Repository navigation
fix: open the Hub when private desktop shell services are unavailable - #1783
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
clawsweeper
Bot
added
clawsweeper:intake:bug
|
Codex review: needs maintainer review before merge. What this changesThis PR allows Hub startup without unsupported desktop shell services and cleans up accessibility fixtures when window discovery fails. Example: Launch Companion on a private Windows desktop where tray construction throws NotImplementedException.
Review scores
ProductKind: Bug fix · Worth it: Yes · Fix scope: Complete Merge readiness✅ Ready for maintainer review This PR fixes a startup failure still present on current main; the new runtime evidence resolves the previous proof request, and no introduced correctness or security defect was found. Priority: P2 Before mergeNone. FindingsNone. Tests
Agent review detailsHow this fits togetherApp initializes WindowManager's hidden runtime anchor and TrayController before opening the requested Hub; the accessibility fixture launches an isolated executable and navigates it through the existing activation path. flowchart TD
A[Application launch] --> B[Hidden runtime anchor]
B --> C[Optional tray construction]
C --> D[Unsupported shell warning]
C --> E[Requested Hub]
D --> E
E --> F[Navigation and UI Automation]
Technical reviewBest possible solution: Retain the narrow fixes in WindowManager and TrayController, with the existing native lifecycle and fixture-cleanup coverage. Do we have a high-confidence way to reproduce the issue? Current main performs both shell-dependent operations before opening the requested Hub, and the contributor's exact-head runtime log demonstrates the unsupported tray condition; this review did not execute current main. Is this the best way to solve the issue? The patch removes an unnecessary shell operation and handles the specific optional-tray failure at its existing owner while preserving other startup failures and shutdown ownership. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 20fddaf66846. Provenance checked
TestingProof path: shipped entry point. SecurityNone. EvidenceWhat I checked:
Likely related people:
LabelsLabel changes:
Label justifications:
Rating scale6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior. WorkflowClawSweeper edits this one comment on every review. Comment HistoryReviewed October 21, 2026, 5:33 PM ET / 21:33 UTC (Revision 3). |
Extract the independently reviewed reliability seam without the held native timeout consumer. No change to executor releases, package pins or sandbox enforcement.
8c37263 to
5657804
Compare
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
clawsweeper:intake:bug
|
@clawsweeper re-review |
|
🦞👀 Re-review progress:
|
clawsweeper
Bot
added
proof: sufficient
shanselman
added
the
status: 🚢 actively landing
shanselman
removed
the
status: 🚢 actively landing
What Problem This Solves
Fixes: the Hub never opens when optional shell services are unavailable on a private desktop.
User Impact
User impact: the requested Hub can open even when its optional tray icon is unavailable. The expected unsupported-desktop exception is a warning rather than a fatal-crash marker. Current-head hosted review passed the readiness gate.
Why This Change Was Made
Keep the never-activated lifetime anchor independent of shell-switcher registration. Handle only the unsupported optional tray-construction case; other failures remain visible. Failed fixture construction cleans up its own child and temporary profile. The rebased tests exercise WindowManager lifecycle rather than matching implementation text.
Evidence
Current independent head:
e16d2f9f4070f91aa1da4958c712c0c0ab80436b, based on public main2b7cfce17bb496ec5d8f0c563fb71ebb46e015fa. Published Microsoft.Mxc.Sdk 1.0.0 references are unchanged. No unpublished native changes or pin updates.Current-head CI: 9 successful checks, no failed or pending checks at the 2026-10-21 refresh. The real UI job passed. This does not turn configured skips into proof.
Real-process isolated proof exercised Hub startup, failed-construction cleanup, the hidden runtime anchor and a Gateway-fixture conversation. The actual recovered optional TrayIcon exception previously reached
LogCrash, making the unchanged final no-crash guard fail. Current source logs WARN; the same real-app fixture path and original guard passed. No assertion, screenshot threshold or timeout was relaxed.Local source review of the warning refinement found no blocking source finding; it is not a hosted verdict. Historical installed Hub402 at combined
63a8130977fa091647226b553857f418d9d7007dcompleted normal onboarding, live operator/paired-node connections, authenticated MCP and coordinator chat. That combined observation is not standalone private-desktop shell-failure proof. Private installed screenshots are not published here.Change Type
Scope
winnodeRequired proof pools
windows-winui-interactive: five selected real owned-process startup, runtime-anchor and fixture cases passed on an isolated desktop. This is functional UIA/process proof, not pixel/compositor proof or qualification of the entire pool.Validation
Final independent source was frozen before commit and verified byte-identical afterward. Tray/native tests ran on task-owned private desktops with isolated roots and verified quiet/WER/native-completion receipts. No installed-state changes.
.\build.ps1dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restoredotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restoredotnet test .\tests\OpenClaw.Tray.UITests\OpenClaw.Tray.UITests.csproj --no-build --no-restore -r win-x64 --filter "FullyQualifiedName~AccessibilityFixtureStartupTests|FullyQualifiedName~WindowManagerRuntimeAnchorTests|FullyQualifiedName~GatewayFixtureUiTests.HistoricalFractionalVoiceConversationRendersWithoutLoadingPlaceholder"UI project built with
-r win-x64 -p:Platform=x64 -p:DevBuild=false. The table escapes filter pipes for Markdown; pass ordinary|characters to dotnet.An earlier proof-controller run produced no managed result and remains a failure. Subsequent runs retained the desktop-creating launcher until native exit and verified native and managed completion. Historical combined63a build/Shared4,685+25skips/privateTray4,469 results remain combined only.
Real Behavior Proof
e16d2f9f4070f91aa1da4958c712c0c0ab80436b.{"Total":5,"Executed":5,"Passed":5,"Failed":0,"Unexecuted":0,"ExitCode":0,"DesktopCreatorRetainedUntilNativeExit":true,"NativeExitReceiptVerified":true}N/Afor local private evidence. The current-head hosted UI log above is public; local TRX, app logs and native ownership receipts are retained, not represented as publicly fetchable.Inspectable runtime log and app readback, 2026-10-21
This is new actual runtime evidence, rebuilt and executed at exact current
head
e16d2f9f4070f91aa1da4958c712c0c0ab80436b, not a restatement of test counts.The normal source-built executable ran on an owned private desktop with an
isolated profile and synthetic loopback Gateway. No installed app or Gateway
was used. These excerpts omit profile paths, endpoint addresses and all auth
fields.
Copied from the running application's
openclaw-tray.log(local UTC-07):The first line is the actual unsupported shell condition, not an injected
exception. Foreground activation was declined on the non-input desktop and is
not concealed. The Hub remained responsive; the app's authenticated local
navigation went to Chat, the native UIA scenario selected the historical
fixture conversation, and the live app response after navigation was:
{ "appProcessId": 41016, "appProcessStartUtc": "2026-10-21T20:49:54.8265783Z", "appResponding": true, "appStatus": { "connectionStatus": "Connected", "overallState": "Ready", "operatorState": "Connected", "nodeState": "Disabled", "gatewayVersion": "fixture-1", "sessionCount": 6 }, "chatSnapshot": { "requestedThreadId": "agent:main:fixture-voice", "selectedTimeline": {"historyLoaded": true} }, "outcome": "passed", "recordedAt": "2026-10-21T13:50:08.428554-07:00" }The JSON above is a field-selected transcription of genuine
run.jsonandfractional-voice-snapshot.jsonfrom this one app process. It is not an exampleschema or mounted in-process page. The native UIA callback also verified the
final history sentinel and absence of
Loading messages...; its unchangedno-crash-marker guard passed. This is navigation/UIA/readback proof, not pixels,
foreground activation or real-provider proof.
Binary provenance from that same run:
The controller verified clean exact source and unchanged executable hashes,
one executed/passed native app scenario, zero skips, quiet startup/WER and
original native-handle completion. The original app process was absent after
the run. No screenshot is claimed, and the synthetic Gateway's Ready status
does not imply real node pairing or containment.
Security Impact
NoNoNoNoNoYes, explain the risk and mitigation: N/A. Optional shell support does not weaken execution or approval policy.Compatibility and Migration
YesNoNoReview Conversations
Current-head hosted review passed: Overall platinum hermit (4/6), Proof platinum hermit (4/6), Patch diamond lobster (5/6). No merge is authorized.