fix: require admin for HTTP session kills by steipete-oai · Pull Request #92651 · openclaw/openclaw

steipete-oai · 2026-06-13T09:46:51Z

Summary

Fixes the HTTP session-kill authorization path so POST /sessions/:sessionKey/kill no longer treats client-declared x-openclaw-requester-session-key as parent-session ownership proof.
Requires the existing sessions.delete / operator.admin scope before session lookup, then always routes authorized requests through the established admin kill helper.
Removes the stale requester-owned HTTP kill branch; admin-scoped local and trusted HTTP kill behavior stays intact.
Intentionally out of scope: adding a new non-admin HTTP kill capability. The current HTTP auth result has no authenticated session-key binding to make that ownership claim trustworthy.

Linked context

Maintainer-requested security sweep. No linked issue.

Real behavior proof (required for external PRs)

Behavior or issue addressed: trusted HTTP callers with only operator.write can no longer spoof x-openclaw-requester-session-key to kill a child session owned by another requester.
Real environment tested: local OpenClaw checkout exercising the gateway HTTP handler through its HTTP-server regression test.
Exact steps or command run after this patch: node scripts/run-vitest.mjs src/gateway/session-kill-http.test.ts
Evidence after fix: [test] passed 1 Vitest shard; Test Files 4 passed (4); Tests 52 passed (52).
Observed result after fix: trusted-proxy requester-session kill with operator.write returns 403 / missing scope: operator.admin; admin-scoped requests still return 200 and call killSubagentRunAdmin with the canonical session key.
What was not tested: a live remote gateway/devbox run.
Proof limitations or environment constraints: remote devbox execution from this workstation was blocked before repo commands ran because the local SSH signing agent refused signing; PR CI is the broad remote gate.
Before evidence: the removed regression expected write-scoped requester-session HTTP kills to succeed through killControlledSubagentRun.

Tests and validation

node scripts/run-vitest.mjs src/gateway/session-kill-http.test.ts
git diff --check
.agents/skills/autoreview/scripts/autoreview --mode local -> autoreview clean: no accepted/actionable findings reported

Regression coverage now asserts that the spoofable requester header is rejected without operator.admin, and that admin-scoped requests ignore the requester header and use the admin kill path.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes. Non-admin HTTP requester-session kills are no longer accepted.

Did config, environment, or migration behavior change? (Yes/No)

No.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes. HTTP session kills now require the admin session-delete scope.

What is the highest-risk area?

Remote clients that were relying on the previous write-scoped requester-session HTTP kill path now need an admin-scoped caller or a future session-bound HTTP proof mechanism.

How is that risk mitigated?

The removed path had no trustworthy HTTP binding between the caller and the declared requester session key. The admin path remains available and covered, and the direct local/admin Control UI behavior remains intact.

Current review state

Next action: CI, review, then land if green.

Waiting on: GitHub CI. Remote devbox proof is blocked by local SSH signing on this workstation; focused local regression proof and autoreview are complete.

Reviewer comments addressed: none yet.

clawsweeper · 2026-06-13T09:48:15Z

Codex review: needs real behavior proof before merge. Reviewed June 13, 2026, 5:53 AM ET / 09:53 UTC.

Summary
The PR removes the requester-owned write-scoped HTTP session kill branch and requires sessions.delete/admin scope before using killSubagentRunAdmin.

PR surface: Source -54, Tests -61. Total -115 across 2 files.

Reproducibility: yes. Current main and v2026.6.6 both show the trusted-proxy requester header selecting the write-scoped sessions.abort path, and the removed test case encoded that success path.

Review metrics: 1 noteworthy metric.

HTTP Kill Compatibility Path: 1 write-scoped requester-owned path removed; admin path retained. This is a shipped HTTP behavior change that existing trusted-proxy clients may notice before merge.

Stored data model
Persistent data-model change detected: serialized state: src/gateway/session-kill-http.test.ts, serialized state: src/gateway/session-kill-http.ts, unknown-data-model-change: src/gateway/session-kill-http.test.ts, unknown-data-model-change: src/gateway/session-kill-http.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted live Gateway/devbox proof showing operator.write requester-header kills return 403 and admin-scoped kills still return 200, or get a maintainer proof override.
[P1] Have a maintainer explicitly accept the shipped non-admin HTTP kill compatibility break before landing.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body reports targeted Vitest HTTP-server regression output but no live Gateway/devbox run; add redacted live terminal/log proof or maintainer override, then update the PR body to trigger re-review.

Risk before merge

[P1] Existing trusted-proxy clients that relied on operator.write plus x-openclaw-requester-session-key for HTTP subagent kills will start receiving 403 until they use an admin-scoped caller or a future authenticated session-binding mechanism.
[P1] The PR body reports focused HTTP-handler regression tests, but not a live Gateway/devbox run; for an external PR this remains mock/test-only real behavior proof.

Maintainer options:

Accept Admin-Only HTTP Kills After Proof (recommended)
Land this security hardening once a maintainer confirms the write-scoped HTTP kill path is not a supported contract and the proof gate is satisfied or overridden.
Design Session-Bound Non-Admin Proof
Pause the PR if maintainers decide non-admin HTTP kills must remain supported, and add an authenticated session binding instead of trusting the requester header.

Next step before merge

[P1] Protected maintainer label plus a compatibility-sensitive fail-closed auth change require human maintainer acceptance; there is no narrow automated repair to queue.

Security
Cleared: No new security or supply-chain regression was found; the diff narrows a requester-header authorization boundary and adds focused regression coverage.

Review details

Best possible solution:

Land the admin-only HTTP kill path after maintainer acceptance of the compatibility break and either live proof or an explicit proof override.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main and v2026.6.6 both show the trusted-proxy requester header selecting the write-scoped sessions.abort path, and the removed test case encoded that success path.

Is this the best way to solve the issue?

Yes, with maintainer acceptance. Because the HTTP auth result has no authenticated binding between caller and requester session key, requiring the existing admin sessions.delete scope is the narrowest safe fix; a non-admin replacement would need a new proof mechanism.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f3df863aff9c.

Label changes

Label changes:

add P1: The PR addresses a security-sensitive Gateway authorization path that can affect real HTTP session control workflows.
add merge-risk: 🚨 compatibility: Merging changes shipped trusted-proxy operator.write requester-session kills into admin-only failures.
add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body reports targeted Vitest HTTP-server regression output but no live Gateway/devbox run; add redacted live terminal/log proof or maintainer override, then update the PR body to trigger re-review.

Label justifications:

P1: The PR addresses a security-sensitive Gateway authorization path that can affect real HTTP session control workflows.
merge-risk: 🚨 compatibility: Merging changes shipped trusted-proxy operator.write requester-session kills into admin-only failures.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body reports targeted Vitest HTTP-server regression output but no live Gateway/devbox run; add redacted live terminal/log proof or maintainer override, then update the PR body to trigger re-review.

Evidence reviewed

PR surface:

Source -54, Tests -61. Total -115 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	9	63	-54
Tests	1	21	82	-61
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	30	145	-115

What I checked:

Current HTTP kill path trusts requester header: Current main reads x-openclaw-requester-session-key, chooses sessions.abort when the request is not local-admin, and then calls the controlled subagent kill path based on that declared requester key. (src/gateway/session-kill-http.ts:89, f3df863aff9c)
PR requires admin scope before lookup: The PR head resolves trusted HTTP scopes, authorizes sessions.delete, rejects missing admin scope before session lookup, and always calls killSubagentRunAdmin with the canonical session key. (src/gateway/session-kill-http.ts:81, aec980982b65)
Regression test covers rejected spoofable path: The PR head asserts a trusted-proxy request with operator.write plus requester-session header gets 403/missing scope: operator.admin, while an admin-scoped request with the header still uses the admin kill helper. (src/gateway/session-kill-http.test.ts:248, aec980982b65)
Scope contract supports the admin-only target: Gateway method descriptors classify sessions.abort as operator.write and sessions.delete as operator.admin, so routing HTTP kills through the delete/admin policy matches the stronger maintenance operation. (src/gateway/methods/core-descriptors.ts:153, f3df863aff9c)
Sibling HTTP owner check rejects self-declared ownership: Managed image attachment tests already reject trusted-proxy and device-token requests that try to prove ownership with only x-openclaw-requester-session-key, and allow the owner path through admin scope. (src/gateway/managed-image-attachments.test.ts:290, f3df863aff9c)
Shipped behavior includes the compatibility path: Release v2026.6.6 contains the requester-session HTTP kill branch, so this PR intentionally removes behavior that has reached a release tag. (src/gateway/session-kill-http.ts:89, 8c802aa68351)

Likely related people:

joshavant: Current-main blame for session-kill-http.ts, http-auth-utils.ts, method descriptors, and the admin kill helper points to the recent gateway/source-tree reintroduction commit that now carries this behavior. (role: recent area contributor; confidence: high; commits: da4671ebccfb; files: src/gateway/session-kill-http.ts, src/gateway/http-auth-utils.ts, src/gateway/methods/core-descriptors.ts)
jacobtomlinson: Authored and merged the PR that changed HTTP session kills from bearer-admin access to requester-owned control, and later merged the scope-enforcement PR preserving that branch. (role: feature-history owner; confidence: high; commits: 02cf12371f93, 54a087851716; files: src/gateway/session-kill-http.ts, src/gateway/session-kill-http.test.ts)
eleqtrizit: Authored the merged scope-enforcement change that required sessions.abort for requester-owned kills and sessions.delete for admin kills. (role: scope-hardening contributor; confidence: high; commits: 54a087851716; files: src/gateway/session-kill-http.ts, src/gateway/session-kill-http.test.ts)
steipete: Recently changed HTTP auth utility behavior to require admin for model overrides, adjacent to the same trusted HTTP operator-scope boundary touched here. (role: recent adjacent auth hardening contributor; confidence: medium; commits: 26b97369226e; files: src/gateway/http-auth-utils.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

steipete-oai · 2026-06-13T09:57:06Z

Land-ready proof for aec980982b652a5d56142eee962d7efd6b106a4f:

Focused gateway tests: node scripts/run-vitest.mjs src/gateway/session-kill-http.test.ts passed, 52 tests.
Diff sanity: git diff --check passed.
Structured autoreview: .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main clean; no accepted/actionable findings, overall 0.98.
GitHub CI: CI 27463302882, CodeQL 27463302865, Dependency Guard 27463302838, Workflow Sanity 27463302868, OpenGrep PR Diff 27463302873, and Real behavior proof 27463306196 all green for this head.
Crabbox devbox proof was attempted, but local SSH-agent signing failed before any remote command executed; no remote product E2E result beyond the green CI/real-behavior proof gate.

Merge state is clean and the PR is mergeable.

steipete-oai · 2026-06-13T09:59:49Z

Maintainer closeout after merge:

I am accepting the admin-only HTTP kill behavior for this security hardening. The removed operator.write + x-openclaw-requester-session-key path used caller-controlled HTTP metadata as ownership proof; preserving non-admin HTTP kills safely would require a new authenticated session-binding mechanism rather than trusting that header.

Compatibility note: trusted-proxy clients that relied on write-scoped requester-header kills must use an admin-scoped caller for HTTP kills, or wait for a future session-bound non-admin design.

Proof was posted in the land-ready comment above. Crabbox devbox proof remains blocked at local SSH-agent signing before remote execution; ssh-add -T still returns agent refusal, so reprovisioning another box would not reach the OpenClaw command phase.

Co-authored-by: Peter Steinberger <[email protected]>

…26.6.8) (#1144) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.6` → `2026.6.8` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.8`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202668) [Compare Source](openclaw/openclaw@v2026.6.6...v2026.6.8) ##### Highlights - Telegram and WhatsApp channel delivery are richer and less brittle: Telegram can send structured rich text with tables, lists, expandable blockquotes, prompt-preserving CLI backend delivery, retired native draft migration, and safer rich-media boundaries, while WhatsApp now honors configured ACP bindings. ([#92679](openclaw/openclaw#92679), [#84082](openclaw/openclaw#84082), [#89421](openclaw/openclaw#89421), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus), [@jzakirov](https://github.com/jzakirov), [@spacegeologist](https://github.com/spacegeologist), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent and Gateway recovery is sharper across account-scoped DM sends, generated media completions, restart shutdown aborts, yielded subagent pauses, yielded cron media, heartbeat dedupe, session identity prompts, and unknown OpenAI agent selector rejection. ([#92788](openclaw/openclaw#92788), [#91246](openclaw/openclaw#91246), [#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510)) Thanks [@yetval](https://github.com/yetval), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), and [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Provider/model handling expands and tightens with GLM-5.2, Claude Haiku 4.5 catalog rows, OpenRouter and Google Vertex provider-prefix normalization, managed SecretRef auth, bounded model browse discovery, storeless OpenAI Responses replay gating, and Claude 4.5 Copilot tool-streaming safety. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@snowzlm](https://github.com/snowzlm), and [@Kailigithub](https://github.com/Kailigithub). - `/usage` and reply payload hooks now have a native full footer renderer, default template, fixed-decimal formatting, credential-aware limits, better partial-count handling, and warnings for broken templates instead of silent bad output. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - UI and mobile flows are steadier: workspace files can collapse and start collapsed, WebChat backscroll survives streaming, the sidebar session picker remains interactive above the desktop workbench, reset soft args survive UI dispatch, stale dashboard session parent lineage is preserved, and iOS reconnects stale foreground gateways. ([#92779](openclaw/openclaw#92779), [#92622](openclaw/openclaw#92622), [#92705](openclaw/openclaw#92705), [#91353](openclaw/openclaw#91353), [#90658](openclaw/openclaw#90658), [#92552](openclaw/openclaw#92552)) Thanks [@shakkernerd](https://github.com/shakkernerd), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@NianJiuZst](https://github.com/NianJiuZst), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@luoyanglang](https://github.com/luoyanglang), and [@Solvely-Colin](https://github.com/Solvely-Colin). - Memory, state, and diagnostics recover cleaner: oversized OpenAI embedding batches split before 431s, QMD memory search stays available in transient mode, SQLite avoids WAL on NFS state volumes, stuck-session recovery scheduling no longer resets warning backoff, and Infinity chunk limits stay genuinely unbounded. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752), [#92735](openclaw/openclaw#92735)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), [@gnanam1990](https://github.com/gnanam1990), and [@yhterrance](https://github.com/yhterrance). ##### Changes - Providers/models: add GLM-5.2 support and Claude Haiku 4.5 catalog entries while keeping provider-qualified model IDs normalized across OpenRouter and Google Vertex paths. ([#92796](openclaw/openclaw#92796), [#90116](openclaw/openclaw#90116), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218)) Thanks [@arkyu2077](https://github.com/arkyu2077), [@liuhao1024](https://github.com/liuhao1024), and [@bymle](https://github.com/bymle). - Channel plugins: ship Telegram rich-message delivery and WhatsApp ACP binding support, including rich prompt handoff to CLI backends and transport fixtures for richer drafts. ([#92679](openclaw/openclaw#92679), [#92513](openclaw/openclaw#92513)) Thanks [@obviyus](https://github.com/obviyus) and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agent commands: support `/btw` in CLI-backed sessions and keep CLI usage-error exits classified as usage failures instead of successful runs. ([#92669](openclaw/openclaw#92669), [#92162](openclaw/openclaw#92162)) Thanks [@joshavant](https://github.com/joshavant) and [@Pandah97](https://github.com/Pandah97). - Usage hooks: add built-in full footer rendering, default footer templates, per-turn usage state, credential-aware limits, and fixed-decimal formatting for usage-bar templates. ([#92657](openclaw/openclaw#92657), [#89835](openclaw/openclaw#89835), [#89629](openclaw/openclaw#89629)) Thanks [@Marvinthebored](https://github.com/Marvinthebored). - Docs and operator guidance: document node config examples, clarify before-install hook scope, correct agent default concurrency comments, refresh ZAI provider docs, and update channel/group docs for current Telegram and WhatsApp behavior. ([#92677](openclaw/openclaw#92677), [#92766](openclaw/openclaw#92766), [#92695](openclaw/openclaw#92695)) Thanks [@liuhao1024](https://github.com/liuhao1024), [@sallyom](https://github.com/sallyom), and [@ArielSmoliar](https://github.com/ArielSmoliar). ##### Fixes - Onboarding/skills: show the Homebrew install recommendation only on macOS and Linux, so FreeBSD and other unsupported platforms no longer get a misleading brew prompt. Fixes [#68893](openclaw/openclaw#68893); carries forward [#68894](openclaw/openclaw#68894), [#68910](openclaw/openclaw#68910), [#68941](openclaw/openclaw#68941), [#68943](openclaw/openclaw#68943), [#69002](openclaw/openclaw#69002), and [#69545](openclaw/openclaw#69545). Thanks [@yurivict](https://github.com/yurivict), [@Sanjays2402](https://github.com/Sanjays2402), [@Eruditi](https://github.com/Eruditi), [@JustInCache](https://github.com/JustInCache), [@nnish16](https://github.com/nnish16), and [@Mlightsnow](https://github.com/Mlightsnow). - Channels and delivery: preserve account-scoped DM channel send policy, rich Telegram final replies, rich Telegram tables and lists, Telegram thread-create CLI remapping, Slack outbound `message_sent` hooks, contributed message-tool schema optionality, same-channel generated media completions, and channel chunking around surrogate pairs and Infinity limits. ([#92788](openclaw/openclaw#92788), [#92679](openclaw/openclaw#92679), [#89421](openclaw/openclaw#89421), [#89943](openclaw/openclaw#89943), [#91137](openclaw/openclaw#91137), [#91246](openclaw/openclaw#91246), [#92735](openclaw/openclaw#92735)) Thanks [@yetval](https://github.com/yetval), [@obviyus](https://github.com/obviyus), [@spacegeologist](https://github.com/spacegeologist), [@rishitamrakar](https://github.com/rishitamrakar), [@lundog](https://github.com/lundog), [@TurboTheTurtle](https://github.com/TurboTheTurtle), and [@yhterrance](https://github.com/yhterrance). - Auto-reply/groups: keep ordinary group text replies on automatic final-reply delivery while allowing `message(action=send)` for files, images, and other attachments to the same group or topic. Carries forward [#43276](openclaw/openclaw#43276); refs [#48004](openclaw/openclaw#48004). Thanks [@NayukiChiba](https://github.com/NayukiChiba) and [@ShakaRover](https://github.com/ShakaRover). - Auto-reply/skills: preserve multiline payloads for `/skill` and direct skill slash commands while keeping command-head normalization for aliases, colon syntax, and bot mentions. Fixes [#79155](openclaw/openclaw#79155); carries forward [#81305](openclaw/openclaw#81305). Thanks [@web3blind](https://github.com/web3blind). - iMessage: normalize leading NUL sent-message echo prefixes while preserving interior NUL bytes and the leading attributedBody marker handling from [#73942](openclaw/openclaw#73942). Carries forward [#63581](openclaw/openclaw#63581). Thanks [@drvoss](https://github.com/drvoss). - Discord: give generated auto-thread titles a 60-second timeout and 4,096-token reasoning-model output budget, clamped to the selected model output cap. ([#64734](openclaw/openclaw#64734)) Thanks [@hanamizuki](https://github.com/hanamizuki). - Agent, cron, and Gateway runtime: mark active main sessions before restart shutdown aborts, pause yielded subagent runs whose terminal also signals abort, preserve yielded media completions, de-duplicate main-session heartbeat events, expose session identity in runtime prompts, reject unknown OpenAI agent selectors, keep generated media completions and slash-command block replies in WebChat, preserve fresh post-compaction usage while clearing stale usage snapshots, and require admin privileges for HTTP session/model override surfaces. ([#91357](openclaw/openclaw#91357), [#92631](openclaw/openclaw#92631), [#92146](openclaw/openclaw#92146), [#91287](openclaw/openclaw#91287), [#92468](openclaw/openclaw#92468), [#92510](openclaw/openclaw#92510), [#91246](openclaw/openclaw#91246), [#50795](openclaw/openclaw#50795), [#50845](openclaw/openclaw#50845), [#82874](openclaw/openclaw#82874), [#92651](openclaw/openclaw#92651), [#92646](openclaw/openclaw#92646)) Thanks [@ooiuuii](https://github.com/ooiuuii), [@openperf](https://github.com/openperf), [@IWhatsskill](https://github.com/IWhatsskill), [@ZengWen-DT](https://github.com/ZengWen-DT), [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@Hollychou924](https://github.com/Hollychou924), [@leno23](https://github.com/leno23), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Agents/exec: default empty-success background completion notices on only for real chat channels, preserving explicit opt-outs and keeping generic providers silent while carrying forward the narrow UX intent from [#39726](openclaw/openclaw#39726) and [#46926](openclaw/openclaw#46926). Thanks [@Sapientropic](https://github.com/Sapientropic) and [@wenkang-xie](https://github.com/wenkang-xie). - Providers and model replay: preserve storeless OpenAI Responses replay compatibility, avoid eager tool streaming for Claude 4.5 in Copilot, honor profile auth for SecretRef model entries, bound model browsing, strip provider prefixes where runtimes need bare IDs, and surface nested embedding fetch failures. ([#90706](openclaw/openclaw#90706), [#75393](openclaw/openclaw#75393), [#90686](openclaw/openclaw#90686), [#92247](openclaw/openclaw#92247), [#92627](openclaw/openclaw#92627), [#91218](openclaw/openclaw#91218), [#92628](openclaw/openclaw#92628)) Thanks [@snowzlm](https://github.com/snowzlm), [@Kailigithub](https://github.com/Kailigithub), [@rohitjavvadi](https://github.com/rohitjavvadi), [@samson910022](https://github.com/samson910022), [@liuhao1024](https://github.com/liuhao1024), [@bymle](https://github.com/bymle), and [@mushuiyu886](https://github.com/mushuiyu886). - Memory, state, diagnostics, and config: split header-too-large embedding batches, keep QMD memory search enabled in transient mode, avoid SQLite WAL on NFS volumes, preserve recovery scheduling outside stuck-session warning backoff, and keep shell environment fallbacks contained in config write tests. ([#92650](openclaw/openclaw#92650), [#92618](openclaw/openclaw#92618), [#92639](openclaw/openclaw#92639), [#91247](openclaw/openclaw#91247), [#92752](openclaw/openclaw#92752)) Thanks [@mushuiyu886](https://github.com/mushuiyu886), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@849261680](https://github.com/849261680), and [@gnanam1990](https://github.com/gnanam1990). - Workspace setup state: store setup completion outside the workspace dot directory using an OpenClaw-named root file, migrate valid legacy state forward, and avoid clobbering generic root `workspace-state.json` files for TigerFS-style dot-path compatibility. This Clownfish replacement carries forward the focused [#53326](openclaw/openclaw#53326) fix idea because the original branch was closed and uneditable. ([#53326](openclaw/openclaw#53326), [#44783](openclaw/openclaw#44783), [#39446](openclaw/openclaw#39446)) Thanks [@1qh](https://github.com/1qh). - UI/mobile/TUI: preserve dashboard session parent lineage, WebChat backscroll, reset soft command args, sidebar session picker interactivity, collapsed workspace files, resolved `/model` confirmation refs, and stale foreground iOS Gateway reconnects. ([#90658](openclaw/openclaw#90658), [#92622](openclaw/openclaw#92622), [#91353](openclaw/openclaw#91353), [#92705](openclaw/openclaw#92705), [#92779](openclaw/openclaw#92779), [#92773](openclaw/openclaw#92773), [#92552](openclaw/openclaw#92552)) Thanks [@luoyanglang](https://github.com/luoyanglang), [@TurboTheTurtle](https://github.com/TurboTheTurtle), [@zhouhe-xydt](https://github.com/zhouhe-xydt), [@NianJiuZst](https://github.com/NianJiuZst), [@shakkernerd](https://github.com/shakkernerd), [@NarahariRaghava](https://github.com/NarahariRaghava), and [@Solvely-Colin](https://github.com/Solvely-Colin). - TUI: reload the active session after external `/new` or `/reset` session-change events so stale transcript and stream state clear promptly. Fixes [#38966](openclaw/openclaw#38966); carries forward [#40472](openclaw/openclaw#40472). Thanks [@yizhanzjz](https://github.com/yizhanzjz) and [@wsyjh8](https://github.com/wsyjh8). - Control UI: preserve Gateway Access tokens during same-normalized WebSocket URL edits and reload gateway-scoped tokens when switching endpoints. Fixes [#41545](openclaw/openclaw#41545); repairs [#42001](openclaw/openclaw#42001) with additional source PRs [#41546](openclaw/openclaw#41546), [#41552](openclaw/openclaw#41552), and [#41718](openclaw/openclaw#41718). Thanks [@wsyjh8](https://github.com/wsyjh8), [@llagy0020](https://github.com/llagy0020), [@llagy007](https://github.com/llagy007), [@pingfanfan](https://github.com/pingfanfan), and [@zheliu2](https://github.com/zheliu2). - Gateway CLI: tolerate a single transient clean WebSocket close before `hello-ok` so one-shot RPC calls reconnect instead of failing noisily, while repeated clean pre-hello closes still surface. Carries forward source PRs [#54475](openclaw/openclaw#54475) and [#54774](openclaw/openclaw#54774); [#85253](openclaw/openclaw#85253) covered adjacent connect assembly diagnostics. Thanks [@ruanrrn](https://github.com/ruanrrn). - Gateway/Linux: keep root-owned systemd user service lifecycle commands on root's user manager when a stale `SUDO_USER` remains in a root shell with root's user bus environment. Fixes [#81410](openclaw/openclaw#81410). Thanks [@Ericksza](https://github.com/Ericksza) and [@ChuckClose-tech](https://github.com/ChuckClose-tech). - Release and test reliability: extend slow Gateway/full-suite watchdogs, split local full-suite shards when throttled, stabilize plugin auth marker fixtures, avoid brittle provider-ref error text, and keep QA Lab bootstrap selection assertions aligned with flow-only scenarios. ([#92652](openclaw/openclaw#92652)) - macOS Peekaboo bridge: update the embedded Peekaboo package to 3.5.2 and route bundled-skill CLI commands through the OpenClaw app bridge so they inherit its Screen Recording and Accessibility grants. - Agent routing: route subagent RPC callbacks addressed to an agent-shaped `--to` target to the correct session key instead of falling back to the main session, so WeChat (and other channel) session-key callbacks reach the intended subagent session. ([#90231](openclaw/openclaw#90231)) Thanks [@zhangguiping-xydt](https://github.com/zhangguiping-xydt). - Cron: preserve model, fallback, thinking, timeout, light-context, unsafe-content, and tool allow-list overrides on implicit text payloads by promoting them to agent turns, while explicit system events still prune those fields. Fixes [#28905](openclaw/openclaw#28905); carries forward [#64060](openclaw/openclaw#64060) and [#73946](openclaw/openclaw#73946). Thanks [@liaoandi](https://github.com/liaoandi). - QQBot delivery: keep markdown table chunks self-contained across message boundaries by preserving table state across block deliveries, flushing unfinished table-row fragments as plain text, and detecting short pipe-terminated rows by column count so split rows are not sent as malformed markdown. ([#92428](openclaw/openclaw#92428)) Thanks [@sliverp](https://github.com/sliverp). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1144

Co-authored-by: Peter Steinberger <[email protected]>

fix: require admin for HTTP session kills

aec9809

openclaw-barnacle Bot added gateway Gateway runtime size: S maintainer Maintainer-authored PR labels Jun 13, 2026

steipete-oai merged commit f78d7b5 into main Jun 13, 2026
212 of 220 checks passed

steipete-oai deleted the codex/openclaw-security-audit-2 branch June 13, 2026 09:57

github-actions Bot mentioned this pull request Jun 13, 2026

📡 Upstream Digest — 2026-06-13 10:22 UTC curtismercier/openclaw-mods#1065

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 14, 2026

fix: require admin for HTTP session kills (openclaw#92651)

60cb8ce

Co-authored-by: Peter Steinberger <[email protected]>

wangmiao0668000666 pushed a commit to wangmiao0668000666/openclaw that referenced this pull request Jun 17, 2026

fix: require admin for HTTP session kills (openclaw#92651)

ee987fe

Co-authored-by: Peter Steinberger <[email protected]>

badgerbees pushed a commit to badgerbees/openclaw that referenced this pull request Jul 8, 2026

fix: require admin for HTTP session kills (openclaw#92651)

74ea2ad

Co-authored-by: Peter Steinberger <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix: require admin for HTTP session kills#92651

fix: require admin for HTTP session kills#92651
steipete-oai merged 1 commit into
mainfrom
codex/openclaw-security-audit-2

steipete-oai commented Jun 13, 2026

Uh oh!

clawsweeper Bot commented Jun 13, 2026 •

edited

Loading

Uh oh!

steipete-oai commented Jun 13, 2026

Uh oh!

Uh oh!

steipete-oai commented Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

steipete-oai commented Jun 13, 2026

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

steipete-oai commented Jun 13, 2026

Uh oh!

Uh oh!

steipete-oai commented Jun 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jun 13, 2026 •

edited

Loading