github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-06 14:21:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix NODE_EXTRA_CA_CERTS missing from LaunchAgent environment on macOS

Browse Source 
launchd services do not inherit the shell environment, so Node's undici/fetch
cannot locate the macOS system CA bundle (/etc/ssl/cert.pem). This causes TLS
verification failures for all HTTPS requests (e.g. Telegram, webhooks) when the
gateway runs as a LaunchAgent, while the same gateway works fine in a terminal.

Add NODE_EXTRA_CA_CERTS defaulting to /etc/ssl/cert.pem on macOS in both
buildServiceEnvironment and buildNodeServiceEnvironment. User-supplied
NODE_EXTRA_CA_CERTS is always respected and takes precedence.

Fixes #22856

Co-authored-by: Clawborn <tianrun.yang103@gmail.com>
This commit is contained in:
Clawborn
2026-02-22 04:42:20 +08:00
committed by Ayaan Zaidi
parent 7bbfb9de5e
commit d33f24c4e9
2 changed files with 48 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
src/daemon/service-env.test.ts
View File

@@ -328,6 +328,24 @@ describe("buildServiceEnvironment", () => {
expect(env.NO_PROXY).toBe("localhost,127.0.0.1");
expect(env.http_proxy).toBe("http://proxy.local:7890");
expect(env.all_proxy).toBe("socks5://proxy.local:1080");
it("defaults NODE_EXTRA_CA_CERTS to system cert bundle on macOS", () => {
const env = buildServiceEnvironment({
env: { HOME: "/home/user" },
port: 18789,
});
if (process.platform === "darwin") {
expect(env.NODE_EXTRA_CA_CERTS).toBe("/etc/ssl/cert.pem");
} else {
expect(env.NODE_EXTRA_CA_CERTS).toBeUndefined();
}
});
it("respects user-provided NODE_EXTRA_CA_CERTS over the default", () => {
const env = buildServiceEnvironment({
env: { HOME: "/home/user", NODE_EXTRA_CA_CERTS: "/custom/certs/ca.pem" },
port: 18789,
});
expect(env.NODE_EXTRA_CA_CERTS).toBe("/custom/certs/ca.pem");
});
});
@@ -365,6 +383,24 @@ describe("buildNodeServiceEnvironment", () => {
});
expect(env.TMPDIR).toBe(os.tmpdir());
});
it("defaults NODE_EXTRA_CA_CERTS to system cert bundle on macOS for node services", () => {
const env = buildNodeServiceEnvironment({
env: { HOME: "/home/user" },
});
if (process.platform === "darwin") {
expect(env.NODE_EXTRA_CA_CERTS).toBe("/etc/ssl/cert.pem");
} else {
expect(env.NODE_EXTRA_CA_CERTS).toBeUndefined();
}
});
it("respects user-provided NODE_EXTRA_CA_CERTS for node services", () => {
const env = buildNodeServiceEnvironment({
env: { HOME: "/home/user", NODE_EXTRA_CA_CERTS: "/custom/certs/ca.pem" },
});
expect(env.NODE_EXTRA_CA_CERTS).toBe("/custom/certs/ca.pem");
});
});
describe("resolveGatewayStateDir", () => {