fix(gateway): share approval runtime socket token by fuller-stack-dev · Pull Request #87105 · openclaw/openclaw

fuller-stack-dev · 2026-05-27T01:31:56Z

Summary

Use the existing exec-approvals.json socket token as the approval-runtime token when it exists, so Docker/CLI/separate-process approval clients sharing OPENCLAW_HOME can authenticate as the local approval runtime.
Keep the process-local random token as the fallback when no shared socket token exists, without creating exec-approvals.json just to read a token.
Keep approvalRuntimeToken attached only for generated local gateway URL sources, including the existing gateway.mode=remote with missing gateway.remote.url fallback-local path.
Omit approvalRuntimeToken for env, explicit, and configured remote URL sources even when the host is loopback; those approval calls use stable requester device identity instead.

Scope split

Split out from fix: repair local approval resolution #86771.
This PR is only shared approval-runtime token selection for Docker/CLI/separate-process approval clients sharing OpenClaw state.
It does not include stale Discord button UX or the approval.routeNotice.send gateway method.

Real behavior proof

Behavior addressed: A separate approval-runtime process sharing OPENCLAW_HOME can authenticate with the existing exec-approvals.json socket token and resolve a requester-bound approval. Env/configured remote gateway URL sources omit approvalRuntimeToken and cannot resolve requester-bound approvals without normal owner visibility/runtime authority. Env-selected approval request/wait calls keep requester identity. Remote mode without gateway.remote.url keeps the existing fallback-local approval-runtime behavior.

Real environment tested: Current PR head a89cfa1c4234771e0336fa2b5722f20b1f3ed43b was tested on Blacksmith Testbox through Crabbox, provider blacksmith-testbox, id tbx_01ktkpn7ebxk5nr9tz74qwe5vc, Actions run 27140908325. Earlier live two-process smoke proof covered the shared-OPENCLAW_HOME runtime handoff on head 1ef8400457; the current-head delta is the fallback-local target classification fix and its focused regression proof.

Exact steps or command run after this patch: node scripts/crabbox-wrapper.mjs run --provider blacksmith-testbox --blacksmith-org openclaw --blacksmith-workflow .github/workflows/ci-check-testbox.yml --blacksmith-job check --blacksmith-ref main --idle-timeout 90m --ttl 240m --timing-json -- corepack pnpm test src/agents/tools/gateway.test.ts src/gateway/operator-approval-runtime-token.test.ts src/gateway/operator-approvals-client.test.ts src/gateway/server/ws-connection/message-handler.post-connect-health.test.ts -- --reporter=dot

Evidence after fix:

provider=blacksmith-testbox id=tbx_01ktkpn7ebxk5nr9tz74qwe5vc sync=delegated auth=blacksmith
GitHub Actions run: https://github.com/openclaw/openclaw/actions/runs/27140908325
[test] starting test/vitest/vitest.gateway.config.ts
Test Files 11 passed (11)
Tests 113 passed (113)
[test] starting test/vitest/vitest.agents.config.ts
Test Files 1 passed (1)
Tests 29 passed (29)
[test] passed 2 Vitest shards in 17.12s
blacksmith run summary sync=delegated command=1m5.014s total=1m15.223s exit=0

Observed result after fix: The current-head focused proof covers shared-token derivation, approval-client token omission/preservation rules, server-side remote locality rejection, and the agent-tool fallback-local regression. The new regression asserts gateway.mode=remote without gateway.remote.url keeps approvalRuntimeToken and does not switch to requester deviceIdentity.

What was not tested: No Docker Compose smoke was run. The earlier live two-process smoke used two Node processes on one host sharing OPENCLAW_HOME; the current-head proof reran the affected gateway and agent shards on Testbox after the fallback-local fix.

Tests and validation

node scripts/run-vitest.mjs src/agents/tools/gateway.test.ts --reporter=dot — passed; 1 file, 29 tests.
node_modules/.bin/oxfmt --check src/agents/tools/gateway.ts src/agents/tools/gateway.test.ts — passed.
git diff --check — passed.
Testbox-through-Crabbox focused proof above — passed; 2 shards, 142 tests.
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main — clean; no accepted/actionable findings.

Risk checklist

Did user-visible behavior change? Yes

Did config, environment, or migration behavior change? No

Did security, auth, secrets, network, or tool execution behavior change? Yes

Highest-risk area: approval-runtime authentication for local approval clients sharing OpenClaw state.

Mitigation: Shared-token selection only reads an existing socket token; it does not create the shared file. The approval client attaches the runtime token only for generated local/fallback gateway URL sources; env, explicit, and configured remote URL sources omit it. Env-selected and configured-remote approval calls use stable requester device identity instead of runtime authority, and fail before opening a gateway connection if that identity cannot be loaded.

clawsweeper · 2026-05-27T01:34:44Z

Codex review: needs maintainer review before merge. Reviewed June 8, 2026, 9:41 AM ET / 13:41 UTC.

Summary
The PR derives local approval-runtime auth from an existing exec-approvals socket token, restricts runtime-token attachment to generated local/fallback gateway sources, uses requester device identity for remote approval calls, and adds gateway/agent regression tests.

PR surface: Source +89, Tests +330. Total +419 across 8 files.

Reproducibility: yes. from source inspection: current main only creates a process-local random approval-runtime token, so a separate process sharing OPENCLAW_HOME cannot derive the same token. I did not run a live repro in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Maintainers should explicitly accept or reject the shared exec-approvals-token runtime-authority model before merge.
Run an exact Docker/shared-volume smoke only if the team wants deployment-topology proof beyond the Testbox and earlier two-process evidence.

Risk before merge

[P1] Merging intentionally broadens approval-runtime authority from same-process memory to local or separate processes that can read the existing exec-approvals socket token and connect through an accepted local gateway path.
[P1] Env-selected and configured-remote approval RPCs now depend on a stable persisted device identity; read-only, damaged, or invalid state directories can fail before opening the gateway connection.
[P1] The current-head proof covers Testbox gateway/agent shards and earlier two-process shared-home smoke, but it does not include an exact Docker Compose/shared-volume smoke for the deployment class named in the PR body.

Maintainer options:

Accept the guarded shared-runtime boundary (recommended)
If maintainers agree that local readers of the existing exec-approvals socket token may act as the approval runtime, merge after normal branch and CI gates stay green.
Require exact Docker shared-volume proof
Ask for one Docker or equivalent shared-OPENCLAW_HOME smoke if maintainers need proof of the named deployment topology before accepting the boundary.
Pause if the trust model is too broad
If shared exec-approvals token possession is not an acceptable runtime-authority signal, pause this PR and redesign the local approval-runtime credential contract.

Next step before merge

No automated repair is needed; the remaining action is maintainer acceptance of the security-boundary and compatibility tradeoff plus normal merge gates.

Security
Cleared: No concrete security defect was found in the diff; the remaining security question is the intentional local shared-token boundary decision.

Review details

Best possible solution:

Land this only after maintainers accept the shared local-token trust boundary and compatibility behavior, keeping runtime authority limited to generated local/fallback gateway sources with the current regression coverage.

Do we have a high-confidence way to reproduce the issue?

Yes, from source inspection: current main only creates a process-local random approval-runtime token, so a separate process sharing OPENCLAW_HOME cannot derive the same token. I did not run a live repro in this read-only review.

Is this the best way to solve the issue?

Yes, this looks like the best bounded implementation if maintainers accept the trust model: the PR derives a scoped token instead of sending the raw socket token, rejects remote locality on the server, and keeps env/configured remote paths on requester identity.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9a82b60024b5.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies current-head Testbox-through-Crabbox terminal proof for a89cfa1 and documents the earlier two-process shared-home smoke.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body supplies current-head Testbox-through-Crabbox terminal proof for a89cfa1 and documents the earlier two-process shared-home smoke.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P2: The PR fixes a bounded gateway approval workflow, but it changes security-sensitive runtime auth behavior rather than an urgent broken core runtime.
merge-risk: 🚨 compatibility: Remote/env approval calls can now fail early when a stable persisted requester device identity cannot be loaded.
merge-risk: 🚨 security-boundary: The PR deliberately expands approval-runtime authority to local/separate processes that can read the existing exec-approvals socket token.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body supplies current-head Testbox-through-Crabbox terminal proof for a89cfa1 and documents the earlier two-process shared-home smoke.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body supplies current-head Testbox-through-Crabbox terminal proof for a89cfa1 and documents the earlier two-process shared-home smoke.

Evidence reviewed

PR surface:

Source +89, Tests +330. Total +419 across 8 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	4	138	49	+89
Tests	4	337	7	+330
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	8	475	56	+419

What I checked:

Repository policy read: Root AGENTS.md and scoped src/agents, src/agents/tools, and src/gateway AGENTS.md were read; gateway auth, fallback behavior, and security-boundary guidance affected the merge-risk review. (AGENTS.md:14, 9a82b60024b5)
Current main behavior: Current main's approval-runtime token is module-local random process state, so a separate process sharing OPENCLAW_HOME cannot derive the same runtime token from source alone. (src/gateway/operator-approval-runtime-token.ts:10, 9a82b60024b5)
Shared-token implementation: The PR reads the existing exec-approvals socket token, derives an HMAC-scoped approval runtime token, and keeps a process-local fallback when no shared token exists. (src/gateway/operator-approval-runtime-token.ts:16, a89cfa1c4234)
Agent gateway boundary: The PR classifies env-selected and configured-remote approval calls as remote, withholds approvalRuntimeToken outside local targets, and supplies persisted requester device identity for remote approval methods. (src/agents/tools/gateway.ts:111, a89cfa1c4234)
Server-side remote rejection: The PR prevents a valid approvalRuntimeToken from marking remote websocket clients as the trusted approval runtime. (src/gateway/server/ws-connection/message-handler.ts:1727, a89cfa1c4234)
Regression coverage: PR tests cover shared-token derivation, env/configured remote token omission, remote device identity failures, fallback-local token preservation, and remote-client runtime-token rejection. (src/agents/tools/gateway.test.ts:367, a89cfa1c4234)

Likely related people:

shakkernerd: Member review identified the env-loopback and fallback-local boundary issues, and the latest PR commits implement the security-boundary and fallback-local fixes. (role: recent reviewer and follow-up owner; confidence: high; commits: 21dd6fa8405c, 42ae60579493, a89cfa1c4234; files: src/agents/tools/gateway.ts, src/gateway/server/ws-connection/message-handler.ts, src/gateway/operator-approvals-client.ts)
fuller-stack-dev: The merged local approval-resolution PR split this shared-token follow-up out, and the first two commits on this PR implement the shared-token and env-gating direction. (role: related feature contributor; confidence: high; commits: 13cfb77c10f9, 963e312fef9c, add6518cf24b; files: src/gateway/operator-approvals-client.ts, src/gateway/operator-approval-runtime-token.ts, src/agents/tools/gateway.ts)
steipete: History across the touched gateway files shows heavy prior work on gateway auth, pairing locality, and approval gateway setup, making this a useful routing candidate for the boundary decision. (role: adjacent gateway auth owner; confidence: medium; commits: 1df78202b967, 1ab37d7a124e, bb01e49192d3; files: src/gateway/operator-approvals-client.ts, src/gateway/server/ws-connection/message-handler.ts, src/agents/tools/gateway.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-27T01:41:09Z

ClawSweeper PR egg

🔥 Warming up: real-behavior proof passed; findings, security review, or rank-up moves are still in progress.

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

fuller-stack-dev · 2026-05-27T04:31:20Z

Refreshed the PR body with current-head proof for a395cede70. The new proof covers a real two-process shared-OPENCLAW_HOME approval-runtime smoke, plus env override and configured remote loopback rejection for requester-bound approvals.

@clawsweeper re-review

clawsweeper · 2026-05-27T04:31:23Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26490892934
Updated: 2026-05-27T04:40:00.733Z

shakkernerd · 2026-06-08T13:31:25Z

Addressed the fallback-local ClawSweeper finding in a89cfa1c4234771e0336fa2b5722f20b1f3ed43b.

What changed:

gateway.mode=remote without gateway.remote.url now stays on the existing fallback-local approval-runtime path.
Env-selected gateway URLs still remain token-ineligible, including loopback URLs.
Added a regression test proving fallback-local approval calls keep approvalRuntimeToken and do not switch to requester deviceIdentity.

Verification:

node scripts/run-vitest.mjs src/agents/tools/gateway.test.ts --reporter=dot — passed; 29 tests.
node_modules/.bin/oxfmt --check src/agents/tools/gateway.ts src/agents/tools/gateway.test.ts — passed.
git diff --check — passed.
Testbox-through-Crabbox tbx_01ktkpn7ebxk5nr9tz74qwe5vc, Actions run 27140908325: focused gateway/agent shards passed, 142 tests.
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main — clean; no accepted/actionable findings.

Updated the PR body with current-head proof.

@clawsweeper re-review

clawsweeper · 2026-06-08T13:31:28Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27141203667
Updated: 2026-06-08T13:42:44.116Z

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

openclaw-barnacle Bot added gateway Gateway runtime size: S proof: supplied External PR includes structured after-fix real behavior proof. labels May 27, 2026

kevinslin approved these changes May 27, 2026

View reviewed changes

fuller-stack-dev force-pushed the codex/shared-approval-runtime-token branch from cff56e3 to a7e9845 Compare May 27, 2026 03:00

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 27, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 27, 2026

fuller-stack-dev force-pushed the codex/shared-approval-runtime-token branch from a7e9845 to a395ced Compare May 27, 2026 03:38

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 27, 2026

RomneyDa added the dependency-guard-backfill label May 29, 2026

clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels May 29, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 8, 2026

shakkernerd force-pushed the codex/shared-approval-runtime-token branch from 52d988d to 4b9589e Compare June 8, 2026 12:53

shakkernerd force-pushed the codex/shared-approval-runtime-token branch from 4b9589e to 9a830a3 Compare June 8, 2026 13:09

openclaw-barnacle Bot added size: L and removed size: M labels Jun 8, 2026

clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jun 8, 2026

fuller-stack-dev and others added 4 commits June 8, 2026 14:21

fix(gateway): share approval runtime socket token

963e312

fix(gateway): gate env approval runtime auth

add6518

fix: require stable approval requester identity

21dd6fa

fix: limit approval runtime token to local clients

42ae605

shakkernerd force-pushed the codex/shared-approval-runtime-token branch from 9a830a3 to 42ae605 Compare June 8, 2026 13:22

fix: preserve fallback approval runtime auth

a89cfa1

shakkernerd merged commit da40134 into openclaw:main Jun 8, 2026
191 of 196 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(gateway): share approval runtime socket token#87105

fix(gateway): share approval runtime socket token#87105
shakkernerd merged 5 commits into
openclaw:mainfrom
fuller-stack-dev:codex/shared-approval-runtime-token

fuller-stack-dev commented May 27, 2026 •

edited by shakkernerd

Loading

Uh oh!

clawsweeper Bot commented May 27, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 27, 2026 •

edited

Loading

Uh oh!

fuller-stack-dev commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 •

edited

Loading

Uh oh!

shakkernerd commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

fuller-stack-dev commented May 27, 2026 • edited by shakkernerd Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Scope split

Real behavior proof

Tests and validation

Risk checklist

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hatch command

Uh oh!

fuller-stack-dev commented May 27, 2026

Uh oh!

clawsweeper Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

shakkernerd commented Jun 8, 2026

Uh oh!

clawsweeper Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

fuller-stack-dev commented May 27, 2026 •

edited by shakkernerd

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented May 27, 2026 •

edited

Loading

clawsweeper Bot commented Jun 8, 2026 •

edited

Loading