53dcaaedec
feat(gateway): generic operator roles for non-maintainer access ( #128548 )
...
* feat(gateway): generic operator roles for non-maintainer access
Adds gateway.roles: named role bundles over a closed capability set —
sessions.others (none/view/suggest/write), an agents allowlist, and an
operator-scope ceiling. Roles are person-level (additive user_profiles.role
column, SQLite stays at v9); users.setRole (admin-only) assigns them. With
no gateway.roles config, behavior is unchanged for solo deployments.
Enforcement is deny-by-default from a host-minted actor identity
(system vs operator+profileId on server-only client.internal, never
accepted from the wire) and covers every entry point: WS RPCs, OpenAI-compat
and Responses HTTP, tools invocation, cron, questions, usage, task
suggestions, session catalog/sharing/reads. The agents allowlist gates both
session creation and run-start on existing sessions. Subagent completion
announce and descendant wake mint explicit system authority so role
boundaries never silently drop parent notifications.
The enforcement surface is expressed through a narrow policy vocabulary
(operatorSessionCap, hasOperatorBoundary, authorizeSessionSharing) rather
than per-handler policy internals.
* fix(gateway): heal PR CI after rebase onto main
- Break import cycles: extract GatewayOperatorRoleActor leaf contract; merge
session-group-mutation-targets into session-sharing-target-input.
- Split sessions-suggestions.test.ts (max-lines) into a visibility suite.
- Add users.setRole to the 2026.8 train registry test and regenerate the
Kotlin protocol client.
- Startup UNAVAILABLE gating now precedes session authorization: session
stores are not loaded during startup, so authorization reads would deny
with a misleading non-retryable error.
- sessions.assignOwner keeps its documented visibility-authorized contract
when no operator role caps the caller; view/suggest-capped roles still
cannot reassign foreign session ownership.
- Test stubs updated for main's socket readyState guard (#128144 ) and the
system-authority arg on channel-native resets.
* test(gateway): chat.send pending-profile dispatch carries its required session target
chat.send requires a non-empty sessionKey at the protocol level; the mutation
pipeline now rejects targetless frames before profile-dependent dispatch, so
the pending-profile test must send a realistic frame.
2026-08-24 01:20:03 -07:00
bbbd70542b
feat(sessions): recover offline device placements ( #126284 )
...
* feat(sessions): recover offline device placements
* chore(protocol): refresh session placement models
* perf(ui): lazy-load session placement recovery
* test(ui): remove dropdown timing assertion
* test(ui): await committed cloud recovery route
* fix(sessions): complete explicit abandonment locally
* fix(sessions): fence lists by runner availability
* fix(ui): preserve canonical session freshness
* fix(sessions): preserve recovery contracts after rebase
* test(ui): await durable cloud recovery entry
* test(gateway): complete current runner fixtures
* fix(gateway): publish runner availability edges
* fix(ui): preserve shared session freshness
* fix(ui): preserve canonical sidebar session state
* fix(sessions): preserve abandoned partials and run-owned replies
* fix(sessions): resume durable abandonment retries
* test(gateway): compose provisioning replay with runner availability
* fix(sessions): publish recovered move transitions
2026-08-20 09:59:59 -07:00
46ef757a29
feat: add per-project cloud worker profile defaults ( #126238 )
...
* feat(config): add cloud worker project profiles
* feat(gateway): resolve project cloud worker profiles
* docs(gateway): document project profile defaults
* fix(gateway): require admin for project profile dispatch
2026-08-19 03:20:39 -07:00
80934e5639
feat(ui): dispatch sessions to paired devices ( #126187 )
2026-08-19 01:11:49 -07:00
97a4d324f5
fix(gateway): allow non-admin cloud sessions ( #125787 )
...
* fix(gateway): allow non-admin cloud sessions
Admin-provisioned shared runners are now usable by operator.write while raw environment, config, and pairing controls remain admin-only.
Closes #125602
* chore(test): prune assertion safety baseline
* refactor(gateway): isolate cloud reclaim lifecycle
* test(gateway): declare Codex dispatch ownership
* test(ui): cover session-scoped cloud cleanup
* perf(ui): trim tooltip startup path
* fix(gateway): fence cloud placement activation
* test(gateway): update move recovery dispatch contract
* fix(gateway): fail closed on placement recovery
* docs(gateway): explain fail-closed move recovery
* refactor(gateway): consolidate session mutation target keys
2026-08-18 11:33:54 -07:00
eab287d224
docs(gateway): correct node pairing storage ( #124571 )
2026-08-16 05:46:44 -07:00
e03d1a42f8
improve(ui): collapse limited access notice ( #123735 )
...
* improve(ui): collapse limited access notice
* test(ui): follow limited access banner host
* test(ui): await limited access guidance host
* test(compaction): split context budget coverage
---------
Co-authored-by: RoboClaw <309084314+roboclaw-bot@users.noreply.github.com >
2026-08-14 10:25:28 -07:00
6076efc968
docs(gateway): clarify dynamic operator scopes ( #122931 )
2026-08-12 19:23:54 -07:00
cef071582e
feat: let limited browsers request admin access ( #121459 )
...
* feat(gateway): add live device scope upgrades
* feat(ui): add limited-access upgrade flow
* fix(protocol): refresh Swift scope upgrade models
* perf(ui): lazy-load device scope upgrades
* fix(ci): complete scope upgrade generated surfaces
* perf(ui): lazy-load GitHub link hovercards
* fix(ui): keep admin repair guidance focusable
* fix(ui): gate and refresh scope upgrade banner
* refactor(ui): keep gateway client within line budget
* fix(ci): align rebased scope upgrade checks
* fix(ui): resolve scope upgrade in browser tests
* fix(gateway): honor refreshed scope upgrade deadline
* fix(gateway): honor refreshed scope upgrade deadline
* fix(gateway): coalesce scope upgrade waiters
* fix(ui): gate scope upgrade actions
* chore(plugin-sdk): refresh rebased API baseline
* fix(scope-upgrade): return canonical request ids
* fix(ui): preserve gateway event type binding
* fix(protocol): generate scope upgrade result models
* fix(ui): preserve scope upgrade recovery guidance
* chore(plugin-sdk): refresh rebased API baseline
* test(ui): avoid scope upgrade navigation race
* docs(control-ui): clarify scope upgrade approver
* test(gateway): align appended method counts
* chore(plugin-sdk): refresh rebased API baseline
* refactor(ui): keep place picker within line budget
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* chore(plugin-sdk): refresh rebased API baseline
* fix(gateway): preserve scope-upgrade browser origin
2026-08-12 18:32:00 -07:00
c6edd3e80f
feat(gateway): grant scopes by verified identity ( #121531 )
...
* feat(gateway): grant scopes by verified identity
* chore(plugin-sdk): refresh API baseline
* test(agents): isolate transcript repair mocks
2026-08-10 03:19:45 -07:00
34062ead20
fix(gateway): allow write-scoped session model changes ( #120875 )
2026-08-08 21:43:55 -07:00
47591e7b11
docs: document control ui owner handoff
2026-08-06 02:21:45 +01:00
618fba92bf
feat(audit): add execution identity inspection ( #117034 )
...
* feat(audit): add opt-in execution identity inspection
* fix(audit): gate recovery identity retention
* fix(audit): keep recovery identity type private
* test(audit): type internal recovery fixture
* test(audit): split recovery identity coverage
* docs(audit): define operator read trust boundary
* test(qa): register identity scenario child
* fix(audit): enforce shared identity retention bounds
* fix(audit): seal public ingress identity boundary
* fix(audit): keep ingress guard lint-clean
* fix(gateway): preserve advertised method order
* chore(protocol): sync advertised method order
* fix(protocol): encode audit selector invariants
* test(audit): prove exact execution guard
* fix(audit): keep identity storage lazy
2026-08-04 20:05:15 -05:00
151c549494
fix(browser): uploads fail when the browser runs on a remote node ( #115291 )
...
* fix(browser): resolve upload paths on the owning browser node, not the Gateway
When a browser session is proxied to a remote node, the upload action
previously ran resolveExistingUploadPaths on the Gateway, pinning paths
to a filesystem the node cannot see and rejecting node-local files. The
node-side /hooks/file-chooser route already re-resolves paths against
its own filesystem, so skip Gateway-local resolution whenever the
request is proxied and forward the requested paths as-is.
Fixes openclaw/openclaw#115251
* fix(browser): transfer uploads to remote browser nodes
* fix(browser): normalize upload abort errors
---------
Co-authored-by: Vincent Koc <vincentkoc@ieee.org >
2026-07-29 20:31:46 +08:00
e1a00726a3
feat(gateway): add least-privilege voice-node pairing ( #115712 )
...
* feat(gateway): add least-privilege voice-node pairing
* chore: leave voice-node note to release
* fix(gateway): keep bootstrap helpers private
* fix(ci): remove unused Code Mode type export
* fix(ci): remove stale model matrix import
* fix(ci): align QA evidence timeout guard
2026-07-29 04:09:37 -04:00
938749180e
refactor(nodes)!: retire arming leases for durable capability enablement ( #114892 )
...
* refactor(nodes): retire phone control leases
* fix(doctor): clean retired phone control state
* docs(nodes): document durable capability enablement
* docs(changelog): defer node enablement note
* fix(doctor): harden retired phone control cleanup
* fix(doctor): fail closed on unreadable lease state
* fix(doctor): validate retired lease journals
* fix(doctor): preserve deny-shadowed consent
* docs: refresh node authorization map
* fix(doctor): keep retirement helpers private
2026-07-27 23:51:30 -04:00
62c5a8b888
fix(gateway): make scope errors machine-readable across clients ( #111013 )
...
* fix(gateway): consume structured scope errors
* docs(gateway): clarify tools error boundary
* refactor(gateway): unify node admin policy
2026-07-18 17:53:45 -07:00
1d492f5c53
fix(gateway): honor scopes for WebChat session mutations ( #110931 )
...
* fix(gateway): authorize webchat session mutations by scope
* chore: keep gateway release note in PR body
2026-07-18 20:48:39 +01:00
8592b87c39
fix(node-pairing): require operator.admin to approve fs.listDir nodes ( #105936 ) ( #106004 )
...
* fix(node-pairing): require operator.admin to approve fs.listDir nodes (#105936 )
* fix(gateway): align node command authorization
---------
Co-authored-by: joshavant <830519+joshavant@users.noreply.github.com >
2026-07-13 16:40:55 -05:00
5b20013399
docs(security): clarify computer act authorization
2026-07-10 13:06:53 -05:00
f7d7148cf0
docs: rewrite published docs grounded in current source ( #100142 )
...
Source-grounded rewrite of 529 published docs pages with per-unit information-loss verification: 1,713 factual corrections cited to src/**, generated surfaces regenerated, frontmatter titles preserved for i18n, release notes pages untouched. All docs gates green.
Closes #100141
2026-07-05 00:32:47 -04:00
0d0bddf032
fix(gateway): require admin for device role approvals ( #87146 )
...
* fix(gateway): require admin for device role approvals
* fix(gateway): add trusted-proxy approval proof
2026-05-27 08:08:51 -07:00
517ce3df75
fix: require admin for node device approvals
2026-05-27 13:18:50 +01:00
01d95b9757
fix(gateway): allow bearer-auth session history reads ( #81815 )
...
Merged via squash.
Prepared head SHA: eb496673241575008+medns@users.noreply.github.com >
Co-authored-by: odysseus0 <8635094+odysseus0@users.noreply.github.com >
Reviewed-by: @odysseus0
2026-05-21 13:23:17 -07:00
c3f5c20f2c
fix(cli): retry admin device approval after ownership denial
2026-05-04 00:41:55 +01:00
e8f13c625e
fix(cli): request admin scope for admin device approvals
2026-05-03 01:38:24 +01:00
Peter Steinberger