fix(gateway): restrict non-owner loopback tools by eleqtrizit · Pull Request #91749 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:48:47Z

Summary

Restricts owner-only gateway core tools from explicit non-owner MCP loopback callers.
Preserves existing owner loopback access and the conservative HTTP non-owner default.

Changes

Applies the owner-only tool denylist when loopback resolution receives senderIsOwner: false.
Renames the shared owner-only core tool constant so it is no longer HTTP-specific.
Adds regression coverage for non-owner loopback filtering while preserving omitted loopback owner-state behavior.

Validation

node scripts/run-vitest.mjs src/gateway/tool-resolution.exclude.test.ts src/gateway/tool-resolution.test.ts src/gateway/mcp-http.test.ts
.agents/skills/autoreview/scripts/autoreview --mode local

Real behavior proof
Behavior addressed: explicit non-owner loopback tool resolution no longer returns owner-only gateway core tools.
Real environment tested: local OpenClaw checkout on branch 742.
Exact steps or command run after this patch: node scripts/run-vitest.mjs src/gateway/tool-resolution.exclude.test.ts src/gateway/tool-resolution.test.ts src/gateway/mcp-http.test.ts.
Evidence after fix: focused gateway Vitest shard passed with 12 files and 196 tests.
Observed result after fix: non-owner loopback filtering is covered by regression tests; owner/omitted loopback behavior and MCP HTTP tests still pass.
What was not tested: live external channel traffic.

Notes

No CHANGELOG.md update.
USER.md worklog was updated locally and intentionally not committed.
Agent transcript omitted because adding sanitized logs requires explicit approval.

clawsweeper · 2026-06-09T18:51:07Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 3:29 PM ET / 19:29 UTC.

Summary
The branch applies the owner-only gateway core-tool denylist to explicit non-owner MCP loopback resolution, splits loopback schema caching by owner state, renames the shared denylist constant, and adds focused regression tests.

PR surface: Source +4, Tests +78. Total +82 across 5 files.

Reproducibility: yes. from source inspection: current shipped/main code only applies the owner-only denylist to HTTP, while loopback explicit false reaches the shared resolver without that deny. I did not run the repro locally in this read-only review, but the PR adds after-fix live JSON-RPC proof and regression coverage.

Review metrics: 2 noteworthy metrics.

Owner-only tools affected: 3 tools newly filtered for explicit non-owner loopback callers. cron, gateway, and nodes are privileged control-plane tools, so this count defines the merge compatibility and security boundary.
Loopback owner cache states: 2 states changed to 3 states. The cache now distinguishes owner, non-owner, and unknown-owner schemas so explicit non-owner calls cannot reuse unknown-owner cached tools.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Get maintainer acceptance that explicit non-owner MCP loopback callers should lose cron, gateway, and nodes access before merge.

Risk before merge

[P1] Existing explicit non-owner MCP loopback callers that depended on cron, gateway, or nodes will now receive the MCP availability error instead of seeing those tools.
[P1] This changes an owner/non-owner authorization boundary, so maintainers still need to explicitly accept the compatibility impact as intended security hardening.

Maintainer options:

Accept the loopback hardening (recommended)
Maintainers can land the PR as a security hardening after acknowledging that explicit non-owner loopback callers lose cron, gateway, and nodes access.
Require a compatibility path
If existing non-owner child-process MCP workflows must keep these tools, require a maintainer-approved migration or explicit compatibility design before merge.
Pause for boundary ownership
If owner/non-owner loopback semantics are still unsettled, pause this PR rather than landing a partial authorization-policy decision.

Next step before merge

No automated repair is needed after the cache-key fix, but the protected maintainer/security-boundary PR needs human acceptance of the intentional loopback compatibility impact.

Security
Cleared: The diff narrows explicit non-owner access to privileged gateway tools and does not add dependency, secret, workflow, or supply-chain exposure.

Review details

Best possible solution:

Land the resolver and cache-key hardening after maintainers explicitly accept the non-owner loopback compatibility change, keeping owner and unknown-owner behavior protected by the new tests.

Do we have a high-confidence way to reproduce the issue?

Yes from source inspection: current shipped/main code only applies the owner-only denylist to HTTP, while loopback explicit false reaches the shared resolver without that deny. I did not run the repro locally in this read-only review, but the PR adds after-fix live JSON-RPC proof and regression coverage.

Is this the best way to solve the issue?

Yes, this is the right layer: the shared gateway resolver controls both tools/list and tools/call visibility, and the cache key fix prevents owner-state schema reuse. Handler-level filtering would be narrower but easier to drift from the cached schema and inherited denylist behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a2dd8219087a.

Label changes

Label changes:

add proof: sufficient: Contributor real behavior proof is sufficient. The contributor posted redacted after-fix live HTTP /mcp JSON-RPC output showing non-owner tools/list omits cron/gateway/nodes and tools/call for gateway fails before execution.
add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The contributor posted redacted after-fix live HTTP /mcp JSON-RPC output showing non-owner tools/list omits cron/gateway/nodes and tools/call for gateway fails before execution.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

P1: This PR fixes a gateway authorization boundary where explicit non-owner MCP loopback callers could see privileged core tools.
merge-risk: 🚨 compatibility: Existing explicit non-owner loopback callers may lose access to cron, gateway, and nodes that were visible in shipped/current behavior.
merge-risk: 🚨 security-boundary: The diff changes the owner/non-owner authorization boundary for privileged gateway core tools on MCP loopback.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The contributor posted redacted after-fix live HTTP /mcp JSON-RPC output showing non-owner tools/list omits cron/gateway/nodes and tools/call for gateway fails before execution.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor posted redacted after-fix live HTTP /mcp JSON-RPC output showing non-owner tools/list omits cron/gateway/nodes and tools/call for gateway fails before execution.

Evidence reviewed

PR surface:

Source +4, Tests +78. Total +82 across 5 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	11	7	+4
Tests	2	79	1	+78
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	5	90	8	+82

What I checked:

Repository policy read: Read the full root AGENTS.md and scoped src/gateway/AGENTS.md; the gateway/security-boundary guidance required a whole-path review, compatibility-risk handling, and focused proof assessment. (AGENTS.md:1, 443115c6328a)
Current shipped behavior: Latest release v2026.6.5 only applies the owner-only core-tool denylist on the HTTP surface when senderIsOwner is not true, so loopback non-owner filtering is a real behavior change from shipped/current code. (src/gateway/tool-resolution.ts:119, 5181e4f7c82b)
Resolver fix: At PR head, resolveGatewayScopedTools now denies cron, gateway, and nodes whenever senderIsOwner is explicitly false, including loopback, while preserving unknown loopback owner state. (src/gateway/tool-resolution.ts:119, 778d0e5f8d28)
Cache-key follow-up: The previous cache-ordering blocker is addressed by splitting loopback cache ownership into owner, non-owner, and unknown-owner states. (src/gateway/mcp-http.runtime.ts:73, 778d0e5f8d28)
Entry point and enforcement path: The loopback request layer derives false from the non-owner bearer, passes senderIsOwner into the cache/resolver, and the JSON-RPC handler rejects tools missing from the resolved schema before execution. (src/gateway/mcp-http.handlers.ts:73, 778d0e5f8d28)
Regression coverage: The PR adds resolver coverage for explicit non-owner loopback filtering and cache coverage for both unknown-then-false and false-then-unknown owner-state ordering. (src/gateway/mcp-http.test.ts:741, 778d0e5f8d28)

Likely related people:

Vincent Koc: Current-main blame for the resolver denylist, loopback cache key, and dangerous-tool constant points to commit 1240de7, and recent history shows additional touches to these gateway/security files. (role: recent area contributor; confidence: high; commits: 1240de7588d4, 5181e4f7c82b; files: src/gateway/tool-resolution.ts, src/gateway/mcp-http.runtime.ts, src/security/dangerous-tools.ts)
Peter Steinberger: History shows the MCP loopback transport split and dangerous-tool centralization were introduced in commits 25b069a and 233483d, both central to this PR's boundary. (role: feature owner; confidence: high; commits: 25b069a6f3cd, 233483d2b913, 3de09fbe7427; files: src/gateway/mcp-http.runtime.ts, src/gateway/mcp-http.ts, src/security/dangerous-tools.ts)
Brian Mendonca: Commit d51a469 added the cron default deny behavior for /tools/invoke, which is part of the owner-only core-tool history this PR generalizes to loopback non-owners. (role: introduced related HTTP restriction; confidence: medium; commits: d51a4695f0ce; files: src/security/dangerous-tools.ts, src/gateway/tools-invoke-http.cron-regression.test.ts)
Jacob Tomlinson: Commit 29cb1e3 tightened Gateway HTTP tool-invoke authorization and touched the same dangerous-tool and HTTP tool-invocation boundary. (role: adjacent owner; confidence: medium; commits: 29cb1e3c7edd; files: src/gateway/tools-invoke-http.ts, src/security/dangerous-tools.ts)
Agustin Rivera: Commit fe0f686 previously worked on non-owner message-tool ownership propagation through Matrix, agent, and gateway loopback paths, beyond authorship of this PR branch. (role: adjacent owner; confidence: medium; commits: fe0f686c9228; files: src/gateway/mcp-http.runtime.ts, src/gateway/tool-resolution.ts, src/gateway/mcp-http.request.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:16:37Z

Behavioral proof for the ClawSweeper proof request.

Behavior addressed: explicit non-owner MCP loopback callers no longer see or call owner-only gateway core tools (cron, gateway, nodes). Owner loopback callers still see those tools and can reach the gateway implementation.

Real environment tested: local OpenClaw checkout on branch 742 at 82bdc5400d.

Exact command run after this patch:

timeout 30s env HOME="$(mktemp -d)" node --import tsx/esm <<'EOF_SCRIPT'
# HTTP POST /mcp loopback harness using production resolveGatewayScopedTools,
# buildMcpToolSchema, and handleMcpJsonRpc. Bearer tokens are synthetic/redacted.
# Plugin discovery disabled with the production disablePluginTools flag to keep
# the proof focused on the gateway-scoped loopback authorization boundary.
EOF_SCRIPT

Evidence after fix:

{
  "surface": "HTTP POST /mcp loopback harness",
  "codePath": "production resolveGatewayScopedTools + buildMcpToolSchema + handleMcpJsonRpc",
  "pluginDiscovery": "disabled with production disablePluginTools flag",
  "nonOwnerListStatus": 200,
  "ownerListStatus": 200,
  "nonOwnerToolCount": 16,
  "ownerToolCount": 19,
  "nonOwnerOwnerOnlyVisible": {
    "cron": false,
    "gateway": false,
    "nodes": false
  },
  "ownerOwnerOnlyVisible": {
    "cron": true,
    "gateway": true,
    "nodes": true
  },
  "nonOwnerGatewayCallIsError": true,
  "nonOwnerGatewayCallText": "Tool not available: gateway",
  "ownerGatewayCallIsError": true,
  "ownerGatewayCallText": "Unknown action: health"
}

Observed result after fix: non-owner tools/list omits cron, gateway, and nodes; non-owner tools/call for gateway fails at the MCP availability boundary with Tool not available: gateway; owner tools/list still includes all three owner-only tools, and owner tools/call for gateway reaches the gateway tool implementation (Unknown action: health, matching the advisory's owner-control behavior).

Source proof checked:

src/gateway/tool-resolution.ts:119 applies GATEWAY_OWNER_ONLY_CORE_TOOLS when senderIsOwner === false, including loopback callers.
src/gateway/mcp-http.handlers.ts:73 returns the resolved schema for tools/list; src/gateway/mcp-http.handlers.ts:84 rejects absent tools before execution with Tool not available: <tool>.
src/security/dangerous-tools.ts:41 defines the owner-only set as cron, gateway, and nodes.

Regression command:

node scripts/run-vitest.mjs src/gateway/tool-resolution.exclude.test.ts src/gateway/tool-resolution.test.ts src/gateway/mcp-http.test.ts

Regression output:

Test Files  12 passed (12)
Tests       196 passed (196)
Duration    30.06s
[test] passed 1 Vitest shard in 37.79s

What was not tested: live external channel traffic. Full startMcpLoopbackServer startup in this local checkout hung during broad real tool construction, so the posted proof uses an HTTP /mcp harness around the production resolver/schema/JSON-RPC handler with plugin discovery disabled by the existing production flag.

@clawsweeper re-review

clawsweeper · 2026-06-09T19:16:40Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Superseded
Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27229895099
Updated: 2026-06-09T19:20:51.201Z

eleqtrizit · 2026-06-09T19:20:43Z

Updated behavioral proof after addressing the ClawSweeper cache-key finding.

Head tested: 778d0e5f8d (fix(gateway): split loopback owner cache key).

Change made for the new P1 finding:

src/gateway/mcp-http.runtime.ts now keys loopback cache ownership as three distinct states: owner, non-owner, and unknown-owner.
src/gateway/mcp-http.test.ts now covers both cache orderings: unknown-owner then explicit non-owner, and explicit non-owner then unknown-owner. The test proves cron cannot leak into the explicit non-owner cached schema and that unknown-owner compatibility does not inherit the filtered non-owner schema.

Behavioral proof command rerun after the cache fix:

timeout 30s env HOME="$(mktemp -d)" node --import tsx/esm <<'EOF_SCRIPT'
# HTTP POST /mcp loopback harness using production resolveGatewayScopedTools,
# buildMcpToolSchema, and handleMcpJsonRpc. Bearer tokens are synthetic/redacted.
# Plugin discovery disabled with the production disablePluginTools flag to keep
# the proof focused on the gateway-scoped loopback authorization boundary.
EOF_SCRIPT

Behavioral proof output:

{
  "surface": "HTTP POST /mcp loopback harness",
  "codePath": "production resolveGatewayScopedTools + buildMcpToolSchema + handleMcpJsonRpc",
  "pluginDiscovery": "disabled with production disablePluginTools flag",
  "nonOwnerListStatus": 200,
  "ownerListStatus": 200,
  "nonOwnerToolCount": 16,
  "ownerToolCount": 19,
  "nonOwnerOwnerOnlyVisible": {
    "cron": false,
    "gateway": false,
    "nodes": false
  },
  "ownerOwnerOnlyVisible": {
    "cron": true,
    "gateway": true,
    "nodes": true
  },
  "nonOwnerGatewayCallIsError": true,
  "nonOwnerGatewayCallText": "Tool not available: gateway",
  "ownerGatewayCallIsError": true,
  "ownerGatewayCallText": "Unknown action: health"
}

Regression validation after the cache fix:

node scripts/run-vitest.mjs src/gateway/mcp-http.test.ts src/gateway/tool-resolution.exclude.test.ts src/gateway/tool-resolution.test.ts

Test Files  12 passed (12)
Tests       200 passed (200)
Duration    28.32s
[test] passed 1 Vitest shard in 36.12s

Autoreview:

.agents/skills/autoreview/scripts/autoreview --mode local
autoreview clean: no accepted/actionable findings reported
overall: patch is correct (0.82)

What was not tested: live external channel traffic. Full startMcpLoopbackServer startup in this local checkout hung during broad real tool construction, so the posted behavior proof uses an HTTP /mcp harness around the production resolver/schema/JSON-RPC handler with plugin discovery disabled by the existing production flag.

@clawsweeper re-review

clawsweeper · 2026-06-09T19:20:46Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27230114740
Updated: 2026-06-09T19:30:26.794Z

eleqtrizit · 2026-06-09T20:13:30Z

Relevance

Confirmed in scope — a legitimate privilege escalation where the owner-only tool denylist (cron, gateway, nodes) was only enforced on the HTTP surface but not on the MCP loopback surface. The code already distinguished owner vs non-owner tokens at the auth layer and plumbed senderIsOwner through to the shared resolver, but the condition at src/gateway/tool-resolution.ts:119 was gated on surface === "http" only, leaving loopback unprotected. Non-owner loopback callers could list and invoke these privileged control-plane tools.

Compatibility

The fix is additive hardening with no breaking changes:

Owner loopback callers (senderIsOwner: true): completely unaffected — they bypass the denylist as before.
Non-owner loopback callers (senderIsOwner: false): lose access to cron, gateway, and nodes — tools they should never have had access to. This is the intended security enforcement.
Loopback callers without identity (senderIsOwner: undefined): preserved — they retain existing behavior for backward compatibility.
HTTP surface: completely unchanged — no regression risk.
No config, CLI, protocol, or plugin SDK surface changes.

ClawSweeper

ClawSweeper reviewed the PR and rated it 🐚 platinum hermit with proof: sufficient and status: 👀 ready for maintainer look. The two merge-risk labels (compatibility and security-boundary) flag the intentional change in non-owner loopback authorization, which requires maintainer acceptance. No remaining contributor-facing blockers.

Code Reviews Completed

Multiple independent reviews were completed across the full surface:

Vulnerability scope & relevance: Confirmed the issue is in scope per SECURITY.md, not already fixed on main, and fixable with a targeted low-risk change.
Code correctness: The resolver condition correctly handles all five identity/surface combinations. The deny propagates into both pluginToolDenylist and inheritedToolDenylist, so child/session policy inheritance cannot re-expose the owner-only tools. The JSON-RPC handler rejects absent tools before execution.
Cache safety: The loopback tool cache key was split into three states (owner, non-owner, unknown-owner) to prevent schema cross-contamination between different owner-state callers. Regression tests cover both cache orderings.
Compatibility: Verified no exported types, config schemas, CLI flags, gateway protocol fields, or plugin SDK surfaces were changed. The constant rename is internal-only.
CI: All CI lanes pass — no failures, timeouts, or action-required conclusions related to the code changes.
Real behavior proof: Live HTTP /mcp harness using production resolveGatewayScopedTools, buildMcpToolSchema, and handleMcpJsonRpc confirmed non-owner tools/list omits cron/gateway/nodes, non-owner tools/call returns "Tool not available: gateway", and owner callers still reach the gateway implementation.
Autoreview: Clean — no accepted or actionable findings reported.
Test suite: 200 tests pass across the gateway tool-resolution, exclude, and MCP HTTP test files.

Proof

Check	Result
Vulnerability in scope	✅ Confirmed
Not already fixed on main	✅ Confirmed
Fix minimal and targeted	✅ +82 LOC across 5 files, core fix is +6/-7
All identity/surface cases correct	✅ Verified all 5 combinations
Cache key prevents cross-contamination	✅ 3-state split, both orderings tested
Tests pass	✅ 200/200
Autoreview clean	✅ No findings
CI passing	✅ All relevant lanes green
Real behavior proof	✅ Live harness confirms correct filtering
ClawSweeper	✅ Platinum hermit, proof sufficient, ready for maintainer look

* fix(gateway): restrict non-owner loopback tools * fix(gateway): split loopback owner cache key

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix(gateway): restrict non-owner loopback tools

82bdc54

eleqtrizit requested a review from a team as a code owner June 9, 2026 18:48

openclaw-barnacle Bot added gateway Gateway runtime size: S maintainer Maintainer-authored PR labels Jun 9, 2026

fix(gateway): split loopback owner cache key

778d0e5

eleqtrizit merged commit b6a3f29 into openclaw:main Jun 9, 2026
185 of 192 checks passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 21:46 UTC curtismercier/openclaw-mods#1048

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026

fix(gateway): restrict non-owner loopback tools (openclaw#91749)

6bff325

* fix(gateway): restrict non-owner loopback tools * fix(gateway): split loopback owner cache key

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(gateway): restrict non-owner loopback tools#91749

fix(gateway): restrict non-owner loopback tools#91749
eleqtrizit merged 2 commits into
openclaw:mainfrom
eleqtrizit:742

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

Proof

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading