fix(ios): read IDEProvisioningTeamByIdentifier by fetzig · Pull Request #41284 · openclaw/openclaw

fetzig · 2026-03-09T16:59:19Z

UPDATE: created this PR while trying out the openclaw iOS app. Everything worked out of the box except of scripts/ios-team-id.sh. So I thought this tiny fix might be of use. Reg. agents feedback about tests: Didn't wrote tests that execute python code since there were no existing ones that do that.

Summary

Problem: scripts/ios-team-id.sh only read IDEProvisioningTeams and legacy fallbacks. On my local Xcode prefs, the team list is stored under IDEProvisioningTeamByIdentifier, so team lookup failed.
Why it matters: scripts/ios-configure-signing.sh then exits with WARN: Unable to detect an Apple Team ID; keeping existing iOS signing override (if any).
What changed: parse exported Xcode prefs for both IDEProvisioningTeamByIdentifier and IDEProvisioningTeams, and add test coverage for the identifier-key layout.
What did NOT change (scope boundary): team selection preference order and the existing provisioning-profile / keychain fallbacks.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related fix(ios): support Xcode 16+ team detection and fix ntohl build error #22773

User-visible / Behavior Changes

scripts/ios-team-id.sh now resolves team IDs from Xcode prefs that store teams under IDEProvisioningTeamByIdentifier.
scripts/ios-configure-signing.sh now succeeds on that prefs layout instead of warning and leaving signing unchanged.

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) No
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: macOS
Runtime/container: local shell
Model/provider: N/A
Integration/channel (if any): N/A
Relevant config (redacted): IOS_PYTHON_BIN=/usr/bin/python3 for deterministic local repro

Steps

Save the pre-change scripts/ios-team-id.sh and scripts/ios-configure-signing.sh from HEAD to a temp directory and run IOS_PYTHON_BIN=/usr/bin/python3 .../ios-configure-signing.sh.
Run IOS_PYTHON_BIN=/usr/bin/python3 scripts/ios-team-id.sh from this branch.
Run IOS_PYTHON_BIN=/usr/bin/python3 scripts/ios-configure-signing.sh from this branch.
Run pnpm exec vitest test/scripts/ios-team-id.test.ts.

Expected

Before the fix, the old helper should fail to resolve a team ID on this Xcode prefs layout.
After the fix, the helper should print the selected Team ID and signing configuration should succeed.
The regression test should pass.

Actual

Before: WARN: Unable to detect an Apple Team ID; keeping existing iOS signing override (if any).
After scripts/ios-team-id.sh: 2FD7P95TP8
After scripts/ios-configure-signing.sh: iOS signing config already up to date: team=2FD7P95TP8 app=ai.openclaw.ios.test.klem-2fd7p95tp8
Test: pnpm exec vitest test/scripts/ios-team-id.test.ts

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios:
- Local Xcode prefs contain IDEProvisioningTeamByIdentifier with valid teams.
- The pre-change helper fails on that prefs layout.
- The patched helper returns 2FD7P95TP8 on the same machine.
- scripts/ios-configure-signing.sh succeeds with the patched helper.
- pnpm exec vitest test/scripts/ios-team-id.test.ts passes.
Edge cases checked:
- Existing team de-duplication stays in place via the unchanged append_team logic.
What you did not verify:
- Physical-device build/install after this script-only change.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) No
Migration needed? (Yes/No) No
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert this PR or set IOS_DEVELOPMENT_TEAM explicitly.
Files/config to restore: scripts/ios-team-id.sh
Known bad symptoms reviewers should watch for: scripts/ios-team-id.sh prints no team ID on a machine where IDEProvisioningTeamByIdentifier is populated.

Risks and Mitigations

Risk: parsing both Xcode prefs keys could surface duplicate team entries.
- Mitigation: append_team already de-duplicates by Team ID before selection.

greptile-apps · 2026-03-09T17:03:37Z

Greptile Summary

This PR fixes scripts/ios-team-id.sh to also read team data stored under the IDEProvisioningTeamByIdentifier key in Xcode preferences, which is written by recent Xcode versions. Without this fix, the signing-configuration script silently fell back to a no-op warning when only this key was populated.

Key changes:

A new parsing block in load_teams_from_xcode_preferences calls defaults export com.apple.dt.Xcode and uses Python's plistlib to extract teams from both IDEProvisioningTeamByIdentifier and IDEProvisioningTeams in a single pass, with an early return if any teams are found (skipping the older plutil fallback).
Error cases (empty output, malformed plist, missing Python) are handled gracefully via SystemExit(0) in the Python snippet; tabs in team names are sanitised; deduplication is left to the existing append_team helper.
The test suite introduces a dedicated guidanceHomeDir fixture to preserve the guidance-message test, since the shared defaults mock now correctly emits IDEProvisioningTeamByIdentifier plist data.
The smoke test's expected output changes from AAAAA11111 to BBBBB22222 because AAAAA11111 is now correctly marked as a free provisioning team, making BBBBB22222 the preferred non-free team.

The implementation is safe, backward-compatible, and has been manually verified by the author on their local Xcode setup.

Confidence Score: 5/5

Safe to merge — the change is additive, backward-compatible, and all error paths are properly handled.
The implementation is correct and complete. The Python parsing logic properly handles both plist keys with comprehensive error handling. All edge cases (empty input, malformed plist, missing Python, tab characters) are handled gracefully. The fallback chain is preserved. The change has been manually verified by the author and passes all tests. No security or compatibility concerns.
No files require special attention.

_{Last reviewed commit: d62773c}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 274fe3b86e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58272c3a59

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-19T21:53:25Z

  it("resolves a fallback team ID from Xcode team listings (smoke)", async () => {
    const fallbackResult = runScript(sharedHomeDir, { IOS_PYTHON_BIN: sharedFakePythonPath });


Exercise the real Xcode plist parser in this smoke test

In this test setup IOS_PYTHON_BIN points at sharedFakePythonPath, which is a shell stub that prints canned team rows and ignores the -c '…' program passed by scripts/ios-team-id.sh. That means load_teams_from_xcode_preferences() never executes the new inline Python that parses defaults export / IDEProvisioningTeamByIdentifier, so syntax errors or data-shape regressions in the actual fix still leave this test green. Because this commit’s only behavior change lives in that parser, the test is currently a false positive rather than coverage for the new path.

Useful? React with 👍 / 👎.

openclaw-barnacle · 2026-04-26T04:36:16Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

clawsweeper · 2026-04-27T10:46:05Z

Thanks for the context here. I did a careful shell check against current main, and the useful part of this older PR is already implemented there.

Current main already contains the useful iOS signing fix: scripts/ios-team-id.sh now reads IDEProvisioningTeamByIdentifier directly and has regression coverage, so this older PR branch is no longer the right landing path.

So I’m closing this older PR as already covered on main rather than keeping a mostly-duplicated branch open.

Review details

Best possible solution:

Keep the current main implementation and open a fresh narrow issue or PR only if a distinct Xcode preference layout still fails there.

Do we have a high-confidence way to reproduce the issue?

No current-main failure was reproduced. Source and test inspection show current main reads IDEProvisioningTeamByIdentifier, while the PR body provides credible before/after macOS output for the original stale-branch behavior.

Is this the best way to solve the issue?

No, merging this branch is no longer the best way to solve the issue. Current main has a narrower per-key parser plus regression coverage, and the remaining branch diff is an obsolete alternate rewrite of the same helper.

Security review:

Security review cleared: No concrete security or supply-chain concern found; the diff only changes local Xcode preference parsing and tests.

AGENTS.md: found and applied where relevant.

What I checked:

Current main source reads the identifier-key layout: Current main factors Xcode preference parsing through load_teams_from_xcode_team_key and calls it for both IDEProvisioningTeamByIdentifier and IDEProvisioningTeams. (scripts/ios-team-id.sh:100, 6aa83374d90d)
Current main regression test covers the requested layout: The current test suite stubs plutil -extract IDEProvisioningTeamByIdentifier and requires scripts/ios-team-id.sh --require-canonical to resolve the canonical team ID. (test/scripts/ios-team-id.test.ts:269, 6aa83374d90d)
Caller behavior matches the reported warning path: scripts/ios-configure-signing.sh delegates team detection to scripts/ios-team-id.sh and emits the reported warning only when the helper cannot resolve a team ID. (scripts/ios-configure-signing.sh:35, 59950f7b5266)
Git history provenance for current-main implementation: Blame on the current parser and test lines points to the current-main proof commit that contains the exact identifier-key parser and regression coverage now present in the checkout. (scripts/ios-team-id.sh:100, 6da2d6ac5a0d)
Related merged Xcode 16 signing work: The related merged PR covered the broader Xcode 16 team-detection failure with managed-profile fallback and actionable guidance, so this PR remains useful context but not the landing path. (scripts/ios-team-id.sh:154, 069c56cd759a)
Current-main-only release provenance: No tag contains the current-main proof SHA, and latest release v2026.6.6 still lacks the exact IDEProvisioningTeamByIdentifier parser, so the direct-key implementation is current-main-only. (6da2d6ac5a0d)

Likely related people:

Vincent Koc: Current blame attributes the exact IDEProvisioningTeamByIdentifier parser and regression test now on main to this proof commit. (role: current-main proof author; confidence: medium; commits: 6da2d6ac5a0d; files: scripts/ios-team-id.sh, test/scripts/ios-team-id.test.ts)
brianleach: Authored the merged Xcode 16 team-detection PR that added managed-profile fallback and actionable signing guidance for the same failure area. (role: Xcode 16 fallback contributor; confidence: high; commits: 73f526f025af, 069c56cd759a; files: scripts/ios-team-id.sh, test/scripts/ios-team-id.test.ts)
steipete: Hardened the iOS team-id fallback and tests in the merged Xcode 16 signing work and appears in the older helper history. (role: recent area contributor; confidence: high; commits: fd07861bc3d2, b9d80aa53597; files: scripts/ios-team-id.sh, test/scripts/ios-team-id.test.ts)
ngutman: Introduced the broader local signing auto-selection flow that owns the helper/caller behavior this PR touches. (role: adjacent feature owner; confidence: medium; commits: 98962ed81d26; files: scripts/ios-team-id.sh, scripts/ios-configure-signing.sh)

Codex review notes: model internal, reasoning high; reviewed against 6aa83374d90d; fix evidence: commit 6da2d6ac5a0d, main fix timestamp 2026-06-16T04:59:05+02:00.

clawsweeper · 2026-05-20T03:25:22Z

ClawSweeper PR egg

🔥 Warming up: real-behavior proof passed; findings, security review, or rank-up moves are still in progress.

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

openclaw-barnacle · 2026-06-08T04:59:07Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

openclaw-clownfish · 2026-06-15T12:08:55Z

Thanks @fetzig for sending this and for documenting the IDEProvisioningTeamByIdentifier case. Clownfish is closing this as superseded by the already-merged canonical fix in #22773: #22773

#22773 covered the Xcode 16+ iOS team-detection path in scripts/ios-team-id.sh with tests, and it has already landed on main. This PR remains useful context for that same signing failure, so the source PR and your report stay linked here for attribution: #41284

If this still reproduces on current main with a distinct IDEProvisioningTeamByIdentifier-only setup after #22773, please reply with the repro details and maintainers can reopen or split a focused follow-up.

vincentkoc · 2026-06-16T07:24:49Z

Thanks @fetzig for sending this and for documenting the IDEProvisioningTeamByIdentifier case. Clownfish is closing this as already covered by the merged canonical fix in #22773: #22773

#22773 covered the Xcode 16+ iOS team-detection path in scripts/ios-team-id.sh with tests, and it has already landed on main. This PR remains useful context for the same signing failure, so your source PR stays linked here for attribution: #41284

If this still reproduces on current main with a distinct IDEProvisioningTeamByIdentifier-only setup after #22773, please reply with the repro details and maintainers can reopen or split a focused follow-up.

openclaw-barnacle Bot added scripts Repository scripts size: S labels Mar 9, 2026

fetzig force-pushed the fix/ios-team-id-by-identifier branch from d62773c to 92f342a Compare March 10, 2026 08:39

chatgpt-codex-connector Bot reviewed Mar 19, 2026

View reviewed changes

Comment thread scripts/ios-team-id.sh Outdated

fetzig force-pushed the fix/ios-team-id-by-identifier branch from 274fe3b to 58272c3 Compare March 19, 2026 21:48

chatgpt-codex-connector Bot reviewed Mar 19, 2026

View reviewed changes

fetzig force-pushed the fix/ios-team-id-by-identifier branch from 58272c3 to 4cbd397 Compare March 19, 2026 21:54

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Apr 26, 2026

fix(ios): read Xcode team IDs from preferences

ce370a2

fetzig force-pushed the fix/ios-team-id-by-identifier branch from 4cbd397 to ce370a2 Compare April 27, 2026 14:57

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Apr 28, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026

openclaw-barnacle Bot added triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. labels May 10, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 10, 2026

clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. and removed proof: sufficient ClawSweeper judged the real behavior proof convincing. labels May 10, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 11, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 12, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 12, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026