Gateway: fix device identity required despite dangerouslyDisableDeviceAuth=true by alexyyyander · Pull Request #29960 · openclaw/openclaw

alexyyyander · 2026-02-28T17:45:05Z

Summary

When gateway.controlUi.dangerouslyDisableDeviceAuth=true is set, the Gateway was still requiring device identity if there was no shared auth (token/password) present.

Root Cause

The evaluateMissingDeviceIdentity() function in connect-policy.ts didn't check the allowBypass flag early enough. It fell through to roleCanSkipDeviceIdentity() which requires sharedAuthOk=true, but when there's no token/password, sharedAuthOk is false, causing the connection to be rejected with "device identity required" even though device auth was supposed to be disabled.

Fix

Added an early check for controlUiAuthPolicy.allowBypass at the beginning of evaluateMissingDeviceIdentity(), which returns 'allow' immediately when device auth is disabled, regardless of whether shared auth is present.

Changes

src/gateway/server/ws-connection/connect-policy.ts: Added early return when allowBypass is true
src/gateway/server/ws-connection/connect-policy.test.ts: Added test coverage for the scenario

Fixes #29801

The secondary window was defaulting to 24 hours (86400 seconds), causing the status to show 'Day' instead of 'Week' for users with weekly usage limits when the API doesn't return the limit. Changed default to 604800 seconds (168 hours = 1 week) since Codex typically has weekly secondary windows.

Previously, detectContentType() checked for MP4 magic bytes (ftyp at bytes 4-7) before the M4A-specific check, causing LINE voice messages (M4A/AAC-LC in MPEG-4 container) to be misclassified as video/mp4 instead of audio/mp4. This fix checks the ftyp sub-brand at bytes 8-11 to distinguish: - M4A / M4B (audio) -> returns audio/mp4 - isom/mp42 (video) -> returns video/mp4 Fixes openclaw#29751

- Show days (e.g., '2d', '3d') for multi-day windows between 24-167 hours - 24 hours = 'Day', 168+ hours = 'Week' - Previously all windows >= 24 hours showed as 'Day', which was confusing for multi-day periods

Fix issue openclaw#29886 where isolated sessions (cron/subagents) could not access built-in provider env vars from openclaw.json. The issue was that config env vars (like OPENAI_API_KEY, ANTHROPIC_API_KEY) configured in openclaw.json were not being applied to process.env when running isolated cron sessions. This fix ensures applyConfigEnvVars is called at the start of runCronIsolatedAgentTurn to ensure these env vars are available when resolving API keys for built-in providers.

The hardcoded system prompt instructed agents to use memory_search + memory_get to pull only needed lines from memory files, which conflicts with AGENTS.md that instructs agents to read entire memory files directly. This conflict caused confusion for agents deciding which instructions to follow. Fixes openclaw#29772

Fixes openclaw#29772 - Hardcoded system prompt conflicts with AGENTS.md The AGENTS.md template instructed agents to read memory files directly, while the system prompt instructed to use memory_search/memory_get tools for memory context. This caused conflicting guidance. Changes: - Update AGENTS.md template to use memory_search/memory_get for memory - Keep reading SOUL.md and USER.md directly (identity files) - Update AGENTS.default.md similarly for consistency

…eAuth=true When gateway.controlUi.dangerouslyDisableDeviceAuth=true is set, the Gateway was still requiring device identity if there was no shared auth (token/password) present. This was because evaluateMissingDeviceIdentity() didn't check the allowBypass flag early enough - it fell through to roleCanSkipDeviceIdentity() which requires sharedAuthOk=true. Fix by adding an early check for controlUiAuthPolicy.allowBypass at the beginning of evaluateMissingDeviceIdentity(), which returns 'allow' immediately when device auth is disabled, regardless of whether shared auth is present. Also adds test coverage for this scenario. Fixes openclaw#29801

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 735297d3a9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-02-28T17:50:34Z

src/agents/system-prompt.ts

-    "## Memory Recall",
-    "Before answering anything about prior work, decisions, dates, people, preferences, or todos: run memory_search on MEMORY.md + memory/*.md; then use memory_get to pull only the needed lines. If low confidence after search, say you checked.",
-  ];
+  const lines = ["## Memory Recall"];


Reinstate memory lookup instruction in system prompt

The Memory Recall section now only emits a heading plus citation formatting guidance, but no longer tells the model to run memory_search/memory_get before answering questions about prior work or preferences. In sessions where memory tools are available, this regression makes it much more likely the agent responds from stale model context instead of retrieved notes, reducing answer accuracy for history-dependent queries.

Useful? React with 👍 / 👎.

greptile-apps · 2026-02-28T17:54:55Z

Greptile Summary

Fixes device identity requirement bug when device auth is set to bypass mode by adding an early check in the evaluateMissingDeviceIdentity() function. The fix correctly handles cases where device auth is disabled but no shared authentication is present.

Key changes:

connect-policy.ts: Added early return when bypass is enabled, preventing fallthrough to role-based logic that requires shared auth
connect-policy.test.ts: Added comprehensive test coverage for both operator and node roles
Also includes unrelated fixes: cron config env vars ([Bug]: Isolated sessions (cron/subagents) cannot access built-in provider env vars from openclaw.json #29886), codex usage window label improvements, MP4/M4A detection improvements, and AGENTS.md memory instruction updates

Critical issue found: Comment corruption on line 94 of connect-policy.ts must be fixed before merge

Confidence Score: 3/5

Safe to merge after fixing the corrupted comment on line 94
The core logic fix is correct and well-tested with comprehensive coverage. However, there's a critical syntax issue (corrupted comment) that must be fixed before merging. The unrelated changes in the PR are all correct and safe. Score reflects the need to address the comment corruption before merge.
Pay attention to src/gateway/server/ws-connection/connect-policy.ts - fix the corrupted comment on line 94

_{Last reviewed commit: 735297d}

greptile-apps

_{8 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-28T17:54:58Z

src/gateway/server/ws-connection/connect-policy.ts

    // (needed for device identity) is unavailable in insecure HTTP contexts.
    // Remote connections are still rejected to preserve the MitM protection
-    // that the security fix (#20684) intended.
+    // that the security fix (#20684) (!params.controlUi intended.


comment corrupted - extra text (!params.controlUi inserted

Suggested change

// that the security fix (#20684) (!params.controlUi intended.

// that the security fix (#20684) intended.

Prompt To Fix With AI

This is a comment left during a code review. Path: src/gateway/server/ws-connection/connect-policy.ts Line: 94 Comment: comment corrupted - extra text `(!params.controlUi` inserted ```suggestion // that the security fix (#20684) intended. ``` How can I resolve this? If you propose a fix, please make it concise.

openclaw-barnacle · 2026-03-06T04:03:17Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

RepairYourTech · 2026-03-08T03:19:17Z

is this being worked on ?

alexyyyander added 7 commits February 28, 2026 15:31

fix: improve openai-codex usage window label display

dca614e

- Show days (e.g., '2d', '3d') for multi-day windows between 24-167 hours - 24 hours = 'Day', 168+ hours = 'Week' - Previously all windows >= 24 hours showed as 'Day', which was confusing for multi-day periods

openclaw-barnacle bot added docs Improvements or additions to documentation gateway Gateway runtime agents Agent runtime and tooling size: S labels Feb 28, 2026

chatgpt-codex-connector bot reviewed Feb 28, 2026

View reviewed changes

greptile-apps bot reviewed Feb 28, 2026

View reviewed changes

razvanandreibratu approved these changes Feb 28, 2026

View reviewed changes

openclaw-barnacle bot added the stale Marked as stale due to inactivity label Mar 6, 2026

openclaw-barnacle bot removed the stale Marked as stale due to inactivity label Mar 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Gateway: fix device identity required despite dangerouslyDisableDeviceAuth=true#29960

Gateway: fix device identity required despite dangerouslyDisableDeviceAuth=true#29960
alexyyyander wants to merge 7 commits intoopenclaw:mainfrom
alexyyyander:fix/29801-dangerously-disable-device-auth

alexyyyander commented Feb 28, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Feb 28, 2026

Uh oh!

greptile-apps bot commented Feb 28, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Feb 28, 2026

Uh oh!

openclaw-barnacle bot commented Mar 6, 2026

Uh oh!

RepairYourTech commented Mar 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	// that the security fix (#20684) (!params.controlUi intended.
	// that the security fix (#20684) intended.

Uh oh!

Conversation

alexyyyander commented Feb 28, 2026

Summary

Root Cause

Fix

Changes

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Feb 28, 2026

Greptile Summary

Confidence Score: 3/5

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

openclaw-barnacle bot commented Mar 6, 2026

Uh oh!

RepairYourTech commented Mar 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants