ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-26 04:15:48 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(gateway): tools.invoke must carry the caller's host-minted role authority (#129725)

Browse Source 
* fix(gateway): tools.invoke must carry the caller's host-minted role authority

The connect handshake resolves each connection's authority once and stores it
server-side (shared-secret operator owners mint system authority there).
tools.invoke discarded that fact and re-derived ownership from scopes, so a
shared-secret caller with no durable profile resolved to the deny-by-default
role and was refused dispatch on its own agents — while the same connection
could still mutate sessions directly.

Carry client.internal.operatorRoleActor into the synthetic dispatch client and
keep the scope-derived fallback for callers that have no connection actor
(HTTP). Regression test fails pre-fix with the FORBIDDEN agent-allowlist error.

* test(opencode): close the fake CLI before exec to stop ETXTBSY flakes

The catalog suite wrote the fake opencode executable and spawned it
immediately. Under parallel CI shards the write handle could still be open
at exec time, so the launch failed with ETXTBSY and failed the shard.

Write through an explicit file handle with an fsync before close so the
binary is fully durable before the first spawn.

* fix(ci): repair red main type and lint gates

Two gates were failing on main independently of this branch:

- extensions/qa-lab cleanup tests still built OpenClawCrablineChannelDriverSelection
  with the retired smokeArtifactPath and a stale capabilityMatrixPath, so
  check:test-types failed after the readiness-artifact change (#124189).
  Align both fixtures with the current type and its pinned constants.
- scripts/github/release-validation-campaign.d.mts declared the Actions Octokit
  client as any (#129726), tripping no-explicit-any. Declare the structural
  subset the publisher actually calls instead of suppressing the rule.

Verified failing on clean origin/main before the fix.
This commit is contained in:
Peter Steinberger
2026-08-25 19:15:01 -07:00
committed by GitHub
parent c841a9958a
commit 637da87a5d
7 changed files with 89 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/github/release-validation-campaign.d.mts
+20 -1
View File
@@ -27,8 +27,27 @@ export function validateReleaseValidationCampaignArtifact(
},
): ReleaseValidationCampaignArtifact;
/**
* Structural subset of the Actions-provided Octokit client this publisher uses.
* Declared locally so the script keeps a real contract without depending on
* Octokit's generated types from a plain-Node script surface.
*/
export type ReleaseValidationCampaignGitHubClient = {
rest: {
issues: {
get(params: Record<string, unknown>): Promise<{ data: unknown }>;
getLabel(params: Record<string, unknown>): Promise<unknown>;
createLabel(params: Record<string, unknown>): Promise<unknown>;
createComment(params: Record<string, unknown>): Promise<unknown>;
update(params: Record<string, unknown>): Promise<{ data: unknown }>;
listForRepo: unknown;
};
};
paginate(route: unknown, params: Record<string, unknown>): Promise<unknown[]>;
};
export function runReleaseValidationCampaignPublish(params: {
github: any;
github: ReleaseValidationCampaignGitHubClient;
context: { repo: { owner: string; repo: string } };
core: { info(message: string): void; setOutput?(name: string, value: string): void };
artifact: unknown;