Skip to content

fix(test): skip live auth browser caches#91907

Merged
steipete merged 2 commits into
openclaw:mainfrom
BryanTegomoh:bryan/fix-live-auth-cache-copy
Jul 6, 2026
Merged

fix(test): skip live auth browser caches#91907
steipete merged 2 commits into
openclaw:mainfrom
BryanTegomoh:bryan/fix-live-auth-cache-copy

Conversation

@BryanTegomoh

Copy link
Copy Markdown
Contributor

Summary

  • Prevent live test auth staging from copying generated browser profile, cache, and recording trees from external auth directories such as .gemini.
  • Preserve staged auth/config files, including .gemini/oauth_creds.json and .gemini/settings.json.
  • Keep the filter limited to external auth directory staging so .openclaw/credentials and plugin state copying are unchanged.

Linked context

Closes #91893

Related #91893

Was this requested by a maintainer or owner? No.

Real behavior proof (required for external PRs)

  • Behavior addressed: live test HOME staging no longer copies generated .gemini browser cache/profile/recording trees while preserving Gemini auth files.
  • Real environment tested: local macOS temp checkout with OPENCLAW_LIVE_TEST=1, using a temporary HOME containing .gemini auth files plus cache-like browser directories.
  • Exact steps or command run after this patch: node --import tsx --input-type=module with a temp HOME fixture, importing installTestEnv from test/test-env.ts, then checking the staged temp HOME.
  • Evidence after fix:
{
  "tempHomeDiffers": true,
  "copiedGeminiOauth": true,
  "copiedGeminiSettings": true,
  "skippedBrowserProfile": true,
  "skippedRecordings": true,
  "skippedGpuCache": true,
  "skippedServiceWorkerCache": true
}
  • Observed result after fix: the live test temp HOME kept Gemini auth files but did not stage the generated browser profile, recordings, GPU cache, or service worker cache trees.
  • What was not tested: a real multi-GB Antigravity profile was not copied or created.
  • Proof limitations or environment constraints: the proof uses small cache-shaped fixtures to avoid intentionally consuming disk space.
  • Before evidence: current origin/main has copyDirIfExists using recursive fs.cpSync with no filter for .gemini staging.

Tests and validation

  • node scripts/run-vitest.mjs test/test-env.test.ts passed, 4 tests.
  • pnpm exec oxfmt --check --threads=1 test/test-env.ts test/test-env.test.ts passed.
  • pnpm changed:lanes --json selected only tooling.
  • git diff --check passed.
  • OPENCLAW_CHECK_CHANGED_REMOTE_CHILD=1 OPENCLAW_CHANGED_LANES_RAW_SYNC=1 CI=1 PNPM_CONFIG_VERIFY_DEPS_BEFORE_RUN=false corepack pnpm check:changed passed.

Direct pnpm check:changed could not start because the local Crabbox binary failed its basic sanity check before running the gate.

Regression coverage adds .gemini auth files plus generated browser cache/profile fixtures to the existing live HOME staging test.

Risk checklist

Did user-visible behavior change? No.

Did config, environment, or migration behavior change? No.

Did security, auth, secrets, network, or tool execution behavior change? No.

What is the highest-risk area? Over-filtering live test auth staging.

How is that risk mitigated? The filter applies only to external auth directory staging and the regression test proves Gemini auth/settings files still copy.

Current review state

What is the next action? Maintainer review.

What is still waiting on author, maintainer, CI, or external proof? CI and ClawSweeper review.

Which bot or reviewer comments were addressed? None yet.

@openclaw-barnacle openclaw-barnacle Bot added size: S proof: supplied External PR includes structured after-fix real behavior proof. labels Jun 10, 2026
@clawsweeper

clawsweeper Bot commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 30, 2026, 5:03 PM ET / 21:03 UTC.

Summary
This branch adds a filter to live external-auth test staging that skips browser cache/profile directory segments and extends installTestEnv coverage for Gemini auth preservation.

PR surface: Tests +62. Total +62 across 2 files.

Reproducibility: yes. source-level. With OPENCLAW_LIVE_TEST=1, current main reaches stageLiveTestState, copies .gemini from LIVE_EXTERNAL_AUTH_DIRS, and uses recursive fs.cpSync without a filter; this read-only review did not recreate the multi-GB ENOSPC failure.

Review metrics: 1 noteworthy metric.

  • External auth roots filtered: 3 roots affected. The new filter is applied to every LIVE_EXTERNAL_AUTH_DIRS entry, so maintainers should review scope beyond the reported .gemini cache path.

Stored data model
Persistent data-model change detected: persistent cache schema: test/test-env.test.ts, persistent cache schema: test/test-env.ts, serialized state: test/test-env.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #91893
Summary: This PR is the active fix candidate for the canonical live-test external-auth staging ENOSPC issue; several same-root PR attempts are already closed unmerged.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Have a maintainer accept the all-external-auth-root filter scope or request a narrow .gemini-only adjustment before merge.

Risk before merge

  • [P1] The filter is applied to all three LIVE_EXTERNAL_AUTH_DIRS roots, so cache-named subtrees under .claude/backups or .minimax would stop staging if those ever contain meaningful auth state.
  • [P1] The supplied proof uses small cache-shaped fixtures rather than a real multi-GB Antigravity profile, which is reasonable for a deterministic path filter but leaves full disk-pressure behavior unmeasured.

Maintainer options:

  1. Accept The Scoped Live-Test Filter (recommended)
    Land after maintainers accept that browser-cache directory names are intentionally skipped under every live external-auth root during test staging.
  2. Narrow The Filter To Gemini
    If maintainers want no behavior change for .claude/backups and .minimax, adjust the call site so these exclusions apply only to .gemini.
  3. Pause For Large-Profile Proof
    If fixture proof is not enough, wait for redacted proof against a real large Antigravity profile without committing proof artifacts.

Next step before merge

  • [P2] No repair lane is needed because the actionable code is already in an open clean PR; the remaining action is maintainer scope review and merge-or-narrow judgment.

Security
Cleared: The diff only changes local test-home staging and regression fixtures; it adds no dependency, workflow, package, credential, permission, or supply-chain surface.

Review details

Best possible solution:

Land this scoped live-test staging filter after maintainer acceptance of the all-root scope, or narrow it to .gemini before merge if the fix should exactly target the reported provider state.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level. With OPENCLAW_LIVE_TEST=1, current main reaches stageLiveTestState, copies .gemini from LIVE_EXTERNAL_AUTH_DIRS, and uses recursive fs.cpSync without a filter; this read-only review did not recreate the multi-GB ENOSPC failure.

Is this the best way to solve the issue?

Yes, with one maintainer scope choice. The patch fixes the implicated live-test staging layer, preserves known auth/config files, leaves core runtime state copying alone, and can be narrowed to .gemini if maintainers want the smallest behavior change.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b885c81479d0.

Label changes

Label justifications:

  • P2: This fixes a real live-test infrastructure bug that can exhaust temp storage, but the blast radius is limited to maintainer and live-test workflows.
  • merge-risk: 🚨 automation: The diff changes live test-home staging behavior, which can affect maintainer live-test automation and is not fully settled by ordinary CI.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live-output JSON from a local macOS temp-HOME staging run showing Gemini auth files copied and browser cache/profile/recording trees skipped.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live-output JSON from a local macOS temp-HOME staging run showing Gemini auth files copied and browser cache/profile/recording trees skipped.
Evidence reviewed

PR surface:

Tests +62. Total +62 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 2 64 2 +62
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 64 2 +62

What I checked:

  • Current main still copies external auth directories without a filter: LIVE_EXTERNAL_AUTH_DIRS includes .gemini, and stageLiveTestState still calls copyDirIfExists for each external auth directory; copyDirIfExists uses recursive fs.cpSync with no filter on current main. (test/test-env.ts:253, b885c81479d0)
  • PR implementation scopes the new filter to live external-auth staging: The PR head adds LIVE_EXTERNAL_AUTH_EXCLUDED_DIRS, adds shouldStageLiveExternalAuthPath, passes the filter only from the LIVE_EXTERNAL_AUTH_DIRS loop, and leaves credentials/external-plugin/auth-profile copying unfiltered. (test/test-env.ts:20, b486b4cb2b2a)
  • Regression coverage matches the reported Gemini cache paths: The PR test fixture creates Gemini auth/config files plus Antigravity profile, browser recording, GPU cache, and Service Worker CacheStorage paths, then asserts auth/config files are staged and cache/profile paths are absent. (test/test-env.test.ts:135, b486b4cb2b2a)
  • Linked issue remains the canonical bug report: The linked issue reports OPENCLAW_LIVE_TEST staging recursively copying .gemini/antigravity-browser-profile and .gemini/antigravity/browser_recordings through copyDirIfExists, causing ENOSPC on machines with large Antigravity browser state; GitHub shows this PR as its open closing PR.
  • Latest release still has the unfixed implementation: Tag v2026.6.11 points at e085fa1a3ffd32d0ea6917e1e6fb4ecbffbb77d2 and still contains .gemini in LIVE_EXTERNAL_AUTH_DIRS plus unfiltered recursive copyDirIfExists; no release contains this PR head. (test/test-env.ts:11, e085fa1a3ffd)
  • Feature history provenance: 914becee5242 introduced isolated live-test HOME staging and the unfiltered helper; d56831f81b7d added .gemini to external auth staging; 1851aa7944d2 later added adjacent external-plugin staging in the same helper path. (test/test-env.ts, 914becee5242)

Likely related people:

  • steipete: Introduced isolated live-test HOME staging, added .gemini to live external-auth staging, and later added adjacent external-plugin staging in the same helper path. (role: feature owner and adjacent contributor; confidence: high; commits: 914becee5242, d56831f81b7d, 1851aa7944d2; files: test/test-env.ts, test/test-env.test.ts)
  • gumadeiras: Changed stale isolated state-dir handling in stageLiveTestState and updated the adjacent live environment test fixture. (role: recent adjacent contributor; confidence: medium; commits: 225d58b74aca; files: test/test-env.ts, test/test-env.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (1 earlier review cycle)
  • reviewed 2026-06-21T18:55:37.691Z sha b486b4c :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 10, 2026
@clawsweeper clawsweeper Bot added the P2 Normal backlog priority with limited blast radius. label Jun 15, 2026
@clawsweeper clawsweeper Bot added the merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. label Jun 19, 2026
@steipete steipete self-assigned this Jul 6, 2026
@steipete
steipete force-pushed the bryan/fix-live-auth-cache-copy branch from b486b4c to 65e7a5e Compare July 6, 2026 17:43
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Maintainer verification for 65e7a5e159d2383d7e913ef96ee0e87753d0e306 is complete. Thanks @BryanTegomoh — I kept your fix as the base, rebased it onto current main, and added one maintainer commit to tighten the ownership boundary.

What changed during review:

  • Scoped exclusions to exact .gemini generated-browser paths instead of dropping any Cache-named directory across Gemini, Claude, and MiniMax auth trees.
  • Added current Gemini CLI's generated .gemini/cli-browser-profile root.
  • Added regressions proving Gemini commands and MiniMax credentials under directories named Cache still stage normally.

Dependency contract checked directly against Gemini CLI 892b35fcfb6ab8e192e51c603583279c99e8b0a4: its storage API keeps credentials, OAuth tokens, settings, commands, skills, policies, and agents throughout .gemini, while its browser manager owns .gemini/cli-browser-profile. That makes an auth-file allowlist or generic cache-name filter functionality-breaking; exact generated-path exclusions are the narrow fix.

Proof:

  • Original exact head b486b4cb2b2: AWS Crabbox cbx_c461ee7e8a45, run_5bc87ff2aa03 — focused test passed 4/4.
  • Original exact head black-box behavior: AWS run_783ad50cebef — failed because .gemini/commands/Cache/review.toml was silently omitted, confirming the overbroad-filter regression.
  • Repaired exact head: AWS Crabbox cbx_dc70743ab658, run_dfbe387582e8pnpm test test/test-env.test.ts passed 5/5; black-box live-HOME staging preserved five auth/config cases byte-for-byte and excluded 320 MiB across all five generated browser trees.
  • Canonical oxfmt --check passed for both changed files; git diff --check passed.
  • Fresh local-repair and combined-branch autoreviews: clean, no accepted/actionable findings.
  • Repo-native hosted gate passed on the exact head: CI run 28811370479.

No remaining proof gaps. Land-ready.

@steipete
steipete merged commit e88f5ce into openclaw:main Jul 6, 2026
70 checks passed
@steipete

steipete commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65e7a5e159

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread test/test-env.ts
Comment on lines +452 to +456
const filter =
authDir === ".gemini"
? (entryPath: string) => shouldStageLiveGeminiPath(sourcePath, entryPath)
: undefined;
copyDirIfExists(sourcePath, path.join(params.tempHome, authDir), { filter });

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Apply Gemini cache filtering to Docker staging too

In Docker live contexts this filter never runs: google-gemini-cli still resolves to the whole .gemini auth dir in scripts/lib/live-docker-auth.sh:105-107, and the Docker harness copies that mounted dir with cp -R (for example scripts/test-live-gateway-models-docker.sh:142-145; cp --help documents -R as recursively copying directories). As a result, pnpm test:docker:live-gateway:gemini/default Docker live runs can still copy the same Antigravity browser profiles into the container or prestaged home and fill disk before Vitest reaches this local installTestEnv staging path.

Useful? React with 👍 / 👎.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 7, 2026
* fix(test): skip live auth browser caches

* fix(test): scope Gemini live auth exclusions

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
* fix(test): skip live auth browser caches

* fix(test): scope Gemini live auth exclusions

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 automation 🚨 May affect CI, automerge, proof capture, label sync, or maintainer automation. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test-env.ts: copyDirIfExists copies multi-GB browser cache causing ENOSPC in live tests

2 participants