From a7ee38bc42582fef0d632c6cffe82bde2eb18d14 Mon Sep 17 00:00:00 2001
From: Dallin Romney <dallinromney@gmail.com>
Date: Thu, 20 Aug 2026 22:00:00 -0700
Subject: [PATCH] fix(release): preserve frozen ClawHub request contracts

---
 scripts/e2e/lib/package-compat.mjs          | 13 +++++++++++--
 scripts/e2e/lib/upgrade-survivor/run.sh     |  9 +++------
 scripts/e2e/upgrade-survivor-docker.sh      |  9 ++++++++-
 test/scripts/direct-run-entrypoints.test.ts | 12 ++++++++++++
 test/scripts/docker-build-helper.test.ts    | 14 +++++++++++---
 5 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/scripts/e2e/lib/package-compat.mjs b/scripts/e2e/lib/package-compat.mjs
index 141bcc6c1527..3f2abe51436e 100644
--- a/scripts/e2e/lib/package-compat.mjs
+++ b/scripts/e2e/lib/package-compat.mjs
@@ -9,6 +9,15 @@ export function legacyPackageAcceptanceCompat(version) {
   );
 }
 
-if (isDirectRunUrl(process.argv[1], import.meta.url)) {
-  console.log(legacyPackageAcceptanceCompat(process.argv[2]) ? "1" : "0");
+export function clawhubReleaseSecurityMode(version) {
+  // 2026.6.35 shipped before the ClawHub release-security endpoint existed.
+  return version === "2026.6.35" ? "absent" : "required";
+}
+
+if (isDirectRunUrl(process.argv[1], import.meta.url)) {
+  if (process.argv[2] === "--clawhub-release-security-mode") {
+    console.log(clawhubReleaseSecurityMode(process.argv[3]));
+  } else {
+    console.log(legacyPackageAcceptanceCompat(process.argv[2]) ? "1" : "0");
+  }
 }
diff --git a/scripts/e2e/lib/upgrade-survivor/run.sh b/scripts/e2e/lib/upgrade-survivor/run.sh
index b13f6b7461ec..915cb495d87d 100644
--- a/scripts/e2e/lib/upgrade-survivor/run.sh
+++ b/scripts/e2e/lib/upgrade-survivor/run.sh
@@ -1669,16 +1669,13 @@ phase prepare-update-restart-probe prepare_update_restart_probe
 phase configure-plugin-registry configure_plugin_registry
 phase update-candidate update_candidate
 if [ -n "${OPENCLAW_CLAWHUB_URL:-}" ]; then
-  clawhub_security_mode="required"
+  clawhub_security_mode="$(
+    node scripts/e2e/lib/package-compat.mjs --clawhub-release-security-mode "$candidate_version"
+  )"
   prepublish_package="@openclaw/whatsapp"
   if configured_plugin_installs_enabled; then
     prepublish_package="@openclaw/matrix"
   fi
-  # 2026.6.35 predates the release-security endpoint. The trusted fixture still
-  # asserts its exact older request contract instead of accepting arbitrary IO.
-  if [ "$candidate_version" = "2026.6.35" ]; then
-    clawhub_security_mode="absent"
-  fi
   phase assert-prepublish-requests node \
     "${OPENCLAW_UPGRADE_SURVIVOR_CLAWHUB_FIXTURE_SERVER:-scripts/e2e/lib/clawhub-fixture-server.cjs}" \
     assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "$prepublish_package" "$candidate_version" "$clawhub_security_mode"
diff --git a/scripts/e2e/upgrade-survivor-docker.sh b/scripts/e2e/upgrade-survivor-docker.sh
index 96d8d511220f..a7803017a1eb 100755
--- a/scripts/e2e/upgrade-survivor-docker.sh
+++ b/scripts/e2e/upgrade-survivor-docker.sh
@@ -503,6 +503,10 @@ node scripts/e2e/lib/upgrade-survivor/assertions.mjs seed
 openclaw_e2e_install_package "$OPENCLAW_UPGRADE_SURVIVOR_ARTIFACT_ROOT/install.log" "upgrade survivor package" "$npm_config_prefix"
 command -v openclaw >/dev/null
 package_version="$(node -p "JSON.parse(require(\"node:fs\").readFileSync(process.argv[1] + \"/lib/node_modules/openclaw/package.json\", \"utf8\")).version" "$npm_config_prefix")"
+candidate_version="$(
+  tar -xOf "${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" package/package.json |
+    node -e "let raw=[]; process.stdin.on(\"data\", (chunk) => raw.push(chunk)); process.stdin.on(\"end\", () => process.stdout.write(JSON.parse(Buffer.concat(raw)).version));"
+)"
 OPENCLAW_PACKAGE_ACCEPTANCE_LEGACY_COMPAT="$(
   node scripts/e2e/lib/package-compat.mjs "$package_version"
 )"
@@ -540,8 +544,11 @@ if [ "$update_status" -ne 0 ]; then
   exit "$update_status"
 fi
 if [ -n "${OPENCLAW_CLAWHUB_URL:-}" ]; then
+  clawhub_security_mode="$(
+    node scripts/e2e/lib/package-compat.mjs --clawhub-release-security-mode "$candidate_version"
+  )"
   node "$OPENCLAW_UPGRADE_SURVIVOR_CLAWHUB_FIXTURE_SERVER" \
-    assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$package_version"
+    assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$candidate_version" "$clawhub_security_mode"
 fi
 
 if [ "$UPDATE_RESTART_MODE" = "auto-auth" ]; then
diff --git a/test/scripts/direct-run-entrypoints.test.ts b/test/scripts/direct-run-entrypoints.test.ts
index 9c5510fd834a..7d9cdc160ba2 100644
--- a/test/scripts/direct-run-entrypoints.test.ts
+++ b/test/scripts/direct-run-entrypoints.test.ts
@@ -38,6 +38,18 @@ const EXECUTABLE_ENTRYPOINTS = [
     script: "scripts/e2e/lib/package-compat.mjs",
     status: 0,
   },
+  {
+    args: ["--clawhub-release-security-mode", "2026.6.35"],
+    output: "absent",
+    script: "scripts/e2e/lib/package-compat.mjs",
+    status: 0,
+  },
+  {
+    args: ["--clawhub-release-security-mode", "2026.8.1"],
+    output: "required",
+    script: "scripts/e2e/lib/package-compat.mjs",
+    status: 0,
+  },
   {
     args: [],
     output: "docker_e2e_count=",
diff --git a/test/scripts/docker-build-helper.test.ts b/test/scripts/docker-build-helper.test.ts
index 0de574b0512a..c88b9ef75047 100644
--- a/test/scripts/docker-build-helper.test.ts
+++ b/test/scripts/docker-build-helper.test.ts
@@ -2536,7 +2536,15 @@ docker_e2e_docker_run_cmd run demo
     expect(publishedRunner.indexOf("phase update-candidate update_candidate")).toBeLessThan(
       publishedRunner.indexOf("phase assert-prepublish-requests node"),
     );
-    expect(publishedRunner).toContain('if [ "$candidate_version" = "2026.6.35" ]; then');
+    expectTextToIncludeAll(runner, [
+      'tar -xOf "${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}" package/package.json',
+      '"${OPENCLAW_CURRENT_PACKAGE_TGZ:?missing OPENCLAW_CURRENT_PACKAGE_TGZ}"',
+      'package-compat.mjs --clawhub-release-security-mode "$candidate_version"',
+      'assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$candidate_version" "$clawhub_security_mode"',
+    ]);
+    expect(publishedRunner).toContain(
+      'package-compat.mjs --clawhub-release-security-mode "$candidate_version"',
+    );
     expect(publishedRunner).toContain('prepublish_package="@openclaw/whatsapp"');
     expect(publishedRunner).toContain("if configured_plugin_installs_enabled; then");
     expect(publishedRunner).toContain('prepublish_package="@openclaw/matrix"');
@@ -2557,12 +2565,12 @@ docker_e2e_docker_run_cmd run demo
     );
     expect(runner.indexOf('openclaw "${update_args[@]}"')).toBeLessThan(
       runner.indexOf(
-        'assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$package_version"',
+        'assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$candidate_version" "$clawhub_security_mode"',
       ),
     );
     expect(
       runner.indexOf(
-        'assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$package_version"',
+        'assert-prepublish-requests "$OPENCLAW_CLAWHUB_URL" "@openclaw/whatsapp" "$candidate_version" "$clawhub_security_mode"',
       ),
     ).toBeLessThan(runner.indexOf("openclaw doctor --fix --non-interactive"));
     expect(runner).toContain(