Skip to content

fix(status): resolve gateway auth secrets for deep audit#87848

Merged
steipete merged 1 commit into
openclaw:mainfrom
ai-hpc:fix/status-deep-gateway-auth-secretref
Jun 1, 2026
Merged

fix(status): resolve gateway auth secrets for deep audit#87848
steipete merged 1 commit into
openclaw:mainfrom
ai-hpc:fix/status-deep-gateway-auth-secretref

Conversation

@ai-hpc

@ai-hpc ai-hpc commented May 29, 2026

Copy link
Copy Markdown
Member

Summary

  • Fix status --deep so gateway auth SecretRefs are resolved before the embedded security audit runs.
  • Share the gateway auth target list with the security-audit command target list to keep both command paths aligned.
  • Add focused coverage for status target selection, including the import-safe path that avoids channel/plugin registry discovery.

Fixes #87815.

Verification

  • pnpm test src/cli/command-secret-targets.test.ts src/cli/command-secret-targets.import.test.ts
  • pnpm test src/commands/status.scan-overview.test.ts src/commands/status.scan.test.ts src/commands/status.scan.fast-json.test.ts src/security/audit-gateway-http-auth.test.ts
  • git diff --check

Real behavior proof

content: behavior

environment: Ubuntu 26.04, Node 22.22.2, OpenClaw source checkout at c3ff31e7, isolated config/state under /tmp/openclaw-87815-proof, gateway token supplied through a SecretRef to OPENCLAW_GATEWAY_TOKEN.

steps:

  1. Created an isolated config with gateway.auth.mode="token" and gateway.auth.token as an env SecretRef.
  2. Started a real local gateway from the built checkout on port 28815.
  3. Ran status --deep against the same isolated config and SecretRef-backed token.

evidence:

Secret diagnostics:
- gateway.auth.token: gateway token env var is configured.

Gateway              local · ws://127.0.0.1:28815 (local loopback) · reachable 908ms · auth token

Security audit
Summary: 0 critical · 1 warn · 1 info
  WARN Reverse proxy headers are not trusted
    gateway.bind is loopback and gateway.trustedProxies is empty.

observedResult: status --deep reports the gateway as reachable with auth token, and the embedded security audit does not emit gateway.http.no_auth or claim gateway.auth.mode="none" for the SecretRef-backed token config.

notTested: A packaged install/service upgrade E2E was not run. The proof uses a real source-checkout gateway/status run with isolated config and focused regression tests for the command target selection path.

@openclaw-barnacle openclaw-barnacle Bot added cli CLI command changes size: XS labels May 29, 2026
@clawsweeper

clawsweeper Bot commented May 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed May 31, 2026, 8:59 PM ET / 00:59 UTC.

Summary
The PR shares gateway auth SecretRef target ids between status and security-audit command secret scanning and adds focused target-selection tests.

PR surface: Source +2, Tests +23. Total +25 across 3 files.

Reproducibility: yes. for source-level review: current main routes status scans through getStatusCommandSecretTargetIds while that selector omits gateway auth targets, matching the linked report and PR proof. I did not run the CLI because this review was read-only.

Review metrics: 1 noteworthy metric.

  • Status secret target ids: 4 gateway auth ids added. The runtime behavior change is exactly that status now resolves the gateway auth SecretRef surfaces needed by its embedded audit.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🦞 diamond lobster
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

  • [P2] No repair-lane work is needed; the branch already contains the narrow code/test fix and sufficient real behavior proof, so the remaining action is maintainer merge handling.

Security
Cleared: The diff expands read-only CLI secret target selection and tests only; it does not add secret exposure, dependency, workflow, package, or code-execution risk.

Review details

Best possible solution:

Land this scoped selector/test change after normal maintainer handling so status --deep and security audit resolve the same gateway auth SecretRefs.

Do we have a high-confidence way to reproduce the issue?

Yes for source-level review: current main routes status scans through getStatusCommandSecretTargetIds while that selector omits gateway auth targets, matching the linked report and PR proof. I did not run the CLI because this review was read-only.

Is this the best way to solve the issue?

Yes, this is the best narrow fix: reuse the existing command-secret resolver by sharing the gateway auth target ids with status, rather than changing gateway auth runtime behavior or adding a new config path.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 43ced7bc4949.

Label changes

Label justifications:

  • P2: This fixes a medium-impact CLI/auth diagnostic bug with limited blast radius in status and security-audit target selection.
  • rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live output from a real local gateway plus status --deep using a SecretRef-backed gateway token, and the land-prep comment reports focused regression tests passing on the reviewed head.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live output from a real local gateway plus status --deep using a SecretRef-backed gateway token, and the land-prep comment reports focused regression tests passing on the reviewed head.
Evidence reviewed

PR surface:

Source +2, Tests +23. Total +25 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 1 7 5 +2
Tests 2 23 0 +23
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 3 30 5 +25

What I checked:

  • Repository policy read: Root AGENTS.md was read fully and applied; no scoped AGENTS.md owns src/cli, and the only maintainer note found was Telegram-specific and unrelated. (AGENTS.md:1, 43ced7bc4949)
  • Current main status target gap: Current main's STATIC_STATUS_TARGET_IDS contains memory-search targets but not gateway.auth or gateway.remote auth targets, while STATIC_SECURITY_AUDIT_TARGET_IDS already includes those four gateway auth target ids. (src/cli/command-secret-targets.ts:57, 43ced7bc4949)
  • Status resolves command-selected secrets before scanning: collectStatusScanOverview resolves the loaded config with getStatusCommandSecretTargetIds before downstream status rendering and audit work use that config snapshot. (src/commands/status.scan-overview.ts:185, 43ced7bc4949)
  • Embedded status audit consumes the resolved status config: resolveStatusSecurityAudit passes the already-resolved status config into runSecurityAudit, making the status command target set the correct fix boundary for the embedded audit output. (src/commands/status-runtime-shared.ts:33, 43ced7bc4949)
  • Gateway HTTP no-auth finding depends on resolved auth: collectGatewayHttpNoAuthFindings calls resolveGatewayAuth and returns no finding when hasResolvedGatewayHttpAuth succeeds, so unresolved gateway auth SecretRefs can explain the false gateway.http.no_auth report. (src/security/audit-extra.sync.ts:727, 43ced7bc4949)
  • Gateway auth target ids are canonical SecretRef surfaces: The target registry declares gateway.auth.token, gateway.auth.password, gateway.remote.password, and gateway.remote.token as supported SecretRef targets with string resolved values. (src/secrets/target-registry-data.ts:168, 43ced7bc4949)

Likely related people:

  • steipete: Recent commit history for status, security audit, and command-secret target surfaces repeatedly shows steipete, and the latest land-prep comment verified this PR's scoped diff and focused tests. (role: recent area contributor and land-prep reviewer; confidence: high; commits: 00d8d7ead059, 9e67f53b913a, e3a248585e66; files: src/cli/command-secret-targets.ts, src/commands/status.scan-overview.ts, src/commands/status-runtime-shared.ts)
  • vincentkoc: Recent history for src/cli/command-secret-targets.ts includes vincentkoc's refactor of shared web secret target selection, adjacent to the selector list this PR changes. (role: recent selector-surface contributor; confidence: medium; commits: 95ea4b7cc6f0; files: src/cli/command-secret-targets.ts)
  • joshavant: Recent command-secret-target history includes joshavant's provider-backed SecretRef resolution work, which is adjacent to this PR's command target selection fix. (role: SecretRef command-path contributor; confidence: medium; commits: 2416de142194; files: src/cli/command-secret-targets.ts, src/cli/command-secret-gateway.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. labels May 29, 2026
@clawsweeper clawsweeper Bot added rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels May 29, 2026
@steipete steipete self-assigned this Jun 1, 2026
@steipete
steipete force-pushed the fix/status-deep-gateway-auth-secretref branch from ca31e9d to 41b052a Compare June 1, 2026 00:53
@steipete

steipete commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

Maintainer land prep for SHA 41b052a18188470ece311fe56ef79874f1ed08f9:

  • Rebased the contributor branch onto current origin/main to clear stale-base CI failures from unrelated memory-wiki / cron test type errors.
  • Verified the diff stayed scoped to src/cli/command-secret-targets.ts, src/cli/command-secret-targets.test.ts, and src/cli/command-secret-targets.import.test.ts.
  • Ran git diff --check origin/main...HEAD.
  • Ran focused proof via autoreview parallel tests: pnpm test src/cli/command-secret-targets.test.ts src/cli/command-secret-targets.import.test.ts src/commands/status.scan-overview.test.ts src/commands/status.scan.test.ts src/commands/status.scan.fast-json.test.ts src/security/audit-gateway-http-auth.test.ts.
  • Result: 3 Vitest shards passed, 77 tests passed.
  • Ran .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main --parallel-tests '<focused test command>'.
  • Auto Review result: clean, no accepted/actionable findings.

Known proof gap: no packaged install/service upgrade E2E was rerun locally; the PR body already contains real source-checkout gateway/status behavior proof for the SecretRef-backed gateway token case.

@steipete
steipete merged commit 3716969 into openclaw:main Jun 1, 2026
157 checks passed
@clawsweeper clawsweeper Bot mentioned this pull request Jun 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@steipete steipete

Labels

cli CLI command changes P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: status --deep falsely reports gateway.auth.mode="none" when token auth is configured via secret reference

3 participants

@ai-hpc @steipete @RomneyDa