fix(exec): stop isolated state dirs from moving live approvals (#108742)

* fix(exec): isolate approval state directories

* chore: drop release-owned changelog entry

* chore: refresh native i18n inventory

* fix(ci): pin XcodeGen for Periphery scans
This commit is contained in:
Peter Steinberger
2026-07-16 08:57:32 -07:00
committed by GitHub
parent 7a18a781bc
commit 8fe4eeea9e
35 changed files with 88 additions and 1208 deletions

View File

@@ -55,7 +55,6 @@ git_cli="$git_root/openclaw.mjs"
package_version="$(node -p "require(\"$npm_root/package.json\").version")"
update_doctor_env="OPENCLAW_UPDATE_IN_PROGRESS=1"
update_doctor_env+=" OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS=1"
update_doctor_env+=" OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE=1"
update_doctor_env+=" OPENCLAW_UPDATE_PARENT_SUPPORTS_GATEWAY_RESTART=1"
update_doctor_env+=" OPENCLAW_UPDATE_PARENT_ALLOWS_GATEWAY_SERVICE_REPAIR=1"
@@ -162,7 +161,6 @@ run_flow() {
fi
assert_entrypoint "$unit_path" "$doctor_expected"
assert_no_env_key "$unit_path" "OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS"
}
run_flow \
@@ -239,7 +237,6 @@ run_cross_state_approval_flow() {
test "$(plugin_binding_approval_count "$state_database")" = "0"
if ! openclaw_e2e_maybe_timeout "$command_timeout" env \
-u OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS \
-u OPENCLAW_UPDATE_IN_PROGRESS \
OPENCLAW_STATE_DIR="$custom_state_dir" \
OPENCLAW_CONFIG_PATH="$custom_state_dir/openclaw.json" \
@@ -248,12 +245,12 @@ run_cross_state_approval_flow() {
exit 1
fi
test ! -e "$exec_source"
test ! -e "$plugin_source"
test "$(sha256sum "$exec_source.migrated" | awk '{print $1}')" = "$exec_source_hash"
test "$(sha256sum "$plugin_source.migrated" | awk '{print $1}')" = "$plugin_source_hash"
test -e "$custom_state_dir/exec-approvals.json"
test "$(plugin_binding_approval_count "$state_database")" = "1"
test "$(sha256sum "$exec_source" | awk '{print $1}')" = "$exec_source_hash"
test "$(sha256sum "$plugin_source" | awk '{print $1}')" = "$plugin_source_hash"
test ! -e "$exec_source.migrated"
test ! -e "$plugin_source.migrated"
test ! -e "$custom_state_dir/exec-approvals.json"
test "$(plugin_binding_approval_count "$state_database")" = "0"
}
run_cross_state_approval_flow
@@ -287,7 +284,6 @@ run_proxy_env_flow() {
} >>"$unit_path"
if ! openclaw_e2e_maybe_timeout "$command_timeout" env \
OPENCLAW_UPDATE_IN_PROGRESS=1 \
OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS=1 \
OPENCLAW_UPDATE_PARENT_SUPPORTS_DOCTOR_CONFIG_WRITE=1 \
OPENCLAW_UPDATE_PARENT_SUPPORTS_GATEWAY_RESTART=1 \
OPENCLAW_UPDATE_PARENT_ALLOWS_GATEWAY_SERVICE_REPAIR=1 \
@@ -298,7 +294,6 @@ run_proxy_env_flow() {
fi
assert_no_env_key "$unit_path" "HTTP_PROXY"
assert_no_env_key "$unit_path" "HTTPS_PROXY"
assert_no_env_key "$unit_path" "OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS"
}
run_proxy_env_flow

View File

@@ -22,10 +22,6 @@ const WATCH_LOCK_DIR = path.join(".local", "watch-node");
const WATCH_DIST_ENTRY_POLL_MS = 1_000;
const WATCH_DIST_ENTRY_TIMEOUT_MS = 5 * 60 * 1_000;
const AUTO_DOCTOR_DISABLE_VALUES = new Set(["0", "false", "no", "off"]);
// The source watcher cannot import the TypeScript owner; keep this literal
// aligned with src/commands/doctor-invocation.ts.
const DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS_ENV =
"OPENCLAW_DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS";
const buildRunnerArgs = (args) => [WATCH_NODE_RUNNER, ...args];
const buildDoctorRunnerArgs = () => [WATCH_NODE_RUNNER, "doctor", "--fix", "--non-interactive"];
@@ -487,7 +483,6 @@ export async function runWatchMain(params = {}) {
detached: useChildProcessGroup,
env: {
...childEnv,
[DOCTOR_DISABLE_CROSS_STATE_DIR_IMPORTS_ENV]: "1",
},
stdio: "inherit",
});