Summary

When openclaw backup create is interrupted (timeout, SIGKILL, process crash), the temporary .tar.gz.<uuid>.tmp file created by buildTempArchivePath() is left on disk. On successive runs, each interrupted backup leaves a new .tmp file, accumulating and consuming significant disk space (12.6GB across 6 files reported in #50442).

This PR adds cleanupStaleTempArchives() that scans the output directory for files matching the backup temp pattern (<basename>.<uuid>.tmp) and removes stale ones before creating a new archive.

Key safety property: Only .tmp files whose mtime is older than a 30 s staleness threshold (BACKUP_TEMP_STALE_AGE_MS) are removed. This protects against concurrently running backup processes that target the same output path — their actively-written temp archive will be preserved, and the count of skipped active archives is reported in the log message for observability.

The cleanup is non-fatal — errors from missing directories or permission issues are gracefully caught and logged without blocking the backup.

Changes

• src/infra/backup-create.ts: Added buildTempArchiveGlobPattern(), cleanupStaleTempArchives(), and the BACKUP_TEMP_STALE_AGE_MS constant (30 s). Called in createBackupArchive() before creating the new temp archive (after the overwrite guard, in the non-dry-run path). Exported via testApi for testing.
• src/infra/backup-create.test.ts: Added 7 tests covering:
  • Removal of stale .tmp files matching the UUID pattern
  • Preservation of non-tmp files and the final archive
  • Graceful handling of non-existent directories
  • Scoping to only the target archive (not differently-named archives in the same directory)
  • Human-readable size reporting in log output
  • Active temp archive protection: files within the staleness threshold are skipped and reported
  • All-stale cleanup when no files are recent

Real behavior proof

Behavior addressed: Stale .tmp files from interrupted openclaw backup create runs accumulate on disk (up to 12.6GB reported), because the process has no mechanism to discover and remove leftovers before starting a new backup. Additionally, the v1 cleanup could collide with a concurrently running backup targeting the same output path.

Real environment tested: Node v22.22.0, Linux 4.19.112-2.el8.x86_64, commit 39c4cf6. tsx v4.22.3 used to import the actual production module from src/infra/backup-create.js.

Exact steps or command run after this patch:

1. Import the actual cleanupStaleTempArchives from src/infra/backup-create.js (real production module, not copied logic)
2. Create 1 active .tmp file (mtime = now, simulating a concurrent openclaw backup create writer)
3. Create 3 stale .tmp files (mtime = 150 s ago, sizes 5MB + 3MB + 2MB, simulating 3 interrupted runs)
4. Invoke cleanupStaleTempArchives({ outputPath, log }) with default 30 s staleness threshold
5. Verify active file preserved, all 3 stale files removed

Evidence after fix (terminal capture):

$ npx tsx -e 'import fs from "node:fs/promises"; import os from "node:os"; import path from "node:path";
const { testApi } = await import("./src/infra/backup-create.js");
const { cleanupStaleTempArchives } = testApi;
const dir = await fs.mkdtemp(path.join(os.tmpdir(), "oc-proof-real-import-"));
const outputPath = path.join(dir, "openclaw-backup.tar.gz");
const activeTmp = outputPath + ".a1b2c3d4-e5f6-7890-abcd-ef1234567890.tmp";
await fs.writeFile(activeTmp, "ACTIVE: backup being written by concurrent process", "utf8");
const stale1 = outputPath + ".b2c3d4e5-f6a7-8901-bcde-f12345678901.tmp";
const stale2 = outputPath + ".c3d4e5f6-a7b8-9012-cdef-123456789012.tmp";
const stale3 = outputPath + ".d4e5f6a7-b8c9-0123-defa-234567890123.tmp";
await fs.writeFile(stale1, Buffer.alloc(5_242_880, "x")); await fs.writeFile(stale2, Buffer.alloc(3_145_728, "y")); await fs.writeFile(stale3, Buffer.alloc(2_097_152, "z"));
const oldTime = new Date(Date.now() - 150_000);
await fs.utimes(stale1, oldTime, oldTime); await fs.utimes(stale2, oldTime, oldTime); await fs.utimes(stale3, oldTime, oldTime);
console.log("Before cleanup:");
for (const f of await fs.readdir(dir)) { const s = await fs.stat(path.join(dir, f)); console.log(" ", f, "|", (s.size/1048576).toFixed(1)+"MB", "|", Math.round((Date.now()-s.mtimeMs)/1000)+"s ago"); }
const logs = [];
await cleanupStaleTempArchives({ outputPath, log: (msg) => logs.push(msg) });
console.log("\nLog:", logs[0]);
console.log("\nAfter cleanup:");
for (const f of await fs.readdir(dir)) console.log(" ", f);
await fs.rm(dir, { recursive: true, force: true });'

Before cleanup:
openclaw-backup.tar.gz.a1b2c3d4-e5f6-7890-abcd-ef1234567890.tmp | 0.0MB | 0s ago
openclaw-backup.tar.gz.b2c3d4e5-f6a7-8901-bcde-f12345678901.tmp | 5.0MB | 150s ago
openclaw-backup.tar.gz.c3d4e5f6-a7b8-9012-cdef-123456789012.tmp | 3.0MB | 150s ago
openclaw-backup.tar.gz.d4e5f6a7-b8c9-0123-defa-234567890123.tmp | 2.0MB | 150s ago

Log: Backup cleaned up 3 stale temp archives (10.0MB) from a previous interrupted run. (1 active temp archive skipped)

After cleanup:
openclaw-backup.tar.gz.a1b2c3d4-e5f6-7890-abcd-ef1234567890.tmp

exit code: 0

Observed result after fix:

• 3 stale .tmp files (10.0MB total) were removed
• 1 active .tmp file (concurrent writer) was preserved — staleness guard works
• Log correctly reports "3 stale temp archives" + "(1 active temp archive skipped)"
• The function was imported from the real src/infra/backup-create.js module path, not copied inline

What was not tested:

• End-to-end openclaw backup create CLI command with a full OpenClaw state directory (requires building the entire project and having real agent state)
• Signal-handler cleanup for the interrupted process itself (SIGTERM/SIGKILL still cannot run JavaScript cleanup — this PR mitigates on the next run)
• Behavior when the backup output path is on a network filesystem where mtime precision may differ