`openclaw --update` rewrites to `openclaw update` (useful for shells and launcher scripts).

## See also

## Related

- `openclaw doctor` (offers to run update first on git checkouts)

- [Development channels](/install/development-channels)

5. In `remote` mode: seed once on create, then operate directly on the remote

workspace.

## See also

## Related

- [Sandboxing](/gateway/sandboxing) -- modes, scopes, and backend comparison

- [Sandbox vs Tool Policy vs Elevated](/gateway/sandbox-vs-tool-policy-vs-elevated) -- debugging blocked tools

In `"non-main"` mode, group/channel keys are _not_ main. Use the main session key (shown by `sandbox explain`) or switch mode to `"off"`.

## See also

## Related

- [Sandboxing](/gateway/sandboxing) -- full sandbox reference (modes, scopes, backends, images)

- [Multi-Agent Sandbox & Tools](/tools/multi-agent-sandbox-tools) -- per-agent overrides and precedence

For general help, see [Troubleshooting](/help/troubleshooting) and [FAQ](/help/faq).

</Tip>

## See also

## Related

<CardGroup cols={2}>

<Card title="Local models" href="/gateway/local-models" icon="server">

| `AcpRuntimeError: Permission prompt unavailable in non-interactive mode` | `permissionMode` blocks writes/exec in non-interactive ACP session. | Set `plugins.entries.acpx.config.permissionMode` to `approve-all` and restart gateway. See [Permission configuration](#permission-configuration). |

| ACP session fails early with little output | Permission prompts are blocked by `permissionMode`/`nonInteractivePermissions`. | Check gateway logs for `AcpRuntimeError`. For full permissions, set `permissionMode=approve-all`; for graceful degradation, set `nonInteractivePermissions=deny`. |

| ACP session stalls indefinitely after completing work | Harness process finished but ACP session did not report completion. | Monitor with `ps aux \| grep acpx`; kill stale processes manually. |

## Related

- [Sub-agents](/tools/subagents)

- [Multi-agent sandbox tools](/tools/multi-agent-sandbox-tools)

- [Agent send](/tools/agent-send)

"input": "*** Begin Patch\n*** Update File: src/index.ts\n@@\n-const foo = 1\n+const foo = 2\n*** End Patch"

}

```

## Related

- [Diffs](/tools/diffs)

- [Exec tool](/tools/exec)

- [Code execution](/tools/code-execution)

- Remote CDP profiles accept `http://`, `https://`, `ws://`, and `wss://`.

Use HTTP(S) for `/json/version` discovery, or WS(S) when your browser

service gives you a direct DevTools socket URL.

## Related

- [Browser](/tools/browser)

- [Browser login](/tools/browser-login)

- [Browser WSL2 troubleshooting](/tools/browser-wsl2-windows-remote-cdp-troubleshooting)

```

Or disable sandboxing for the agent that posts updates.

## Related

- [Browser](/tools/browser)

- [Browser Linux troubleshooting](/tools/browser-linux-troubleshooting)

- [Browser WSL2 troubleshooting](/tools/browser-wsl2-windows-remote-cdp-troubleshooting)

- verify the Windows Chrome endpoint locally first

- verify the same endpoint from WSL2 second

- only then debug OpenClaw config or Control UI auth

## Related

- [Browser](/tools/browser)

- [Browser login](/tools/browser-login)

- [Browser Linux troubleshooting](/tools/browser-linux-troubleshooting)

If a PR skips the capability layer and hardcodes vendor behavior into a

channel/tool, send it back and define the contract first.

## Related

- [Plugin](/tools/plugin)

- [Creating skills](/tools/creating-skills)

- [Tools and plugins](/tools)