Address ClawSweeper P1 (Carry the effective git channel into finalize):
an unconfigured git/source update runs the core update on the git/dev channel
(runGatewayUpdate: opts.channel ?? "dev"), but the finalizer received no channel
and fell back to the stable package channel, so plugin convergence could resolve
official plugins on the wrong channel.
Mirror the CLI post-core resume's effective/requested channel split: the RPC
finalize path now passes the effective channel (configChannel ?? DEFAULT_GIT_CHANNEL)
to update finalize via OPENCLAW_UPDATE_EFFECTIVE_CHANNEL (convergence-only), never
as --channel. update finalize uses it as a convergence fallback but never persists
update.channel unless the user actually requested one.
Codex follow-up: defaulting the channel to dev and passing --channel made
update finalize persist update.channel into openclaw.json (persistRequestedUpdateChannel
treats any --channel as an explicit request). Only forward --channel when the
caller has a configured channel so the finalizer never writes a channel the user
did not request; when omitted it converges on the stored/default channel and the
reconcile still resolves a host-compatible version. Keeps the per-step vs
whole-process timeout decoupling.
Address codex PR-review findings:
- Default the post-core finalize channel to the git/dev channel (matching
runGatewayUpdate's git default) instead of letting update finalize fall back to
the stable package channel, so official plugins converge on the same channel as
the core update for default source updates.
- Decouple the finalizer's whole-process spawn timeout from the per-step
--timeout so a valid multi-step finalize is not killed prematurely and falsely
reported as post-core-plugin-finalize-failed.
- Strip gateway service identity (OPENCLAW_SERVICE_MARKER/KIND/PID) from the
finalizer child so it is not mistaken for the managed service, matching the
CLI post-core spawn.
- Skip finalize for no-op git updates (unchanged SHA and version), mirroring the
CLI resume gate, to avoid an unnecessary doctor/convergence run.
The gateway update.run RPC updated git/source installs via runGatewayUpdate
but, unlike the openclaw update CLI, never resumed the post-core plugin
convergence that runGatewayUpdate's doctor pass defers. As a result a
git/source core update would restart on the new core with official managed
plugins still pinned to versions built against removed core APIs.
Spawn the rebuilt binary's update finalize entrypoint after a successful
git update so official plugins reconcile to a host-compatible version, and
block the restart if convergence fails (mirroring the CLI).
Peter Steinberger