chore: upgrade OpenClaw from 2026.4.9 to 2026.4.24

Dockerfile

@@ -172,15 +172,18 @@ RUN set -eu; \
     sed -i 's/baseLstat\.isSymbolicLink()/false \/* nemoclaw: symlink check disabled, realpath guards containment *\//' "$ipd_file"; \
     if grep -q 'fs\.lstat(params\.installBaseDir)' "$ipd_file"; then echo "ERROR: Patch 3b (install-package-dir) left lstat in assertInstallBaseStable" >&2; exit 1; fi; \
     # --- Patch 4: graceful EACCES in replaceConfigFile for sandbox (#2254) --- \
-    # Plugin install persists metadata to openclaw.json via replaceConfigFile. \
-    # In the sandbox, openclaw.json is immutable (444 root:root in a 755 \
-    # root:root directory) by design.  The write fails with EACCES.  This \
-    # patch wraps the writeConfigFile call inside replaceConfigFile to catch \
-    # EACCES when OPENSHELL_SANDBOX=1 and emit a warning instead of crashing. \
-    # Plugins still load via auto-discovery from the extensions directory. \
+    # Plugin install persists metadata via replaceConfigFile. In the sandbox, \
+    # openclaw.json is immutable (444 root:root) by design.  OpenClaw 2026.4.24 \
+    # restructured config writes: replaceConfigFile now first attempts a \
+    # single-key include-file mutation (tryWriteSingleTopLevelIncludeMutation), \
+    # falling back to writeConfigFile for the full config.  Both paths can hit \
+    # EACCES in the read-only sandbox tree.  This patch wraps the entire \
+    # write block in a try/catch that catches EACCES when OPENSHELL_SANDBOX=1 \
+    # and emits a warning instead of crashing.  Plugins still load via \
+    # auto-discovery from the extensions directory. \
     rcf_file="$(grep -RIlE --include='*.js' 'async function replaceConfigFile\(params\)' "$OC_DIST" | head -n 1)"; \
     test -n "$rcf_file" || { echo "ERROR: replaceConfigFile function not found in OpenClaw dist" >&2; exit 1; }; \
-    python3 -c "import sys; p=sys.argv[1]; f=open(p); src=f.read(); f.close(); old='\tawait writeConfigFile(params.nextConfig, {\n\t\t...writeOptions,\n\t\t...params.writeOptions\n\t});'; new='\ttry { await writeConfigFile(params.nextConfig, {\n\t\t...writeOptions,\n\t\t...params.writeOptions\n\t}); } catch(_rcfErr) { if (process.env.OPENSHELL_SANDBOX === \"1\" && _rcfErr.code === \"EACCES\") { console.error(\"[nemoclaw] Config is read-only in sandbox \\u2014 plugin metadata not persisted (plugins auto-load from extensions/)\"); } else { throw _rcfErr; } }'; assert old in src, 'writeConfigFile(params.nextConfig) pattern not found'; f=open(p,'w'); f.write(src.replace(old,new,1)); f.close()" "$rcf_file"; \
+    python3 -c "import sys; p=sys.argv[1]; f=open(p); src=f.read(); f.close(); old='\tif (!await tryWriteSingleTopLevelIncludeMutation({\n\t\tsnapshot,\n\t\tnextConfig: params.nextConfig\n\t})) await writeConfigFile(params.nextConfig, {\n\t\tbaseSnapshot: snapshot,\n\t\t...writeOptions,\n\t\t...params.writeOptions\n\t});'; new='\ttry { if (!await tryWriteSingleTopLevelIncludeMutation({\n\t\tsnapshot,\n\t\tnextConfig: params.nextConfig\n\t})) await writeConfigFile(params.nextConfig, {\n\t\tbaseSnapshot: snapshot,\n\t\t...writeOptions,\n\t\t...params.writeOptions\n\t}); } catch(_rcfErr) { if (process.env.OPENSHELL_SANDBOX === \"1\" && _rcfErr.code === \"EACCES\") { console.error(\"[nemoclaw] Config is read-only in sandbox \\u2014 plugin metadata not persisted (plugins auto-load from extensions/)\"); } else { throw _rcfErr; } }'; assert old in src, 'tryWriteSingleTopLevelIncludeMutation/writeConfigFile pattern not found in replaceConfigFile'; f=open(p,'w'); f.write(src.replace(old,new,1)); f.close()" "$rcf_file"; \
     grep -REq --include='*.js' 'OPENSHELL_SANDBOX.*EACCES' "$rcf_file" || { echo "ERROR: Patch 4 (replaceConfigFile EACCES) not applied" >&2; exit 1; }
 
 # Set up blueprint for local resolution.

Dockerfile.base

@@ -152,7 +152,7 @@ RUN printf '%s\n' \
 # OpenClaw version: change the OPENCLAW_VERSION ARG default so CI rebuilds
 # the base image on push to main, or use workflow_dispatch on base-image.yaml
 # with the openclaw_version input for a one-off build without editing this file.
-ARG OPENCLAW_VERSION=2026.4.9
+ARG OPENCLAW_VERSION=2026.4.24
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 

agents/openclaw/manifest.yaml

@@ -19,7 +19,7 @@ homepage: "https://openclaw.ai"
 install_method: npm  # npm install -g openclaw@<version>
 binary_path: /usr/local/bin/openclaw
 version_command: "openclaw --version"
-expected_version: "2026.4.9"
+expected_version: "2026.4.24"
 gateway_command: "openclaw gateway run"
 
 # ── Health probe ────────────────────────────────────────────────

nemoclaw-blueprint/blueprint.yaml

@@ -4,7 +4,7 @@
 version: "0.1.0"
 min_openshell_version: "0.0.32"
 max_openshell_version: "0.0.36"
-min_openclaw_version: "2026.4.9"
+min_openclaw_version: "2026.4.24"
 # Mirrors the components.sandbox.image manifest digest below. Lets a
 # downstream consumer (or release tooling) verify the blueprint declares
 # a specific sandbox image without parsing the components tree, and

src/lib/sandbox-version.test.ts

@@ -36,7 +36,7 @@ vi.mock("./agent-defs.js", () => ({
     name,
     displayName: name === "openclaw" ? "OpenClaw" : "Hermes Agent",
     versionCommand: name === "openclaw" ? "openclaw --version" : "hermes --version",
-    expectedVersion: name === "openclaw" ? "2026.4.9" : "2026.4.9",
+    expectedVersion: name === "openclaw" ? "2026.4.24" : "2026.4.24",
     stateDirs: [],
     configPaths: { writableDir: "/sandbox/.openclaw-data" },
   })),
@@ -76,12 +76,12 @@ describe("checkAgentVersion", () => {
     registry.registerSandbox({
       name: "test-sb",
       agent: null,
-      agentVersion: "2026.4.9",
+      agentVersion: "2026.4.24",
     });
 
     const result = checkAgentVersion("test-sb");
     expect(result.detectionMethod).toBe("registry");
-    expect(result.sandboxVersion).toBe("2026.4.9");
+    expect(result.sandboxVersion).toBe("2026.4.24");
     expect(result.isStale).toBe(false);
   });
 
@@ -102,7 +102,7 @@ describe("checkAgentVersion", () => {
     registry.registerSandbox({
       name: "test-sb",
       agent: null,
-      agentVersion: "2026.4.9",
+      agentVersion: "2026.4.24",
     });
 
     const result = checkAgentVersion("test-sb");
@@ -119,7 +119,7 @@ describe("checkAgentVersion", () => {
 
     vi.mocked(spawnSync).mockReturnValue({
       status: 0,
-      stdout: "OpenClaw 2026.4.9 (abc123)\n",
+      stdout: "OpenClaw 2026.4.24 (abc123)\n",
       stderr: "",
       pid: 1234,
       output: [],
@@ -128,12 +128,12 @@ describe("checkAgentVersion", () => {
 
     const result = checkAgentVersion("test-sb");
     expect(result.detectionMethod).toBe("ssh-exec");
-    expect(result.sandboxVersion).toBe("2026.4.9");
+    expect(result.sandboxVersion).toBe("2026.4.24");
     expect(result.isStale).toBe(false);
 
     // Should have cached the version in registry
     const updated = registry.getSandbox("test-sb");
-    expect(updated?.agentVersion).toBe("2026.4.9");
+    expect(updated?.agentVersion).toBe("2026.4.24");
   });
 
   it("returns unavailable when SSH config fails", () => {
@@ -163,7 +163,7 @@ describe("checkAgentVersion", () => {
 
     vi.mocked(spawnSync).mockReturnValue({
       status: 0,
-      stdout: "OpenClaw 2026.4.9 (abc123)\n",
+      stdout: "OpenClaw 2026.4.24 (abc123)\n",
       stderr: "",
       pid: 1234,
       output: [],
@@ -172,7 +172,7 @@ describe("checkAgentVersion", () => {
 
     const result = checkAgentVersion("test-sb", { forceProbe: true });
     expect(result.detectionMethod).toBe("ssh-exec");
-    expect(result.sandboxVersion).toBe("2026.4.9");
+    expect(result.sandboxVersion).toBe("2026.4.24");
   });
 });
 
@@ -199,14 +199,14 @@ describe("formatStalenessWarning", () => {
   it("includes sandbox name, versions, and rebuild hint", () => {
     const lines = formatStalenessWarning("my-sb", {
       sandboxVersion: "2026.3.11",
-      expectedVersion: "2026.4.9",
+      expectedVersion: "2026.4.24",
       isStale: true,
       detectionMethod: "registry",
     });
     const joined = lines.join("\n");
     expect(joined).toContain("my-sb");
     expect(joined).toContain("2026.3.11");
-    expect(joined).toContain("2026.4.9");
+    expect(joined).toContain("2026.4.24");
     expect(joined).toContain("rebuild");
   });
 });