skills.rest
openclaw
openclawOFFICIAL
Explore all skills by this author →
Website𝕏@openclawGitHub

openclaw-live-updater

Fast-forward the canonical OpenClaw main checkout, verify the managed Gateway, and run full release validation.

388k|81.5k|Updated Nov 24, 2025
Search Tags:#fast-forward#gateway#launchd#release-validation#Openclaw#ci-repair#live-updater
One-click install
npx skills add https://github.com/openclaw/openclaw --skill openclaw-live-updater
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: openclaw-live-updater
Source: https://github.com/openclaw/openclaw/tree/main/.agents/skills/openclaw-live-updater
Command: npx skills add https://github.com/openclaw/openclaw --skill openclaw-live-updater

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Operators running OpenClaw as a live deployment need a deterministic, safe heartbeat that keeps the canonical main checkout, managed Gateway, local macOS app, and exact-head CI in lockstep without weakening release gates or risking the live mirror.

Core Features & Use Cases

  • Deterministic Fast-Forward Update: Runs a Node.js helper that verifies the live mirror invariants, fetches origin/main, performs a --ff-only merge, and rebuilds the Gateway only when source or build provenance changed.
  • Managed Gateway Lifecycle: Acquires a maintenance lock, suspends the Gateway via gateway.suspend.prepare, stops the managed LaunchAgent, rebuilds, restarts, and proves health through deep RPC status and verbose health probes plus restart-window log audits.
  • macOS App Rebuild and Verification: When changed paths affect macOS, rebuilds dist/OpenClaw.app, preserves the bundle across JS cleanups, and requires the exact executable before re-running Gateway proof.
  • Attributable CI Repair: Loads $openclaw-testing, inspects only relevant required checks for exact current origin/main, and routes failures through a focused PR landed via $openclaw-pr-maintainer's scripts/pr.
  • Full Release Validation: Loads $release-openclaw-ci and $openclaw-testing to dispatch pnpm ci:full-release on a 12-hour cadence with release_profile=full and rerun_group=all, watching the parent run and reporting evidence without publishing.

Quick Start

Use the openclaw-live-updater skill to fast-forward the canonical OpenClaw main mirror, verify the managed Gateway and exact-head CI, and report the resulting SHA with proof.

Frequently Asked Questions about openclaw-live-updater

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fast-forward the canonical OpenClaw main checkout safely?▼

Run `node --import tsx .agents/skills/openclaw-live-updater/scripts/update-main.mjs` from the canonical checkout. The helper verifies mirror invariants, fetches `origin/main`, performs a `--ff-only` merge, and rebuilds only when source or build provenance changed.

What does the OpenClaw live updater verify before restarting the Gateway?▼

It checks `dist/.buildstamp`, `dist/.runtime-postbuildstamp`, `dist/entry.js`, the Control UI index plus referenced local assets, and `dist/build-info.json` all match the post-update `afterSha`. It then runs `gateway status --deep --require-rpc --json` and `health --verbose --json`.

How does the updater handle macOS app rebuilds?▼

When changed paths affect macOS, it runs `scripts/restart-mac.sh --sign --wait --target-only` with `SKIP_TSC=1` and `SKIP_UI_BUILD=1` after the exact-SHA JS/UI build. It preserves `dist/OpenClaw.app` outside `dist` and requires the exact executable before re-running Gateway proof.

Why does the updater refuse to run on a shallow or linked worktree?▼

The helper enforces that the checkout is a full, standalone, non-symlinked clone with exactly one worktree on `main`. Shallow clones, sparse checkouts, partial clones, borrowed objects, and linked worktrees all fail closed with explicit invariant errors.

When should I run full release validation instead of a normal update?▼

Full release validation runs on a 12-hour wall-clock cadence, not per-SHA. It dispatches `pnpm ci:full-release` with `release_profile=full` and `rerun_group=all`, watches the parent run to terminal, and reports evidence without publishing artifacts.

Related Skills

Explore More Software Engineering Skills→
mauriciodelriomauriciodelrio
3

install-dependencies-rules

Enforce pinned pnpm dependency versions with pnpm audit and OSV scanning.

Community
Advanced
HybridAIOneHybridAIOne
126

apple-passwords

Retrieve specific credentials from macOS Passwords and Keychain via the security CLI.

Official
Intermediate
p-sree-sai-pavanp-sree-sai-pavan
5

openclaw-landable-bug-sweep

Identify five landable OpenClaw bugfix PRs with CI-green heads.

Community
Advanced
rnavarychrnavarych
14

alpha-core:ci-cd-patterns

Design CI/CD pipelines with build, test, and deploy stages.

Community
Advanced