Skip to content

Publish update manifest endpoint for manual update checker #46

Open

Description

@angnuoli

Background

PR #45 adds the MicroClaw Desktop client-side manual update checker in Settings > About. The client expects a public update manifest at:

https://microclaw.microsoftol.com/releases/latest.json

That remote endpoint is not available yet, so the checker currently fails safely with the "Could not check for updates" state until the web/CDN side is published.

Scope

  • Publish latest.json at the expected URL, or confirm the final manifest URL and update the client constant if it changes.
  • Point downloadUrl to the current release artifact, initially likely MicroClawInstaller.zip until a formal MicroClawSetup.exe exists.
  • Ensure the manifest is served as JSON over HTTPS.
  • Keep the manifest format compatible with the client validation in PR Add manual update checker #45.

Expected manifest shape

{
  "version": "1.0.1",
  "releasedAt": "2026-07-15",
  "downloadUrl": "https://microclaw.microsoftol.com/downloads/MicroClawInstaller.zip",
  "sha256": "<artifact sha256>",
  "openclawVersion": "2026.3.12",
  "releaseNotes": [
    "Add manual update checker"
  ]
}

Acceptance criteria

  • GET https://microclaw.microsoftol.com/releases/latest.json returns HTTP 200 with valid JSON.
  • version is a numeric dotted version string, for example 1.0.1.
  • downloadUrl is HTTPS and points to a downloadable release artifact.
  • MicroClaw Desktop Settings > About > Check for updates can show either "up to date" or "update available" instead of failing due to a missing endpoint.

Related

Activity

  1. angnuoli commented on Aug 19, 2026

    @angnuoli
    CollaboratorAuthor

    Implementation progress:

    • Client companion PR: Fix update manifest domain #215
      • switches UPDATE_MANIFEST_URL from the obsolete microclaw.microsoftol.com host to canonical microclaw.microsoft.com
      • targeted update-checker tests pass (8/8)
    • Web/deployment PR: https://github.com/angnuoli_microsoft/MicroClawWeb/pull/4
      • adds fail-closed manifest validation, Azure Web App deployment workflow, IIS web.config, and deployment documentation
      • rejects the stale aka.ms/MicroClaw-Installer target because it resolves to HTML
      • rejects SHA-256 mismatches and invalid Authenticode signatures

    Verified live status on 2026-08-19:

    • https://microclaw.microsoft.com/ -> Azure China Front Door HTTP 403 CONFIG_NOCACHE
    • https://microclaw.microsoft.com/releases/latest.json -> HTTP 403
    • legacy https://microclaw.microsoftol.com/releases/latest.json -> IIS HTTP 404

    Remaining external blockers before the issue's live acceptance criteria can pass:

    1. Enable a GitHub Actions runner for MicroClawWeb.
    2. Add AZURE_WEBAPP_PUBLISH_PROFILE.
    3. Publish a public, Authenticode-signed MicroClawSetup.exe release asset and update the manifest URL/SHA-256.
    4. Repair the Azure China Front Door route/origin/WAF configuration for microclaw.microsoft.com.

    The current Actions installer was not used because it is authenticated-only and unsigned. The deployment path remains fail-closed rather than publishing an invalid update manifest.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions