fix: reject incompatible Node 23 runtimes by fuller-stack-dev · Pull Request #99832 · openclaw/openclaw

fuller-stack-dev · 2026-07-04T05:46:04Z

Summary

narrow the supported runtime contract to Node 22.19+, Node 23.11+, or newer majors
reject Node 23.0-23.10 consistently in package metadata, the launcher, runtime guards, daemon diagnostics, the macOS runtime locator, and all installers
make the CLI-only installer verify the required node:sqlite statement API before accepting an existing runtime
add boundary coverage across TypeScript, launcher, shell, PowerShell, and macOS surfaces

Related to #90007.

Verification

focused Vitest matrix on the final rebased head: 7 files passed, 9 tests passed, 197 skipped
real launcher matrix with Node 22.19, 23.7, 23.11, and 24: 22.19/23.11/24 started; 23.7 exited with the supported-range diagnostic
bash -n scripts/install.sh scripts/install-cli.sh
installer source files are byte-identical to the companion openclaw.ai branch
AWS Crabbox Linux proof on the same patch before the final base refresh:
- corepack pnpm check:changed: run_a9d4d7aef036
- corepack pnpm build: run_29b2b32b3865
final $autoreview --mode branch --base upstream/main: clean, no accepted/actionable findings

The macOS Swift unit suite could not run locally because the package requires Swift 6.2 and the installed toolchain is Swift 6.0; the RuntimeLocator boundary tests are included for CI.

Real behavior proof

Behavior addressed: OpenClaw could install successfully on Node 23.0-23.10, then fail at startup or during state migration because those releases do not expose the required StatementSync.columns() API.

Real environment tested: macOS with official Node 22.19, 23.7, 23.11, and 24 runtimes; Linux on AWS Crabbox for changed checks and build.

Exact steps or command run after this patch: launched openclaw.mjs --version under each Node runtime, ran the focused Vitest boundary matrix, and ran the installer shell probes for the same version boundaries.

Evidence after fix: Node 23.7 is rejected before OpenClaw startup with an actionable runtime-range message; Node 22.19, Node 23.11, and Node 24 proceed successfully.

Observed result after fix: the unsupported Node interval can no longer reach the SQLite-backed runtime paths that trigger statement.columns is not a function.

What was not tested: the macOS Swift unit suite locally due to the Swift 6.2 toolchain requirement.

github-actions · 2026-07-04T05:46:20Z

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

npm-shrinkwrap.json
package.json

Maintainer follow-up:

Review whether the dependency changes are intentional.
Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

github-actions · 2026-07-04T05:46:35Z

Dependency graph change authorized

This PR includes dependency graph changes. A repository admin or member of @openclaw/openclaw-secops authorized this exact head SHA with /allow-dependencies-change.

Approved SHA: 7b116c11b56af036294617be8b6067aa0b6092f4
Approved by: @steipete

A later push changes the PR head SHA and requires a fresh security approval.

clawsweeper · 2026-07-04T05:47:19Z

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 2:58 AM ET / 06:58 UTC.

Summary
The PR changes package engine metadata, launcher/runtime guards, installers, macOS runtime lookup, daemon diagnostics, docs, and boundary tests to reject Node 23.0-23.10 while accepting Node 22.19+, 23.11+, and newer majors.

Reproducibility: yes. from source and related reports: current main accepts Node 23.0-23.10 through package and launcher checks while SQLite state helpers call statement.columns(). I did not run a live Node 23.7 repro in this checkout.

Review metrics: 1 noteworthy metric.

Package engine surfaces: 2 changed, 0 added, 0 removed. package.json and npm-shrinkwrap.json now encode a narrower Node range, which changes package-manager and upgrade behavior for existing Node 23.0-23.10 users.

Stored data model
Persistent data-model change detected: serialized state: src/agents/cli-runner.ts, serialized state: src/agents/cli-session.test.ts, serialized state: src/agents/command/attempt-execution.cli.test.ts, serialized state: src/config/sessions/cli-session-binding.ts, serialized state: src/config/sessions/types.ts, serialized state: src/cron/isolated-agent/run.cron-model-override-forwarding.test.ts, and 14 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #90007
Summary: This PR is the current early-rejection implementation candidate for the Node 23.0-23.10 StatementSync.columns() startup/install failure tracked by the canonical issue cluster.

Members:

canonical: [Bug]: 2026.6.1 — plugin install index + task registry/flow sidecar migrations fail with "statement.columns is not a function" after upgrade from 2026.5.7 #90007 - The older issue tracks the same Node 23 statement.columns is not a function failure in SQLite state migration/startup paths.
duplicate: [Bug]: startup fail #99818 - The later report shows the curl installer accepting Node 23.7 and first startup failing with the same plugin state database statement.columns error.
duplicate: Node 23/26: statement.columns() removed from node:sqlite — breaks plugin state DB and CLI #90148 - This issue reports the same Node 23 StatementSync.columns() plugin state database and CLI startup failure.
superseded: fix(sqlite): support Node 23.0–23.10 runtimes lacking StatementSync.columns() #90035 - That closed unmerged PR proposed preserving Node 23.0-23.10 support with a SQLite fallback; this PR takes the alternate early-rejection direction.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Get explicit maintainer acceptance of the fail-closed Node 23.0-23.10 runtime contract before merge.

Risk before merge

[P2] Merging intentionally makes existing Node 23.0-23.10 installs fail earlier during install, update, startup, or macOS runtime lookup instead of preserving that runtime interval with a SQLite fallback.

Maintainer options:

Land the fail-closed runtime contract (recommended)
Maintainers can accept that Node 23.0-23.10 is no longer supported and land the package, installer, runtime, and macOS checks after exact-head CI and merge review are clean.
Preserve Node 23.0-23.10 support
If maintainers want that interval to keep working, replace this direction with a shared SQLite/Kysely compatibility fallback and targeted proof on an affected Node 23 release.
Pause while runtime policy is unsettled
If the supported-runtime policy is not agreed, pause the PR rather than merging a package-engine break that existing Node 23 users discover during setup or startup.

Next step before merge

[P2] The remaining action is maintainer judgment on a protected, compatibility-sensitive runtime contract plus normal exact-head merge validation, not a narrow automated repair.

Security
Cleared: No concrete security or supply-chain regression was found; the shrinkwrap and package changes only narrow engines.node and do not add executable dependency sources.

Review details

Best possible solution:

Land this direction only with maintainer acceptance of the fail-closed Node 23.0-23.10 contract; otherwise replace it with a shared SQLite compatibility fallback that keeps that interval supported.

Do we have a high-confidence way to reproduce the issue?

Yes from source and related reports: current main accepts Node 23.0-23.10 through package and launcher checks while SQLite state helpers call statement.columns(). I did not run a live Node 23.7 repro in this checkout.

Is this the best way to solve the issue?

Yes if maintainers choose early rejection over preserving EOL Node 23.0-23.10 support. The safer alternative, if that interval remains supported, is a shared SQLite/Kysely compatibility fallback instead of a fail-closed runtime contract.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 29814252e8e3.

Label changes

Label justifications:

P0: The PR addresses a reported install and first-start blocker where OpenClaw installed on Node 23.7 and then failed to start on the SQLite state path.
merge-risk: 🚨 compatibility: The diff intentionally changes the supported runtime contract and can stop existing Node 23.0-23.10 setups during install, update, startup, or macOS runtime lookup.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body records after-fix real runtime matrix proof for Node 22.19, 23.7, 23.11, and 24 plus Crabbox check/build run IDs, which is sufficient for this runtime-guard PR.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body records after-fix real runtime matrix proof for Node 22.19, 23.7, 23.11, and 24 plus Crabbox check/build run IDs, which is sufficient for this runtime-guard PR.

Evidence reviewed

What I checked:

Repository policy read: Root AGENTS.md and relevant scoped guides for docs, extensions, scripts, agents, gateway, tests, and UI were read; the review applied compatibility, protected-label, dependency/shrinkwrap, and best-fix guidance. (AGENTS.md:20, 29814252e8e3)
Current main still accepts the failing Node interval: Current main declares engines.node as >=22.19.0 and the launcher accepts any major above 22, so Node 23.0-23.10 can still reach startup before this PR. (package.json:2063, 29814252e8e3)
Current main has the missing-API call path: The sync SQLite helper still calls statement.columns() before query execution, matching the reported failure when that method is unavailable. (src/infra/kysely-sync.ts:42, 29814252e8e3)
Dependency contract supports the version gap: Official Node docs list statement.columns() under StatementSync and mark it as added in v23.11.0 and v22.16.0, which explains why Node 23.0-23.10 is the incompatible interval. (nodejs.org)
Merge result narrows package metadata: The PR's potential merge commit changes package.json to >=22.19.0 <23 || >=23.11.0, rejecting Node 23.0-23.10 at package metadata boundaries. (package.json:2063, c2b2ec572d58)
Merge result narrows launcher guard: The potential merge commit adds a Node 23.11 floor in openclaw.mjs, so Node 23.7 fails before runtime startup while 22.19, 23.11, and 24+ continue. (openclaw.mjs:27, c2b2ec572d58)

Likely related people:

steipete: GitHub commit history ties this area to the native node:sqlite Kysely dialect and the shared SQLite state database work implicated by the Node runtime gap. (role: introduced and recent area contributor; confidence: high; commits: 955b0256976a, bc848b367f0b; files: src/infra/kysely-node-sqlite.ts, src/infra/kysely-sync.ts, src/infra/runtime-guard.ts)
vincentkoc: Recent history shows installer runtime work and sync SQLite facade maintenance on surfaces this PR updates or routes around. (role: recent installer and SQLite helper contributor; confidence: medium; commits: be7198f6a222, adc4d9fe02af, 80f1ae6ffe3e; files: scripts/install.sh, scripts/install-cli.sh, src/infra/kysely-sync.ts)
ImLukeF: Prior macOS RuntimeLocator history includes minimum Node alignment and boundary-test work that this PR extends for the Node 23.0-23.10 gap. (role: macOS runtime locator contributor; confidence: medium; commits: bed661609e5c; files: apps/macos/Sources/OpenClaw/RuntimeLocator.swift, apps/macos/Tests/OpenClawIPCTests/RuntimeLocatorTests.swift)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete · 2026-07-04T06:39:47Z

/allow-dependencies-change

steipete · 2026-07-04T06:54:15Z

/allow-dependencies-change

steipete · 2026-07-04T06:55:48Z

/allow-dependencies-change

steipete · 2026-07-04T07:03:32Z

Maintainer review: land-ready.

Best-fix judgment: yes. OpenClaw unconditionally calls node:sqlite StatementSync.columns(), which Node added in 23.11.0. Failing closed on Node 23.0-23.10 at every bootstrap/runtime boundary is safer and more complete than maintaining a partial SQL-shape fallback for an EOL Node line.
Surface reviewed: package engine, launcher, canonical runtime guard, managed update preflight, daemon runtime selection, shell/PowerShell/CLI installers, macOS runtime locator, website parity, callers, sibling entry points, tests, docs, current main, shipped package metadata, and the upstream Node API contract.
Accepted fixes during review: aligned public docs/security requirements with the split range; kept recognized engine ranges fail-closed when a managed runtime version is unreadable.
Local proof: seven changed TS test files passed across five Vitest shards (196 passed, 12 skipped); runtime-guard plus full update CLI passed 172 tests; installer bash -n; dependency report found 0 resolved-package additions/removals/changes; docs MDX passed for 690 files; 5,550 internal links checked with 0 broken.
Remote proof: exact-head CI run 28698314940 passed, including Windows Node, macOS Node/Swift, build, type, lint, docs, QA, and all Node shards. Dependency Guard run 28698314554 passed after current-head secops authorization. Existing AWS Testbox proof: run_a9d4d7aef036 (changed checks) and run_29b2b32b3865 (build).
Fresh autoreview after both fixes: clean; no accepted or actionable findings.
Exact head: 7b116c11b56af036294617be8b6067aa0b6092f4.

No remaining proof gap or blocker.

steipete · 2026-07-04T07:03:53Z

Merged via squash.

Prepared head SHA: 7b116c11b56af036294617be8b6067aa0b6092f4
Landed commit: cccc856b82f7880fb68aa6e995a2e8642a5668c9

* fix: reject incompatible Node 23 runtimes * fix: repair installer CI coverage * docs: clarify supported Node ranges * fix: fail closed on unreadable runtime versions --------- Co-authored-by: Peter Steinberger <[email protected]>

fix: reject incompatible Node 23 runtimes

a11e076

fuller-stack-dev requested a review from a team as a code owner July 4, 2026 05:46

fuller-stack-dev mentioned this pull request Jul 4, 2026

fix: reject incompatible Node 23 installers openclaw/openclaw.ai#185

Merged

openclaw-barnacle Bot added app: macos App: macos gateway Gateway runtime cli CLI command changes scripts Repository scripts commands Command implementations size: L maintainer Maintainer-authored PR labels Jul 4, 2026

github-actions Bot added the dependencies-changed PR changes dependency-related files label Jul 4, 2026

fix: repair installer CI coverage

843ccc3

clawsweeper Bot added P0 Emergency: data loss, security bypass, crash loop, or unusable core runtime. and removed P1 High-priority user-facing bug, regression, or broken workflow. labels Jul 4, 2026

steipete self-assigned this Jul 4, 2026

docs: clarify supported Node ranges

6fa3268

openclaw-barnacle Bot added docs Improvements or additions to documentation agents Agent runtime and tooling size: XL and removed size: L labels Jul 4, 2026

clawsweeper Bot removed the rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. label Jul 4, 2026

fix: fail closed on unreadable runtime versions

7b116c1

openclaw-barnacle Bot added channel: line Channel integration: line app: web-ui App: web-ui labels Jul 4, 2026

steipete merged commit cccc856 into openclaw:main Jul 4, 2026
120 of 124 checks passed

github-actions Bot mentioned this pull request Jul 4, 2026

📡 Upstream Digest — 2026-07-04 10:01 UTC curtismercier/openclaw-mods#1203

Open

clawsweeper Bot mentioned this pull request Jul 7, 2026

fix(installer): complete first-run onboarding #101901

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: reject incompatible Node 23 runtimes#99832

fix: reject incompatible Node 23 runtimes#99832
steipete merged 4 commits into
openclaw:mainfrom
fuller-stack-dev:codex/node-runtime-range

fuller-stack-dev commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

fuller-stack-dev commented Jul 4, 2026

Summary

Verification

Real behavior proof

Uh oh!

github-actions Bot commented Jul 4, 2026

Dependency Guard

Uh oh!

github-actions Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency graph change authorized

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Uh oh!

steipete commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading