fix(skill-install): refresh OpenClaw skills after update (Fixes #1911)

[deepujain]

fix(skill-install): refresh OpenClaw sessions after skill updates (Fixes #1911)

Summary

Fixes #1911.

OpenClaw was writing the updated SKILL.md into the sandbox, but nemoclaw <sandbox> skill install still skipped the session refresh on updates. That left the agent serving stale skill content for an existing session even though the on-disk skill had changed.

This change keeps the existing mirror step and always clears the OpenClaw session index after install or update so the next session reloads the latest skill content.

Changes

• src/nemoclaw.ts: stop telling post-install to skip the OpenClaw refresh on updates.
• src/lib/skill-install.ts: keep the mirror step and always clear sessions.json for OpenClaw installs unless a caller explicitly opts out.
• src/lib/skill-install.test.ts: add coverage that the OpenClaw post-install flow mirrors the skill and refreshes the session index.

Testing

• npm run build:cli
• npm run typecheck:cli
• npm test -- src/lib/skill-install.test.ts
• npm test

Evidence it works

• The new post-install test verifies that updating an OpenClaw skill now issues the session refresh command instead of leaving the old session index in place.
• The touched-path build and unit test pass locally.
• Full npm test still hits unrelated pre-existing suite failures in this environment, including:
  • test/install-preflight.test.ts
  • test/legacy-path-guard.test.ts
  • src/lib/preflight.test.ts
  • src/lib/sandbox-version.test.ts
  • test/security-c2-dockerfile-injection.test.ts

Signed-off-by: Deepak Jain deepujain@gmail.com

Summary by CodeRabbit

• Bug Fixes

  • Session data is now consistently refreshed after both skill installations and updates, preventing stale metadata.

• Improvements

  • Post-install commands for mirrored skills run more reliably and command execution is now pluggable for better flexibility and testing.

• Tests

  • Added test coverage for post-install behavior, verifying session refresh and mirror-related commands are executed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 55775c47-2733-47a3-a444-208135994dfb

📥 Commits

Reviewing files that changed from the base of the PR and between e31c80c and 3b19d71.

📒 Files selected for processing (3)

• src/lib/skill-install.test.ts
• src/lib/skill-install.ts
• src/nemoclaw.ts

✅ Files skipped from review due to trivial changes (2)

• src/nemoclaw.ts
• src/lib/skill-install.test.ts

---

📝 Walkthrough

Walkthrough

postInstall now accepts an injectable SSH executor and is invoked unconditionally after skill install, causing the session/index refresh to run for both fresh installs and updates; a new test exercises postInstall with a stubbed ssh executor validating mirror commands and session clearing.

Changes

Cohort / File(s)	Summary
Tests src/lib/skill-install.test.ts	Added a postInstall test that creates a temp SKILL.md, calls postInstall(...) with resolved skill paths and a stubbed sshExecImpl, asserts { success: true, messages: [] }, and verifies captured SSH commands mirror the skill and clear sessions.
Post-Install Implementation src/lib/skill-install.ts	Extended postInstall opts to include sshExecImpl; introduced runSsh = opts.sshExecImpl ?? sshExec and replaced internal sshExec(...) calls with runSsh(...) for mirror mkdir/cat and session-clear printf command.
CLI Integration src/nemoclaw.ts	sandboxSkillInstall now calls postInstall(ctx, paths, skillDir) unconditionally (removed { skipRefresh: isUpdate }), so the post-install refresh runs for both installs and updates.

Sequence Diagram(s)

sequenceDiagram
    rect rgba(200,230,255,0.5)
    participant CLI as Nemoclaw CLI
    participant PI as postInstall
    participant SSH as sshExec / sshExecImpl
    participant SBD as Sandbox (/.openclaw/skills, sessions.json)
    end

    CLI->>PI: call postInstall(ctx, paths, skillDir)
    PI->>SSH: runSsh("mkdir -p $HOME/.openclaw/skills/<skill>")
    SSH-->>SBD: create/mirror skill files
    PI->>SSH: runSsh("cat ... > $HOME/.openclaw/skills/<skill>/SKILL.md")
    SSH-->>SBD: write mirrored SKILL.md
    PI->>SSH: runSsh("printf '{}' > /sandbox/.openclaw-data/agents/main/sessions/sessions.json")
    SSH-->>SBD: overwrite sessions.json (clears agent sessions)
    PI-->>CLI: return { success: true, messages: [] }

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped in swift with tests and a plan,

Mirrored a skill with a careful command,
I cleared out sessions with a tiny puff,
Now agents read fresh — no cached fluff,
I twitched my nose and munched a carrot — job done! 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title clearly identifies the main change: refreshing OpenClaw skills after update, and references the fixed issue.
Linked Issues check	✅ Passed	The PR implementation directly addresses issue #1911 by ensuring OpenClaw session refresh always occurs on skill install/update to reload changed skill content.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the skill refresh issue: test coverage, session refresh logic, and SSH execution abstraction for testability.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[deepujain]

Added the missing docstring coverage cleanup on the touched skill-install entrypoint and reran the local checks. Build, CLI typecheck, and the skill-install test all pass here.

[wscurran]

✨
Possibly related open issues:

• #1911 [NemoClaw][All Platform] OpenClaw agent uses stale skill content after skill update via nemoclaw skill install

---

Possibly related open issues:

• #1911 [NemoClaw][All Platform] OpenClaw agent uses stale skill content after skill update via nemoclaw skill install

[deepujain]

Rebased this onto current main and reran the touched-path checks. Build, CLI typecheck, and the skill-install test still pass here.