fix(ui): preserve gateway token during safe websocket url edits by openclaw-clownfish[bot] · Pull Request #73923 · openclaw/openclaw

openclaw-clownfish · 2026-04-29T01:33:47Z

Summary

Fixes [Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545 by preserving the Gateway Token while the user makes harmless same-normalized-endpoint WebSocket URL edits in Overview > Gateway Access.
Clears or reloads the token when the normalized gateway endpoint changes so a gateway-scoped credential is not carried to another endpoint.
Repairs source PR fix(ui): preserve gateway token when editing WebSocket URL #42001 and preserves attribution for @llagy0020 / @llagy007.

Validation

pnpm check:changed

Notes

Security-routed PRs #41546, #41552, and #41718 are left to central OpenClaw security handling and are not modified by this fix path.

ProjectClownfish replacement details:

Cluster: ghcrawl-156708-autonomous-smoke
Source PRs: fix(ui): preserve gateway token when editing WebSocket URL #42001
Credit: Repair source PR: fix(ui): preserve gateway token when editing WebSocket URL #42001 by @llagy0020, with commit author @llagy007; preserve attribution in the PR body and branch history.; Canonical bug report: [Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545 by @wsyjh8; credit the reporter in the changelog entry if the project style allows.; Security-routed PRs fix(ui): preserve gateway token when editing websocket url #41546, fix(control-ui): preserve token when editing WebSocket URL #41552, and fix(ui): prevent WebSocket URL edit from clearing Gateway Token #41718 must not be modified by this repair path.
Validation: pnpm check:changed
Repair fallback: To https://github.com/llagy0020/openclaw.git
! [remote rejected] HEAD -> fix/issue-41545 (refusing to allow a GitHub App to create or update workflow .github/workflows/auto-response.yml without workflows permission)
error: failed to push some refs to 'https://github.com/llagy0020/openclaw.git'

greptile-apps · 2026-04-29T01:40:14Z

Greptile Summary

This PR fixes a regression where editing the Gateway Access WebSocket URL in the Overview panel (e.g. adding a trailing slash or trimming whitespace) would unnecessarily clear the in-memory gateway token. It replaces the previous simple trimmed-string equality check with a resolveGatewayTokenForUrlEdit helper that uses normalizeGatewayTokenScope to determine whether the URL change is semantically same-endpoint. When the normalized endpoint changes, the helper loads any existing scoped session token for the new endpoint from sessionStorage, or returns an empty string if none is stored. The logic, tests, and changelog entry all look correct and complete.

Confidence Score: 5/5

This PR is safe to merge; the change is narrow, well-tested, and correctly scoped.

No logic errors, security concerns, or behavioural regressions found. The new helper mirrors the existing normalizeGatewayTokenScope / loadSessionToken pattern already present in storage.ts, and three targeted unit tests plus an updated integration test cover the same-scope, different-scope-with-token, and different-scope-without-token cases.

No files require special attention.

_{Reviews (1): Last reviewed commit: "fix(ui): preserve gateway token during s..." | Re-trigger Greptile}

clawsweeper · 2026-04-29T01:41:32Z

Codex review: needs changes before merge. Reviewed June 15, 2026, 2:41 AM ET / 06:41 UTC.

Summary
The PR changes Control UI Gateway Access URL editing so same-normalized endpoint edits preserve the current Gateway Token while endpoint changes load or clear the scoped session token.

PR surface: Source +17, Tests +66, Docs +1. Total +84 across 5 files.

Reproducibility: yes. Source inspection on current main and v2026.6.6 shows the Overview URL input writes token to an empty string whenever the typed value differs from the previous gateway URL.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: durable storage schema: ui/src/ui/storage.ts, serialized state: ui/src/ui/navigation.browser.test.ts, serialized state: ui/src/ui/views/overview.node.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🌊 off-meta tidepool
Patch quality: 🦐 gold shrimp
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Refresh or replace the branch on current main.
Remove the CHANGELOG.md entry.
Run the focused Overview/navigation token-state tests and git diff --check.

Mantis proof suggestion
A short visible Control UI proof would directly show the Gateway Token field surviving a same-endpoint URL edit and changing correctly on endpoint switches. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

visual task: verify Overview Gateway Access preserves the Gateway Token after a same-endpoint URL edit and clears or reloads it when switching endpoints.

Risk before merge

[P1] GitHub currently reports the PR head as conflicting/dirty, so the exact branch cannot merge without a refresh or replacement branch.
[P1] The PR changes Gateway Token auth state; focused validation should cover same-scope URL edits, endpoint switches with a stored scoped token, and endpoint switches without a scoped token.
[P1] The PR adds a manual CHANGELOG.md entry even though release generation owns that file for normal PRs.

Maintainer options:

Refresh The Narrow UI Fix (recommended)
Refresh or recreate the branch on current main, remove the changelog edit, preserve the scoped-token behavior, and rerun the focused UI tests before merge.
Accept The Auth-State Change After Proof
Maintainers can accept the token-state behavior once the refreshed branch proves same-endpoint edits and changed-endpoint token reload/clear behavior.
Replace The Dirty Bot Branch
If this branch is not worth repairing, open a clean replacement PR with the same behavior and close this one after the replacement is viable.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Refresh the PR against current main, remove the CHANGELOG.md edit, preserve the UI/storage scoped-token fix and tests, then run node scripts/run-vitest.mjs ui/src/ui/views/overview.node.test.ts --maxWorkers=1, node scripts/run-vitest.mjs ui/src/ui/navigation.browser.test.ts --maxWorkers=1, and git diff --check.

Next step before merge

[P2] A narrow automated repair can refresh or recreate the branch, remove the changelog edit, and preserve the scoped-token fix and regression tests.

Security
Cleared: No concrete security or supply-chain regression found; the PR adds no dependencies, workflows, or new credential sink beyond existing sessionStorage token scoping.

Review findings

[P2] Remove the release-owned changelog entry — CHANGELOG.md:16

Review details

Best possible solution:

Land a refreshed narrow Control UI fix that uses the existing normalized gateway-token scope, keeps the regression tests, and leaves release-note context outside CHANGELOG.md.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection on current main and v2026.6.6 shows the Overview URL input writes token to an empty string whenever the typed value differs from the previous gateway URL.

Is this the best way to solve the issue?

Yes with cleanup. Reusing storage's normalized gateway-token scope is the right boundary, but the branch needs to be refreshed and the release-owned changelog edit removed.

Full review comments:

[P2] Remove the release-owned changelog entry — CHANGELOG.md:16
CHANGELOG.md is release-generated in this repo, and normal PR release-note context belongs in the PR body or commit message. Keeping this line turns a narrow UI bug fix into release bookkeeping and should be dropped before merge.
Confidence: 0.93

Overall correctness: patch is incorrect
Overall confidence: 0.86

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against bcb016a528b1.

Label changes

Label justifications:

P2: The PR addresses a normal-priority Control UI auth-state bug with limited blast radius.
merge-risk: 🚨 auth-provider: The diff changes how Gateway Token state is preserved, cleared, or reloaded for the selected gateway endpoint.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This is an OpenClaw bot replacement PR, so the external contributor real-behavior-proof gate does not apply; focused validation is still needed before landing.

Evidence reviewed

PR surface:

Source +17, Tests +66, Docs +1. Total +84 across 5 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	19	2	+17
Tests	2	69	3	+66
Docs	1	1	0	+1
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	5	89	5	+84

Acceptance criteria:

[P1] node scripts/run-vitest.mjs ui/src/ui/views/overview.node.test.ts --maxWorkers=1.
[P1] node scripts/run-vitest.mjs ui/src/ui/navigation.browser.test.ts --maxWorkers=1.
[P1] git diff --check.

What I checked:

Repository policy read: Root AGENTS.md was read fully and its ClawSweeper review, auth-state merge-risk, and release-owned changelog guidance apply to this PR. (AGENTS.md:1, bcb016a528b1)
Scoped UI policy read: ui/AGENTS.md was read fully; it adds Control UI i18n guidance and does not change the token-state review path. (ui/AGENTS.md:1, bcb016a528b1)
Current main still has the bug source: The Overview WebSocket URL input still clears settings.token whenever the typed value differs from the previous gateway URL, matching the linked report's immediate token loss. (ui/src/ui/views/overview.ts:272, bcb016a528b1)
Latest release still has the same handler: v2026.6.6 still contains the same token-clearing Overview URL input logic, so the central behavior is not shipped fixed. (ui/src/ui/views/overview.ts:272, 8c802aa68351)
Existing token scope contract: Control UI token storage already normalizes gateway token scope and loads tokens from sessionStorage by that selected gateway URL, which supports the PR's helper boundary. (ui/src/ui/storage.ts:137, bcb016a528b1)
Connect path uses current token and URL: GatewayBrowserClient is created with host.settings.gatewayUrl and the trimmed host.settings.token, so this form state directly affects gateway authentication. (ui/src/ui/app-gateway.ts:795, bcb016a528b1)

Likely related people:

velvet-shark: GitHub metadata for fix(ui): preserve control-ui auth across refresh #40892 shows velvet-shark authored and merged the March 2026 auth-refresh fix whose squash commit added sessionStorage token scoping and the current Overview URL-edit token-clearing behavior. (role: introduced behavior / auth-refresh feature history; confidence: high; commits: f2f561fab1bf, f9b237589248; files: ui/src/ui/views/overview.ts, ui/src/ui/storage.ts, ui/src/ui/navigation.browser.test.ts)
BunsDev: Recent history shows substantial Control UI and Overview-adjacent work in the dashboard and settings surfaces, including PR feat(ui): overhaul settings and slash command UX #67819. (role: recent adjacent UI contributor; confidence: medium; commits: 2cfb660a9bb8, f76a3c5225bb; files: ui/src/ui/views/overview.ts, ui/src/ui/app-render.ts, ui/src/ui/storage.ts)
Sally O'Malley: History shows adjacent per-gateway Control UI session scoping work in storage.ts, which shares the selected-gateway state invariant used by this PR. (role: adjacent storage contributor; confidence: medium; commits: d37e3d582fd8; files: ui/src/ui/storage.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

barnacle-openclaw · 2026-05-30T04:53:59Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

openclaw-barnacle · 2026-06-14T05:05:27Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

vincentkoc · 2026-06-16T06:02:50Z

Clownfish 🐠 reef update

Thanks for the work here. Clownfish patched this branch directly so the contributor trail stays right where it started.

Source PR: #73923
Validation: pnpm check:changed
Contributor credit stays attached to this PR and its history. no one gets washed out with the tide.

fish notes: model gpt-5.5, reasoning medium; reviewed against 691264f.

…claw#73923) * fix(ui): preserve gateway token during safe websocket url edits * fix(ui): preserve gateway token during safe websocket url edits --------- Co-authored-by: openclaw-clownfish[bot] <280122609+openclaw-clownfish[bot]@users.noreply.github.com>

openclaw-clownfish Bot mentioned this pull request Apr 29, 2026

fix(ui): preserve gateway token when editing WebSocket URL #42001

Closed

openclaw-clownfish Bot added the clawsweeper Tracked by ClawSweeper automation label Apr 29, 2026

openclaw-barnacle Bot added app: web-ui App: web-ui size: S labels Apr 29, 2026

clawsweeper Bot mentioned this pull request Apr 29, 2026

[Bug]: Editing WebSocket URL clears Gateway Token in Overview #41545

Closed

This was referenced Apr 29, 2026

fix(ui): preserve gateway token when editing websocket url #41546

Closed

fix(control-ui): preserve token when editing WebSocket URL #41552

Closed

fix(ui): prevent WebSocket URL edit from clearing Gateway Token #41718

Closed

barnacle-openclaw Bot added the stale Marked as stale due to inactivity label May 30, 2026

clawsweeper Bot added the rating: 🌊 off-meta tidepool PR readiness rating does not apply to this item. label May 30, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label May 31, 2026

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jun 14, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jun 15, 2026

clawsweeper Bot added the merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. label Jun 15, 2026

openclaw-clownfish Bot added 2 commits June 16, 2026 06:02

fix(ui): preserve gateway token during safe websocket url edits

62c8512

fix(ui): preserve gateway token during safe websocket url edits

691264f

vincentkoc force-pushed the clownfish/ghcrawl-156708-autonomous-smoke branch from ee19a9f to 691264f Compare June 16, 2026 06:02

vincentkoc merged commit 59950f7 into main Jun 16, 2026
17 of 18 checks passed

vincentkoc deleted the clownfish/ghcrawl-156708-autonomous-smoke branch June 16, 2026 06:03

vincentkoc added the clownfish Tracked by Clownfish automation label Jun 16, 2026

This was referenced Jun 18, 2026

fix(control-ui): share gateway token scope across loopback hosts #73987

Open

feat: redesign control overview dashboard #77774

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(ui): preserve gateway token during safe websocket url edits#73923

fix(ui): preserve gateway token during safe websocket url edits#73923
vincentkoc merged 2 commits into
mainfrom
clownfish/ghcrawl-156708-autonomous-smoke

openclaw-clownfish Bot commented Apr 29, 2026

Uh oh!

greptile-apps Bot commented Apr 29, 2026

Uh oh!

clawsweeper Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

barnacle-openclaw Bot commented May 30, 2026

Uh oh!

openclaw-barnacle Bot commented Jun 14, 2026

Uh oh!

vincentkoc commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

openclaw-clownfish Bot commented Apr 29, 2026

Summary

Validation

Notes

Uh oh!

greptile-apps Bot commented Apr 29, 2026

Greptile Summary

Confidence Score: 5/5

Uh oh!

clawsweeper Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

barnacle-openclaw Bot commented May 30, 2026

Uh oh!

openclaw-barnacle Bot commented Jun 14, 2026

Uh oh!

vincentkoc commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

clawsweeper Bot commented Apr 29, 2026 •

edited

Loading