# Openclaw Safe Update

> Safely verify and apply OpenClaw upgrades with isolated sidecar checks. Use when asked to update OpenClaw, verify a target version before upgrading, avoid global package pollution, or run a production-safe upgrade flow with verify-only default and explicit --apply.

- Skill: `dvcrn/openclaw-safe-update` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add dvcrn/openclaw-safe-update`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dvcrn/openclaw-safe-update/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: dvcrn (https://skillmd.com/u/dvcrn)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/dvcrn/openclaw-safe-update

---


# OpenClaw Safe Update

Run production-safe OpenClaw upgrades with isolation-first defaults.

## Workflow

1. Use bundled script: `scripts/openclaw-safe-update.sh`.
2. Run verify-only first (default):
   - `bash scripts/openclaw-safe-update.sh`
   - Optional target pin: `--target <version>`
   - Port is auto-selected from free ports starting at `18000`.
3. If verify fails, inspect log path printed by script and report the root cause.
4. If verify passes, ask whether to apply.
5. Apply only on explicit confirmation:
   - `bash scripts/openclaw-safe-update.sh --apply`

## Platform references

Detect OS first, then read exactly one platform guide:

- macOS (`uname` = `Darwin`) → `references/macos.md`
- Linux (`uname` = `Linux`) → `references/linux.md`

## Rules

- Default to verify-only; never apply without explicit user consent.
- Keep candidate install isolated (`npm --prefix ~/.openclaw/versions/<version>`).
- Keep sidecar isolated (`--profile sidecar-verify`, dedicated `--port`).
- Preserve logs on failure and include path in status updates.
- If verify fails, do not mutate global install.