MacNodeHostWorker launches `openclaw node worker` under ManagedProcess, which
owns the child by process group (SIGTERM -pgid, 250 ms, SIGKILL -pgid). The
CLI startup respawn re-executes the real worker with detached: true (setsid),
so the app only ever owned the respawn wrapper. When the worker did not exit
on the forwarded SIGTERM, the app's SIGKILL escalation killed the wrapper and
orphaned the worker together with its codex app-server child.
Set OPENCLAW_NO_RESPAWN=1 on the worker launch, matching the gateway's own
node-worker supervisor, so the worker stays in the owned group. The package
proof harness uses the same launch shape so requireProcessTreeExit proves
the real worker exited, not only the wrapper.
Co-authored-by: Colton Harris <287090614+opspot-business@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Pair packaged apps with complete private arm64 and x86_64 workers whose full build identity matches the app. Preserve independently managed Gateways and complete recognized native-first state through the canonical initializer. Verify emitted-SDK filesystem calls, native capabilities, readiness and shutdown before app publication.
Derive elevation payloads without modifying canonical installed inputs. Preserve universal slices, resources and contained links; reject incomplete, malformed, escaping or mismatched payloads. Reuse descriptor-bound native inventory for signing while retaining the portable installer's independent distribution contract and every Foundation identity, entitlement, notarization and architecture gate.
Use the existing pinned-pnpm package path, including Corepack-only builders, and avoid recursive app-glob expansion. Centralize Mac CI ownership. Carry invocation-owned Git lock cleanup into main's canonical Git owner and regenerate its workflow projection, retaining lifetime fencing and pre-existing/junction-linked locks.
Fix the Android refresh race exposed by CI by removing the redundant reconnect after connect already replaces each role's socket. Preserve authentication, scopes and physical connection leases, with a controlled real-WebSocket regression.
Closes#131459
