openclaw-safe-update - SKILL.md Agent Skill

name: openclaw-safe-update description: Safely verify and apply OpenClaw upgrades with isolated sidecar checks. Use when asked to update OpenClaw, verify a target version before upgrading, avoid global package pollution, or run a production-safe upgrade flow with verify-only default and explicit --apply. homepage: https://docs.openclaw.ai/install/updating metadata: { "openclaw": { "emoji": "🛡️", "requires": { "bins": ["openclaw", "node", "npm", "curl", "bash"] }, },

}

OpenClaw Safe Update

Verify first, upgrade second.

Workflow

Run verify-only (default):

bash scripts/openclaw-safe-update.sh

Optional target pin:

bash scripts/openclaw-safe-update.sh --target 2026.3.2

If verification fails, read the printed log path and report root cause.
If verification passes, ask for explicit confirmation.
Apply upgrade only after confirmation:

bash scripts/openclaw-safe-update.sh --apply

Critical behavior

--apply does not skip verification. It verifies first, then applies global upgrade only on success.
Default mode is verify-only.
Sidecar port is auto-selected from free ports starting at 18000.
Candidate installs are isolated in ~/.openclaw/versions/<version>.
Candidate retention keeps latest 3 directories by mtime (KEEP_VERSIONS, default 3).
Log file is a single rolling file: ~/.openclaw/logs/openclaw-sidecar-verify.log (overwritten per run).

Platform references

macOS (uname = Darwin) → references/macos.md
Linux (uname = Linux) → references/linux.md
Scheduled usage templates → references/cron-templates.md

Safety rules

Never run --apply without explicit user consent.
If verify fails, do not mutate global install.
If gateway restart fails after apply, report warning and request manual restart.