feat: let limited browsers request admin access (#121459)

* feat(gateway): add live device scope upgrades

* feat(ui): add limited-access upgrade flow

* fix(protocol): refresh Swift scope upgrade models

* perf(ui): lazy-load device scope upgrades

* fix(ci): complete scope upgrade generated surfaces

* perf(ui): lazy-load GitHub link hovercards

* fix(ui): keep admin repair guidance focusable

* fix(ui): gate and refresh scope upgrade banner

* refactor(ui): keep gateway client within line budget

* fix(ci): align rebased scope upgrade checks

* fix(ui): resolve scope upgrade in browser tests

* fix(gateway): honor refreshed scope upgrade deadline

* fix(gateway): honor refreshed scope upgrade deadline

* fix(gateway): coalesce scope upgrade waiters

* fix(ui): gate scope upgrade actions

* chore(plugin-sdk): refresh rebased API baseline

* fix(scope-upgrade): return canonical request ids

* fix(ui): preserve gateway event type binding

* fix(protocol): generate scope upgrade result models

* fix(ui): preserve scope upgrade recovery guidance

* chore(plugin-sdk): refresh rebased API baseline

* test(ui): avoid scope upgrade navigation race

* docs(control-ui): clarify scope upgrade approver

* test(gateway): align appended method counts

* chore(plugin-sdk): refresh rebased API baseline

* refactor(ui): keep place picker within line budget

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* chore(plugin-sdk): refresh rebased API baseline

* fix(gateway): preserve scope-upgrade browser origin

test/vitest-scoped-config.test.ts

@@ -190,6 +190,18 @@ describe("resolveVitestIsolation", () => {
       find: "@openclaw/retry",
       replacement: path.join(process.cwd(), "packages", "retry", "src", "index.ts"),
     });
+    expect(
+      findAlias(sharedVitestConfig.resolve.alias, "@openclaw/gateway-client/scope-upgrade"),
+    ).toEqual({
+      find: "@openclaw/gateway-client/scope-upgrade",
+      replacement: path.join(
+        process.cwd(),
+        "packages",
+        "gateway-client",
+        "src",
+        "scope-upgrade.ts",
+      ),
+    });
   });
 
   it("defaults shared scoped configs to the non-isolated runner", () => {

test/vitest-ui-package-config.test.ts

@@ -1,4 +1,5 @@
 // Vitest UI package config tests validate UI package test project settings.
+import path from "node:path";
 import { describe, expect, it } from "vitest";
 import uiConfig from "../ui/vitest.config.ts";
 import uiNodeConfig from "../ui/vitest.node.config.ts";
@@ -18,6 +19,27 @@ function requireTestConfig(config: unknown): ExpectedTestConfig {
   return config.test as ExpectedTestConfig;
 }
 
+function requireAlias(config: unknown, specifier: string): { find: string; replacement: string } {
+  const aliases = (config as { resolve?: { alias?: unknown } }).resolve?.alias;
+  if (!Array.isArray(aliases)) {
+    throw new Error("expected ui package vitest aliases");
+  }
+  const alias = aliases.find((candidate): candidate is { find: string; replacement: string } =>
+    Boolean(
+      candidate &&
+      typeof candidate === "object" &&
+      "find" in candidate &&
+      candidate.find === specifier &&
+      "replacement" in candidate &&
+      typeof candidate.replacement === "string",
+    ),
+  );
+  if (!alias) {
+    throw new Error(`missing ui package vitest alias ${specifier}`);
+  }
+  return alias;
+}
+
 describe("ui package vitest config", () => {
   it("keeps the standalone ui package on thread workers without broad isolation", () => {
     const testConfig = requireTestConfig(uiConfig);
@@ -41,4 +63,17 @@ describe("ui package vitest config", () => {
     expect(testConfig.isolate).toBe(false);
     expect(testConfig.runner).toBeUndefined();
   });
+
+  it("aliases the scope-upgrade workspace subpath for clean browser test checkouts", () => {
+    expect(requireAlias(uiConfig, "@openclaw/gateway-client/scope-upgrade")).toEqual({
+      find: "@openclaw/gateway-client/scope-upgrade",
+      replacement: path.join(
+        process.cwd(),
+        "packages",
+        "gateway-client",
+        "src",
+        "scope-upgrade.ts",
+      ),
+    });
+  });
 });

test/vitest/vitest.shared.config.ts

@@ -223,6 +223,10 @@ export const sharedVitestConfig = {
         find: "@openclaw/gateway-client/readiness",
         replacement: path.join(repoRoot, "packages", "gateway-client", "src", "readiness.ts"),
       },
+      {
+        find: "@openclaw/gateway-client/scope-upgrade",
+        replacement: path.join(repoRoot, "packages", "gateway-client", "src", "scope-upgrade.ts"),
+      },
       {
         find: "@openclaw/gateway-client/timeouts",
         replacement: path.join(repoRoot, "packages", "gateway-client", "src", "timeouts.ts"),