fix: allow custom control UI origins by ishangodawatta · Pull Request #73511 · openclaw/openclaw

ishangodawatta · 2026-04-28T11:02:27Z

What Problem This Solves

gateway.controlUi.allowedOrigins supports explicit browser origin allowlists, but hosted custom desktop-app origins such as tauri://localhost, electron://localhost, and app://localhost currently fail exact matching. The root cause is WHATWG URL behaviour: new URL("tauri://localhost").origin serialises as null, so the Gateway compares the configured tauri://localhost allowlist entry with null and rejects the browser WebSocket connection.

This matters for Tauri/Electron-style Control UI wrappers because operators currently have to use wildcard origins even when they want a specific origin allowlist.

Summary

Preserve normal URL.origin behaviour for standard web origins.
For parsed hosted opaque origins only, reconstruct the exact protocol//host value before matching against gateway.controlUi.allowedOrigins.
Keep configured allowlist values as exact trimmed/lowercase strings, plus the existing * behaviour.
Do not add wildcard, prefix, or scheme-pattern policy.
Keep literal Origin: null, malformed origins, hostless file:/data: origins, and unlisted custom origins rejected.

Linked Issue

Closes #46520.

Evidence

Validation added in this branch:

src/gateway/origin-check.test.ts covers exact allowlist success for app://localhost, electron://localhost, and tauri://localhost.
src/gateway/origin-check.test.ts covers rejection for an unlisted hosted custom-scheme origin.
src/gateway/origin-check.test.ts covers fail-closed behaviour for literal Origin: null, malformed origins, file: origins, and data: origins.
src/gateway/server.auth.browser-hardening.test.ts starts a real Gateway, configures gateway.controlUi.allowedOrigins, opens a WebSocket with a browser Origin header, and verifies both sides of the runtime boundary:
- Origin: tauri://localhost with allowedOrigins: ["tauri://localhost"] reaches hello-ok.
- Origin: electron://attacker.example with allowedOrigins: ["tauri://localhost"] is rejected through the existing CONTROL_UI_ORIGIN_NOT_ALLOWED path.

Local verification:

git diff --check upstream/main...HEAD passed.
Local Vitest could not run in this worktree because dependency verification attempted registry fetches and repeatedly timed out with npm ETIMEDOUT before Vitest started. GitHub CI is running the branch with dependencies available.

Security Impact

New permissions/capabilities: No.
Secrets/tokens handling changed: No.
New/changed network calls: No.
Command/tool execution surface changed: No.
Data access scope changed: No.

The security boundary remains explicit allowlist matching. The parser fallback only changes the parsed origin string for successfully parsed URLs that have both a protocol and a host.

Compatibility

Backward compatible. No config, migration, or docs changes are required.

greptile-apps · 2026-04-28T11:04:13Z

Greptile Summary

This PR fixes allowlist matching for custom-scheme browser origins (e.g. tauri://localhost) by handling the WHATWG URL spec behavior where url.origin returns the string "null" for non-special schemes. The fix reconstructs the origin from protocol + "//" + host when url.origin === "null" and url.host is non-empty, while keeping literal Origin: null headers and custom origins not present in the allowlist rejected. The implementation is correct and the new test cases cover the key scenarios.

Confidence Score: 5/5

Safe to merge — targeted fix with correct logic and no security regressions.

The change is minimal and well-reasoned: it correctly handles the WHATWG URL origin === "null" edge case for non-special schemes, the early guard for literal "null" headers is preserved, and custom-scheme origins only pass when explicitly listed in allowedOrigins. New test cases cover the allowlist match and reject paths.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix: allow custom control UI origins" | Re-trigger Greptile}

clawsweeper · 2026-04-28T11:07:02Z

Codex review: needs real behavior proof before merge. Reviewed July 9, 2026, 7:27 AM ET / 11:27 UTC.

Summary
The PR updates Gateway origin parsing so hosted non-special schemes with a host can match exact gateway.controlUi.allowedOrigins entries, and adds parser plus Gateway WebSocket handshake coverage.

PR surface: Source +10, Tests +77. Total +87 across 3 files.

Reproducibility: yes. source-reproducible: current main compares the allowlist against url.origin, and Node reports origin: "null" for hosted custom schemes like tauri://localhost. I did not run a full live Gateway reproduction.

Review metrics: 1 noteworthy metric.

Origin-boundary coverage: 7 parser cases, 2 runtime handshake rows added. The added cases cover both exact custom-scheme allowlist success and fail-closed behavior that matters for the Gateway origin boundary.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #46520
Summary: This PR is a candidate fix for the custom-scheme exact allowlist bug; other open PRs overlap the same URL-origin normalization root cause, while scheme-level wildcard support is adjacent but distinct.

Members:

canonical: [Bug]: Origin validation fails for custom URL schemes (tauri://, electron://) #46520 - The PR body closes this open bug, and the issue reports tauri:// and electron:// exact gateway.controlUi.allowedOrigins rejection.
fixed_by_candidate: Fix custom scheme origin allowlist matching #94132 - This open PR targets the same custom-scheme exact allowlist failure with overlapping parser changes and live ClawControl context.
same_root_cause: Gateway: allow extension origins in browser allowlist #38290 - This open PR addresses chrome-extension:// exact origin allowlisting, which has the same URL.origin === "null" root cause.
adjacent_distinct: gateway.controlUi.allowedOrigins: support scheme-level wildcards (e.g. chrome-extension://*) #39739 - That issue requests scheme-level wildcard patterns, which is broader policy than this PR's exact-origin custom-scheme fix.
superseded: fix(gateway): support custom URL schemes in origin allowlist matching #98912 - This was a closed unmerged duplicate attempt for the same custom-scheme origin allowlist behavior.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦪 silver shellfish
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted live Gateway logs, terminal output, or a Tauri/Electron/ClawControl recording showing exact custom-scheme allowlist success and mismatched-origin rejection; updating the PR body should trigger ClawSweeper, or a maintainer can comment @clawsweeper re-review.

Proof guidance:

[P1] Needs real behavior proof before merge: Visible proof is limited to tests, CI, and workflow context checks; the contributor still needs redacted live Gateway or desktop-wrapper output showing the changed behavior, with private IPs, endpoints, tokens, phone numbers, and other sensitive details removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] The diff expands accepted browser origins at the Control UI/WebChat origin gate for explicitly allowlisted non-special schemes, so an incorrect parser edge case would affect a security boundary.
[P1] The visible contributor proof is still tests, CI, and workflow context validation rather than a redacted live Gateway or desktop-wrapper run showing the real origin header behavior after the fix.

Maintainer options:

Require live origin-boundary proof (recommended)
Ask the contributor for redacted Gateway logs, terminal output, or a desktop-wrapper recording showing the exact custom-scheme allowlist accept path and mismatched reject path on this head.
Accept source and CI proof
A maintainer can explicitly accept the parser/unit/Gateway-test proof as enough for this narrow auth-boundary change, but that would be a proof-gate exception.
Defer to the canonical cluster
If maintainers prefer a different open candidate for the same bug, pause this PR and route the proof and review effort through the canonical fix path.

Next step before merge

[P1] The remaining blocker is contributor real behavior proof and maintainer merge review, not an automated code repair.

Security
Cleared: No concrete supply-chain or secret-handling issue was found; the security-boundary merge risk is tracked separately because the diff changes origin allowlist behavior.

Review details

Best possible solution:

Land the shared parser fix after redacted real behavior proof shows an exact custom-scheme allowlist succeeds and a mismatched custom-scheme origin is rejected; keep wildcard scheme policy in the separate product/security discussion.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main compares the allowlist against url.origin, and Node reports origin: "null" for hosted custom schemes like tauri://localhost. I did not run a full live Gateway reproduction.

Is this the best way to solve the issue?

Yes for the code shape: fixing the shared parser with an exact protocol//host fallback is narrower than wildcard or scheme-pattern policy and keeps existing callers aligned. Merge readiness still depends on real behavior proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2806195e1127.

Label changes

Label changes:

add merge-risk: 🚨 security-boundary: The PR changes which browser Origin values can pass the Gateway Control UI/WebChat origin gate when explicitly allowlisted.
add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦪 silver shellfish and patch quality is 🦞 diamond lobster.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Visible proof is limited to tests, CI, and workflow context checks; the contributor still needs redacted live Gateway or desktop-wrapper output showing the changed behavior, with private IPs, endpoints, tokens, phone numbers, and other sensitive details removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

P2: This is a normal-priority Gateway bug fix with limited blast radius, improving exact allowlisting for custom desktop-wrapper origins.
merge-risk: 🚨 security-boundary: The PR changes which browser Origin values can pass the Gateway Control UI/WebChat origin gate when explicitly allowlisted.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦪 silver shellfish and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Visible proof is limited to tests, CI, and workflow context checks; the contributor still needs redacted live Gateway or desktop-wrapper output showing the changed behavior, with private IPs, endpoints, tokens, phone numbers, and other sensitive details removed. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +10, Tests +77. Total +87 across 3 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	12	2	+10
Tests	2	104	27	+77
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	3	116	29	+87

What I checked:

Current main parser behavior: Current parseOrigin returns url.origin directly, so a non-special custom scheme whose WHATWG origin is the string null cannot match an exact custom-scheme allowlist entry. (src/gateway/origin-check.ts:25, 2806195e1127)
Dependency/runtime contract: Node reports origin:"null" with a populated protocol and host for tauri://LOCALHOST, electron://attacker.example, and app://localhost, while hostless file: and data: URLs have empty hosts.
Runtime entry points: Gateway WebSocket connect handling and trusted-proxy HTTP browser-origin authorization both delegate to checkBrowserOrigin, so the parser fix sits at the shared origin gate rather than a one-off caller. (src/gateway/server/ws-connection/message-handler.ts:884, 2806195e1127)
PR diff behavior: The PR head preserves normal URL.origin, falls back to exact protocol//host only when origin is null and a host exists, and adds custom-scheme accept/reject plus hostless fail-closed tests. (src/gateway/origin-check.ts:23, 17f2234c9a2c)
Configuration contract: Gateway docs and schema help already describe gateway.controlUi.allowedOrigins as explicit full browser origins, with * as a deliberate allow-all policy. Public docs: docs/gateway/configuration-reference.md. (docs/gateway/configuration-reference.md:617, 2806195e1127)
Proof gate: The current PR body and comments describe added tests and CI; the Real behavior proof workflow only checked that the PR includes problem context and evidence, and no redacted live Gateway or desktop-wrapper transcript/log/screenshot is visible. (17f2234c9a2c)

Likely related people:

steipete: Current checkout blame attributes the shared Gateway origin-check helper to Peter Steinberger's recent commit carrying the current implementation. (role: recent area contributor; confidence: medium; commits: fc5a4defaf62; files: src/gateway/origin-check.ts)
andreas-247: Opened a separate live-context PR for the same custom-scheme origin allowlist root cause, which may be useful review context even though it is not current-main ownership. (role: adjacent contributor; confidence: low; files: src/gateway/origin-check.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (4 earlier review cycles)

reviewed 2026-07-08T11:22:31.942Z sha b8da2e3 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T11:30:50.451Z sha b8da2e3 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T16:01:07.184Z sha 1563ed7 :: needs real behavior proof before merge. :: none
reviewed 2026-07-08T16:12:25.794Z sha 1563ed7 :: needs real behavior proof before merge. :: none

openclaw-barnacle · 2026-05-30T04:43:57Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

ishangodawatta · 2026-07-08T11:08:42Z

Updated this PR on top of current upstream/main at commit 084906a73692b1c5cad8ccd8c85e5d23d7ce708b.

What changed:

Removed the release-owned CHANGELOG.md entry.
Kept the parser fix narrow: normal URL.origin is used when available; hosted opaque origins only fall back to exact protocol//host matching when new URL(origin) succeeds and the parsed URL has a host.
Left configured gateway.controlUi.allowedOrigins as exact trimmed/lowercase string matching, plus the existing * behaviour. No wildcard or prefix policy was added.

Gateway behaviour proof added in this branch:

src/gateway/server.auth.browser-hardening.test.ts now starts a real Gateway, configures gateway.controlUi.allowedOrigins, opens a WebSocket with a browser Origin header, and exercises both sides of the boundary.
Positive case: Origin: tauri://localhost with allowedOrigins: ["tauri://localhost"] reaches hello-ok.
Negative case: Origin: electron://localhost with allowedOrigins: ["tauri://localhost"] is rejected with the existing CONTROL_UI_ORIGIN_NOT_ALLOWED path.

Additional parser regression coverage:

app://localhost, electron://localhost, and tauri://localhost pass only when exactly allowlisted.
Unlisted hosted custom-scheme origins fail closed.
Literal Origin: null, malformed origins, file: origins, and data: origins fail closed.

Local verification:

git diff --check upstream/main...HEAD passed.
I could not run local Vitest proof in this worktree: pnpm install and then pnpm test src/gateway/origin-check.test.ts -- --reporter=verbose both blocked before Vitest on npm registry ETIMEDOUT fetches during dependency verification. The updated GitHub checks are now running against the new SHA.

@clawsweeper re-review

clawsweeper · 2026-07-08T11:08:44Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

ishangodawatta · 2026-07-08T11:16:56Z

Current head is now b8da2e377c26e56d796016f94fa0e233dc4631d0.

Updates since the previous review request:

The runtime negative Gateway case now uses electron://attacker.example, not electron://localhost, so it is not accepted by the existing local-loopback fallback.
The PR body evidence has been corrected to match that pushed test case.
Real behavior proof is passing on the current head.
CI is rerunning on the corrected SHA, including the previously failing checks-node-compact-small-4 shard.

@clawsweeper re-review

clawsweeper · 2026-07-08T11:17:00Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

ishangodawatta · 2026-07-08T15:14:27Z

Current state on b8da2e377c26e56d796016f94fa0e233dc4631d0:

Normal CI run 28938305034 completed successfully.
Real behavior proof run 28938384331 completed successfully.
The previously failing checks-node-compact-small-4 shard passed on this head.
The fresh ClawSweeper review has no code finding: patch quality is high and the security review is cleared. The remaining blocker is the P1 request for redacted live Gateway or desktop-wrapper proof.

The branch already includes a real Gateway WebSocket handshake test for the changed runtime boundary:

Origin: tauri://localhost with allowedOrigins: ["tauri://localhost"] reaches hello-ok.
Origin: electron://attacker.example with the same allowlist is rejected with CONTROL_UI_ORIGIN_NOT_ALLOWED.

I also tried to produce a standalone local Gateway proof from this exact worktree, but this machine cannot currently hydrate the missing Gateway startup dependency: npm registry tarball requests time out, and direct curl to registry tarballs times out as well. The standalone proof gets as far as Gateway imports, then stops on missing @openclaw/fs-safe from the incomplete dependency install.

If source-level proof plus the green Gateway handshake CI is sufficient for this narrow parser-layer auth-boundary fix, I believe this is ready for maintainer review. If not, I will need to provide a desktop-wrapper or live Gateway transcript from an environment with working dependency access.

steipete · 2026-07-09T11:42:15Z

Superseded by #38290, landed as fa0349a.

The landed fix uses the same exact hosted-origin approach, rebuilt on current main and hardened against parser-normalized dot segments and backslash path separators. It preserves current private-same-origin, tailnet, host-header, token/device-auth, and loopback policy while allowing only authority-form custom origins.

Verification covered 146 focused validator and real Gateway-auth tests, a live WebSocket connect handshake for exact tauri://localhost, fresh autoreview, and exact-head CI/CodeQL/OpenGrep. Thanks for the careful issue analysis and real-Gateway coverage in this branch.

openclaw-barnacle Bot added gateway Gateway runtime size: XS labels Apr 28, 2026

ishangodawatta force-pushed the IshanG97/46520-custom-origin-schemes branch 4 times, most recently from 36d0bdb to 5d19030 Compare April 28, 2026 14:45

clawsweeper Bot mentioned this pull request Apr 30, 2026

[Bug]: Origin validation fails for custom URL schemes (tauri://, electron://) #46520

Closed

This was referenced May 9, 2026

Gateway: allow extension origins in browser allowlist #38290

Merged

gateway.controlUi.allowedOrigins: support scheme-level wildcards (e.g. chrome-extension://*) #39739

Open

openclaw-barnacle Bot added stale Marked as stale due to inactivity triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 30, 2026

clawsweeper Bot added the rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. label May 30, 2026

barnacle-openclaw Bot removed the stale Marked as stale due to inactivity label May 30, 2026

andreas-247 mentioned this pull request Jun 17, 2026

Fix custom scheme origin allowlist matching #94132

Closed

openclaw-barnacle Bot added the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jun 20, 2026

clawsweeper Bot added the rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. label Jun 20, 2026

ishangodawatta force-pushed the IshanG97/46520-custom-origin-schemes branch from 5d19030 to 084906a Compare July 8, 2026 11:01

ishangodawatta requested a review from a team as a code owner July 8, 2026 11:01

openclaw-barnacle Bot added size: S and removed size: XS labels Jul 8, 2026

openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 8, 2026

ishangodawatta force-pushed the IshanG97/46520-custom-origin-schemes branch from 084906a to b8da2e3 Compare July 8, 2026 11:13

ishangodawatta force-pushed the IshanG97/46520-custom-origin-schemes branch 2 times, most recently from 1563ed7 to 84c30a6 Compare July 9, 2026 11:06

fix: allow custom control UI origins

17f2234

ishangodawatta force-pushed the IshanG97/46520-custom-origin-schemes branch from 84c30a6 to 17f2234 Compare July 9, 2026 11:20

steipete closed this Jul 9, 2026

ishangodawatta deleted the IshanG97/46520-custom-origin-schemes branch July 9, 2026 11:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: allow custom control UI origins#73511

fix: allow custom control UI origins#73511
ishangodawatta wants to merge 1 commit into
openclaw:mainfrom
ishangodawatta:IshanG97/46520-custom-origin-schemes

ishangodawatta commented Apr 28, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Apr 28, 2026

Uh oh!

clawsweeper Bot commented Apr 28, 2026 •

edited

Loading

Uh oh!

openclaw-barnacle Bot commented May 30, 2026

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

ishangodawatta commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Summary

Linked Issue

Evidence

Security Impact

Compatibility

Uh oh!

greptile-apps Bot commented Apr 28, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

clawsweeper Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openclaw-barnacle Bot commented May 30, 2026

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ishangodawatta commented Jul 8, 2026

Uh oh!

steipete commented Jul 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ishangodawatta commented Apr 28, 2026 •

edited

Loading

clawsweeper Bot commented Apr 28, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading