Skip to content

fix(windows): repair doctor update fallback migration#88311

Closed
vincentkoc wants to merge 3 commits into
mainfrom
fix/windows-doctor-startup-migration
Closed

fix(windows): repair doctor update fallback migration#88311
vincentkoc wants to merge 3 commits into
mainfrom
fix/windows-doctor-startup-migration

Conversation

@vincentkoc

@vincentkoc vincentkoc commented May 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

  • fixes Windows update-mode doctor repair so running managed gateways are activated/restarted, while stopped services stay staged
  • audits stale OPENCLAW_SERVICE_VERSION values and repairs version drift through the existing gateway service doctor path
  • removes legacy Windows Startup-folder fallback launchers (.cmd and hidden .vbs) only after Task Scheduler reports running evidence
  • preserves auth during update-mode task rewrites by migrating a legacy embedded OPENCLAW_GATEWAY_TOKEN into gateway.auth.token before reinstalling the task
  • keeps config writes safe across both modern update parents and legacy update handoffs, so later doctor writes do not drop recovered tokens and older parents are not given unreadable config

Fixes #87156.

Verification

  • node scripts/run-vitest.mjs src/commands/doctor-gateway-services.test.ts src/flows/doctor-health-contributions.test.ts src/commands/doctor-update.test.ts src/daemon/schtasks.startup-fallback.test.ts src/daemon/schtasks.stop.test.ts -- --run - passed after rebase on 11f564ede1ba3acade0a697090e62e21794c8e59 (100 assertions across 5 files)
  • node_modules/.bin/oxfmt --check src/commands/doctor-gateway-services.ts src/commands/doctor-gateway-services.test.ts src/flows/doctor-health-contributions.ts src/flows/doctor-health-contributions.test.ts - passed
  • node scripts/run-oxlint.mjs src/commands/doctor-gateway-services.ts src/commands/doctor-gateway-services.test.ts src/flows/doctor-health-contributions.ts src/flows/doctor-health-contributions.test.ts - passed
  • git diff --check origin/main...HEAD && git diff --check - passed
  • .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main - clean after addressing accepted findings for token propagation, update-safe write options, and legacy update-parent write guards
  • Native Windows Crabbox proof run_52d49841f33d on AWS Windows (cbx_013fda705836) created both Startup-folder fallback extensions under the real Windows Startup folder and removed both: windows_startup_dual_extension_cleanup=ok, removed_extensions=.cmd,.vbs
  • Native Windows GitHub probe https://github.com/openclaw/openclaw/actions/runs/26690553757 passed on windows-2025; WSL was present (wsl_status_exit=0, default version 2) but no distro was installed, so this is WSL availability proof, not successful WSL distro execution
  • Crabbox changed gate run_a9b4283c04ab reached pnpm check:changed; conflict markers, changelog attributions, dependency guards, core typecheck, and core test typecheck passed, then the gate failed in an untouched current-main Discord boundary dts check: extensions/discord/src/monitor/gateway-plugin.ts:165 (1000 | 1001 compared with 1008). This branch does not touch extensions/discord/**.

Real behavior proof

Behavior addressed: Windows doctor/update migration now distinguishes running vs stopped managed gateways, detects stale service versions, preserves gateway auth during task rewrites, restarts stale installed/running gateways after update, and removes old Startup-folder fallback launchers only after Task Scheduler running evidence.

Real environment tested: native AWS Windows via Crabbox for Startup-folder dual-extension cleanup; GitHub-hosted Windows Server 2025 probe for native Windows and WSL availability; focused local Vitest shards for daemon startup fallback, daemon stop, doctor update, doctor gateway services, and doctor health config handoff.

Exact steps or command run after this patch: focused Vitest/format/lint/autoreview commands listed above; native Windows cleanup probe run_52d49841f33d; remote changed gate node scripts/crabbox-wrapper.mjs run --provider aws --idle-timeout 90m --ttl 240m --timing-json --shell -- "pnpm check:changed" (run_a9b4283c04ab).

Evidence after fix: focused tests passed after the latest rebase at 11f564ede1ba3acade0a697090e62e21794c8e59; autoreview is clean; native Windows cleanup proof removed both .cmd and .vbs Startup-folder fallbacks; remote changed gate passed the touched core typecheck and test typecheck lanes before hitting the unrelated Discord boundary dts failure.

Observed result after fix: the Windows doctor/service migration paths are validated for the touched unit behavior and the native Windows Startup-folder cleanup path. The broad changed gate is blocked by an untouched current-main Discord type issue, not by this patch.

What was not tested: successful WSL2 distro boot/execution inside a Windows runner; direct Blacksmith Testbox proof, because Blacksmith auth is not available in this environment.

@vincentkoc vincentkoc self-assigned this May 30, 2026
@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime commands Command implementations size: M maintainer Maintainer-authored PR labels May 30, 2026
@clawsweeper

clawsweeper Bot commented May 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: found issues before merge. Reviewed June 21, 2026, 4:35 AM ET / 08:35 UTC.

Summary
This PR changes Windows doctor/update service repair to restart running managed gateways, migrate legacy embedded gateway tokens into config, preserve update-safe config writes, and remove Startup-folder fallbacks after Scheduled Task running evidence.

PR surface: Source +158, Tests +488. Total +646 across 11 files.

Reproducibility: yes. source-reproducible. Current main and v2026.6.9 still stage update-mode service repair, and the linked issue/PR body include live native-Windows evidence for stale fallback state and post-update gateway unavailability.

Review metrics: 2 noteworthy metrics.

  • Service-version audit sources: 1 existing on main, 1 added in PR. A stale OPENCLAW_SERVICE_VERSION diagnostic should have one owner before merge to avoid duplicate repair behavior.
  • Update config-write paths: 2 changed. Both service-token repair writes and final doctor writes now affect update-time config persistence, which is upgrade-sensitive.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/commands/doctor-gateway-services.test.ts, migration/backfill/repair: src/commands/doctor-gateway-services.ts, migration/backfill/repair: src/commands/doctor-service-audit.test-helpers.ts, migration/backfill/repair: src/commands/doctor-update.test.ts, migration/backfill/repair: src/commands/doctor-update.ts, migration/backfill/repair: src/flows/doctor-health-contributions.test.ts, and 7 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #87156
Summary: This PR is the broad candidate fix for the Windows doctor/update fallback migration bug; related PRs cover narrower or adjacent Windows gateway repair slices.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Rebase against current main and remove the duplicate service-version mismatch audit in favor of SERVICE_AUDIT_CODES.gatewayServiceVersionMismatch.
  • Rerun the focused Windows doctor/service tests and a changed gate after the refresh.

Risk before merge

  • [P2] The branch changes upgrade-time Windows service activation and fallback cleanup for existing installs; maintainers need to accept the exact running-evidence gate before merge.
  • [P1] The branch migrates a legacy embedded OPENCLAW_GATEWAY_TOKEN into gateway.auth.token during update repair, which is an auth-provider upgrade boundary.
  • [P1] Current main already owns stale service-version metadata through SERVICE_AUDIT_CODES.gatewayServiceVersionMismatch; merging this branch without refresh would create duplicate or competing diagnostics.
  • [P1] The broad changed gate in the PR body did not finish green because of an unrelated current-main Discord dts failure, so a fresh changed gate after rebase is still needed before landing.

Maintainer options:

  1. Refresh And Reuse Canonical Audit (recommended)
    Rebase against current main and remove the local gatewayVersionMismatch check so stale service metadata is diagnosed only by SERVICE_AUDIT_CODES.gatewayServiceVersionMismatch.
  2. Accept The Upgrade Boundary
    Maintainers may intentionally accept the Windows update restart, fallback cleanup, and token persistence semantics after the duplicate audit path is resolved and proof is refreshed.
  3. Split If Refresh Stalls
    If the broad branch cannot be refreshed safely, keep the linked bug open and land narrower slices for update restart, fallback cleanup, and token preservation separately.

Next step before merge

  • [P2] Maintainer-owned draft with protected label and compatibility/auth/availability upgrade boundaries needs author refresh and maintainer acceptance instead of a separate repair job.

Security
Cleared: No supply-chain change was found; the security-sensitive token migration uses the existing gateway auth config path but remains an auth-provider merge risk for maintainer acceptance.

Review findings

  • [P1] Use the canonical service-version audit — src/commands/doctor-gateway-services.ts:467-471
Review details

Best possible solution:

Refresh the branch against current main, remove the duplicated local version-mismatch audit in favor of the canonical service-audit code, then land only after maintainers accept the Windows upgrade auth and availability behavior.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible. Current main and v2026.6.9 still stage update-mode service repair, and the linked issue/PR body include live native-Windows evidence for stale fallback state and post-update gateway unavailability.

Is this the best way to solve the issue?

No as currently based. The repair is in the right owner surfaces, but it duplicates current main's canonical service-version audit and needs refresh before it is the best fix.

Full review comments:

  • [P1] Use the canonical service-version audit — src/commands/doctor-gateway-services.ts:467-471
    Current main already audits stale OPENCLAW_SERVICE_VERSION in auditGatewayServiceConfig as SERVICE_AUDIT_CODES.gatewayServiceVersionMismatch. Adding a second gatewayVersionMismatch issue here would create duplicate diagnostics and competing repair codes after rebase, so this branch should reuse the central service-audit result instead.
    Confidence: 0.86

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9940110b881b.

Label changes

Label justifications:

  • P2: The PR targets a bounded Windows doctor/update reliability bug with clear user impact but no emergency security bypass or unusable core-runtime signal.
  • merge-risk: 🚨 compatibility: The PR changes upgrade behavior for existing Windows fallback installs, service metadata repair, and update-time config writes.
  • merge-risk: 🚨 auth-provider: The PR changes gateway auth handling by migrating a legacy embedded service token into gateway.auth.token during Windows update repair.
  • merge-risk: 🚨 availability: The PR changes when running gateways are restarted or activated and when fallback launchers are removed, which can affect gateway availability after update.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (logs): The PR body includes after-fix native Windows Crabbox cleanup proof, a Windows Server 2025 probe, focused test output, and changed-gate evidence that reached an unrelated current-main Discord type failure.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix native Windows Crabbox cleanup proof, a Windows Server 2025 probe, focused test output, and changed-gate evidence that reached an unrelated current-main Discord type failure.
Evidence reviewed

PR surface:

Source +158, Tests +488. Total +646 across 11 files.

View PR surface stats
Area Files Added Removed Net
Source 6 189 31 +158
Tests 5 500 12 +488
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 11 689 43 +646

What I checked:

Likely related people:

  • vincentkoc: The PR is assigned to Vincent, the head branch changes the central Windows doctor/update paths, and current-main blame in this shallow checkout points recent doctor/schtasks/service-audit lines at Vincent commits. (role: current fix owner and recent area contributor; confidence: high; commits: 11f564ede1ba, af3e509ab823; files: src/commands/doctor-gateway-services.ts, src/commands/doctor-update.ts, src/daemon/schtasks.ts)
  • steipete: GitHub file history shows repeated adjacent work on doctor gateway checks, Windows schtasks behavior, daemon audit helpers, and gateway service diagnostics. (role: historical gateway doctor and Windows service contributor; confidence: high; commits: 3b914ca40bc8, a3c44d53d18d, f348284fa9eb; files: src/commands/doctor-gateway-services.ts, src/daemon/schtasks.ts, src/daemon/service-audit.ts)
  • wAngByg: Commit 6c5cd71 added the current central stale OPENCLAW_SERVICE_VERSION audit and tests that this PR now overlaps. (role: adjacent service-version audit contributor; confidence: medium; commits: 6c5cd7177f21; files: src/daemon/service-audit.ts, src/daemon/service-audit.test.ts)
  • Kaspre: Commit c4fa9cd added update-mode systemd repair deferral in the same doctor gateway service repair path. (role: introduced adjacent update-mode repair behavior; confidence: medium; commits: c4fa9cd2e0d4; files: src/commands/doctor-gateway-services.ts, src/commands/doctor-gateway-services.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. labels May 30, 2026
@vincentkoc
vincentkoc force-pushed the fix/windows-doctor-startup-migration branch from 41233b5 to d6193de Compare May 30, 2026 11:42
@BradGroux BradGroux mentioned this pull request May 30, 2026
Draft
@vincentkoc
vincentkoc force-pushed the fix/windows-doctor-startup-migration branch 3 times, most recently from e107b30 to b4f59bc Compare May 30, 2026 12:24
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels May 30, 2026
@vincentkoc
vincentkoc force-pushed the fix/windows-doctor-startup-migration branch 3 times, most recently from e8066b7 to 18a08eb Compare May 30, 2026 17:37
@vincentkoc
vincentkoc force-pushed the fix/windows-doctor-startup-migration branch from 18a08eb to 11f564e Compare May 31, 2026 12:22
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 31, 2026
@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels May 31, 2026
@vincentkoc vincentkoc mentioned this pull request May 31, 2026
Closed
@clawsweeper clawsweeper Bot mentioned this pull request Jun 15, 2026
Closed
@clawsweeper clawsweeper Bot added the merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. label Jun 15, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 19, 2026
Closed
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. and removed rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 20, 2026
@clawsweeper clawsweeper Bot mentioned this pull request Jun 29, 2026
Closed
@steipete steipete mentioned this pull request Jul 6, 2026
Merged
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Replaced and landed in #101213 as commit bb44c23.

This branch could not be updated because maintainer edits are disabled, so I replayed the work on a maintainer branch, preserved the original commits and co-author credit, and hardened the takeover with exact process ownership, rollback, broader update-path tests, full exact-head CI, and native Windows doctor/update proof.

Thank you, @vincentkoc, for identifying and implementing the core Windows repair. For future contributor PRs, enabling Allow edits by maintainers lets us improve and land the original branch directly.

@steipete steipete closed this Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@vincentkoc vincentkoc

Labels

commands Command implementations gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 availability 🚨 May cause crashes, hangs, restart loops, stalls, or process outages. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. size: L status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: Windows doctor update leaves Startup-folder gateway fallback stale and does not install Scheduled Task

2 participants

@vincentkoc @steipete