OpenClaw Safe Update

这是生产安全的OpenClaw升级工具，核心是通过隔离sidecar检查验证升级包，默认仅验证，需显式确认或加--apply参数才应用；支持指定目标版本，自动分配空闲端口，验证失败留日志且不改动全局安装。适用于升级前验证版本、避免全局包污染、生产环境安全升级场景，输入为带可选参数的脚本命令，输出含验证状态、日志路径及操作提示。

ianchenx

热度 69.31

最近更新 2026-05-11 17:28:38

分类：自动化依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add openclaw-safe-update

Metadata

name: openclaw-safe-update
description: Safely verify and apply OpenClaw upgrades with isolated sidecar checks. Use when asked to update OpenClaw, verify a target version before upgrading, avoid global package pollution, or run a production-safe upgrade flow with verify-only default and explicit --apply.
homepage: https://docs.openclaw.ai/install/updating
metadata: {"openclaw":{"emoji":"🛡️","requires":{"bins":["openclaw","node","npm","curl","bash"]}}}

OpenClaw Safe Update

Run production-safe OpenClaw upgrades with isolation-first defaults.

Workflow

Use bundled script: scripts/openclaw-safe-update.sh.
Run verify-only first (default):
- bash scripts/openclaw-safe-update.sh
- Optional target pin: --target <version>
- Port is auto-selected from free ports starting at 18000.
If verify fails, inspect log path printed by script and report the root cause.
If verify passes, ask whether to apply.
Apply only on explicit confirmation:
- bash scripts/openclaw-safe-update.sh --apply

Platform references

Detect OS first, then read exactly one platform guide:

macOS (uname = Darwin) → references/macos.md
Linux (uname = Linux) → references/linux.md

Rules

Default to verify-only; never apply without explicit user consent.
Keep candidate install isolated (npm --prefix ~/.openclaw/versions/<version>).
Keep sidecar isolated (--profile sidecar-verify, dedicated --port).
Preserve logs on failure and include path in status updates.
If verify fails, do not mutate global install.