feat(claws): make openclaw update-ox.sh actually upgrade ox#600
Merged
Conversation
Co-Authored-By: SageOx <ox@sageox.ai> SageOx-Session: https://sageox.ai/repo/repo_019c5812-01e9-7b7d-b5b1-321c471c9777/sessions/2026-05-11T15-56-galexy-OxUeTL/view
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (2)
📝 WalkthroughWalkthroughBoth sageox-distill and sageox-summary pin ox to v0.7.2 (new checksums), refactor update-ox.sh to derive the pin from install-ox-curl.sh and auto-invoke the installer on version drift, and update SKILL.md/INSTALL.md to document the new behavior and exit codes. ChangesOx Auto-Upgrade Implementation
Sequence DiagramsequenceDiagram
participant Client as update-ox.sh
participant Installer as install-ox-curl.sh
participant Ox as $HOME/.local/bin/ox
Client->>Installer: read OX_INSTALL_REF
Client->>Ox: execute "ox version"
Ox-->>Client: returns version string
Client->>Client: compare installed vs pinned
alt match
Client->>Client: exit 0
else mismatch
Client->>Installer: invoke installer to upgrade/downgrade
alt installer succeeds
Client->>Client: exit 0
else installer fails
Client->>Client: exit 3
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@claws/openclaw/sageox-summary/scripts/update-ox.sh`:
- Around line 78-85: The skill_pin extraction can fail under set -euo pipefail
because grep returning non-zero will cause an early exit before the subsequent
empty-check; modify the extraction so the pipeline never returns a non-zero
status (e.g., append "|| true" to the grep pipeline or capture the pipeline with
a conditional assignment) when computing skill_pin from INSTALL_SCRIPT using the
OX_INSTALL_REF pattern, and keep the existing empty-check that echoes the error
and exits with code 2 (ensure the symbols skill_pin, INSTALL_SCRIPT and the
OX_INSTALL_REF pattern are used unchanged).
In `@claws/openclaw/sageox-summary/SKILL.md`:
- Around line 112-125: The "Stderr" contract in SKILL.md incorrectly asserts
failures are exactly two lines; update the Stderr bullet to say callers must
surface stderr verbatim (may be one or many lines) and remove the "two-line"
wording so it matches actual output from scripts like scripts/update-ox.sh
(which can emit single-line or multi-line stderr including command stderr). Edit
the Stderr bullet in SKILL.md to state: on any failure, surface the script's
stderr output verbatim (no assumption about line count) and, if helpful, call
out that callers should not trim or reformat the stderr before presenting it to
the user.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4ea08b68-70f2-40ea-98ae-e0257913b5df
📒 Files selected for processing (8)
claws/openclaw/sageox-distill/SKILL.mdclaws/openclaw/sageox-distill/references/INSTALL.mdclaws/openclaw/sageox-distill/scripts/install-ox-curl.shclaws/openclaw/sageox-distill/scripts/update-ox.shclaws/openclaw/sageox-summary/SKILL.mdclaws/openclaw/sageox-summary/references/INSTALL.mdclaws/openclaw/sageox-summary/scripts/install-ox-curl.shclaws/openclaw/sageox-summary/scripts/update-ox.sh
Co-Authored-By: SageOx <ox@sageox.ai> SageOx-Session: https://sageox.ai/repo/repo_019c5812-01e9-7b7d-b5b1-321c471c9777/sessions/2026-05-11T15-56-galexy-OxUeTL/view
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@claws/openclaw/sageox-distill/scripts/update-ox.sh`:
- Around line 25-27: The stderr contract comment in update-ox.sh is too
strict—change the header on/around the Stdout/Stderr block so it no longer
claims stderr is always a "one-line" signal; reword it to indicate stderr will
typically be a single-line diagnostic but may emit short multi-line messages
(e.g., on the failure paths around the code that currently emits multi-line
output at the blocks near lines referencing the install/upgrade failures and the
install-ox-curl.sh calls). Update the wording referencing install-ox-curl.sh so
tests/docs expect one-line or short multi-line diagnostics rather than a hard
single-line guarantee.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: eb58ede5-0d2a-4417-9ad5-5c00e1c07909
📒 Files selected for processing (4)
claws/openclaw/sageox-distill/SKILL.mdclaws/openclaw/sageox-distill/scripts/update-ox.shclaws/openclaw/sageox-summary/SKILL.mdclaws/openclaw/sageox-summary/scripts/update-ox.sh
🚧 Files skipped from review as they are similar to previous changes (3)
- claws/openclaw/sageox-summary/SKILL.md
- claws/openclaw/sageox-distill/SKILL.md
- claws/openclaw/sageox-summary/scripts/update-ox.sh
#600) Co-Authored-By: SageOx <ox@sageox.ai> SageOx-Session: https://sageox.ai/repo/repo_019c5812-01e9-7b7d-b5b1-321c471c9777/sessions/2026-05-11T15-56-galexy-OxUeTL/view
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
update-ox.shscript inclaws/openclaw/sageox-distillandclaws/openclaw/sageox-summarywas a misleadingly named readiness gate, not an updater. Its own header said so: "The curl install path has no per-run update — users re-run install-ox-curl.sh to bump the pinned release." It only verified the installed binary matched the version pin already recorded in~/.openclaw/memory/sageox-ox-install.json. As a result, after aclawhub installof a refreshed skill, users would either keep the stale install (state file matched) or get a hard exit2with a "run the install flow from references/INSTALL.md" hint — they had to manually re-enter the install flow to pick up the new pinned release.update-ox.shso the install actually catches up to the skill's pin on every run. The script now readsOX_INSTALL_REFfrom the siblinginstall-ox-curl.sh(the source of truth, with itsOX_INSTALL_REFand per-platform sha256s reviewed at skill publish), compares against the installed binary'sox version, and re-invokesinstall-ox-curl.shto upgrade in place when they differ. New exit code3covers "upgrade attempted butinstall-ox-curl.shfailed."v0.6.4(April release) tov0.7.2(the actual latest, May 4) with sha256 constants taken from the v0.7.2checksums.txtasset. Bumps skill versions:sageox-distill0.2.1 → 0.3.0,sageox-summary0.3.1 → 0.4.0. Updates SKILL.md andreferences/INSTALL.mdin both skills to describe the new install-and-update gate and new exit code.Motivation
The pin-then-publish supply-chain model stays intact — there's still no dynamic "latest" resolution from the internet, and an attacker still can't substitute a different binary without editing
install-ox-curl.sh(which is reviewed on skill publish). What changes is that drift between "skill ships a new pinned version" and "the installed binary catches up" closes automatically, instead of requiring the user to manually re-enter the install flow each time the skill bumpsOX_INSTALL_REF.What's in the change
scripts/install-ox-curl.shOX_INSTALL_REFv0.6.4→v0.7.2; all 5OX_SHA256_*constants replaced with values from v0.7.2checksums.txt.scripts/update-ox.shinstall-ox-curl.sh, re-runs it in place on drift. Adds exit3. Stays byte-identical between distill and summary.SKILL.mdox" describes the new gate, documents exit codes including the new3, drops the "no per-run auto-update" paragraph.references/INSTALL.mdox" section rewritten to describe the new auto-converge behavior.Flow
flowchart TD A[skill invokes bash scripts/update-ox.sh] --> B{state file exists?} B -- no --> X1[exit 2 — run install flow] B -- yes --> C{~/.local/bin/ox executable?} C -- no --> X1 C -- yes --> D{command -v ox resolves to pinned path?} D -- no --> X2[exit 2 — fix PATH] D -- yes --> E[read OX_INSTALL_REF from install-ox-curl.sh] E --> F[run ox version] F --> G{first line == 'ox skill_version'?} G -- yes --> Z0[exit 0 — already current] G -- no --> H[bash install-ox-curl.sh — upgrade in place] H --> I{install ok?} I -- yes --> Z0b[exit 0 — upgraded] I -- no --> X3[exit 3 — surface stderr]Test plan
bash -nsyntax-checked both rewrittenupdate-ox.shfiles.install-ox-curl.shproducesv0.7.2.diff -qconfirms scripts andINSTALL.mdstayed byte-identical across both skills.clawhub-skill-lintPASSED both skills (0 critical, 0 warnings, 0 info).~/.local/bin/oxat v0.6.4: confirmupdate-ox.shtriggers the in-place download and the state file rewrites to v0.7.2.~/.local/bin/ox: confirm exit2still kicks the user toreferences/INSTALL.md.Summary by CodeRabbit
New Features
Chores