Warn on generated wrapper overwrites and status diagnostics#90537
Conversation
|
Codex review: needs maintainer review before merge. Reviewed June 21, 2026, 7:41 AM ET / 11:41 UTC. Summary PR surface: Source +108, Tests +166. Total +274 across 12 files. Reproducibility: yes. The linked issue at #90518 includes an isolated macOS LaunchAgent repro, and current main plus v2026.6.9 still show the same unconditional generated-wrapper write path; I did not rerun the macOS repro in this read-only review. Review metrics: none identified. Stored data model Root-cause cluster Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Next step before merge
Security Review detailsBest possible solution: Land the focused launchd/status diagnostics after normal maintainer review, while keeping the related legacy auth-profile migration note separate unless it is independently reproduced. Do we have a high-confidence way to reproduce the issue? Yes. The linked issue at #90518 includes an isolated macOS LaunchAgent repro, and current main plus v2026.6.9 still show the same unconditional generated-wrapper write path; I did not rerun the macOS repro in this read-only review. Is this the best way to solve the issue? Yes. The PR fixes the narrow owner boundaries: launchd warns at the generated-wrapper write site, daemon lifecycle preserves structured warnings, doctor can surface repair notes, and status uses installed service metadata without provider-specific behavior or new config. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against d1cbe29f3d52. Label changesLabel justifications:
Evidence reviewedPR surface: Source +108, Tests +166. Total +274 across 12 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
|
@clawsweeper re-review |
|
🦞👀 Command router queued. I will update this comment with the next step. Re-review progress:
|
|
I checked the failed The later current-head CI run is green, ClawSweeper has this at I tried to rerun the failed labeler job, but GitHub rejected it with |
50786f8 to
7386fe8
Compare
|
Rebased this branch onto current Validation on head @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
7386fe8 to
3b4833c
Compare
3b4833c to
c6b6589
Compare
|
Merged via squash.
Thanks @TurboTheTurtle! |
…#90537) Merged via squash. Prepared head SHA: c6b6589 Co-authored-by: TurboTheTurtle <[email protected]> Co-authored-by: vincentkoc <[email protected]> Reviewed-by: @vincentkoc
Summary
Fixes #90518
Real behavior proof
Behavior addressed: Generated macOS LaunchAgent env wrappers can be regenerated during gateway service rendering. After this patch, when the existing generated wrapper has local custom behavior, OpenClaw emits an overwrite warning that points operators to
openclaw gateway install --wrapper <path>/OPENCLAW_WRAPPER, then restores the generated wrapper.Real environment tested: Local macOS developer machine. The wrapper overwrite behavior proof below was run on PR head
00829a3ed4with the Node source CLI vianode --import tsx, tempHOME, synthetic profilepr90537proof, synthetic LaunchAgent labelai.openclaw.pr90537proof, and no secret values. The current-head restart JSON proof below was run on PR head50786f859dwith a tempHOME, tempOPENCLAW_STATE_DIR, synthetic LaunchAgent labelai.openclaw.pr90537restart, isolatedlaunchctlshim, and redacted gateway token.Exact steps or command run after this patch: Ran a local terminal proof script that imports
./src/daemon/launchd.ts, callsstageLaunchAgentwith service env entries, edits the generated*-env-wrapper.shto add a redactedcustom-secret-provider-marker, restages once with the structured warning callback, restages once without the callback to exercise CLI-style stdout warnings, and removes the temp HOME.Evidence after fix: Terminal output copied from the run on
00829a3ed4:Current-head restart JSON evidence: Terminal output copied from the run on
50786f859d:Observed result after fix: The customized generated wrapper is detected before overwrite, the structured warning path records exactly one warning for JSON/doctor-style callers, the stdout path prints the same warning for CLI-style callers, the warning names both
--wrapperandOPENCLAW_WRAPPER, and the wrapper is restored to the generated content after restage. The restart path now threads the same structured warning callback throughrunServiceRestartinto the launchd restart adapter, soopenclaw gateway restart --jsoncan serialize the overwrite warning instead of losing it to a null/stdout-only path.What was not tested: Full
openclaw gateway install --forcelaunchd bootstrap was not repeated from this source checkout because this checkout does not have a builtdist/index.jsservice entrypoint; the installed user gateway was left untouched. The current-head restart proof invokes the daemon CLI lifecycle runner used byopenclaw gateway restart --jsondirectly from source so the proof can target a synthetic LaunchAgent without stopping or restarting the real user gateway.Supplemental local checks on current head
50786f859d:Checks
node scripts/test-projects.mjs src/daemon/launchd.test.ts src/cli/daemon-cli/install.test.ts src/commands/status.test.tsnode scripts/run-vitest.mjs src/daemon/launchd.test.ts src/cli/daemon-cli/lifecycle-core.test.ts src/cli/daemon-cli/install.test.tsnode_modules/.bin/oxfmt --write --no-error-on-unmatched-pattern src/daemon/service-types.ts src/daemon/launchd.ts src/daemon/launchd.test.ts src/cli/daemon-cli/install.ts src/cli/daemon-cli/install.test.ts src/commands/doctor-gateway-services.ts src/commands/status.service-summary.ts src/commands/status.daemon.ts src/commands/status.command.ts src/commands/status.test.ts