Greptile Summary

This PR completes the wiring of createOpenClawCodingTools into the /tools/invoke HTTP surface via resolveGatewayScopedTools. The previous review concerns — unintentional MCP loopback exposure and duplicate agentId resolution — are both addressed: coding tools are now gated behind surface === "http", and resolvedAgentId is computed once before both usages. The implementation, tests, and comments are clean.

Confidence Score: 5/5

Safe to merge — previous review concerns are addressed and no new P0/P1 issues remain.

Both prior concerns (MCP loopback exposure and duplicate agentId resolution) are fixed. The surface === 'http' guard is correct, dedup logic is sound, and all 24 tests pass. All remaining considerations are P2 or lower.

No files require special attention.

_{Reviews (2): Last reviewed commit: "feat(gateway): include coding tools in /..." | Re-trigger Greptile}

check-additional failure is pre-existing upstream lint debt unrelated to this PR:

lint:tmp:no-random-messaging — os.tmpdir() usage in extensions/active-memory, browser, memory-core, etc. (being addressed by #63902)
lint:tmp:channel-agnostic-boundaries — channel id literals in src/agents/acp-spawn.ts
lint:tmp:no-raw-channel-fetch — raw fetch() in extensions/browser/src/browser/client-fetch.ts
All three fail on the current upstream/main HEAD independently of this PR. This PR only touches src/gateway/tool-resolution.ts and src/gateway/tools-invoke-http.test.ts.

Codex review: needs maintainer review before merge.

Summary
The PR adds a raw coding-tool factory, wires core coding primitives into Gateway direct tool resolution, expands the HTTP deny list, and updates focused tests, docs, and changelog.

Reproducibility: yes. Source inspection on current main shows the Gateway resolver only materializes createOpenClawTools, so a direct invoke request for a coding primitive such as read has no core coding tool to resolve.

Next step before merge
No narrow automated repair remains; the next action is maintainer approval for the Gateway direct execution/data surface expansion and any RPC/docs scope decision.

Security
Cleared: No concrete security or supply-chain defect was found; the expanded direct-invoke surface stays behind Gateway auth, tool policy, hook checks, and default denies for mutating/RCE-capable coding tools.

Pivoted to Option A per the clawsweeper review — coding tools are now constructed via a new createOpenClawCodingToolsRaw factory that returns the same tools unwrapped (no wrapToolWithBeforeToolCallHook applied).

Rationale: handleToolsInvokeHttpRequest already calls runBeforeToolCallHook itself before dispatch (tools-invoke-http.ts:267), so the HTTP surface stays the single hook-execution site. No changes to wrapper internals, no adjusted-params drain needed in the HTTP handler.

Implementation (~170 lines, 4 files):

• pi-tools.before-tool-call.ts: new BEFORE_TOOL_CALL_ORIGINAL_TOOL symbol + unwrapToolBeforeToolCallHook() helper
• pi-tools.ts: new createOpenClawCodingToolsRaw() — calls existing factory, unwraps each tool
• tool-resolution.ts: imports raw factory, builds coding tools alongside gateway tools, dedup with gateway tools taking precedence; preserves surface === "http" loopback guard
• tools-invoke-http.test.ts: 5 new regression tests

Tests cover the bot's specific concerns:

• coding-tool availability when allowlisted
• single before_tool_call execution (no double-fire)
• no adjusted-params retained after invoke
• deny-list still blocks unallowlisted coding tools
• loopback non-expansion preserved

Local test results: 90/90 pass on tools-invoke-http.test.ts. Container smoke test: read and exec coding tools reachable via POST /tools/invoke with HTTP 200 from both host and inside a docker network peer.

Force-pushed feat/tools-invoke-coding-tools-upstream. The branch now contains a single commit on top of current upstream/main.

Addressed all 3 clawsweeper review findings (force-pushed).

[P1] Canonical mutating tools added to default HTTP deny list
src/security/dangerous-tools.ts — write, edit, process now deny-listed alongside the existing exec, apply_patch, fs_* entries. Operators must opt in via gateway.tools.allow to expose them.

[P2] Coding-tool construction gated to surface === "http"
src/gateway/tool-resolution.ts — surface is resolved before the construction call; createOpenClawCodingToolsRaw now returns [] for loopback. Loopback tool surface is unchanged. Verified with the existing mcp-http.test.ts suite (57/57 pass).

[P2] Unwrap path replaced with explicit skip flag
The bot was right that the symbol-based unwrap couldn't work for exec/process — applyDeferredFollowupToolDescriptions spreads them into new objects, dropping symbol-keyed metadata regardless of enumerability. Fixed by adding skipBeforeToolCallHook?: boolean to createOpenClawCodingTools's options. createOpenClawCodingToolsRaw now calls it with skipBeforeToolCallHook: true so wrap is never applied in the first place. The unwrapToolBeforeToolCallHook helper and BEFORE_TOOL_CALL_ORIGINAL_TOOL symbol were removed (no longer needed).

New regression tests:

• canonical mutating tools (write, edit, process) blocked by default — HTTP 404
• canonical mutating tools (write) allowed when gateway.tools.allow opts in — HTTP 200
• coding-tool mock now uses canonical names (read, write, edit, process) instead of read_file to exercise the real deny-list paths
• existing mcp-http.test.ts covers loopback non-expansion (no changes needed there since coding tools are now construction-gated)

Test results: 156/156 pass across tools-invoke-http.test.ts (29) + tools-invoke-http.cron-regression.test.ts (9) + mcp-http.test.ts (57) + their dependent suites.

Net diff: 5 files, +202 / -16 lines.

Re-review progress:

• State: Complete
• Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/25338116788
• Updated: 2026-05-04T19:17:33.878Z

Friendly ping — this PR has been ready for review for a few days now:

• ✅ All 3 clawsweeper review findings addressed (P1 deny-list expansion, P2 surface-gating, P2 unwrap mechanism via in-place flag)
• ✅ CI: 76/76 green, no failures
• ✅ Mergeable, no conflicts with current main
• ✅ Latest bot verdict is clawsweeper-verdict:needs-human (no findings)

@steipete — flagging you since you've recently maintained the gateway tool-resolution and tools-invoke surfaces (e.g. fix: keep core gateway tool invokes on shipped tools, refactor: type tool resolution paths, and the recent fix(gateway): invoke plugin-backed catalog tools). This PR is in the same area and uses the same surface-gating pattern (params.surface === "http").

Happy to address any further feedback. Thanks!

Addressed all clawsweeper review findings; current head is d5393cf6e8 (rebased onto current main to clear unrelated upstream check-dependencies drift on extensions/mattermost).

[P2] Plugin suppression — Added disablePluginTools flag to createOpenClawCodingTools that skips both the listChannelAgentTools(...) and createOpenClawTools(...) plugin spreads. createOpenClawCodingToolsRaw() always sets it, so the resolver's core-only intent is honored end-to-end.

[P2] Provider-gated tools — Added excludeProviderGatedTools flag that drops apply_patch at construction time (since /tools/invoke has no session-bound model context, allowlisting apply_patch would silently produce nothing). Documented this caveat in the deny-list entry.

[P3] Docs + changelog — Updated docs/gateway/tools-invoke-http-api.md to list process/write/edit in the deny list, added a "Coding tools available via HTTP" section explaining the surface, and added an Unreleased changelog entry.

Local tests on the private fork: 99/99 in tools-invoke-http.test.ts + cron-regression.test.ts pass. CI green on this branch (79/79).

Rebased onto current main (head edddb07f20); new SHA 427c102e03. Conflicts in pi-tools.ts (hook-wrap block + includeCoreTools interaction added by #74804) and CHANGELOG resolved with no semantic change from d5393cf6e8. Local: 65/65 pass on tools-invoke-http, cron-regression, mcp-http, and pi-tools.before-tool-call.embedded-mode. CI green (86 pass). Clawsweeper re-reviewed in-place against 427c102e03: needs-human, security cleared, no findings.

@steipete — bot lists you as primary reviewer; the only remaining gate per its summary is maintainer approval for exposing core coding primitives over authenticated HTTP. Concrete question: is the proposed surface acceptable in principle?

• read — default-allowed
• write / edit / exec / process — default-denied; require explicit opt-in via gateway.tools.allow
• apply_patch — excluded entirely (no session model context on this surface)

The PR is complete as-is and ready to merge if the answer is yes. If exec/process on HTTP feels like too much surface even with default-deny, I can split this into a read-only PR for immediate merge and follow up with the mutating tools in a separate PR — just let me know which path you'd prefer.