Upgrade OpenClaw to 2026.9.3

[Angnuo (angnuoli)]

Description

Upgrade MicroClaw's managed OpenClaw from 2026.8.2 to 2026.9.3, including required Node runtime changes and Windows Node/MXC approval compatibility.

Related Issue

N/A

Changes

• Pin OpenClaw to 2026.9.3; enforce >=24.16.0 <25 || >=26.1.0, recommend Node 26, and use 26.1.0 as the download fallback. Node 22 and 25 are no longer supported.
• Update installer/runtime selection, skip unsupported desktop Node candidates with diagnostics, and surface actionable startup failures.
• Share the PowerShell runtime gate across setup, build, and CI; bundle the helper with the standalone setup script.
• Pin the MXC approval preload to official 9.3 .mjs bundles and SHA-256 hashes, validating patch shapes before initialization without weakening fail-closed behavior.
• Advertise exec-approvals only with MXC enabled, fixing 9.3 approval requests expiring without delivery while preserving normal-mode behavior.
• Add runtime boundary, packaging, approval-capability, and optional official-package integration coverage; update installation documentation.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• CI/CD or build configuration change
• Refactoring (no functional changes)

Testing

• Tests pass locally (cd desktop && npm run test)
• Renderer tests pass locally (cd desktop/renderer && npm run test)
• Build succeeds (cd desktop && npm run build)
• Manual testing performed (describe below)

Targeted validation completed; full-suite and full-build boxes above are intentionally unchecked:

• 222 Python tests passed covering version/runtime gates, installer upgrades, backup/manifest handling, and setup-script copying.
• 233 desktop tests passed across 11 related files, including official-package integration cases. TypeScript compilation/no-emit checks and targeted lint/format checks passed.
• Installed official openclaw@2026.9.3 in an isolated temporary prefix using Node 24.18.0; both generated locked/active MXC configs passed upstream schema validation.
• Real Gateway startup with the approval preload, HTTP health, MicroClaw-signed protocol-4 handshake, and health, agents.list, sessions.list, channels.status, node.list RPCs succeeded.
• Reproduced missing approval delivery before the fix. A two-client RPC smoke then received exec.approval.requested, preserved executable path/hash, CWD, session and declared access, and successfully denied the request.
• Removed temporary Gateway processes, packages, and state; existing user installations and credentials were not modified.

Full packaged-app/MXC contained-command end-to-end execution was not rerun. Self-hosted CI needs supported Node. A pre-existing formatting discrepancy in main.ts was left untouched.

Checklist

• My code follows the coding guidelines of this project
• I have performed a self-review of my code
• I have commented my code where necessary
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or my feature works
• New and existing unit tests pass locally with my changes

The final checkbox refers to the targeted test selection described above.