OpenClaw Safe Update

提供 OpenClaw 升级的安全流程：先用隔离的候选安装与 sidecar 做只读校验，默认 verify-only，校验通过并获用户明确确认后才执行全局升级；失败时保留日志且不改动全局安装。按系统读取 macOS 或 Linux 指南，附带 Bash 脚本。

热度 69.32

最近更新 2026-05-11 17:28:38

分类：开发依赖：代码执行 / 读写文件 / 第三方 API应用场景：DevOps / 自动化脚本 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add openclaw-safe-update

Metadata

name: openclaw-safe-update
description: Safely verify and apply OpenClaw upgrades with isolated sidecar checks. Use when asked to update OpenClaw, verify a target version before upgrading, avoid global package pollution, or run a production-safe upgrade flow with verify-only default and explicit --apply.
homepage: https://docs.openclaw.ai/install/updating
metadata: {"openclaw":{"emoji":"🛡️","requires":{"bins":["openclaw","node","npm","curl","bash"]}}}

Run production-safe OpenClaw upgrades with isolation-first defaults.

Use bundled script: scripts/openclaw-safe-update.sh.
Run verify-only first (default):
- bash scripts/openclaw-safe-update.sh
- Optional target pin: --target <version>
- Port is auto-selected from free ports starting at 18000.
If verify fails, inspect log path printed by script and report the root cause.
If verify passes, ask whether to apply.
Apply only on explicit confirmation:
- bash scripts/openclaw-safe-update.sh --apply

Detect OS first, then read exactly one platform guide:

Default to verify-only; never apply without explicit user consent.
Keep candidate install isolated (npm --prefix ~/.openclaw/versions/<version>).
Keep sidecar isolated (--profile sidecar-verify, dedicated --port).
Preserve logs on failure and include path in status updates.
If verify fails, do not mutate global install.