* fix(gateway): rank project picker GitHub search by relevance
The Control UI project picker searched /search/repositories with
sort=updated, so a query like openclaw/openclaw surfaced whichever of
~68k tokenized matches was pushed most recently instead of the repo the
user typed; a local updatedAt re-sort destroyed relevance a second time.
Use GitHub best-match ordering for the global lane, preserve API order,
and resolve exact owner/name queries directly via GET /repos/{owner}/{name}
ranked first (404 degrades to search). Deletes candidateSort and the
SearchCandidate wrapper.
* fix(gateway): degrade optional search lanes on transport failure
ClawSweeper P2: the exact-repo and affiliated lanes only swallowed
ControlUiGitHubError, so a transport rejection (network failure, abort
timeout) escaped Promise.all and failed the whole picker search even
when global search succeeded. Optional enrichment lanes now degrade to
search-only results on any failure.
* fix(gateway): unblock GitHub publication on hooksPath checkouts and auto-retry deferred requests
Every publication on a checkout with core.hooksPath configured (which
pnpm install sets in every OpenClaw checkout via prepare-git-hooks.mjs)
failed terminally as workspace_changed: the unsafe-transport assertion
rejected the config before the snapshot could be captured, and the agent
was told to retry forever.
Neutralize instead of reject: the executor pins core.hooksPath=/dev/null
via GIT_CONFIG_* env on every publication git command, so repo-authored
hooks can never run under Gateway publication privilege, and the unsafe
regex drops core.hookspath.
Replace the three model-facing dead ends with a durable deferred queue:
cloud publishes without a live claim queue a claim-less session request,
orphaned claim rows defer instead of terminally failing, preparation
failures defer, and authority loss requeues. Deferred rows publish
automatically at the next accepted reconciliation or quiescent sweep;
persistent failures terminalize with an accurate code and are reported
to the session transcript.
* test(gateway): move publication deferral test to boundaries suite
Keeps github-publication.test.ts under the max-lines gate.
* fix(parallels): skip packaging for macOS dev upgrades
* fix(test): sanitize compile cache for all vitest children
* test(node-host): honor disabled worker compile-cache fixtures
The approval plan now owns the whole trusted-proxy auto-approval
decision — eligibility and the capped grant — returning
trustedProxyAutoApproveScopes/trustedProxyUser instead of a bare flag
that requirePairing re-derived from config. One failPairingHandshake
helper replaces three hand-rolled failure blocks, and the bootstrap
retry block in connect-existing-device flattens its guard pyramid and
computes scopes only where used. Behavior-neutral; net -20 production
LOC.
* fix(models): reject --agent on aliases and scan instead of ignoring it
models aliases list/add/remove and models scan never read the parent
--agent option, so an operator scoping one of them to an agent got no
feedback that the flag did nothing, and a typo'd or nonexistent agent id
was never validated. They only read or write agents.defaults.*, so there
is no agent-scoped path for the flag to feed.
Reuse the existing set/set-image guard rather than inventing a new
mechanism: rename it to rejectAgentScopedModelCommand, give each
global-only command an accurate scope phrase, and call it before the
command runs. fallbacks/image-fallbacks are deliberately untouched;
they are tracked separately in #106346.
Fixes#126597
* fix(models): drop release-owned changelog entry
* fix(models): simplify global-only scope message
Review flagged the production LOC delta. Collapse the runtime scope map
into a type-only union and one accurate message covering both the read
(aliases list) and write commands; net production delta is now +20.
* fix(models): state the guard scope accurately for scan
Review finding: the shared message claimed every guarded command 'only
reads or writes global model config', but models scan --no-probe prints
the catalog and returns before any config update (scan.ts:283).
Say what is true of all six instead: they are global and never
agent-scoped. Docs line updated to match.
---------
Co-authored-by: sashankh <saisashankhd@microsoft.com>
* fix(gateway): tools.invoke must carry the caller's host-minted role authority
The connect handshake resolves each connection's authority once and stores it
server-side (shared-secret operator owners mint system authority there).
tools.invoke discarded that fact and re-derived ownership from scopes, so a
shared-secret caller with no durable profile resolved to the deny-by-default
role and was refused dispatch on its own agents — while the same connection
could still mutate sessions directly.
Carry client.internal.operatorRoleActor into the synthetic dispatch client and
keep the scope-derived fallback for callers that have no connection actor
(HTTP). Regression test fails pre-fix with the FORBIDDEN agent-allowlist error.
* test(opencode): close the fake CLI before exec to stop ETXTBSY flakes
The catalog suite wrote the fake opencode executable and spawned it
immediately. Under parallel CI shards the write handle could still be open
at exec time, so the launch failed with ETXTBSY and failed the shard.
Write through an explicit file handle with an fsync before close so the
binary is fully durable before the first spawn.
* fix(ci): repair red main type and lint gates
Two gates were failing on main independently of this branch:
- extensions/qa-lab cleanup tests still built OpenClawCrablineChannelDriverSelection
with the retired smokeArtifactPath and a stale capabilityMatrixPath, so
check:test-types failed after the readiness-artifact change (#124189).
Align both fixtures with the current type and its pinned constants.
- scripts/github/release-validation-campaign.d.mts declared the Actions Octokit
client as any (#129726), tripping no-explicit-any. Declare the structural
subset the publisher actually calls instead of suppressing the rule.
Verified failing on clean origin/main before the fix.
maybeMigrateAuthProfileJsonStoresToSqlite discarded the error from
resumePendingAuthProfileMigrationArchives entirely, so the warning was always
the same generic string regardless of which of 5 distinct causes fired
(invalid receipt, target verification failure, lock failure, SQLite failure,
corrupt JSON). PR #123164 fixed the identical defect class in the sibling
shared-OAuth catch block 20 lines below in this same function, explicitly
modeling the fix on the third, already-correct sibling. This was the
unaddressed third catch block in that same family.
* fix(gateway): stop fabricating scope-upgrade requests on trusted-proxy reconnects
Same-key trusted-proxy reconnects whose auto-approvable scopes are already
covered by the paired grant now narrow the session in place instead of
running the pairing request/approve machinery: no pending-store writes and
no false 'device access upgrade requested' / 'auto-approved' security-audit
warns on every Control UI page load. The upgrade audit warn moved into
requirePairing so it fires only when a pairing request is materialized.
Durable widening (broadened deviceAutoApprove.scopes) and key-mismatch
repairs keep the existing lanes.
* fix(gateway): revalidate the live paired grant in the reconnect fast path
Address ClawSweeper P1: the narrowing decision now rereads the
authoritative paired row as the last await before returning, so a
concurrent revoke, key replacement, or grant reduction fails closed into
the pairing lane instead of riding the pre-plan snapshot. Extract the
pairing approval-plan resolver into connect-pairing-approval-plan.ts to
keep the authorization owner under the 700-line lint boundary.
* refactor(state): retire six dead shared-state tables at schema v10
agent_model_catalogs, android_notification_recent_packages,
command_log_entries, diagnostic_stability_bundles, media_blobs, and
model_capability_cache landed with the database-first squash but their
runtime writers never reached main; every stable since v2026.6.10 created
them empty (agent_model_catalogs held only rebuildable catalog cache rows
until #111173 removed its writer). State schema 10 drops all six tables
and seven indexes through both the runtime-open and doctor migration
paths, records the retirements, bumps the native reader ceiling, and
corrects stale database-first doc claims that still named these tables
as canonical stores.
* test: move cross-lane schema-version pins to v10
The v10 retirement missed current-version pins outside src/state: the
native guard vitest wrapper, placement-move and node-worker-launch
same-version assertions, and the audit outbound-progress tripwire. The
pinned pre-C04 audit reader is a v9-era build that now refuses v10
databases by the version contract, so the test projects the file back to
the exact v9 shape with the documented 10-to-9 downgrade fixture before
the reader proof; the shared fixture also seeds the v10 retirement
regression.
* test: keep only the used downgrade fixture export
The startup SECURITY WARNING and the critical security-audit remediation for
gateway.auth.trustedProxy.deviceAutoApprove.scopes containing operator.admin
still told operators to wait "until per-identity roles are available".
Per-identity admin grants shipped as gateway.auth.identityScopes and the
trusted-proxy docs already recommend them; the runtime guidance now names
that shipped fix instead of a nonexistent future feature.
Peter Steinberger