9eae43bd37
* refactor(infra): move exec approvals into the shared SQLite state DB Delete the file-runtime exec-approvals store (exec-approvals.json + .lock sidecar machinery) on both runtimes and make the reserved exec_approvals_config singleton row canonical. Doctor owns the one-time import with claim/verify/receipt discipline; runtime fails closed with a doctor instruction while un-migrated legacy state exists. The wire CAS contract, socket semantics, and gateway auth-token derivations are unchanged. Kills the #113929 lock-contention bug class structurally and nets around -2.9k lines. * fix(infra): green CI gates and retire file-era exec approvals tests Break the migration-type import cycle with a leaf contract, regenerate the plugin-SDK API and native i18n baselines for the intentional surface change, drop unused exports, and replace the macOS file-era approvals test suite with SQLite-backed behavior coverage per the obsolete-internals test policy. * chore: green max-lines ratchet, native i18n baseline, and unused-export scan
OpenClaw macOS app (dev + signing)
Quick dev run
# from repo root
scripts/restart-mac.sh
Options:
scripts/restart-mac.sh --no-sign # fastest dev; ad-hoc signing (TCC permissions do not stick)
scripts/restart-mac.sh --sign # force code signing (requires cert)
scripts/restart-mac.sh --background-only # keep services running without automatic windows
--background-only suppresses first-run onboarding, update and CLI prompts, and
the --chat/--dashboard auto-open helpers. Pairing, control-channel, and Mac
node services still start. Combine it with --attach-only when an external
process owns the local Gateway.
Packaging flow
scripts/package-mac-app.sh
Creates dist/OpenClaw.app and signs it via scripts/codesign-mac-app.sh.
Signing behavior
Auto-selects identity (first match):
- Developer ID Application
- Apple Distribution
- Apple Development
- first available identity
If none found:
- errors by default
- set
ALLOW_ADHOC_SIGNING=1orSIGN_IDENTITY="-"to ad-hoc sign
Team ID audit (Sparkle mismatch guard)
After signing, we read the app bundle Team ID and compare every Mach-O inside the app. If any embedded binary has a different Team ID, signing fails.
Skip the audit:
SKIP_TEAM_ID_CHECK=1 scripts/package-mac-app.sh
Library validation workaround (dev only)
If Sparkle Team ID mismatch blocks loading (common with Apple Development certs), opt in:
DISABLE_LIBRARY_VALIDATION=1 scripts/package-mac-app.sh
This adds com.apple.security.cs.disable-library-validation to app entitlements.
Use for local dev only; keep off for release builds.
Useful env flags
SIGN_IDENTITY="Apple Development: Your Name (TEAMID)"ALLOW_ADHOC_SIGNING=1(ad-hoc, TCC permissions do not persist)CODESIGN_TIMESTAMP=off(offline debug)DISABLE_LIBRARY_VALIDATION=1(dev-only Sparkle workaround)SKIP_TEAM_ID_CHECK=1(bypass audit)