mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-17 08:02:12 -06:00
Peter Steinberger
bdcc6836e0
* refactor(gateway): delete the retired Control UI device-auth migration window The one-time remediation window for the retired gateway.controlUi.dangerouslyDisableDeviceAuth break-glass threaded a pending state machine through the connect pipeline, startup bootstrap, lifecycle, request context, device management, security audit, the hello frame, and a Control UI banner flow — steady-state runtime carrying a retired-shape shim the architecture reserves for doctor. The window is closed: the retired key is now fully inert, doctor still detects and removes it, and a browser that never completed the migration pairs through the normal device flow (one approval, no data loss). Deleted with it: the config-machine-state import of the legacy flag, the hello deviceAuthMigration field (optional; clients validate envelopes only, so older gateways emitting it stay compatible), the migration-bound device management authz states, the requireNoPairingCapableOperator approval mode, the effective-operator pairing event emitter whose only subscriber was the migration completion, and the Control UI banner, loader, overlay wiring, i18n strings, and e2e scenario support. Swift and Kotlin protocol models regenerated. Live-verified on an isolated gateway with the retired key present in config: clean boot with no migration warning, silent CLI pairing and silent local scope widening unaffected, and doctor reporting the key as retired-and-inert. Net -1111 production LOC. * fix(ci): finish migration-window cleanup surfaced by the gates The doctor migration for the retired key kept its "Preserved for remediation" change text and describe; both now state plain removal, with the retired tests updated. peekStoredDeviceIdentityId lost its only production consumer with the deleted banner loader and is removed with its test mock. Also fixes the unrelated no-unnecessary-boolean-literal-compare lint break that #124636 landed on main in scripts/check-changed.mts (truthiness is equivalent for the boolean-or-undefined TTY probe). * fix(ui): drop the retired-key device-auth reader from the security summary Review findings on the migration-window removal: the Control UI security summary still derived its "Device auth" row from the retired dangerouslyDisableDeviceAuth key, rendering device auth as disabled on configurations that merely retain the inert key. Device auth is now unconditionally enforced, so the row and its derivation are removed rather than pinned to a constant. The build-admission test also tracks and removes its temporary device-identity databases after each run.
