fix(ui): preserve gateway token when editing websocket url by wsyjh8 · Pull Request #41546 · openclaw/openclaw

wsyjh8 · 2026-03-09T23:59:26Z

Summary

Describe the problem and fix in 2–5 bullets:

Problem: Editing the WebSocket URL in Overview → Gateway Access cleared the Gateway Token field immediately.
Why it matters: This caused Connect to fail unless the user noticed the token was cleared and re-entered it manually.
What changed: Removed the incorrect token reset from the WebSocket URL input handler so editing the URL preserves the existing token.
What did NOT change (scope boundary): No backend, gateway, auth flow, storage schema, or network behavior was changed.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes [Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545
Related #

User-visible / Behavior Changes

Editing the WebSocket URL no longer clears the Gateway Token field in Overview → Gateway Access.
Users can now update the WebSocket URL without needing to re-enter the token before clicking Connect.

Security Impact (required)

New permissions/capabilities? (No)
Secrets/tokens handling changed? (No)
New/changed network calls? (No)
Command/tool execution surface changed? (No)
Data access scope changed? (No)
If any Yes, explain risk + mitigation:

Repro + Verification

Environment

OS: Windows 10
Runtime/container: Source checkout, frontend started locally via pnpm ui:dev
Model/provider: N/A
Integration/channel (if any): N/A
Relevant config (redacted): Overview → Gateway Access form with WebSocket URL and Gateway Token

Steps

Open the dashboard UI and go to Overview.
Enter a value into Gateway Token.
Edit the WebSocket URL field.
Observe whether the token remains unchanged.
Click Connect.

Expected

Editing WebSocket URL should not clear Gateway Token.
Connect should continue using the preserved token.

Actual

Before this fix, editing WebSocket URL immediately cleared Gateway Token.
After this fix, the token remains unchanged and Connect works with the preserved token.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios:
- Entered Gateway Token first, then edited WebSocket URL: token remained unchanged.
- Entered WebSocket URL first, then entered Gateway Token, then edited WebSocket URL again: token remained unchanged.
- After entering a correct token, Connect succeeded without needing to re-enter the token.
Edge cases checked:
- Verified the issue reproduced on the latest upstream/main before the fix.
- Verified the token was previously cleared on input, even before focus left the URL field.
What you did not verify:
- Did not add or verify automated tests for this UI path.
- Did not verify behavior across multiple browsers or production builds beyond local manual verification.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes)
Config/env changes? (No)
Migration needed? (No)
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: Revert this PR or restore the previous version of ui/src/ui/views/overview.ts.
Files/config to restore: ui/src/ui/views/overview.ts
Known bad symptoms reviewers should watch for:
- Gateway Token still gets cleared when WebSocket URL is edited.
- Connect fails because token is unexpectedly missing after editing the URL.

Risks and Mitigations

Risk: Low. The change is limited to a single UI input handler in Overview.
Mitigation: The fix preserves the existing settings object and removes only the incorrect token-clearing behavior. Manual verification confirmed that token preservation now works in both input orders and that Connect still succeeds with the preserved token.

greptile-apps · 2026-03-10T00:01:04Z

Greptile Summary

This PR fixes a bug where editing the WebSocket URL in Overview → Gateway Access immediately cleared the Gateway Token field on every keystroke, causing Connect to fail unless the user re-entered the token manually.

Root cause: The removed line evaluated v.trim() === props.settings.gatewayUrl.trim() on every @input event — comparing the partially-typed new value against the previously saved URL. Since these never match while typing, token was set to "" on the very first keystroke, wiping the user's token silently.

Fix: Removing the line lets the existing object spread (...props.settings) handle the update, which naturally preserves token (and all other settings fields) while only updating gatewayUrl.

The change is a one-line removal, scoped entirely to the URL input handler in ui/src/ui/views/overview.ts. No backend, auth flow, storage, or network behavior is affected. The fix is correct and fully backward compatible.

Confidence Score: 5/5

This PR is safe to merge — it is a minimal, clearly correct one-line removal with no side effects.
The removed line contained an obvious logical defect: it compared a partially-typed URL against the saved URL on every input event, so the condition was almost always false and the token was silently wiped on the first keystroke. Removing it lets the existing spread operator preserve all settings fields correctly. The change is fully backward compatible, touches no backend or auth logic, and the fix matches the described bug exactly.
No files require special attention.

_{Last reviewed commit: ae39061}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae39061ed9

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: facae6fe7b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

openclaw-barnacle · 2026-04-26T04:37:31Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

clawsweeper · 2026-04-27T10:46:34Z

Codex review: keeping this open for maintainer follow-up; there is still a little grit to resolve.

Keep this PR open. Current main still clears the Control UI Gateway Token during ordinary WebSocket URL edits, while this PR is the active scoped repair for open bug #41545 and addresses the earlier token-leak review concern by preserving tokens only within the same normalized gateway endpoint.

Best possible solution:

Review and land this PR or an equivalent focused patch as the canonical fix for #41545: reuse the normalized gateway token scope helper, preserve manually entered Gateway Access tokens during same-scope URL formatting edits, clear them on real endpoint changes, keep the regression coverage and changelog credit, then close or supersede duplicate PRs #41718 and #42001.

What I checked:

current-main-url-handler-still-clears-token: The Overview Gateway Access WebSocket URL input handler on current main sets token to an empty string whenever the edited trimmed value differs from the previous gatewayUrl, which happens during ordinary typing and same-endpoint formatting edits. (ui/src/ui/views/overview.ts:271, a820a307dfeb)
connect-uses-current-settings-token: Gateway connections pass host.settings.token into GatewayBrowserClient, so clearing the UI setting directly affects shared-secret auth on Connect. (ui/src/ui/app-gateway.ts:414, a820a307dfeb)
token-storage-is-gateway-scoped: Current storage derives token session keys through normalizeGatewayTokenScope(gatewayUrl) and persists the token under the current gateway URL scope, matching the desired same-scope preserve/different-scope clear behavior. (ui/src/ui/storage.ts:106, a820a307dfeb)
docs-confirm-selected-gateway-url-scope: The dashboard docs say the UI keeps dashboard URL tokens in sessionStorage for the current browser tab session and selected gateway URL, so token preservation needs to respect endpoint scope. Public docs: docs/web/dashboard.md. (docs/web/dashboard.md:33, a820a307dfeb)
current-tests-cover-clear-on-different-gateway-only: Current browser coverage verifies hash-token hydration and clearing after changing to another gateway, but current main lacks same-scope URL-formatting preservation coverage. (ui/src/ui/navigation.browser.test.ts:562, a820a307dfeb)
pr-head-live-and-scoped: Provided PR context shows the current head changes the handler to compare normalized gateway token scopes, exports the scope helper, adds regression coverage, and adds changelog credit. git ls-remote confirms 24a1f1353d5d2fdf182e6c9a50dc96b49d749a6f is still the live head for this PR. (24a1f1353d5d)

Likely related people:

Peter Steinberger [email protected]: Available blame and shortlog for the relevant current-main Overview handler, gateway token storage helper, and browser token coverage point to Peter-authored mainline commits in the central Control UI files. (role: current-main Control UI area maintainer / source provenance; confidence: medium; commits: 7b2b0d07e84e, be8c24633aaa; files: ui/src/ui/views/overview.ts, ui/src/ui/storage.ts, ui/src/ui/navigation.browser.test.ts)
vincentkoc: The PR discussion says vincentkoc pushed the scoped repair to this branch, noted pnpm check:changed, and managed maintainer review labels; git ls-remote confirms that repair SHA is still the live PR head. (role: recent maintainer follow-up owner; confidence: medium; commits: 24a1f1353d5d; files: ui/src/ui/views/overview.ts, ui/src/ui/storage.ts, ui/src/ui/navigation.browser.test.ts)

Remaining risk / open question:

Until this PR or an equivalent patch lands, current main continues to clear manually entered Gateway Access tokens during harmless WebSocket URL edits, causing avoidable Connect failures.
Gateway token preservation is security-sensitive: a landed fix must preserve only within the same normalized gateway endpoint and continue clearing on real endpoint changes, or a token could be sent to a different gateway.
Closing this PR now would leave the same-author open bug [Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545 and duplicate implementation attempts fix(ui): prevent WebSocket URL edit from clearing Gateway Token #41718/fix(ui): preserve gateway token when editing WebSocket URL #42001 without a landed canonical fix.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a820a307dfeb.

vincentkoc · 2026-04-28T07:19:18Z

ProjectClownfish pushed a narrow repair to this branch so the original contributor path can stay canonical.

Source PR: #41546
Validation: pnpm check:changed
Contributor credit is preserved in the branch history and PR context.

openclaw-clownfish · 2026-04-29T09:08:16Z

Thanks @wsyjh8. I am closing this as superseded by #73923 because both PRs track the same #41545 Gateway Token bug, and #73923 is now the canonical Clownfish path: #73923.

That path preserves the token for same-normalized-endpoint URL edits while keeping the per-gateway token boundary, and its checks are green. Your original report and PR remain part of the credited source trail for this fix. If this PR has a distinct reproduction path or #73923 still misses something after review, please reply and we can reopen or split it back out.

…26.6.8) (#1144) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.6` → `2026.6.8` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.8`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202668) [Compare Source](openclaw/openclaw@v2026.6.6...v2026.6.8) ##### Highlights - Telegram and WhatsApp channel delivery are richer and less brittle: Telegram can send structured rich text with tables, lists, expandable blockquotes, prompt-preserving CLI backend delivery, retired native draft migration, and safer rich-media boundaries, while WhatsApp now honors configured ACP bindings. ([#92679](openclaw/openclaw#92679), [#84082](openclaw/openclaw#84082), [#89421](openclaw/openclaw#89421), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus), [@jzakirov](https://github.com/jzakirov), [@spacegeologist](https://github.com/spacegeologist), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent and Gateway recovery is sharper across account-scoped DM sends, generated media completions, restart shutdown aborts, yielded subagent pauses, yielded cron media, heartbeat dedupe, session identity prompts, and unknown OpenAI agent selector rejection. ([#92788](openclaw/openclaw#92788), [#91246](openclaw/openclaw#91246), [#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510)) Thanks [@yetval](https://github.com/yetval), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), and [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Provider/model handling expands and tightens with GLM-5.2, Claude Haiku 4.5 catalog rows, OpenRouter and Google Vertex provider-prefix normalization, managed SecretRef auth, bounded model browse discovery, storeless OpenAI Responses replay gating, and Claude 4.5 Copilot tool-streaming safety. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@snowzlm](https://github.com/snowzlm), and [@Kailigithub](https://github.com/Kailigithub). - `/usage` and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - UI and mobile flows are steadier: workspace files can collapse and start collapsed, WebChat backscroll survives streaming, the sidebar session picker remains interactive above the desktop workbench, reset soft args survive UI dispatch, stale dashboard session parent lineage is preserved, and iOS reconnects stale foreground gateways. ([#92779](openclaw/openclaw#92779), [#92622](openclaw/openclaw#92622), [#92705](openclaw/openclaw#92705), [#91353](openclaw/openclaw#91353), [#90658](openclaw/openclaw#90658), [#92552](openclaw/openclaw#92552)) Thanks [@shakkernerd](https://github.com/shakkernerd), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@NianJiuZst](https://github.com/NianJiuZst), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@luoyanglang](https://github.com/luoyanglang), and [@Solvely-Colin](https://github.com/Solvely-Colin). - Memory, state, and diagnostics recover cleaner: oversized OpenAI embedding batches split before 431s, QMD memory search stays available in transient mode, SQLite avoids WAL on NFS state volumes, stuck-session recovery scheduling no longer resets warning backoff, and Infinity chunk limits stay genuinely unbounded. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752), [#92735](openclaw/openclaw#92735)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), [@gnanam1990](https://github.com/gnanam1990), and [@yhterrance](https://github.com/yhterrance). ##### Changes - Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), and [@bymle](https://github.com/bymle). - Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including rich prompt handoff to CLI backends and transport fixtures for richer drafts. ([#92679](openclaw/openclaw#92679), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus) and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent commands: support `/btw` in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. ([#92669](openclaw/openclaw#92669), [#92162](openclaw/openclaw#92162)) Thanks [@joshavant](https://github.com/joshavant) and [@Pandah97](https://github.com/Pandah97). - Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - Docs and operator guidance: document node config examples, clarify before-install hook scope, correct agent default concurrency comments, refresh ZAI provider docs, and update channel/group docs for current Telegram and WhatsApp behavior. ([#92677](openclaw/openclaw#92677), [#92766](openclaw/openclaw#92766), [#92695](openclaw/openclaw#92695)) Thanks [@liuhao1024](https://github.com/liuhao1024), [@sallyom](https://github.com/sallyom), and [@ArielSmoliar](https://github.com/ArielSmoliar). ##### Fixes - Onboarding/skills: show the Homebrew install recommendation only on macOS and Linux, so FreeBSD and other unsupported platforms no longer get a misleading brew prompt. Fixes [#68893](openclaw/openclaw#68893); carries forward [#68894](openclaw/openclaw#68894), [#68910](openclaw/openclaw#68910), [#68941](openclaw/openclaw#68941), [#68943](openclaw/openclaw#68943), [#69002](openclaw/openclaw#69002), and [#69545](openclaw/openclaw#69545). Thanks [@yurivict](https://github.com/yurivict), [@Sanjays2402](https://github.com/Sanjays2402), [@Eruditi](https://github.com/Eruditi), [@JustInCache](https://github.com/JustInCache), [@nnish16](https://github.com/nnish16), and [@Mlightsnow](https://github.com/Mlightsnow). - Channels and delivery: preserve account-scoped DM channel send policy, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Slack outbound `message_sent` hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. ([#92788](openclaw/openclaw#92788), [#92679](openclaw/openclaw#92679), [#89421](openclaw/openclaw#89421), [#89943](openclaw/openclaw#89943), [#91137](openclaw/openclaw#91137), [#91246](openclaw/openclaw#91246), [#92735](openclaw/openclaw#92735)) Thanks [@yetval](https://github.com/yetval), [@obviyus](https://github.com/obviyus), [@spacegeologist](https://github.com/spacegeologist), [@rishitamrakar](https://github.com/rishitamrakar), [@lundog](https://github.com/lundog), [@TurboTheTurtle](https://github.com/TurboTheTurtle), and [@yhterrance](https://github.com/yhterrance). - Auto-reply/groups: keep ordinary group text replies on automatic final-reply delivery while allowing `message(action=send)` for files, images, and other attachments to the same group or topic. Carries forward [#43276](openclaw/openclaw#43276); refs [#48004](openclaw/openclaw#48004). Thanks [@NayukiChiba](https://github.com/NayukiChiba) and [@ShakaRover](https://github.com/ShakaRover). - Auto-reply/skills: preserve multiline payloads for `/skill` and direct skill slash commands while keeping command-head normalization for aliases, colon syntax, and bot mentions. Fixes [#79155](openclaw/openclaw#79155); carries forward [#81305](openclaw/openclaw#81305). Thanks [@web3blind](https://github.com/web3blind). - iMessage: normalize leading NUL sent-message echo prefixes while preserving interior NUL bytes and the leading attributedBody marker handling from [#73942](openclaw/openclaw#73942). Carries forward [#63581](openclaw/openclaw#63581). Thanks [@drvoss](https://github.com/drvoss). - Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. ([#64734](openclaw/openclaw#64734)) Thanks [@hanamizuki](https://github.com/hanamizuki). - Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, preserve yielded media completions, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions and slash-command block replies in WebChat, preserve fresh post-compaction usage while clearing stale usage snapshots, and require admin privileges for HTTP session/model override surfaces. ([#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510), [#91246](openclaw/openclaw#91246), [#50795](openclaw/openclaw#50795), [#50845](openclaw/openclaw#50845), [#82874](openclaw/openclaw#82874), [#92651](openclaw/openclaw#92651), [#92646](openclaw/openclaw#92646)) Thanks [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@Hollychou924](https://github.com/Hollychou924), [@leno23](https://github.com/leno23), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agents/exec: default empty-success background completion notices on only for real chat channels, preserving explicit opt-outs and keeping generic providers silent while carrying forward the narrow UX intent from [#39726](openclaw/openclaw#39726) and [#46926](openclaw/openclaw#46926). Thanks [@Sapientropic](https://github.com/Sapientropic) and [@wenkang-xie](https://github.com/wenkang-xie). - Providers and model replay: preserve storeless OpenAI Responses replay compatibility, avoid eager tool streaming for Claude 4.5 in Copilot, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. ([#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#92628](openclaw/openclaw#92628)) Thanks [@snowzlm](https://github.com/snowzlm), [@Kailigithub](https://github.com/Kailigithub), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), and [@mushuiyu886](https://github.com/mushuiyu886). - Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, and keep shell environment fallbacks contained in config write tests. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), and [@gnanam1990](https://github.com/gnanam1990). - Workspace setup state: store setup completion outside the workspace dot directory using an OpenClaw-named root file, migrate valid legacy state forward, and avoid clobbering generic root `workspace-state.json` files for TigerFS-style dot-path compatibility. This Clownfish replacement carries forward the focused [#53326](openclaw/openclaw#53326) fix idea because the original branch was closed and uneditable. ([#53326](openclaw/openclaw#53326), [#44783](openclaw/openclaw#44783), [#39446](openclaw/openclaw#39446)) Thanks [@1qh](https://github.com/1qh). - UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved `/model` confirmation refs, and stale foreground iOS Gateway reconnects. ([#90658](openclaw/openclaw#90658), [#92622](openclaw/openclaw#92622), [#91353](openclaw/openclaw#91353), [#92705](openclaw/openclaw#92705), [#92779](openclaw/openclaw#92779), [#92773](openclaw/openclaw#92773), [#92552](openclaw/openclaw#92552)) Thanks [@luoyanglang](https://github.com/luoyanglang), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@NianJiuZst](https://github.com/NianJiuZst), [@shakkernerd](https://github.com/shakkernerd), [@NarahariRaghava](https://github.com/NarahariRaghava), and [@Solvely-Colin](https://github.com/Solvely-Colin). - TUI: reload the active session after external `/new` or `/reset` session-change events so stale transcript and stream state clear promptly. Fixes [#38966](openclaw/openclaw#38966); carries forward [#40472](openclaw/openclaw#40472). Thanks [@yizhanzjz](https://github.com/yizhanzjz) and [@wsyjh8](https://github.com/wsyjh8). - Control UI: preserve Gateway Access tokens during same-normalized WebSocket URL edits and reload gateway-scoped tokens when switching endpoints. Fixes [#41545](openclaw/openclaw#41545); repairs [#42001](openclaw/openclaw#42001) with additional source PRs [#41546](openclaw/openclaw#41546), [#41552](openclaw/openclaw#41552), and [#41718](openclaw/openclaw#41718). Thanks [@wsyjh8](https://github.com/wsyjh8), [@llagy0020](https://github.com/llagy0020), [@llagy007](https://github.com/llagy007), [@pingfanfan](https://github.com/pingfanfan), and [@zheliu2](https://github.com/zheliu2). - Gateway CLI: tolerate a single transient clean WebSocket close before `hello-ok` so one-shot RPC calls reconnect instead of failing noisily, while repeated clean pre-hello closes still surface. Carries forward source PRs [#54475](openclaw/openclaw#54475) and [#54774](openclaw/openclaw#54774); [#85253](openclaw/openclaw#85253) covered adjacent connect assembly diagnostics. Thanks [@ruanrrn](https://github.com/ruanrrn). - Gateway/Linux: keep root-owned systemd user service lifecycle commands on root's user manager when a stale `SUDO_USER` remains in a root shell with root's user bus environment. Fixes [#81410](openclaw/openclaw#81410). Thanks [@Ericksza](https://github.com/Ericksza) and [@ChuckClose-tech](https://github.com/ChuckClose-tech). - Release and test reliability: extend slow Gateway/full-suite watchdogs, split local full-suite shards when throttled, stabilize plugin auth marker fixtures, avoid brittle provider-ref error text, and keep QA Lab bootstrap selection assertions aligned with flow-only scenarios. ([#92652](openclaw/openclaw#92652)) - macOS Peekaboo bridge: update the embedded Peekaboo package to 3.5.2 and route bundled-skill CLI commands through the OpenClaw app bridge so they inherit its Screen Recording and Accessibility grants. - Agent routing: route subagent RPC callbacks addressed to an agent-shaped `--to` target to the correct session key instead of falling back to the main session, so WeChat (and other channel) session-key callbacks reach the intended subagent session. ([#90231](openclaw/openclaw#90231)) Thanks [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Cron: preserve model, fallback, thinking, timeout, light-context, unsafe-content, and tool allow-list overrides on implicit text payloads by promoting them to agent turns, while explicit system events still prune those fields. Fixes [#28905](openclaw/openclaw#28905); carries forward [#64060](openclaw/openclaw#64060) and [#73946](openclaw/openclaw#73946). Thanks [@liaoandi](https://github.com/liaoandi). - QQBot delivery: keep markdown table chunks self-contained across message boundaries by preserving table state across block deliveries, flushing unfinished table-row fragments as plain text, and detecting short pipe-terminated rows by column count so split rows are not sent as malformed markdown. ([#92428](openclaw/openclaw#92428)) Thanks [@sliverp](https://github.com/sliverp). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1144

openclaw-barnacle Bot added app: web-ui App: web-ui size: XS labels Mar 9, 2026

chatgpt-codex-connector Bot reviewed Mar 10, 2026

View reviewed changes

Comment thread ui/src/ui/views/overview.ts

wsyjh8 force-pushed the fix/overview-preserve-gateway-token branch from ae39061 to facae6f Compare March 10, 2026 01:25

openclaw-barnacle Bot added size: S and removed size: XS labels Mar 10, 2026

chatgpt-codex-connector Bot reviewed Mar 10, 2026

View reviewed changes

Comment thread ui/src/ui/views/overview.ts

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Apr 26, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Apr 28, 2026

clawsweeper Bot mentioned this pull request Apr 28, 2026

[Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545

Closed

wsyjh8 and others added 3 commits April 28, 2026 07:19

fix(ui): preserve gateway token when editing websocket url

a1f23bd

fix(ui): preserve gateway token when editing websocket url

a7ab195

fix(ui): preserve gateway token during safe URL edits

24a1f13

vincentkoc force-pushed the fix/overview-preserve-gateway-token branch from facae6f to 24a1f13 Compare April 28, 2026 07:19

vincentkoc added clownfish:human-review labels Apr 28, 2026

This was referenced Apr 28, 2026

fix(ui): preserve gateway token when editing WebSocket URL #42001

Closed

fix(ui): prevent WebSocket URL edit from clearing Gateway Token #41718

Closed

vincentkoc added clawsweeper Tracked by ClawSweeper automation and removed clownfish:merge-ready labels Apr 28, 2026

openclaw-clownfish Bot mentioned this pull request Apr 29, 2026

fix(ui): preserve gateway token during safe websocket url edits #73923

Merged

openclaw-clownfish Bot closed this Apr 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(ui): preserve gateway token when editing websocket url#41546

fix(ui): preserve gateway token when editing websocket url#41546
wsyjh8 wants to merge 3 commits into
openclaw:mainfrom
wsyjh8:fix/overview-preserve-gateway-token

wsyjh8 commented Mar 9, 2026

Uh oh!

greptile-apps Bot commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

openclaw-barnacle Bot commented Apr 26, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

vincentkoc commented Apr 28, 2026

Uh oh!

openclaw-clownfish Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

wsyjh8 commented Mar 9, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

greptile-apps Bot commented Mar 10, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

openclaw-barnacle Bot commented Apr 26, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vincentkoc commented Apr 28, 2026

Uh oh!

openclaw-clownfish Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading