Skip to content

fix: gate Gateway message action requester provenance [AI]#102031

Merged
pgondhi987 merged 11 commits into
openclaw:mainfrom
pgondhi987:fix/fix-841
Jul 8, 2026
Merged

fix: gate Gateway message action requester provenance [AI]#102031
pgondhi987 merged 11 commits into
openclaw:mainfrom
pgondhi987:fix/fix-841

Conversation

@pgondhi987

@pgondhi987 pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Resolves a problem where a write-scoped Gateway client could provide requester identity fields on message.action requests and have that identity treated as trusted channel provenance by downstream message actions.

Why This Change Was Made

The Gateway now treats requester account and sender provenance like other trusted channel-action context: only full-scope callers can bridge server-injected requester identity through the public RPC boundary. Write-scoped clients can still invoke supported message actions, but their caller-supplied requester identity and owner bit are stripped before channel dispatch.

User Impact

Operators keep the existing message.action workflow for normal write-scoped clients, while channel actions that depend on trusted sender identity no longer accept spoofed requester provenance from those clients. This narrows the authorization boundary without changing channel configuration, storage, migrations, or plugin manifests.

Evidence

  • AI-assisted PR.
  • git diff --check
  • node scripts/run-vitest.mjs src/gateway/server-methods/send.test.ts passed: 124 tests.
  • Remote validation attempted first, but unavailable in this environment: Blacksmith Testbox requires a newer Crabbox binary, direct AWS broker login is missing, and blacksmith CLI is unavailable.

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: S maintainer Maintainer-authored PR labels Jul 8, 2026
@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 6:48 AM ET / 10:48 UTC.

Summary
The PR gates Gateway message.action requester provenance so only trusted admin/backend bridge calls preserve requester identity, while write-scoped callers are downscoped and covered by Gateway and outbound tests.

PR surface: Source +79, Tests +312. Total +391 across 5 files.

Reproducibility: yes. Current main is source-reproducible because message.action forwards requester identity fields into channel dispatch for write-scoped callers, and the contributor’s live Gateway proof shows the after-fix denial and backend bridge control.

Review metrics: 1 noteworthy metric.

  • Gateway RPC behavior changed: 1 method behavior changed: message.action. The PR changes which Gateway clients may supply trusted requester provenance, a compatibility-sensitive RPC boundary.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

  • [P1] Merging intentionally changes compatibility for any write-scoped Gateway client that relied on caller-supplied requesterAccountId or requesterSenderId being treated as trusted channel-action provenance.
  • [P1] The PR is mergeable but behind the current base, so maintainers should refresh or rely on exact merge-queue checks before landing.

Maintainer options:

  1. Accept the intentional compatibility break after refresh (recommended)
    Land after maintainer approval and current-base checks, accepting that non-admin/write-scoped callers lose trusted requester provenance.
  2. Pause for migration or contract redesign
    Keep the PR open if maintainers want docs, a transition plan, or a different requester-provenance contract before changing existing client behavior.

Next step before merge

  • [P2] Human maintainer handling is needed for the protected-label Gateway security-boundary PR because the remaining blocker is compatibility acceptance and landing against current base, not an automated code repair.

Maintainer decision needed

  • Question: Should OpenClaw accept the intentional message.action compatibility change that strips requester provenance from non-admin/write-scoped callers while preserving the trusted backend bridge?
  • Rationale: The patch closes a Gateway requester-spoofing boundary, but it deliberately changes behavior for existing write-scoped clients that may have depended on caller-supplied requester provenance.
  • Likely owner: mcaxtr — mcaxtr introduced and merged the Gateway-routed message-action path that defines the compatibility boundary being hardened here.
  • Options:
    • Accept the boundary change (recommended): Proceed with this PR after base refresh/merge checks because the live Gateway proof shows spoofed write-scoped provenance is stripped and backend bridge provenance still works.
    • Pause for a different auth contract: Hold the PR if maintainers want a different permanent provenance model or migration story for write-scoped integrations.
    • Close and replace: Close this PR only if maintainers decide this compatibility break is unacceptable or needs a broader owner-authored redesign.

Security
Cleared: No supply-chain regression was found; the diff narrows a Gateway requester-provenance trust boundary and does not change dependencies, workflows, secrets, storage, or package resolution.

Review details

Best possible solution:

Land the narrow security-boundary fix after maintainer acceptance of the compatibility tradeoff and exact-head or merge-queue validation against current main.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main is source-reproducible because message.action forwards requester identity fields into channel dispatch for write-scoped callers, and the contributor’s live Gateway proof shows the after-fix denial and backend bridge control.

Is this the best way to solve the issue?

Yes. The PR gates trust at the Gateway RPC boundary, preserves the internal backend bridge with admin proof, and avoids adding a new config option, schema field, or plugin-specific workaround.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 58891c85b68b.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. A PR comment provides live Gateway WebSocket proof for the current head, including denied write-scoped spoofing, preserved backend bridge provenance, exact output JSON, and focused validation commands.
  • add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): A PR comment provides live Gateway WebSocket proof for the current head, including denied write-scoped spoofing, preserved backend bridge provenance, exact output JSON, and focused validation commands.
  • remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.
  • remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P0: The PR narrows a Gateway message.action requester-provenance trust boundary that could let scoped clients spoof trusted sender identity.
  • merge-risk: 🚨 compatibility: Existing write-scoped clients that relied on caller-supplied requester provenance will observe different channel-action authorization behavior after merge.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): A PR comment provides live Gateway WebSocket proof for the current head, including denied write-scoped spoofing, preserved backend bridge provenance, exact output JSON, and focused validation commands.
  • proof: sufficient: Contributor real behavior proof is sufficient. A PR comment provides live Gateway WebSocket proof for the current head, including denied write-scoped spoofing, preserved backend bridge provenance, exact output JSON, and focused validation commands.
Evidence reviewed

PR surface:

Source +79, Tests +312. Total +391 across 5 files.

View PR surface stats
Area Files Added Removed Net
Source 3 104 25 +79
Tests 2 341 29 +312
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 5 445 54 +391

What I checked:

  • Repository policy applied: Root AGENTS.md plus scoped Gateway, Gateway server-methods, outbound, and plugins guides were read; their whole-path, compatibility, security-boundary, and Gateway hot-path review guidance shaped this review. (AGENTS.md:1, 58891c85b68b)
  • Current main has the provenance gap: On current main, message.action forwards requesterAccountId and requesterSenderId from request params into dispatchChannelMessageAction; only senderIsOwner is gated on admin scope. (src/gateway/server-methods/send.ts:527, 58891c85b68b)
  • Gateway method scope contract: message.action is registered as an operator.write Gateway method, so trusted requester provenance needs separate handler-level gating rather than relying on method authorization alone. (src/gateway/methods/core-descriptors.ts:221, 58891c85b68b)
  • PR handler fix: At the PR head, requester provenance is preserved only for admin-scope callers, and trusted backend bridge dispatch is downscoped to operator.write for channel handlers. (src/gateway/server-methods/send.ts:556, 8da4343dabc0)
  • PR outbound bridge fix: At the PR head, outbound Gateway-owned message actions use callGateway with operator.admin only for backend bridge calls carrying requester provenance; other calls remain least-privileged. (src/infra/outbound/message-action-runner.ts:203, 8da4343dabc0)
  • Real behavior proof posted: The contributor posted live Gateway WebSocket proof for head 8da4343: write-scoped spoofed requester fields were absent at the sink, while the backend bridge control preserved trusted requester identity with effective write scopes. (8da4343dabc0)

Likely related people:

  • mcaxtr: Authored and merged the Gateway-routed message-action path in fix(whatsapp): route react through gateway #64638, touching the same Gateway handler and outbound runner now being hardened. (role: feature path introducer; confidence: high; commits: aaae1aeb8f56, 590e7d4ab41c, af5cdd664077; files: src/gateway/server-methods/send.ts, src/infra/outbound/message-action-runner.ts, src/infra/outbound/message-action-runner.plugin-dispatch.test.ts)
  • steipete: Recent history includes message-action fallback hardening and related outbound/Gateway refactors in the same runner path. (role: adjacent Gateway/outbound contributor; confidence: medium; commits: 71cd33713727, 39af215c3113, 13d1712850e0; files: src/infra/outbound/message-action-runner.ts, src/gateway/server-methods/send.ts)
  • gumadeiras: History shows nearby message-action plugin-discovery and outbound runtime work around the same runner and dispatch surfaces. (role: adjacent outbound/runtime contributor; confidence: medium; commits: 3ca8ad38459c, e29d3709696b, 03f18ec043de; files: src/infra/outbound/message-action-runner.ts, src/gateway/server-methods/send.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (10 earlier review cycles; latest 8 shown)
  • reviewed 2026-07-08T05:21:14.924Z sha 56751e5 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-08T05:44:43.069Z sha 394f63d :: needs real behavior proof before merge. :: [P2] Regenerate the Gateway protocol model
  • reviewed 2026-07-08T05:58:16.937Z sha cd00bc9 :: needs real behavior proof before merge. :: [P1] Keep the Swift message-action initializer additive
  • reviewed 2026-07-08T06:14:00.088Z sha 997cdd0 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-08T06:23:16.430Z sha 997cdd0 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-08T07:03:06.595Z sha 6f85fd7 :: needs real behavior proof before merge. :: [P1] Keep false owner provenance least-privilege
  • reviewed 2026-07-08T07:37:18.567Z sha 8da4343 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-08T10:33:38.778Z sha 8da4343 :: needs real behavior proof before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P0 Emergency: data loss, security bypass, crash loop, or unusable core runtime. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. labels Jul 8, 2026
@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@github-actions github-actions Bot mentioned this pull request Jul 8, 2026
Open
@openclaw-barnacle openclaw-barnacle Bot added the app: web-ui App: web-ui label Jul 8, 2026
@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@openclaw-barnacle openclaw-barnacle Bot added the scripts Repository scripts label Jul 8, 2026
@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added the merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. label Jul 8, 2026
@openclaw-barnacle openclaw-barnacle Bot removed app: web-ui App: web-ui scripts Repository scripts size: S labels Jul 8, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 message-delivery 🚨 May drop, duplicate, misroute, suppress, or wrongly target messages. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 8, 2026
@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

ClawSweeper proof for current head 8da4343

Behavior proved: a write-scoped Gateway message.action caller is blocked from supplying trusted requester provenance into channel action authorization, while the trusted backend Gateway bridge still preserves server-derived requester identity.

Environment: local PR checkout at head 8da4343dabc0035906ba54b82cbd11ab4e738c3e; real OpenClaw Gateway test server over WebSocket from src/gateway/test-helpers.server.ts; synthetic proofchat channel plugin used only as the external channel-action sink.

Protected boundary/sink/source: public Gateway message.action request fields crossing into trusted ChannelMessageActionContext sender provenance and the channel plugin action sink. The protected source is trusted requester provenance; the protected sink is the channel action context consumed by plugin authorization.

Command/artifact:

  • node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway-server.config.ts src/gateway/message-action-gateway-proof.temp.test.ts --reporter=verbose
  • Focused validation also passed: git diff --check; node scripts/run-vitest.mjs src/gateway/server-methods/send.test.ts src/infra/outbound/message-action-runner.plugin-dispatch.test.ts (126 + 30 tests).
  • Review gates for this head: GHSA dry-run PASS (ACCEPT / SOLVES / PASS compatibility), review-pr READY with zero findings, Claude autoreview clean, GitHub CI rollup with no pending or failing relevant checks.

Evidence:

  • fixed/denied: a WebSocket Gateway client connected with scopes:["operator.write"] and sent requesterAccountId:"default", requesterSenderId:"spoofed-admin-user", and senderIsOwner:true; protected sink/source result: requester provenance was not exposed to the channel action context, no policy access to trusted requester provenance was exposed, and trusted requester calls: zero (requesterAccountId absent, requesterSenderId absent, senderIsOwner:false, gatewayClientScopes:["operator.write"]).
  • control: a backend Gateway client connected with scopes:["operator.admin"] and sent server-derived requester provenance; intended behavior result: trusted provenance still reached the channel action context as requesterAccountId:"default", requesterSenderId:"trusted-user", senderIsOwner:false, with effective gatewayClientScopes:["operator.write"].
  • exact emitted proof JSON: {"head":"8da4343dabc0035906ba54b82cbd11ab4e738c3e","denied":{"senderIsOwner":false,"gatewayClientScopes":["operator.write"]},"control":{"requesterAccountId":"default","requesterSenderId":"trusted-user","senderIsOwner":false,"gatewayClientScopes":["operator.write"]}}.

Compatibility/operator note: existing message.action method/schema/config/storage/provider surfaces are unchanged. The intentional behavior change is that non-admin/write-scoped Gateway callers no longer get caller-supplied requester provenance treated as trusted sender context; backend bridge calls keep trusted provenance but channel-handler authorization remains effectively operator.write.

Live gaps: no private Discord/WhatsApp/native channel credentials were used. The local proof uses the real Gateway WebSocket path and stubs only the external provider/channel sink; GitHub Actions CI is green for the PR head.

@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 8, 2026
@pgondhi987

pgondhi987 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

Verification before merge:

Behavior addressed: write-scoped Gateway message.action callers can no longer inject trusted requester sender provenance into channel action authorization.
Real environment tested: local PR checkout at head 8da4343dabc0035906ba54b82cbd11ab4e738c3e, real local Gateway WebSocket test server, GitHub Actions PR CI, ClawSweeper re-review.
Exact steps or command run after this patch:

  • auto-pr.sh issue 841 --run-stage ghsa_dry_run → passed for 8da4343dabc0035906ba54b82cbd11ab4e738c3e.
  • scripts/pr review-validate-artifacts 102031 → READY FOR /prepare-pr, 0 findings.
  • timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --engine claude --claude-bin /home/ubuntu/.nvm/versions/node/v24.15.0/lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe → clean.
  • git diff --check; node scripts/run-vitest.mjs src/gateway/server-methods/send.test.ts src/infra/outbound/message-action-runner.plugin-dispatch.test.ts → 126 + 30 tests passed.
  • node scripts/run-vitest.mjs run --config test/vitest/vitest.gateway-server.config.ts src/gateway/message-action-gateway-proof.temp.test.ts --reporter=verbose → live Gateway WebSocket proof passed.
  • auto-pr.sh issue 841 --run-stage ghsa_real_gate → passed and posted reporter-ready evaluation.
    Evidence after fix:
  • Gateway proof denied case: write-scoped spoofed requester fields reached the channel sink as no requester account/sender, senderIsOwner:false, gatewayClientScopes:["operator.write"].
  • Gateway proof control: backend bridge preserved requesterSenderId:"trusted-user" with effective gatewayClientScopes:["operator.write"].
  • review-pr: passed; autoreview: passed; ClawSweeper: proof sufficient, no contributor-facing source/proof blocker remains.
  • CI: statusCheckRollup for 8da4343dabc0035906ba54b82cbd11ab4e738c3e had no pending or failing relevant checks.
    Observed result after fix: the protected trusted requester-provenance source is suppressed for write-scoped public RPC callers, while intended backend bridge behavior still works.
    What was not tested: no private Discord/WhatsApp/native channel credentials; Mantis Telegram proof was not requested.

Regression Risk:
Medium. The changed boundary is Gateway message.action requester provenance; auth, config, storage, migrations, provider setup, and protocol schema stay unchanged. Existing clients that relied on write-scoped spoofed requester fields will lose that behavior intentionally.

Best fix verdict: best/appropriate. The fix belongs at the Gateway trust boundary rather than duplicating sender-provenance checks in every channel plugin, and it preserves the internal backend bridge without exposing admin scope to plugin authorization.

User behavior change:
Before, an operator.write Gateway client could make requester identity fields effective in channel actions. After, only full-scope trusted callers can bridge requester provenance; ordinary write-scoped message.action calls still validate but their requester identity fields are ignored before dispatch.

@pgondhi987
pgondhi987 merged commit e25fa79 into openclaw:main Jul 8, 2026
6 checks passed
@github-actions github-actions Bot mentioned this pull request Jul 8, 2026
Open
giodl73-repo pushed a commit to giodl73-repo/openclaw that referenced this pull request Jul 8, 2026
@pgondhi987 @giodl73-repo
fix: gate Gateway message action requester provenance [AI] (openclaw#…
425c5b6 
…102031)

* fix: gate message action requester provenance

* fix: preserve trusted gateway action context

* fix: preserve message action effective scopes

* chore: refresh gateway protocol swift model

* fix: keep swift message action init additive

* fix: avoid message action wire shape change

* fix: downscope non-owner message action bridge

* fix: keep cli message actions least privileged

* fix: downscope message action runtime scope

* fix: normalize message action bridge provenance
This was referenced Jul 9, 2026
Merged
Merged
Merged
Open
Open
Open
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 9, 2026
@pgondhi987
fix: gate Gateway message action requester provenance [AI] (openclaw#…
328abae 
…102031)

* fix: gate message action requester provenance

* fix: preserve trusted gateway action context

* fix: preserve message action effective scopes

* chore: refresh gateway protocol swift model

* fix: keep swift message action init additive

* fix: avoid message action wire shape change

* fix: downscope non-owner message action bridge

* fix: keep cli message actions least privileged

* fix: downscope message action runtime scope

* fix: normalize message action bridge provenance
wheakerd pushed a commit to wheakerd/clawdbot that referenced this pull request Jul 15, 2026
@pgondhi987 @RomneyDa
fix: gate Gateway message action requester provenance [AI] (openclaw#…
8c31e66 
…102031)

* fix: gate message action requester provenance

* fix: preserve trusted gateway action context

* fix: preserve message action effective scopes

* chore: refresh gateway protocol swift model

* fix: keep swift message action init additive

* fix: avoid message action wire shape change

* fix: downscope non-owner message action bridge

* fix: keep cli message actions least privileged

* fix: downscope message action runtime scope

* fix: normalize message action bridge provenance

(cherry picked from commit e25fa79)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P0 Emergency: data loss, security bypass, crash loop, or unusable core runtime. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pgondhi987