fix: update/sandbox-rebuild robustness — trap, hash gating, auto-repair

aaajiao · claude · aaajiao · commit de7ea4e87c19 · 2026-03-03T07:22:53.000+01:00
- Add EXIT trap in update.sh to restart Gateway if build fails mid-update
- Track all 3 sandbox build results; only save hash when ALL succeed
- Replace 30-line hardcoded auto-repair with refresh-mac-commands.sh call
- Add post-update refresh-mac-commands.sh to pick up wrapper changes
- Gate sandbox-rebuild.sh hash save on all builds succeeding
- Warn on openclaw-orbstack self-pull failure instead of silent || true
- Add 6 new i18n variables to both en.sh and zh-CN.sh

Co-Authored-By: Claude Opus 4.6 &lt;noreply@anthropic.com&gt;
diff --git a/lang/en.sh b/lang/en.sh
@@ -116,6 +116,11 @@ MSG_CMD_UPDATE_STARTING="  Starting service..."
 MSG_CMD_UPDATE_DONE="✅ Update complete!"
 MSG_CMD_UPDATE_SANDBOX_HINT="💡 To rebuild sandbox images: openclaw-update --sandbox"
 MSG_CMD_UPDATE_NPM_REINSTALL="npm missing, reinstalling Node.js package..."
+MSG_CMD_UPDATE_RECOVER="  ⚠ Build failed, restarting service with previous version..."
+MSG_CMD_UPDATE_SANDBOX_COMMON_FAIL="    ✗ common image build failed"
+MSG_CMD_UPDATE_SANDBOX_BROWSER_FAIL="    ✗ browser image build failed"
+MSG_CMD_UPDATE_SANDBOX_PARTIAL="  ⚠ Some sandbox images failed to build. Next update will retry."
+MSG_CMD_UPDATE_PULL_WARN="  ⚠ Failed to update openclaw-orbstack repo, using cached version"
 
 # openclaw-sandbox-rebuild
 MSG_CMD_REBUILD_START="🔨 Rebuilding sandbox Docker images..."
@@ -132,6 +137,7 @@ MSG_CMD_REBUILD_BROWSER_OK_DF="  ✓ sandbox-browser image built (Dockerfile)"
 MSG_CMD_REBUILD_BROWSER_FAIL="  ✗ sandbox-browser image build failed"
 MSG_CMD_REBUILD_DONE="✅ Sandbox image rebuild complete!"
 MSG_CMD_REBUILD_NOTE="💡 Running containers still use old images, run openclaw-restart to apply"
+MSG_CMD_REBUILD_PARTIAL="  ⚠ Some images failed. Hash not saved, next update will retry."
 
 # openclaw-telegram
 MSG_CMD_TG_ADD_USAGE="Usage: openclaw-telegram add <bot_token>"
diff --git a/lang/zh-CN.sh b/lang/zh-CN.sh
@@ -116,6 +116,11 @@ MSG_CMD_UPDATE_STARTING="  启动服务..."
 MSG_CMD_UPDATE_DONE="✅ 更新完成！"
 MSG_CMD_UPDATE_SANDBOX_HINT="💡 如需重建沙箱镜像: openclaw-update --sandbox"
 MSG_CMD_UPDATE_NPM_REINSTALL="npm 缺失，正在重新安装 Node.js 软件包..."
+MSG_CMD_UPDATE_RECOVER="  ⚠ 构建失败，正在使用上一版本重启服务..."
+MSG_CMD_UPDATE_SANDBOX_COMMON_FAIL="    ✗ common 镜像构建失败"
+MSG_CMD_UPDATE_SANDBOX_BROWSER_FAIL="    ✗ 浏览器镜像构建失败"
+MSG_CMD_UPDATE_SANDBOX_PARTIAL="  ⚠ 部分沙箱镜像构建失败，下次更新将重试。"
+MSG_CMD_UPDATE_PULL_WARN="  ⚠ 更新 openclaw-orbstack 仓库失败，使用缓存版本"
 
 # openclaw-sandbox-rebuild
 MSG_CMD_REBUILD_START="🔨 正在重建沙箱 Docker 镜像..."
@@ -132,6 +137,7 @@ MSG_CMD_REBUILD_BROWSER_OK_DF="  ✓ sandbox-browser 镜像构建完成 (Dockerf
 MSG_CMD_REBUILD_BROWSER_FAIL="  ✗ sandbox-browser 镜像构建失败"
 MSG_CMD_REBUILD_DONE="✅ 沙箱镜像重建完成！"
 MSG_CMD_REBUILD_NOTE="💡 已运行的容器仍使用旧镜像，运行 openclaw-restart 使新镜像生效"
+MSG_CMD_REBUILD_PARTIAL="  ⚠ 部分镜像构建失败，未保存哈希，下次更新将重试。"
 
 # openclaw-telegram
 MSG_CMD_TG_ADD_USAGE="用法: openclaw-telegram add <bot_token>"
diff --git a/scripts/commands/sandbox-rebuild.sh b/scripts/commands/sandbox-rebuild.sh
@@ -6,20 +6,23 @@
 source "$(dirname "$0")/_common.sh"
 
 echo "$MSG_CMD_REBUILD_START"
+REBUILD_OK=true
 
 echo "$MSG_CMD_REBUILD_BASE"
 if orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-setup.sh'" 2>/dev/null; then
     echo "$MSG_CMD_REBUILD_BASE_OK"
 elif orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c 'docker build -t openclaw-sandbox:bookworm-slim -f Dockerfile.sandbox .'" 2>/dev/null; then
     echo "$MSG_CMD_REBUILD_BASE_OK_DF"
 else
+    REBUILD_OK=false
     echo "$MSG_CMD_REBUILD_BASE_FAIL"
 fi
 
 echo "$MSG_CMD_REBUILD_COMMON"
 if orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-common-setup.sh'" 2>/dev/null; then
     echo "$MSG_CMD_REBUILD_COMMON_OK"
 else
+    REBUILD_OK=false
     echo "$MSG_CMD_REBUILD_COMMON_FAIL"
 fi
 
@@ -29,11 +32,16 @@ if orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts
 elif orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c 'docker build -t openclaw-sandbox-browser:bookworm-slim -f Dockerfile.sandbox-browser .'" 2>/dev/null; then
     echo "$MSG_CMD_REBUILD_BROWSER_OK_DF"
 else
+    REBUILD_OK=false
     echo "$MSG_CMD_REBUILD_BROWSER_FAIL"
 fi
 
-# Save new sandbox build hash
-orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && cat Dockerfile.sandbox Dockerfile.sandbox-browser scripts/sandbox-setup.sh scripts/sandbox-common-setup.sh scripts/sandbox-browser-setup.sh 2>/dev/null | sha256sum | cut -d' ' -f1 > ~/.openclaw/.sandbox-build-hash"
+# Save new sandbox build hash only if all builds succeeded
+if [ "$REBUILD_OK" = true ]; then
+    orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && cat Dockerfile.sandbox Dockerfile.sandbox-browser scripts/sandbox-setup.sh scripts/sandbox-common-setup.sh scripts/sandbox-browser-setup.sh 2>/dev/null | sha256sum | cut -d' ' -f1 > ~/.openclaw/.sandbox-build-hash"
+else
+    echo "$MSG_CMD_REBUILD_PARTIAL"
+fi
 
 echo ""
 echo "$MSG_CMD_REBUILD_DONE"
diff --git a/scripts/commands/update.sh b/scripts/commands/update.sh
@@ -32,38 +32,9 @@ if grep -q "systemctl status openclaw" ~/bin/openclaw-status 2>/dev/null; then
     orb -m "$OPENCLAW_VM_NAME" bash -lc "sudo rm -f /etc/systemd/system/openclaw.service && sudo systemctl daemon-reload"
     orb -m "$OPENCLAW_VM_NAME" bash -lc "sudo loginctl enable-linger \$(whoami)"
     orb -m "$OPENCLAW_VM_NAME" bash -lc "systemctl --user enable openclaw-gateway.service 2>/dev/null || true"
-    # Mac: fix stale commands
-    cat > ~/bin/openclaw-status << 'FIXEOF'
-#!/bin/bash
-set -e
-_VM="openclaw-vm"; [ -f "$HOME/bin/.openclaw-vm" ] && source "$HOME/bin/.openclaw-vm" && _VM="${OPENCLAW_VM:-$_VM}"
-orb -m "$_VM" bash -lc "openclaw gateway status"
-FIXEOF
-    cat > ~/bin/openclaw-logs << 'FIXEOF'
-#!/bin/bash
-set -e
-_VM="openclaw-vm"; [ -f "$HOME/bin/.openclaw-vm" ] && source "$HOME/bin/.openclaw-vm" && _VM="${OPENCLAW_VM:-$_VM}"
-orb -m "$_VM" bash -lc "openclaw logs --follow"
-FIXEOF
-    cat > ~/bin/openclaw-restart << 'FIXEOF'
-#!/bin/bash
-set -e
-_VM="openclaw-vm"; [ -f "$HOME/bin/.openclaw-vm" ] && source "$HOME/bin/.openclaw-vm" && _VM="${OPENCLAW_VM:-$_VM}"
-orb -m "$_VM" bash -lc "openclaw gateway restart"
-FIXEOF
-    cat > ~/bin/openclaw-stop << 'FIXEOF'
-#!/bin/bash
-set -e
-_VM="openclaw-vm"; [ -f "$HOME/bin/.openclaw-vm" ] && source "$HOME/bin/.openclaw-vm" && _VM="${OPENCLAW_VM:-$_VM}"
-orb -m "$_VM" bash -lc "openclaw gateway stop"
-FIXEOF
-    cat > ~/bin/openclaw-start << 'FIXEOF'
-#!/bin/bash
-set -e
-_VM="openclaw-vm"; [ -f "$HOME/bin/.openclaw-vm" ] && source "$HOME/bin/.openclaw-vm" && _VM="${OPENCLAW_VM:-$_VM}"
-orb -m "$_VM" bash -lc "openclaw gateway start"
-FIXEOF
-    chmod +x ~/bin/openclaw-status ~/bin/openclaw-logs ~/bin/openclaw-restart ~/bin/openclaw-stop ~/bin/openclaw-start
+    # Mac: regenerate all commands
+    OPENCLAW_LANG="$_OPENCLAW_LANG" OPENCLAW_VM_NAME="$OPENCLAW_VM_NAME" \
+        bash "$OPENCLAW_REPO_DIR/scripts/refresh-mac-commands.sh" 2>/dev/null || true
     echo "$MSG_UPDATE_AUTO_UPGRADE_DONE"
 fi
 
@@ -77,6 +48,11 @@ echo "$MSG_CMD_UPDATE_UPDATING"
 
 echo "$MSG_CMD_UPDATE_STOPPING"
 orb -m "$OPENCLAW_VM_NAME" bash -lc "openclaw gateway stop"
+GATEWAY_STOPPED=true
+trap 'if [ "$GATEWAY_STOPPED" = true ]; then
+    echo "$MSG_CMD_UPDATE_RECOVER"
+    orb -m "$OPENCLAW_VM_NAME" bash -lc "openclaw gateway start" 2>/dev/null || true
+fi' EXIT
 
 echo "$MSG_CMD_UPDATE_PULLING"
 orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && git fetch --tags --force"
@@ -121,25 +97,40 @@ fi
 
 if [ "$SANDBOX" = true ]; then
     echo "$MSG_CMD_UPDATE_SANDBOX_REBUILD"
-    SANDBOX_OK=false
+    SANDBOX_OK=true
     echo "$MSG_CMD_UPDATE_SANDBOX_BASE"
-    if orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-setup.sh'" 2>/dev/null; then
-        SANDBOX_OK=true
+    if ! orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-setup.sh'" 2>/dev/null; then
+        SANDBOX_OK=false
     fi
     echo "$MSG_CMD_UPDATE_SANDBOX_COMMON"
-    orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-common-setup.sh'" 2>/dev/null || true
+    if ! orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-common-setup.sh'" 2>/dev/null; then
+        echo "$MSG_CMD_UPDATE_SANDBOX_COMMON_FAIL"
+        SANDBOX_OK=false
+    fi
     echo "$MSG_CMD_UPDATE_SANDBOX_BROWSER"
-    orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-browser-setup.sh'" 2>/dev/null || true
+    if ! orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && sg docker -c './scripts/sandbox-browser-setup.sh'" 2>/dev/null; then
+        echo "$MSG_CMD_UPDATE_SANDBOX_BROWSER_FAIL"
+        SANDBOX_OK=false
+    fi
     echo "$MSG_CMD_UPDATE_SANDBOX_NOTE"
-    # Save new sandbox build hash only if base build succeeded
+    # Save new sandbox build hash only if all builds succeeded
     if [ "$SANDBOX_OK" = true ]; then
         orb -m "$OPENCLAW_VM_NAME" bash -lc "cd ~/openclaw && cat Dockerfile.sandbox Dockerfile.sandbox-browser scripts/sandbox-setup.sh scripts/sandbox-common-setup.sh scripts/sandbox-browser-setup.sh 2>/dev/null | sha256sum | cut -d' ' -f1 > ~/.openclaw/.sandbox-build-hash"
+    else
+        echo "$MSG_CMD_UPDATE_SANDBOX_PARTIAL"
     fi
 fi
 
+GATEWAY_STOPPED=false
+trap - EXIT
+
 echo "$MSG_CMD_UPDATE_STARTING"
 orb -m "$OPENCLAW_VM_NAME" bash -lc "openclaw gateway start"
 
+# Refresh Mac commands (picks up any wrapper changes)
+OPENCLAW_LANG="$_OPENCLAW_LANG" OPENCLAW_VM_NAME="$OPENCLAW_VM_NAME" \
+    bash "$OPENCLAW_REPO_DIR/scripts/refresh-mac-commands.sh" 2>/dev/null || true
+
 echo "$MSG_CMD_UPDATE_DONE"
 if [ "$SANDBOX" = false ]; then
     echo "$MSG_CMD_UPDATE_SANDBOX_HINT"
diff --git a/scripts/refresh-mac-commands.sh b/scripts/refresh-mac-commands.sh
@@ -156,7 +156,7 @@ if [ -z "$REPO" ] || [ ! -d "$REPO" ]; then
     exit 1
 fi
 # Self-update: pull latest openclaw-orbstack repo before executing
-cd "$REPO" && git pull -q 2>/dev/null || true
+cd "$REPO" && git pull -q 2>/dev/null || echo "⚠ Failed to update openclaw-orbstack repo, using cached version"
 exec bash "$REPO/scripts/commands/update.sh" "$@"
 CMDEOF
 
