fix(control-ui): preserve token when editing WebSocket URL by pingfanfan · Pull Request #41552 · openclaw/openclaw

pingfanfan · 2026-03-10T00:07:12Z

Summary

preserve the current gateway token when the Overview WebSocket URL field changes
stop the Overview URL input from blanking the in-memory token on every edit
add browser regression coverage for both existing-token and typed-token flows

Testing

corepack pnpm --dir ui exec vitest run src/ui/navigation.browser.test.ts
corepack pnpm exec oxlint --type-aware ui/src/ui/views/overview.ts ui/src/ui/navigation.browser.test.ts

Notes

behavior-only Control UI fix; no meaningful visual delta to screenshot
AI-assisted with Codex; targeted tests passed and I understand the change

Fixes #41545

greptile-apps · 2026-03-10T00:09:38Z

Greptile Summary

This PR fixes a UX regression in the Overview panel where every keystroke in the WebSocket URL input would clear the in-memory gateway token. The fix is simple and targeted: the gateway URL input handler now only mutates gatewayUrl and preserves all other settings including token via spread syntax.

Changes:

ui/src/ui/views/overview.ts: The gateway URL input handler now cleanly passes only gatewayUrl to the settings update, leaving the token untouched. Additionally, language options are refactored from hardcoded values to use SUPPORTED_LOCALES.map().
ui/src/ui/navigation.browser.test.ts: Expanded test coverage with four new regression tests: verifies token preservation when gateway URL changes (for both hash-injected and user-typed tokens), confirms token persists after tab refresh, and tests pending URL behavior.

No functional complexity is introduced. The fix removes the side-effect entirely. Browser regression tests explicitly verify both affected flows (existing token, typed token).

Confidence Score: 5/5

Safe to merge — the fix removes an unintended side-effect with no security or correctness trade-offs.
This PR is minimal and targeted. The gateway URL handler no longer touches the token field, which was the root cause of the regression. The change introduces no new complexity, and two new browser tests explicitly cover both token scenarios (hash-injected and user-typed). The language options refactoring is a clean maintenance improvement with no behavioral impact. The code is correct and the tests verify the fix works.
No files require special attention.

_{Last reviewed commit: c5232b0}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5232b0766

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-03-10T00:10:39Z

                props.onSettingsChange({
                  ...props.settings,
                  gatewayUrl: v,
-                  token: v.trim() === props.settings.gatewayUrl.trim() ? props.settings.token : "",
                });


Avoid carrying auth token across gateway URL changes

Updating the WebSocket URL now always keeps props.settings.token, so switching from one gateway endpoint to another copies the current bearer token into the new endpoint's settings; on the next connect attempt, connectGateway will send that token to the new URL. This bypasses the per-gateway token scoping in ui/src/ui/storage.ts and can leak a valid token to an unintended host when users retarget the URL (for example, while troubleshooting or after a typo).

Useful? React with 👍 / 👎.

benclawbot · 2026-03-10T18:10:18Z

For the config error - I created a free config validator. Check my previous comments for fixes. Need more help? Email [email protected]

openclaw-barnacle · 2026-04-26T04:37:34Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

clawsweeper · 2026-04-27T10:46:35Z

Codex automated review: keeping this open.

Keep this PR open. Current main still has the Overview behavior the PR targets: editing the WebSocket URL clears the in-memory gateway token, and existing browser coverage asserts that behavior. The PR is not obsolete, but its exact one-line preservation fix needs maintainer review because it can carry a bearer token from one gateway URL to another, conflicting with the current per-gateway token scoping model.

Best possible solution:

Keep this PR open for maintainer review or rework. The best fix is to stop losing the token during harmless editing while preserving the per-gateway credential boundary, for example by using a draft URL field, only applying endpoint changes after confirmation, preserving tokens only when the normalized gateway scope is unchanged, and requiring an explicit token for a different gateway scope.

What I checked:

Current main still clears token on URL edit: The Overview WebSocket URL input handler updates gatewayUrl and sets token to an empty string whenever the edited value trims differently from the current gatewayUrl. (ui/src/ui/views/overview.ts:271, a25366038503)
Current test coverage expects the clear-on-change behavior: The browser navigation test hydrates a hash token, edits the WebSocket URL to another endpoint, and expects settings.token to be empty afterward. (ui/src/ui/navigation.browser.test.ts:562, a25366038503)
Gateway tokens are scoped by gateway URL: Storage derives token session keys from normalizeGatewayTokenScope(gatewayUrl), loads tokens by that scoped key, and persists session tokens under the current gateway URL scope. (ui/src/ui/storage.ts:106, a25366038503)
Token scoping has direct regression coverage: The storage test named "does not reuse a session token for a different gatewayUrl" saves a token for one gateway, switches to another with an empty token, and verifies loading the original gateway restores only its own token. (ui/src/ui/storage.node.test.ts:242, a25366038503)
Security review: connect sends token to configured URL: connectGateway constructs GatewayBrowserClient with url from host.settings.gatewayUrl and token from host.settings.token, so preserving the token while retargeting the URL can send that token to the newly configured endpoint. (ui/src/ui/app-gateway.ts:414, a25366038503)
PR context links the open bug and focused patch: The provided GitHub context shows this PR is open, changes only ui/src/ui/views/overview.ts and ui/src/ui/navigation.browser.test.ts, uses closing syntax for open bug [Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545, and has an unresolved bot review concern about carrying auth tokens across gateway URL changes. (c5232b0766d0)

Remaining risk / open question:

The submitted behavior change may send a bearer token scoped for one gateway to a different gateway URL on the next connection attempt.
The user-facing bug remains present on current main, so closing this PR as implemented or stale would drop a valid implementation candidate before the linked bug is fixed.
Several related open PR attempts target the same UX problem; maintainer review should choose or request one scoped design rather than closing this one in isolation.

Codex Review notes: model gpt-5.5, reasoning high; reviewed against a25366038503.

openclaw-clownfish · 2026-04-29T09:08:19Z

Thanks @pingfanfan. I am closing this as superseded by #73923 because both PRs fix the same #41545 Overview Gateway Token clearing behavior, and #73923 is now the canonical Clownfish path: #73923.

The canonical PR carries the normalized-endpoint token-scope guard that the review feedback asked for, while this branch preserves the token unconditionally. Your source PR remains credited in this closeout and the audit trail. If there is a separate case here that #73923 does not cover, please reply and we can reopen or split it back out.

…26.6.8) (#1144) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.6` → `2026.6.8` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.8`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202668) [Compare Source](openclaw/openclaw@v2026.6.6...v2026.6.8) ##### Highlights - Telegram and WhatsApp channel delivery are richer and less brittle: Telegram can send structured rich text with tables, lists, expandable blockquotes, prompt-preserving CLI backend delivery, retired native draft migration, and safer rich-media boundaries, while WhatsApp now honors configured ACP bindings. ([#92679](openclaw/openclaw#92679), [#84082](openclaw/openclaw#84082), [#89421](openclaw/openclaw#89421), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus), [@jzakirov](https://github.com/jzakirov), [@spacegeologist](https://github.com/spacegeologist), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent and Gateway recovery is sharper across account-scoped DM sends, generated media completions, restart shutdown aborts, yielded subagent pauses, yielded cron media, heartbeat dedupe, session identity prompts, and unknown OpenAI agent selector rejection. ([#92788](openclaw/openclaw#92788), [#91246](openclaw/openclaw#91246), [#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510)) Thanks [@yetval](https://github.com/yetval), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), and [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Provider/model handling expands and tightens with GLM-5.2, Claude Haiku 4.5 catalog rows, OpenRouter and Google Vertex provider-prefix normalization, managed SecretRef auth, bounded model browse discovery, storeless OpenAI Responses replay gating, and Claude 4.5 Copilot tool-streaming safety. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@snowzlm](https://github.com/snowzlm), and [@Kailigithub](https://github.com/Kailigithub). - `/usage` and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - UI and mobile flows are steadier: workspace files can collapse and start collapsed, WebChat backscroll survives streaming, the sidebar session picker remains interactive above the desktop workbench, reset soft args survive UI dispatch, stale dashboard session parent lineage is preserved, and iOS reconnects stale foreground gateways. ([#92779](openclaw/openclaw#92779), [#92622](openclaw/openclaw#92622), [#92705](openclaw/openclaw#92705), [#91353](openclaw/openclaw#91353), [#90658](openclaw/openclaw#90658), [#92552](openclaw/openclaw#92552)) Thanks [@shakkernerd](https://github.com/shakkernerd), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@NianJiuZst](https://github.com/NianJiuZst), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@luoyanglang](https://github.com/luoyanglang), and [@Solvely-Colin](https://github.com/Solvely-Colin). - Memory, state, and diagnostics recover cleaner: oversized OpenAI embedding batches split before 431s, QMD memory search stays available in transient mode, SQLite avoids WAL on NFS state volumes, stuck-session recovery scheduling no longer resets warning backoff, and Infinity chunk limits stay genuinely unbounded. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752), [#92735](openclaw/openclaw#92735)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), [@gnanam1990](https://github.com/gnanam1990), and [@yhterrance](https://github.com/yhterrance). ##### Changes - Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), and [@bymle](https://github.com/bymle). - Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including rich prompt handoff to CLI backends and transport fixtures for richer drafts. ([#92679](openclaw/openclaw#92679), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus) and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent commands: support `/btw` in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. ([#92669](openclaw/openclaw#92669), [#92162](openclaw/openclaw#92162)) Thanks [@joshavant](https://github.com/joshavant) and [@Pandah97](https://github.com/Pandah97). - Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - Docs and operator guidance: document node config examples, clarify before-install hook scope, correct agent default concurrency comments, refresh ZAI provider docs, and update channel/group docs for current Telegram and WhatsApp behavior. ([#92677](openclaw/openclaw#92677), [#92766](openclaw/openclaw#92766), [#92695](openclaw/openclaw#92695)) Thanks [@liuhao1024](https://github.com/liuhao1024), [@sallyom](https://github.com/sallyom), and [@ArielSmoliar](https://github.com/ArielSmoliar). ##### Fixes - Onboarding/skills: show the Homebrew install recommendation only on macOS and Linux, so FreeBSD and other unsupported platforms no longer get a misleading brew prompt. Fixes [#68893](openclaw/openclaw#68893); carries forward [#68894](openclaw/openclaw#68894), [#68910](openclaw/openclaw#68910), [#68941](openclaw/openclaw#68941), [#68943](openclaw/openclaw#68943), [#69002](openclaw/openclaw#69002), and [#69545](openclaw/openclaw#69545). Thanks [@yurivict](https://github.com/yurivict), [@Sanjays2402](https://github.com/Sanjays2402), [@Eruditi](https://github.com/Eruditi), [@JustInCache](https://github.com/JustInCache), [@nnish16](https://github.com/nnish16), and [@Mlightsnow](https://github.com/Mlightsnow). - Channels and delivery: preserve account-scoped DM channel send policy, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Slack outbound `message_sent` hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. ([#92788](openclaw/openclaw#92788), [#92679](openclaw/openclaw#92679), [#89421](openclaw/openclaw#89421), [#89943](openclaw/openclaw#89943), [#91137](openclaw/openclaw#91137), [#91246](openclaw/openclaw#91246), [#92735](openclaw/openclaw#92735)) Thanks [@yetval](https://github.com/yetval), [@obviyus](https://github.com/obviyus), [@spacegeologist](https://github.com/spacegeologist), [@rishitamrakar](https://github.com/rishitamrakar), [@lundog](https://github.com/lundog), [@TurboTheTurtle](https://github.com/TurboTheTurtle), and [@yhterrance](https://github.com/yhterrance). - Auto-reply/groups: keep ordinary group text replies on automatic final-reply delivery while allowing `message(action=send)` for files, images, and other attachments to the same group or topic. Carries forward [#43276](openclaw/openclaw#43276); refs [#48004](openclaw/openclaw#48004). Thanks [@NayukiChiba](https://github.com/NayukiChiba) and [@ShakaRover](https://github.com/ShakaRover). - Auto-reply/skills: preserve multiline payloads for `/skill` and direct skill slash commands while keeping command-head normalization for aliases, colon syntax, and bot mentions. Fixes [#79155](openclaw/openclaw#79155); carries forward [#81305](openclaw/openclaw#81305). Thanks [@web3blind](https://github.com/web3blind). - iMessage: normalize leading NUL sent-message echo prefixes while preserving interior NUL bytes and the leading attributedBody marker handling from [#73942](openclaw/openclaw#73942). Carries forward [#63581](openclaw/openclaw#63581). Thanks [@drvoss](https://github.com/drvoss). - Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. ([#64734](openclaw/openclaw#64734)) Thanks [@hanamizuki](https://github.com/hanamizuki). - Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, preserve yielded media completions, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions and slash-command block replies in WebChat, preserve fresh post-compaction usage while clearing stale usage snapshots, and require admin privileges for HTTP session/model override surfaces. ([#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510), [#91246](openclaw/openclaw#91246), [#50795](openclaw/openclaw#50795), [#50845](openclaw/openclaw#50845), [#82874](openclaw/openclaw#82874), [#92651](openclaw/openclaw#92651), [#92646](openclaw/openclaw#92646)) Thanks [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@Hollychou924](https://github.com/Hollychou924), [@leno23](https://github.com/leno23), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agents/exec: default empty-success background completion notices on only for real chat channels, preserving explicit opt-outs and keeping generic providers silent while carrying forward the narrow UX intent from [#39726](openclaw/openclaw#39726) and [#46926](openclaw/openclaw#46926). Thanks [@Sapientropic](https://github.com/Sapientropic) and [@wenkang-xie](https://github.com/wenkang-xie). - Providers and model replay: preserve storeless OpenAI Responses replay compatibility, avoid eager tool streaming for Claude 4.5 in Copilot, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. ([#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#92628](openclaw/openclaw#92628)) Thanks [@snowzlm](https://github.com/snowzlm), [@Kailigithub](https://github.com/Kailigithub), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), and [@mushuiyu886](https://github.com/mushuiyu886). - Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, and keep shell environment fallbacks contained in config write tests. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), and [@gnanam1990](https://github.com/gnanam1990). - Workspace setup state: store setup completion outside the workspace dot directory using an OpenClaw-named root file, migrate valid legacy state forward, and avoid clobbering generic root `workspace-state.json` files for TigerFS-style dot-path compatibility. This Clownfish replacement carries forward the focused [#53326](openclaw/openclaw#53326) fix idea because the original branch was closed and uneditable. ([#53326](openclaw/openclaw#53326), [#44783](openclaw/openclaw#44783), [#39446](openclaw/openclaw#39446)) Thanks [@1qh](https://github.com/1qh). - UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved `/model` confirmation refs, and stale foreground iOS Gateway reconnects. ([#90658](openclaw/openclaw#90658), [#92622](openclaw/openclaw#92622), [#91353](openclaw/openclaw#91353), [#92705](openclaw/openclaw#92705), [#92779](openclaw/openclaw#92779), [#92773](openclaw/openclaw#92773), [#92552](openclaw/openclaw#92552)) Thanks [@luoyanglang](https://github.com/luoyanglang), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@NianJiuZst](https://github.com/NianJiuZst), [@shakkernerd](https://github.com/shakkernerd), [@NarahariRaghava](https://github.com/NarahariRaghava), and [@Solvely-Colin](https://github.com/Solvely-Colin). - TUI: reload the active session after external `/new` or `/reset` session-change events so stale transcript and stream state clear promptly. Fixes [#38966](openclaw/openclaw#38966); carries forward [#40472](openclaw/openclaw#40472). Thanks [@yizhanzjz](https://github.com/yizhanzjz) and [@wsyjh8](https://github.com/wsyjh8). - Control UI: preserve Gateway Access tokens during same-normalized WebSocket URL edits and reload gateway-scoped tokens when switching endpoints. Fixes [#41545](openclaw/openclaw#41545); repairs [#42001](openclaw/openclaw#42001) with additional source PRs [#41546](openclaw/openclaw#41546), [#41552](openclaw/openclaw#41552), and [#41718](openclaw/openclaw#41718). Thanks [@wsyjh8](https://github.com/wsyjh8), [@llagy0020](https://github.com/llagy0020), [@llagy007](https://github.com/llagy007), [@pingfanfan](https://github.com/pingfanfan), and [@zheliu2](https://github.com/zheliu2). - Gateway CLI: tolerate a single transient clean WebSocket close before `hello-ok` so one-shot RPC calls reconnect instead of failing noisily, while repeated clean pre-hello closes still surface. Carries forward source PRs [#54475](openclaw/openclaw#54475) and [#54774](openclaw/openclaw#54774); [#85253](openclaw/openclaw#85253) covered adjacent connect assembly diagnostics. Thanks [@ruanrrn](https://github.com/ruanrrn). - Gateway/Linux: keep root-owned systemd user service lifecycle commands on root's user manager when a stale `SUDO_USER` remains in a root shell with root's user bus environment. Fixes [#81410](openclaw/openclaw#81410). Thanks [@Ericksza](https://github.com/Ericksza) and [@ChuckClose-tech](https://github.com/ChuckClose-tech). - Release and test reliability: extend slow Gateway/full-suite watchdogs, split local full-suite shards when throttled, stabilize plugin auth marker fixtures, avoid brittle provider-ref error text, and keep QA Lab bootstrap selection assertions aligned with flow-only scenarios. ([#92652](openclaw/openclaw#92652)) - macOS Peekaboo bridge: update the embedded Peekaboo package to 3.5.2 and route bundled-skill CLI commands through the OpenClaw app bridge so they inherit its Screen Recording and Accessibility grants. - Agent routing: route subagent RPC callbacks addressed to an agent-shaped `--to` target to the correct session key instead of falling back to the main session, so WeChat (and other channel) session-key callbacks reach the intended subagent session. ([#90231](openclaw/openclaw#90231)) Thanks [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Cron: preserve model, fallback, thinking, timeout, light-context, unsafe-content, and tool allow-list overrides on implicit text payloads by promoting them to agent turns, while explicit system events still prune those fields. Fixes [#28905](openclaw/openclaw#28905); carries forward [#64060](openclaw/openclaw#64060) and [#73946](openclaw/openclaw#73946). Thanks [@liaoandi](https://github.com/liaoandi). - QQBot delivery: keep markdown table chunks self-contained across message boundaries by preserving table state across block deliveries, flushing unfinished table-row fragments as plain text, and detecting short pipe-terminated rows by column count so split rows are not sent as malformed markdown. ([#92428](openclaw/openclaw#92428)) Thanks [@sliverp](https://github.com/sliverp). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1144

fix(control-ui): preserve token when editing ws url

c5232b0

openclaw-barnacle Bot added app: web-ui App: web-ui size: XS labels Mar 10, 2026

chatgpt-codex-connector Bot reviewed Mar 10, 2026

View reviewed changes

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Apr 26, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Apr 28, 2026

clawsweeper Bot mentioned this pull request Apr 28, 2026

[Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545

Closed

openclaw-clownfish Bot mentioned this pull request Apr 29, 2026

fix(ui): preserve gateway token during safe websocket url edits #73923

Merged

openclaw-clownfish Bot closed this Apr 29, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(control-ui): preserve token when editing WebSocket URL#41552

fix(control-ui): preserve token when editing WebSocket URL#41552
pingfanfan wants to merge 1 commit into
openclaw:mainfrom
pingfanfan:codex/fix-overview-ws-url-preserves-token-41545

pingfanfan commented Mar 10, 2026

Uh oh!

greptile-apps Bot commented Mar 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Mar 10, 2026

Uh oh!

benclawbot commented Mar 10, 2026

Uh oh!

openclaw-barnacle Bot commented Apr 26, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

openclaw-clownfish Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

pingfanfan commented Mar 10, 2026

Summary

Testing

Notes

Uh oh!

greptile-apps Bot commented Mar 10, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

benclawbot commented Mar 10, 2026

Uh oh!

openclaw-barnacle Bot commented Apr 26, 2026

Uh oh!

clawsweeper Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openclaw-clownfish Bot commented Apr 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Apr 27, 2026 •

edited

Loading