Skip to content
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -213,13 +213,13 @@ RUN npm ci --prefix /usr/local/lib/nemoclaw/wechat-runtime \
COPY scripts/patch-openclaw-tool-catalog.mts /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts
COPY scripts/patch-openclaw-chat-send.js /usr/local/lib/nemoclaw/patch-openclaw-chat-send.js
COPY scripts/patch-openclaw-mcp-npx.mts /usr/local/lib/nemoclaw/patch-openclaw-mcp-npx.mts
COPY scripts/patch-openclaw-issue-4434-diagnostics.ts /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts
COPY scripts/patch-openclaw-issue-4434-diagnostics.mts /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.mts
COPY scripts/patch-openclaw-device-self-approval.ts /usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.ts
COPY scripts/verify-wechat-runtime-lock.mts /usr/local/lib/nemoclaw/verify-wechat-runtime-lock.mts
RUN chmod 755 /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts \
/usr/local/lib/nemoclaw/patch-openclaw-chat-send.js \
/usr/local/lib/nemoclaw/patch-openclaw-mcp-npx.mts \
/usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts \
/usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.mts \
/usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.ts \
/usr/local/lib/nemoclaw/verify-wechat-runtime-lock.mts

Expand Down Expand Up @@ -759,7 +759,7 @@ RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-devic
# Removal criteria: drop when upstream OpenClaw emits these structured fields
# from its assistant error formatter for unreachable inference failures.
# hadolint ignore=DL3059
RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts \
RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.mts \
/usr/local/lib/node_modules/openclaw/dist

# Patch OpenClaw's MCP stdio launcher so npx-backed MCP servers run with -y.
Expand Down
12 changes: 6 additions & 6 deletions docs/security/openclaw-2026.6.10-dependency-review.md

Large diffs are not rendered by default.

Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#!/usr/bin/env node
#!/usr/bin/env -S node --experimental-strip-types
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

Expand All @@ -8,8 +8,8 @@
* diagnostics for sandbox fetch failures and inference timeouts.
*/

const fs = require("node:fs");
const path = require("node:path");
import fs from "node:fs";
import path from "node:path";

const AUDIT_FLAG = "--audit";
const EXIT_APPLY_FAILURE = 1;
Expand Down Expand Up @@ -37,7 +37,7 @@ const positional = args.filter((value) => value !== AUDIT_FLAG);
const distDir = positional[0];

if (!distDir || positional.length > 1) {
console.error("Usage: patch-openclaw-issue-4434-diagnostics.ts [--audit] <openclaw-dist-dir>");
console.error("Usage: patch-openclaw-issue-4434-diagnostics.mts [--audit] <openclaw-dist-dir>");
process.exit(EXIT_USAGE);
}

Expand Down
4 changes: 2 additions & 2 deletions src/lib/sandbox/build-context.ts
Original file line number Diff line number Diff line change
Expand Up @@ -244,8 +244,8 @@ function stageOptimizedSandboxBuildContext(
path.join(stagedScriptsDir, "patch-openclaw-mcp-npx.mts"),
);
fs.copyFileSync(
path.join(rootDir, "scripts", "patch-openclaw-issue-4434-diagnostics.ts"),
path.join(stagedScriptsDir, "patch-openclaw-issue-4434-diagnostics.ts"),
path.join(rootDir, "scripts", "patch-openclaw-issue-4434-diagnostics.mts"),
path.join(stagedScriptsDir, "patch-openclaw-issue-4434-diagnostics.mts"),
);
fs.copyFileSync(
path.join(rootDir, "scripts", "patch-openclaw-device-self-approval.ts"),
Expand Down
2 changes: 1 addition & 1 deletion test/issue-4434-error-fields.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ describe("full OpenClaw TUI error guard (#4434)", () => {
const review = fs.readFileSync(DEPENDENCY_REVIEW, "utf-8");
const vitestGuard = fs.readFileSync(LIVE_VITEST_GUARD, "utf-8");
expect(review).toContain("test/issue-4434-error-fields.test.ts");
expect(review).toContain("scripts/patch-openclaw-issue-4434-diagnostics.ts");
expect(review).toContain("scripts/patch-openclaw-issue-4434-diagnostics.mts");
expect(review).toContain("Issue #4434 full live acceptance");
expect(review).toContain("The #4434 compatibility-shim disposition is explicitly accepted");
expect(review).not.toContain("`PRA-5`");
Expand Down
8 changes: 4 additions & 4 deletions test/openclaw-dependency-review.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ const MESSAGING_BUILD_APPLIER = path.join(
const ISSUE_4434_PATCH = path.join(
REPO_ROOT,
"scripts",
"patch-openclaw-issue-4434-diagnostics.ts",
"patch-openclaw-issue-4434-diagnostics.mts",
);
const DEVICE_SELF_APPROVAL_PATCH = path.join(
REPO_ROOT,
Expand Down Expand Up @@ -217,7 +217,7 @@ describe("OpenClaw 2026.6.10 dependency review contract", () => {
expect(review).toContain("PR CI intentionally does not treat PR-authored harness code");
expect(review).toContain("applies the Dockerfile patch block");
expect(review).toContain("test/openclaw-issue-4434-diagnostics-patch.test.ts");
expect(review).toContain("scripts/patch-openclaw-issue-4434-diagnostics.ts");
expect(review).toContain("scripts/patch-openclaw-issue-4434-diagnostics.mts");
expect(review).toContain("scripts/patch-openclaw-device-self-approval.ts");
expect(review).toContain("NemoClaw no longer reads or writes device state during approval");
expect(review).toContain("Merge disposition for this OpenClaw 2026.6.10 bump");
Expand Down Expand Up @@ -411,8 +411,8 @@ check_not_contains "$optional_plugin_block" 'pack_reviewed_npm_tarball' "optiona
grep -Fq 'formatRawAssistantErrorForUi' "$issue_4434_patch"
grep -Fq 'OPENSHELL_SANDBOX !== "1"' "$issue_4434_patch"
grep -Fq 'nemoclaw: #4434 structured unreachable-inference diagnostic' "$issue_4434_patch"
grep -Fq 'COPY scripts/patch-openclaw-issue-4434-diagnostics.ts /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts' Dockerfile
grep -Fq 'node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts \\' Dockerfile
grep -Fq 'COPY scripts/patch-openclaw-issue-4434-diagnostics.mts /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.mts' Dockerfile
grep -Fq 'node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.mts \\' Dockerfile
grep -Fq 'COPY scripts/patch-openclaw-tool-catalog.mts /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts' Dockerfile
grep -Fq 'node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts \\' Dockerfile
! grep -Fq 'patch-openclaw-tool-catalog.js' Dockerfile
Expand Down
2 changes: 1 addition & 1 deletion test/openclaw-integrity-pin-suite.ts
Original file line number Diff line number Diff line change
Expand Up @@ -518,7 +518,7 @@ export function registerOpenClawIntegrityPinTests(group: OpenClawIntegrityPinTes
expect(reviewNote).toContain("claiming `openclaw-pipeline-runtime` inbound proof");
expect(reviewNote).toContain("imports `dist/extensions/telegram/test-api.js`");
expect(reviewNote).toContain("gateway/upstream reporting layer");
expect(reviewNote).toContain("scripts/patch-openclaw-issue-4434-diagnostics.ts");
expect(reviewNote).toContain("scripts/patch-openclaw-issue-4434-diagnostics.mts");
expect(reviewNote).toContain("scripts/patch-openclaw-device-self-approval.ts");
expect(reviewNote).toContain("approveDevicePairing");
expect(reviewNote).toContain(
Expand Down
4 changes: 2 additions & 2 deletions test/openclaw-issue-4434-diagnostics-patch.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ const PATCH_SCRIPT = path.join(
import.meta.dirname,
"..",
"scripts",
"patch-openclaw-issue-4434-diagnostics.ts",
"patch-openclaw-issue-4434-diagnostics.mts",
);

type Formatter = (raw: unknown) => string;
Expand Down Expand Up @@ -295,7 +295,7 @@ describe("OpenClaw diagnostics compatibility patch (#4434)", () => {
},
);
expect(result.status, `${result.stdout}${result.stderr}`).toBe(2);
expect(result.stderr).toContain("Usage: patch-openclaw-issue-4434-diagnostics.ts");
expect(result.stderr).toContain("Usage: patch-openclaw-issue-4434-diagnostics.mts");
} finally {
fs.rmSync(tmp, { recursive: true, force: true });
}
Expand Down
2 changes: 1 addition & 1 deletion test/openclaw-real-patched-dist-harness.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ const PATCH_OPENCLAW_CHAT_SEND = path.join(REPO_ROOT, "scripts", "patch-openclaw
const PATCH_OPENCLAW_ISSUE_4434_DIAGNOSTICS = path.join(
REPO_ROOT,
"scripts",
"patch-openclaw-issue-4434-diagnostics.ts",
"patch-openclaw-issue-4434-diagnostics.mts",
);
// Focused patch scripts also scan the full generated dist. APFS cold-cache
// reads can exceed one minute, so keep them bounded without using unit-fixture
Expand Down
4 changes: 2 additions & 2 deletions test/sandbox-build-context.test.ts
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,7 @@ describe("sandbox build context staging", () => {
writeFixture(path.join("scripts", "patch-openclaw-tool-catalog.mts"));
writeFixture(path.join("scripts", "patch-openclaw-chat-send.js"));
writeFixture(path.join("scripts", "patch-openclaw-mcp-npx.mts"));
writeFixture(path.join("scripts", "patch-openclaw-issue-4434-diagnostics.ts"));
writeFixture(path.join("scripts", "patch-openclaw-issue-4434-diagnostics.mts"));
writeFixture(path.join("scripts", "patch-openclaw-device-self-approval.ts"));
writeFixture(path.join("scripts", "verify-wechat-runtime-lock.mts"));
writeFixture(path.join("scripts", "lib", "reviewed-npm-archive.mts"));
Expand Down Expand Up @@ -373,7 +373,7 @@ describe("sandbox build context staging", () => {
true,
);
expect(
fs.existsSync(path.join(buildCtx, "scripts", "patch-openclaw-issue-4434-diagnostics.ts")),
fs.existsSync(path.join(buildCtx, "scripts", "patch-openclaw-issue-4434-diagnostics.mts")),
).toBe(true);
expect(
fs.existsSync(path.join(buildCtx, "scripts", "patch-openclaw-device-self-approval.ts")),
Expand Down
Loading