refactor: extract gateway client package by steipete · Pull Request #87797 · openclaw/openclaw

steipete · 2026-05-28T22:13:47Z

Summary

Extract gateway protocol sources into packages/gateway-protocol and gateway client/runtime helpers into packages/gateway-client.
Keep src/gateway/client.ts as the OpenClaw host wrapper that injects signing, logging redaction, proxy bypass, and host-specific gateway dependencies.
Add root build, test, CI-scope, CodeQL, Knip, watcher, CODEOWNERS, and docs routing for the new packages.

Real behavior proof

Behavior addressed: gateway client/protocol package extraction without changing the public OpenClaw gateway client contract.
Real environment tested: local macOS source checkout on the rebased PR branch; GitHub Actions started for head b6f4d6a9d94de3d698a88eedd0874f07bcf28bca.
Exact steps or command run after this patch:

node scripts/run-vitest.mjs run src/agents/embedded-agent-runner/run/attempt.cwd-split.test.ts
node scripts/run-vitest.mjs run src/gateway/client.test.ts packages/gateway-protocol/src/index.test.ts packages/gateway-protocol/src/native-protocol-levels.guard.test.ts packages/gateway-protocol/src/primitives.secretref.test.ts
node scripts/run-tsgo.mjs -b tsconfig.core.json
OPENCLAW_LOCAL_CHECK=0 pnpm deadcode:dependencies
git diff --check

Evidence after fix: focused embedded-runner test passed 1 file / 2 tests; focused gateway/protocol Vitest passed 8 files / 190 tests; core tsgo passed; dependency deadcode check passed; git diff --check passed.
Observed result after fix: gateway protocol types resolve from packages/gateway-protocol, gateway client host checks use ipaddr.js instead of hand-rolled IPv6 parsing, and the root gateway client wrapper preserves existing OpenClaw host behavior.
What was not tested: no live gateway/device pairing scenario was run.

Verification

node scripts/run-vitest.mjs run src/agents/embedded-agent-runner/run/attempt.cwd-split.test.ts
node scripts/run-vitest.mjs run src/gateway/client.test.ts packages/gateway-protocol/src/index.test.ts packages/gateway-protocol/src/native-protocol-levels.guard.test.ts packages/gateway-protocol/src/primitives.secretref.test.ts
node scripts/run-tsgo.mjs -b tsconfig.core.json
OPENCLAW_LOCAL_CHECK=0 pnpm deadcode:dependencies
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main running for final closeout on the pushed head

github-actions · 2026-05-28T22:13:57Z

Dependency Changes Detected

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

package.json
packages/gateway-client/package.json
packages/gateway-protocol/package.json
pnpm-lock.yaml

Maintainer follow-up:

Review whether the dependency changes are intentional.
Inspect resolved package deltas when lockfile, shrinkwrap, or workspace dependency policy changes are present.
Treat package-lock.json and npm-shrinkwrap.json diffs as security-review surfaces.
Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

clawsweeper · 2026-05-28T22:15:13Z

Codex review: needs real behavior proof before merge. Reviewed May 28, 2026, 9:19 PM ET / 01:19 UTC.

Summary
The branch extracts gateway protocol and client runtime code into private workspace packages and updates related build, docs, tests, CI, label, ownership, and package metadata.

Reproducibility: yes. for the review blockers by source inspection: PR head shows the public SDK export pointing at packages/gateway-protocol/src while package metadata ships dist only, and CI/ownership maps omit packages/gateway-client/src. I did not run build or live gateway tests because this review is read-only.

Review metrics: 3 noteworthy metrics.

Private workspace packages: 2 added. New gateway-client and gateway-protocol package boundaries expand build, dependency, and release review surfaces.
Published SDK subpaths affected: 1 existing export. openclaw/plugin-sdk/gateway-runtime is a public plugin SDK subpath and must keep shipped type/runtime resolution intact.
Critical routing gaps: 3 path maps missing gateway-client. CodeQL, CODEOWNERS, and labeler routing need the new runtime package path before maintainers can rely on normal review automation.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🦪 silver shellfish
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Fix the plugin SDK gateway-runtime export so published artifacts resolve protocol types and values from shipped files.
[P1] Add packages/gateway-client/src/** to CodeQL, CODEOWNERS, and labeler routing.
[P1] Add redacted after-fix live gateway/device pairing proof or equivalent packaged runtime proof.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body lists focused tests, tsgo, dependency checks, and git diff checks, but explicitly says no live gateway/device pairing scenario was run after the extraction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] External plugin consumers of openclaw/plugin-sdk/gateway-runtime can lose type/runtime resolution if the published package points at packages/gateway-protocol/src paths that are not shipped in the root npm package.
[P1] Future gateway-client auth, TLS, plaintext WebSocket, and token changes can bypass critical CodeQL/profile routing, gateway labels, or secops ownership because packages/gateway-client/src/** is not wired everywhere the moved runtime needs.
[P1] The PR body does not include a live gateway/device pairing run, so this broad runtime extraction still lacks real after-fix proof for the user-facing gateway path.

Maintainer options:

Fix package/export and routing before merge (recommended)
Preserve the published plugin SDK gateway-runtime contract and add packages/gateway-client/src/** to CodeQL, CODEOWNERS, and label routing before this extraction lands.
Require live gateway proof
Ask for a redacted local gateway/device pairing or equivalent packaged gateway smoke that exercises the extracted client at runtime after the patch.
Pause the package split
If maintainers do not want to make the protocol package a shipped or rewritten dependency surface now, pause this branch and keep the code in the current shipped layout.

Next step before merge

[P1] The remaining blockers need author or maintainer handling because contributor real behavior proof is missing and the package-boundary/public SDK choice is compatibility-sensitive.

Security
Needs attention: The diff does not show a malicious dependency change, but it moves auth/TLS gateway client code without preserving critical security review and CodeQL routing.

Review findings

[P1] Keep plugin SDK protocol exports in packaged dist — src/plugin-sdk/gateway-runtime.ts:41-42
[P2] Route gateway-client through critical CodeQL — .github/workflows/codeql-critical-quality.yml:115
[P2] Add secops ownership for gateway-client auth files — .github/CODEOWNERS:32

Review details

Best possible solution:

Land only after the plugin SDK gateway-runtime export resolves through shipped artifacts, gateway-client paths are wired into CI/ownership/labels, and a redacted live gateway/device-pairing proof confirms the refactor preserves runtime behavior.

Do we have a high-confidence way to reproduce the issue?

Yes for the review blockers by source inspection: PR head shows the public SDK export pointing at packages/gateway-protocol/src while package metadata ships dist only, and CI/ownership maps omit packages/gateway-client/src. I did not run build or live gateway tests because this review is read-only.

Is this the best way to solve the issue?

No; the package extraction is a reasonable direction, but the current implementation should first preserve the packaged plugin SDK contract, route the new gateway-client package through review automation, and add live gateway proof.

Full review comments:

[P1] Keep plugin SDK protocol exports in packaged dist — src/plugin-sdk/gateway-runtime.ts:41-42
External plugins can import openclaw/plugin-sdk/gateway-runtime, whose published types point at dist/plugin-sdk/gateway-runtime.d.ts while the root npm package ships dist/ and not packages/. Re-exporting protocol values/types from ../../packages/gateway-protocol/src/index.js can make the generated SDK artifact reference files absent from the tarball; route this through a shipped dist/gateway/protocol artifact or package the protocol surface as an actual dependency/export.
Confidence: 0.87
[P2] Route gateway-client through critical CodeQL — .github/workflows/codeql-critical-quality.yml:115
The moved gateway client package owns auth, TLS fingerprint, token, and plaintext WebSocket checks, but this workflow only adds the protocol package to the trigger/profile paths. A PR that later changes only packages/gateway-client/src/** can miss the critical gateway and auth CodeQL lanes, so add the client package to both the path filters and profile classifier.
Confidence: 0.88
[P2] Add secops ownership for gateway-client auth files — .github/CODEOWNERS:32
packages/gateway-client/src/device-auth.ts and the client host dependency surface now handle signed device auth payloads, token storage callbacks, and TLS formatting. CODEOWNERS only moved protocol secret refs, so future edits to gateway-client auth code can bypass secops review.
Confidence: 0.88
[P3] Label gateway-client edits as Gateway work — .github/labeler.yml:199
The gateway label now follows the protocol package but not the extracted client runtime package. Add packages/gateway-client/src/** so client-only gateway runtime changes still get normal maintainer routing.
Confidence: 0.82

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 92051f6746c6.

Label changes

Label changes:

add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists focused tests, tsgo, dependency checks, and git diff checks, but explicitly says no live gateway/device pairing scenario was run after the extraction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
remove proof: sufficient: Current real behavior proof status is mock_only, not sufficient.
remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.
remove status: ⏳ waiting on author: Current PR status label is status: 📣 needs proof.

Label justifications:

P2: This is a broad gateway runtime/package refactor with concrete compatibility and automation blockers, but no current shipped outage.
merge-risk: 🚨 compatibility: The changed public plugin SDK subpath can break external plugin consumers if generated package artifacts reference repo-only package source paths.
merge-risk: 🚨 availability: Gateway client connection/auth/runtime code moved packages without live gateway pairing proof, so a runtime startup or connection regression is still plausible.
merge-risk: 🚨 automation: The new gateway-client package path is missing from critical CodeQL, secops ownership, and gateway label routing.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦪 silver shellfish.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists focused tests, tsgo, dependency checks, and git diff checks, but explicitly says no live gateway/device pairing scenario was run after the extraction. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

Security concerns:

[medium] gateway-client misses critical CodeQL routing — .github/workflows/codeql-critical-quality.yml:115
packages/gateway-client/src contains WebSocket safety, auth token, and TLS fingerprint handling, but the CodeQL critical workflow paths/profile omit that new package path.
Confidence: 0.88
[medium] gateway-client auth code misses secops ownership — .github/CODEOWNERS:32
The new device-auth package file is not covered by the existing gateway auth CODEOWNERS rules, so future auth payload changes can avoid the intended security owner review.
Confidence: 0.88

What I checked:

Repository policy read: Read the full root AGENTS.md plus scoped docs, scripts, gateway, gateway protocol, plugin SDK, agents, plugins, TUI, and UI guides; plugin SDK public-contract and gateway protocol compatibility rules affected this review. (AGENTS.md:13, 92051f6746c6)
Maintainer notes check: The only local maintainer note found was Telegram-specific, so no note changed the gateway/package review. (.agents/maintainer-notes/telegram.md, 92051f6746c6)
Published SDK export now points at repo-only package source: PR head re-exports ErrorCodes, errorShape, and EventFrame from ../../packages/gateway-protocol/src/index.js inside the public plugin SDK gateway-runtime subpath. (src/plugin-sdk/gateway-runtime.ts:41, b6f4d6a9d94d)
Root npm package ships dist and exposes gateway-runtime from dist: The root package files list includes dist/ but not packages/, while openclaw/plugin-sdk/gateway-runtime points consumers at dist/plugin-sdk/gateway-runtime.d.ts and .js. (package.json:23, b6f4d6a9d94d)
Flat plugin SDK declarations are generated from source entries: The declaration writer builds flat plugin SDK declarations from source entrypoints and only externalizes bare specifiers, so the new relative packages/ import is a packaging-contract risk unless it is rewritten or shipped. (scripts/write-plugin-sdk-entry-dts.ts:80, b6f4d6a9d94d)
gateway-client is not routed through critical CodeQL: The CodeQL trigger/profile paths include packages/gateway-protocol/src/** but still omit packages/gateway-client/src/** even though the new client package owns WebSocket, auth, token, and TLS helper paths. (.github/workflows/codeql-critical-quality.yml:115, b6f4d6a9d94d)

Likely related people:

steipete: Current main blame and history show Peter Steinberger authored the current gateway client, protocol, and plugin-sdk gateway-runtime surfaces that this PR moves. (role: recent area contributor; confidence: high; commits: 49f36ab58dca, 27ae826f6525, f5408d82d210; files: src/gateway/client.ts, src/gateway/protocol/index.ts, src/plugin-sdk/gateway-runtime.ts)
vincentkoc: Recent shared runtime and gateway/client typing refactors in the same area make Vincent Koc a useful routing candidate for package-boundary review. (role: adjacent area contributor; confidence: medium; commits: 87b2a6a16aa2, c109a7623b13; files: src/gateway/client.ts, src/plugin-sdk/gateway-runtime.ts)
joshavant: Josh Avant previously worked on gateway token fallback and reconnect behavior, which overlaps the extracted client auth/reconnect surface. (role: adjacent gateway auth contributor; confidence: medium; commits: a76e81019333; files: src/gateway/client.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 88b9cf3294

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-28T23:04:19Z

  /^(Dockerfile$|\.npmrc$|package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|scripts\/ci-changed-scope\.mjs$|scripts\/install(?:-cli)?\.sh$|scripts\/install\.ps1$|scripts\/test-install-sh-docker\.sh$|scripts\/docker\/|scripts\/e2e\/(?:Dockerfile(?:\.qr-import)?|qr-import-docker\.sh|bun-global-install-smoke\.sh)$|\.github\/workflows\/(?:install-smoke|website-installer-sync)\.yml$|\.github\/actions\/setup-node-env\/action\.yml$)/;
-const FAST_INSTALL_SMOKE_RUNTIME_SCOPE_RE = /^src\/(?:channels|gateway|plugin-sdk|plugins)\//;
+const FAST_INSTALL_SMOKE_RUNTIME_SCOPE_RE =
+  /^(?:src\/(?:channels|gateway|plugin-sdk|plugins)\/|packages\/gateway-protocol\/src\/)/;


Include gateway-client runtime in changed-smoke scope

With the client implementation now moved under packages/gateway-client/src, a PR that edits only that package no longer matches FAST_INSTALL_SMOKE_RUNTIME_SCOPE_RE, so detectInstallSmokeScopeForPath() leaves runFastInstallSmoke/runChangedSmoke false even though the changed code is part of the installed gateway client runtime. This misses the same install-smoke coverage that src/gateway/** and the extracted protocol package still get; include packages/gateway-client/src/ in this runtime scope and add a routing test alongside the new protocol case.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

openclaw/scripts/run-node-watch-paths.mjs

Lines 7 to 9 in 0477290

    
           export const runNodeSourceRoots = ["src", BUNDLED_PLUGIN_ROOT_DIR]; 
        
           export const runNodeConfigFiles = ["tsconfig.json", "package.json", "tsdown.config.ts"]; 
        
           export const runNodeWatchedPaths = [...runNodeSourceRoots, ...runNodeConfigFiles];

Include extracted packages in run-node rebuild inputs

Because the extracted gateway client/protocol are now first-class build inputs, leaving runNodeSourceRoots limited to src and bundled plugins lets pnpm openclaw gateway call/status use a stamped dist without rebuilding after edits under packages/gateway-client/src or packages/gateway-protocol/src when tsconfig.json/tsdown.config.ts did not change. I checked scripts/run-node.mjs: shouldFastPathExistingDistForGatewayClient() only validates these sourceRoots plus config files before skipping the build, while tsdown.config.ts now builds dist entries directly from those package paths, so source changes there can run stale gateway client/protocol code until a config file or src/ changes.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-05-28T23:25:20Z

      - "src/gateway/server-startup-memory.ts"
      - "src/gateway/method-scopes.ts"
-      - "src/gateway/protocol/**"
+      - "packages/gateway-protocol/src/**"
      - "src/gateway/server-methods/**"


Route gateway-client changes through CodeQL gateway checks

With the client runtime moved into packages/gateway-client/src, edits to that package no longer trigger this workflow and also won't set the gateway profile in the file-classification case below; I checked the workflow paths and profile routing, and only packages/gateway-protocol/src/** was added alongside the old gateway surfaces. That means PRs that change the installed gateway client's auth/TLS/plaintext WebSocket handling can bypass the critical gateway CodeQL lane unless they also touch src/gateway/** or the protocol package.

Useful? React with 👍 / 👎.

steipete · 2026-05-29T01:23:32Z

Verification before merge:

Behavior addressed: gateway client/protocol package extraction without changing the public OpenClaw gateway client contract.
Real environment tested: local macOS source checkout on PR head b6f4d6a; GitHub Actions on the same head.
Exact steps or command run after this patch:

node scripts/run-vitest.mjs run src/agents/embedded-agent-runner/run/attempt.cwd-split.test.ts
node scripts/run-vitest.mjs run src/gateway/client.test.ts packages/gateway-protocol/src/index.test.ts packages/gateway-protocol/src/native-protocol-levels.guard.test.ts packages/gateway-protocol/src/primitives.secretref.test.ts
node scripts/run-tsgo.mjs -b tsconfig.core.json
OPENCLAW_LOCAL_CHECK=0 pnpm deadcode:dependencies
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main

Evidence after fix: focused embedded-runner test passed 1 file / 2 tests; focused gateway/protocol Vitest passed 8 files / 190 tests; core tsgo passed; dependency deadcode check passed; git diff check passed; autoreview reported no accepted/actionable findings. GitHub Actions passed on CI run 26611855150, CodeQL run 26611855119 after rerunning a wedged shard, Real behavior proof run 26612185810, Blacksmith Testbox run 26611855096, Blacksmith Build Artifacts Testbox run 26611855102, and OpenGrep run 26611855098.
Observed result after fix: gateway protocol types resolve from packages/gateway-protocol, gateway client host checks use ipaddr.js instead of hand-rolled IPv6 parsing, and the root gateway client wrapper preserves existing OpenClaw host behavior.
What was not tested: no live gateway/device pairing scenario was run.

* refactor: extract gateway client package * chore: drop generated gateway package artifacts * refactor: move gateway protocol package * refactor: remove old gateway protocol tree * test: keep auth compat split in run mode * test: expose gateway wrapper options for internals * fix: watch moved gateway package sources * test: normalize slash command import guard * chore: teach knip gateway package entries * ci: route gateway client package checks * fix: reuse ipaddr for gateway client hosts * fix: sync gateway protocol usage schema

steipete requested a review from a team as a code owner May 28, 2026 22:13

github-actions Bot added the dependencies-changed PR changes dependency-related files label May 28, 2026

openclaw-barnacle Bot added gateway Gateway runtime size: XL maintainer Maintainer-authored PR labels May 28, 2026

openclaw-barnacle Bot added docs Improvements or additions to documentation app: web-ui App: web-ui cli CLI command changes scripts Repository scripts commands Command implementations agents Agent runtime and tooling labels May 28, 2026

chatgpt-codex-connector Bot reviewed May 28, 2026

View reviewed changes

steipete force-pushed the refactor/gateway-client-package branch from 88b9cf3 to 0477290 Compare May 28, 2026 23:21

chatgpt-codex-connector Bot reviewed May 28, 2026

View reviewed changes

steipete added 6 commits May 29, 2026 02:04

test: expose gateway wrapper options for internals

fc84413

fix: watch moved gateway package sources

f5a3334

test: normalize slash command import guard

d78a8d2

chore: teach knip gateway package entries

4a2fa1b

ci: route gateway client package checks

35d3016

fix: reuse ipaddr for gateway client hosts

735b52c

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels May 29, 2026

fix: sync gateway protocol usage schema

b6f4d6a

steipete force-pushed the refactor/gateway-client-package branch from 7f82575 to b6f4d6a Compare May 29, 2026 01:09

steipete merged commit b1117d9 into main May 29, 2026
132 of 140 checks passed

steipete deleted the refactor/gateway-client-package branch May 29, 2026 01:23

Haderach-Ram mentioned this pull request May 29, 2026

Ecosystem Digest — 2026-05-29 Haderach-Ram/openclaw-radar#22

Open

github-actions Bot mentioned this pull request May 29, 2026

📡 Upstream Digest — 2026-05-29 02:31 UTC curtismercier/openclaw-mods#968

Open

This was referenced Jun 11, 2026

Node run/install: add --header for WebSocket upgrade (Cloudflare Zero Trust) #42841

Closed

[Feature]: Reusable gateway WebSocket client SDK package #49178

Open

vincentkoc mentioned this pull request Jun 23, 2026

CLI gateway calls can poison local device scopes after read probes #95997

Closed

clawsweeper Bot mentioned this pull request Jun 27, 2026

fix(security): use constant-time comparison for TLS fingerprint verification #49083

Closed

4 tasks

clawsweeper Bot mentioned this pull request Jul 7, 2026

fix(gateway): restrict allowPrivateWs to trusted private/reserved domain suffixes #100919

Closed

steipete mentioned this pull request Jul 12, 2026

Add gateway watchdog authenticated handshake probe #81590

Closed

clawsweeper Bot mentioned this pull request Jul 15, 2026

[Security] Session hijacking vulnerability due to predictable sequence IDs in gateway client #107523

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

refactor: extract gateway client package#87797

refactor: extract gateway client package#87797
steipete merged 12 commits into
mainfrom
refactor/gateway-client-package

steipete commented May 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 28, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot May 28, 2026

Uh oh!

steipete commented May 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	export const runNodeSourceRoots = ["src", BUNDLED_PLUGIN_ROOT_DIR];
	export const runNodeConfigFiles = ["tsconfig.json", "package.json", "tsdown.config.ts"];
	export const runNodeWatchedPaths = [...runNodeSourceRoots, ...runNodeConfigFiles];

Uh oh!

Uh oh!

Conversation

steipete commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Verification

Uh oh!

github-actions Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Changes Detected

Uh oh!

clawsweeper Bot commented May 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot May 28, 2026

Choose a reason for hiding this comment

Uh oh!

steipete commented May 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

steipete commented May 28, 2026 •

edited

Loading

github-actions Bot commented May 28, 2026 •

edited

Loading

clawsweeper Bot commented May 28, 2026 •

edited

Loading