Skip to content

Limit paired-device pairing actions to the caller device#69375

Merged
drobison00 merged 3 commits into
openclaw:mainfrom
eleqtrizit:fix/device-pair-ownership
Apr 20, 2026
Merged

Limit paired-device pairing actions to the caller device#69375
drobison00 merged 3 commits into
openclaw:mainfrom
eleqtrizit:fix/device-pair-ownership

Conversation

@eleqtrizit

@eleqtrizit eleqtrizit commented Apr 20, 2026

Copy link
Copy Markdown
Contributor

Summary

  • limit paired-device pairing visibility and approvals to the caller device for non-admin device sessions
  • preserve the existing global pairing behavior for admin and non-device operator sessions

Changes

  • scope device.pair.list results to the connected device when the caller is a non-admin paired-device session
  • reject cross-device device.pair.approve requests from non-admin paired-device sessions before approval is applied
  • add regression coverage for self-only list visibility, cross-device approval denial, and the existing scope-ceiling approval guard

Validation

  • Ran corepack pnpm test src/gateway/server-methods/devices.test.ts src/gateway/server.device-pair-approve-authz.test.ts
  • Ran corepack pnpm check:changed
  • Attempted claude -p "/review", but it timed out twice without returning output in this environment

Notes

  • Residual risk or follow-up: this change intentionally preserves current global pairing visibility for admin and non-device operator sessions to avoid broad compatibility changes

@eleqtrizit eleqtrizit requested a review from a team as a code owner April 20, 2026 15:36
@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: M maintainer Maintainer-authored PR labels Apr 20, 2026
@greptile-apps

greptile-apps Bot commented Apr 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Greptile Summary

This PR closes two lateral-movement gaps in the paired-device authorization model: non-admin device sessions can no longer see or act on other devices' pairing requests. device.pair.list is scoped to the caller's own device, and device.pair.approve/device.pair.reject reject cross-device requests before hitting infra. Existing admin and shared-auth (non-device-token) sessions are unaffected.

Confidence Score: 5/5

Safe to merge — the new guards are correctly scoped, the scope-ceiling check in approveDevicePairing still applies after the ownership check, and the TOCTOU window is benign (handled by the existing !approved path).

All findings are P2 or observational. The authorization logic is sound, device IDs are cryptographically verified at handshake time, and the test coverage spans unit tests for all new branches plus integration tests for the key attack scenarios.

No files require special attention.

Reviews (3): Last reviewed commit: "fix(pairing): close device authz review ..." | Re-trigger Greptile

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 20, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55391acdf7

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread src/gateway/server-methods/devices.ts
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Apr 20, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@eleqtrizit

eleqtrizit commented Apr 20, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@eleqtrizit

eleqtrizit commented Apr 20, 2026

Copy link
Copy Markdown
Contributor Author

@greptile review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Apr 20, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

@drobison00 drobison00 force-pushed the fix/device-pair-ownership branch from 4575c1b to 958887c Compare April 20, 2026 18:39
@drobison00 drobison00 force-pushed the fix/device-pair-ownership branch from 958887c to 7cf4f19 Compare April 20, 2026 18:47
@drobison00 drobison00 merged commit 5a12f30 into openclaw:main Apr 20, 2026
84 checks passed
@github-actions github-actions Bot mentioned this pull request Apr 20, 2026
Open
loongfay pushed a commit to YuanbaoTeam/openclaw that referenced this pull request Apr 21, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
dcdeae5 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
lovewanwan pushed a commit to lovewanwan/openclaw that referenced this pull request Apr 28, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
90172e5 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
1dbce21 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
@clawsweeper clawsweeper Bot mentioned this pull request May 3, 2026
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
7a98c92 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
globalcaos pushed a commit to globalcaos/tinkerclaw that referenced this pull request May 13, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
1eaf7ec 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
3901294 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@eleqtrizit @drobison00
Limit paired-device pairing actions to the caller device (openclaw#69375
2b422ae 
)

* fix(pairing): restrict paired-device pairing actions

* fix(pairing): close device authz review gaps

* docs(changelog): note device-pair scoping for non-admin paired devices (openclaw#69375)

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

gateway Gateway runtime maintainer Maintainer-authored PR size: L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eleqtrizit @drobison00