removal is still attempted with the same options; unexpected errors continue to warn. No pruning success is asserted for those directories.

Real behavior proof

  • Behavior addressed: postinstall compile-cache pruning no longer prints a scary warning when the configured compile-cache base cannot be listed because of EACCES.
  • Real setup tested: local OpenClaw checkout on macOS, running the PR head with a real temporary $NODE_COMPILE_CACHE directory whose permissions were changed to 000 so the real filesystem readdirSync path returns EACCES.
  • Exact steps or command run after the patch: node --input-type=module imported pruneOpenClawCompileCache from ./scripts/postinstall-bundled-plugins.mjs, pointed it at the chmod-000 temp compile-cache directory, and captured log.warn output.
  • Evidence after fix: copied terminal output from the rebased PR worktree:
real behavior proof: EACCES base listing suppressed
cache_base=/var/folders/67/txrk93md25lbjhk6jk4nxvrr0000gn/T/openclaw-proof-compile-cache-oMaXEE
warnings=0
  • Observed result after fix: the prune path completed without emitting [postinstall] could not prune OpenClaw compile cache for the permission-denied directory-listing failure.
  • What was not tested: the full root-owned global npm install handoff from the issue was not rerun; this proof exercises the same real filesystem EACCES behavior at the fixed postinstall prune boundary.

Security / runtime controls (unchanged)

No changes to sandboxing, config validation, install trust scanners, credential handling, gateway policies, CLI permissions, or any behavior that replaces runtime enforcement with wording in prompts.

Tests run

  • pnpm exec oxfmt --check --threads=1 CHANGELOG.md scripts/postinstall-bundled-plugins.mjs test/scripts/postinstall-bundled-plugins.test.ts
  • pnpm test test/scripts/postinstall-bundled-plugins.test.ts
  • git diff --check
  • pnpm check:changed

Out of scope

  • Per-user UID-scoped default compile-cache paths under /tmp (alternative suggested on the issue)
  • Changes to Node compile-cache location or pruning strategy beyond warning behavior

@neeravmakwana neeravmakwana mentioned this pull request May 3, 2026
Closed
@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts size: S labels May 3, 2026
@clawsweeper

clawsweeper Bot commented May 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge.

Summary
The PR suppresses EACCES/EPERM warnings during postinstall compile-cache pruning, adds regression coverage, and records the fix in the changelog.

Reproducibility: yes. Source inspection on current main shows both prune catch paths warn unconditionally, and #76353 gives concrete root/non-root global-install steps that hit EACCES under /tmp/node-compile-cache.

Real behavior proof
Sufficient (terminal): The PR body includes after-fix copied terminal output from a real filesystem permission-denied setup showing warnings=0.

Next step before merge
No repair job is needed; the branch already contains the targeted code, tests, changelog, and real behavior proof, leaving normal review and CI handling.

Security
Cleared: The diff touches a postinstall script but only narrows diagnostics for permission-denied prune failures, with no dependency, workflow, permission, download, package-resolution, or secret-handling change.

Review details

Best possible solution:

Land the narrow warning-suppression patch with its regression tests and changelog once exact-head CI and mergeability checks pass.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main shows both prune catch paths warn unconditionally, and #76353 gives concrete root/non-root global-install steps that hit EACCES under /tmp/node-compile-cache.

Is this the best way to solve the issue?

Yes. Suppressing only EACCES/EPERM in the prune warning path keeps best-effort removal intact and preserves warnings for unexpected errors; a UID-scoped cache path would be a broader product change.

What I checked:

  • Current main warning path: Current main warns unconditionally when compile-cache directory removal fails and again when listing a cache base fails, so EACCES/EPERM from shared cache ownership still produces the reported postinstall warning. (scripts/postinstall-bundled-plugins.mjs:845, 91879ac442d1)
  • PR errno guard: The PR adds an EACCES/EPERM helper and skips only those permission-denied warnings in both the removal and listing catch paths while preserving unexpected-error warnings. (scripts/postinstall-bundled-plugins.mjs:814, a2d0021d3ba0)
  • Regression coverage: The PR adds focused tests for EACCES/EPERM during cache-dir removal and EACCES while listing the cache base, while existing coverage still expects non-permission errors to warn and sibling pruning to continue. (test/scripts/postinstall-bundled-plugins.test.ts:147, a2d0021d3ba0)
  • Changelog entry: The PR adds a user-facing Unreleased Fixes entry for the postinstall compile-cache EACCES/EPERM warning and credits the reporter. (CHANGELOG.md:69, a2d0021d3ba0)
  • Real behavior proof: The PR body includes copied terminal output from a real chmod-000 NODE_COMPILE_CACHE directory showing the fixed path completed with warnings=0. (a2d0021d3ba0)
  • Linked issue reproduction: fix(postinstall): catch EACCES when pruning shared OpenClaw compile cache #76353 reports a Debian 11 OpenClaw v2026.5.2 root-owned then non-root global install flow that reaches EACCES under /tmp/node-compile-cache while postinstall succeeds.

Likely related people:

  • steipete: Git history shows Peter Steinberger introduced the postinstall compile-cache prune path and later scoped packaged compile-cache directories by install metadata, which defines the cache layout involved here. (role: introduced behavior and adjacent compile-cache maintainer; confidence: high; commits: 128115fb252b, 52b57d095341; files: scripts/postinstall-bundled-plugins.mjs, test/scripts/postinstall-bundled-plugins.test.ts, src/entry.compile-cache.ts)
  • shakkernerd: Recent history shows Shakker changed the same postinstall script and tests for packaged postinstall cleanup behavior immediately before this report. (role: recent adjacent maintainer; confidence: medium; commits: f7549079ceb3; files: scripts/postinstall-bundled-plugins.mjs, test/scripts/postinstall-bundled-plugins.test.ts, CHANGELOG.md)

Remaining risk / open question:

  • This read-only review did not execute the PR branch tests or exact-head CI; those should still gate mergeability.
  • The PR body proves the same real filesystem EACCES boundary, but it does not rerun the full root-owned to non-root global install handoff from the linked issue.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 91879ac442d1.

@neeravmakwana
neeravmakwana marked this pull request as ready for review May 3, 2026 01:43
@neeravmakwana

neeravmakwana commented May 3, 2026

Copy link
Copy Markdown
Contributor Author

Response to automated review feedback

Reviewer: ClawSweeper Codex verdict on this PR (“needs changes”).

Findings addressed

Item Decision
P3 — Changelog attribution (CHANGELOG.md) Fixed. Appended Thanks @RayWoo. to the #76353 Unreleased Fixes bullet (RayWoo reported the shared /tmp/node-compile-cache permission noise).

No code/test changes: The review concluded the errno handling and regression tests already match the intent; only the changelog line needed the attribution.

Re-verification on the updated branch (bb0768db96)

  • pnpm exec oxfmt --check --threads=1 CHANGELOG.md
  • pnpm check:changelog-attributions (via pnpm check:changed lane)
  • git diff --check
  • pnpm test test/scripts/postinstall-bundled-plugins.test.ts (30 tests)
  • Full pnpm check:changed

Draft status unchanged for maintainer/manual readiness.

@obviyus
obviyus force-pushed the fix/postinstall-compile-cache-eacces-76353 branch from bb0768d to a2d0021 Compare May 5, 2026 15:33
@openclaw-barnacle openclaw-barnacle Bot added triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 5, 2026
@obviyus obviyus self-assigned this May 5, 2026
@obviyus
obviyus force-pushed the fix/postinstall-compile-cache-eacces-76353 branch from a2d0021 to 7660e97 Compare May 5, 2026 15:48
@obviyus
obviyus force-pushed the fix/postinstall-compile-cache-eacces-76353 branch from 7660e97 to ffc75af Compare May 5, 2026 15:50
@obviyus
obviyus force-pushed the fix/postinstall-compile-cache-eacces-76353 branch from ffc75af to e8f9284 Compare May 5, 2026 15:52
obviyus
obviyus approved these changes May 5, 2026
View reviewed changes

@obviyus obviyus left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verified the postinstall compile-cache prune path: EACCES/EPERM cleanup failures now stay quiet while unexpected prune errors still warn.

Maintainer follow-up: rebased onto current main, collapsed the branch to one signed landing commit, fixed the active changelog entry, and added real behavior proof to the PR body.

Local gate: pnpm test test/scripts/postinstall-bundled-plugins.test.ts, formatter check, and pnpm check:changed.

@obviyus
obviyus merged commit 77ae06b into openclaw:main May 5, 2026
78 checks passed
@obviyus

obviyus commented May 5, 2026

Copy link
Copy Markdown
Contributor

Landed on main.

Thanks @neeravmakwana.

@github-actions github-actions Bot mentioned this pull request May 5, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
@obviyus
fix: skip compile cache permission warnings (openclaw#76362) (thanks @…
6d13973 
…neeravmakwana)
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@obviyus
fix: skip compile cache permission warnings (openclaw#76362) (thanks @…
b2b38c9 
…neeravmakwana)
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@obviyus
fix: skip compile cache permission warnings (openclaw#76362) (thanks @…
89a1000 
…neeravmakwana)
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@obviyus
fix: skip compile cache permission warnings (openclaw#76362) (thanks @…
e92e47e 
…neeravmakwana)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@obviyus obviyus obviyus approved these changes

Assignees

@obviyus obviyus

Labels

scripts Repository scripts size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

fix(postinstall): catch EACCES when pruning shared OpenClaw compile cache

2 participants

@neeravmakwana @obviyus