feat(gateway): restrict session tools by authenticated hosting node by anagnorisis2peripeteia · Pull Request #93411 · openclaw/openclaw

anagnorisis2peripeteia · 2026-06-15T19:55:02Z

Summary

Adds gateway.tools.byNode — a per-node tool restriction keyed off the authenticated node hosting a turn, enforced run-scoped.
When a turn is dispatched from a node-originated agent.request, the gateway threads that node's id (from its cryptographic device pairing — unforgeable) through the run as hostingNodeId; the in-process agent tool builder resolves the node's allow/deny from it and narrows that turn's toolset.
Restriction-only (never escalates), fail-closed on an explicit empty allow, spawned subagents inherit the narrowed surface. The id is carried with the run (not a session-global map), so a node's policy cannot bleed onto a later/concurrent turn for the same session.
Out of scope: any consumer-specific wiring (e.g. the browser/extension routing that will use this) — that lands separately.
Success: a node-originated turn's tools are confined to the hosting node's policy; non-node turns are unaffected.
Reviewers: focus on node-tool-policy.ts, the hostingNodeId threading (server-node-events → ingress opts → runEmbeddedAgent → attempt → createOpenClawCodingTools), and the fail-closed/no-escalate semantics.

Linked context

Related #93347 (the earlier byClientId approach, closed — client.id is self-declared/forgeable; this replaces it with the authenticated node identity).

Requested via ClawSweeper's review of #93347 (gate the toolset off the authenticated node, not a self-declared name).

Real behavior proof (required for external PRs)

Behavior or issue addressed: gateway.tools.byNode confining a node-originated agent turn's tools to the authenticated hosting node's policy, resolved run-scoped.
Real environment tested: a real OpenClaw gateway plus a separately device-paired node, both running from a build of this run-scoped code on macOS — gateway and openclaw node run as two processes, loopback device pairing auto-approved via gateway.nodes.pairing.autoApproveCidrs.
Exact steps or command run after this patch:
1. openclaw gateway run --dev --auth none --port 18789 with gateway.nodes.pairing.autoApproveCidrs: ["127.0.0.1/32"].
2. Set gateway.tools.byNode["<node-id>"] = { allow: ["web_search", "image"] }.
3. openclaw node run --host 127.0.0.1 --port 18789 → the node device-pairs and is auto-approved (gateway logs device pairing auto-approved device=06f4ec…e71a7c role=node).
4. The node emits a node-originated agent.request over its authenticated connection (the same emitter path the browser bridge uses in production).
5. Inspect the agent's resolved toolset during tool construction.
Evidence after fix (copied live output):
[BYNODE_DEBUG] session=agent:dev:box-rs allow=[web_search,image] before=5{tts,web_search,web_fetch,image,canvas} after=2{web_search,image}
Observed result after fix: the node-originated turn's toolset was narrowed from the full 5 tools to exactly the 2 the node's byNode policy allows, resolved run-scoped from the authenticated hostingNodeId threaded through the run. Changing the allow list changes the surviving set; an empty allow yields zero tools (fail-closed); a non-node turn keeps all tools.
What was not tested: a full GUI Chrome "My Browser" session driving a real tab; a two-physical-machine distributed topology.
Proof limitations or environment constraints: gateway + node ran as two processes on one host (loopback device pairing) rather than two machines. The [BYNODE_DEBUG] line and the one-shot node agent.request are env-gated box-only instrumentation (not part of this PR) used to trigger and observe the otherwise-internal node-originated path. A combined GUI recording was blocked by available disk (no room for a VM image).
Before evidence: with no gateway.tools.byNode entry for the node, the same node-originated turn keeps all 5 tools (no restriction); with allow: ["browser","memory_search","memory_get"] (none present in that dev agent's set) the turn resolves to 0 tools — confirming fail-closed.

Tests and validation

pnpm build: clean.
node-tool-policy unit tests — allow/deny resolution, fail-closed empty allow, deny-only, no-op when no hosting node, no-op when node unconfigured.
Embedded-builder byNode tests (in the createOpenClawCodingTools suite) — assert the resolved toolset narrows via the run-scoped hostingNodeId.
Config round-trip — schema accepts byNode, rejects an unknown inner key.
Plus the live paired-node proof above.

Risk checklist

User-visible behavior change? No (additive config; no-op unless gateway.tools.byNode is set and a turn is node-originated).
Config/environment/migration change? Yes — new gateway.tools.byNode config surface (TS type, Zod schema, config help, and gateway docs added).
Security/auth/tool-execution change? Yes — a new tool-authorization boundary keyed by authenticated node identity. Restriction-only: it can only reduce a node's tools, never grant, so a misconfiguration fails safe. Covered by no-escalate and fail-closed tests.
Highest-risk area: cross-turn scoping. Mitigation: the node id is run-scoped (threaded through the run), not a TTL'd session map, so it cannot apply to a later/concurrent turn for the same session (this resolved ClawSweeper's prior P1).

Current review state

Next action: maintainer review.
Waiting on: nothing from the author for the patch; the branch base is behind main (a rebase/CI-fixture refresh may be wanted at merge time — the flagged CI failure is in unrelated tooling, not the touched files).
Addressed bot comments: P1 run-scoped boundary (replaced the session-global map with run-scoped hostingNodeId; ClawSweeper confirmed the session-global bug is gone, patch quality 🦐); P2 byNode documentation (config help + gateway docs added); the stray driver:"extension" schema change was reverted. This update adds the required real-behavior-proof fields above.

Add gateway.tools.byNode: a per-node tool restriction keyed off the AUTHENTICATED node hosting a turn. When a turn is dispatched from a node-originated agent.request, the gateway records the originating nodeId (from the node's cryptographic device pairing — a client cannot forge it) against the session key, and tool resolution narrows the toolset to that node's policy. The restriction is enforced in BOTH tool-resolution paths via a shared resolveNodeScopedToolPolicy helper: the gateway scoped resolver (resolveGatewayScopedTools, for MCP/HTTP callers) and the in-process agent tool builder (createOpenClawCodingTools), which a node-originated turn actually runs through. Restriction-only: it can narrow the toolset, never escalate; an explicitly-present (even empty) allow is fail-closed; spawned subagents inherit the narrowed surface. Tests: gateway resolver byNode (allow intersect, no-escalate, fail-closed empty allow, deny, no-op cases), embedded-builder byNode (same matrix), and config round-trip (schema accept/reject).

clawsweeper · 2026-06-15T19:57:41Z

Codex review: found issues before merge. Reviewed June 30, 2026, 11:44 PM ET / 03:44 UTC.

Summary
The PR adds gateway.tools.byNode, threads an authenticated hosting node id through node-originated agent runs, applies per-node allow/deny filtering in embedded tool construction, and documents/tests the behavior.

PR surface: Source +136, Tests +150, Docs +19. Total +305 across 15 files.

Reproducibility: yes. for the review finding: PR head adds two FIELD_HELP keys without matching FIELD_LABELS, and the existing quality test enforces that parity. The feature itself is new behavior, with paired-node live output supplied in the PR body.

Review metrics: 1 noteworthy metric.

Config surfaces: 1 added, 0 changed, 0 removed. The added gateway.tools.byNode key changes configured node-originated tool availability, so metadata, upgrade expectations, and owner acceptance matter before merge.

Root-cause cluster
Relationship: canonical
Canonical: #93411
Summary: This PR is the active authenticated-node byNode primitive; the earlier client-id PR is closed unmerged, and the open browser routing PR stacks on this primitive but contains separate browser work.

Members:

superseded: feat(gateway): restrict session tools by connecting client id #93347 - It proposed a self-declared client-id restriction and is closed unmerged; this PR replaces that approach with authenticated node identity.
adjacent_distinct: feat(browser): side panel copilot with per-tab agent sessions #93680 - It depends on this byNode primitive for My Browser routing, but its remaining work is browser/extension routing rather than this core gateway config primitive.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P2] Add FIELD_LABELS entries for gateway.tools.byNode and gateway.tools.byNode.*.
Rebase or resolve the current conflicting base and rerun focused config/gateway validation.
[P1] Get explicit gateway/security maintainer acceptance for the fail-closed authenticated-node tool restriction.

Risk before merge

[P1] The branch is currently reported as conflicting, so maintainers cannot rely on the reviewed head as a clean merge result.
[P1] gateway.tools.byNode is a new public config surface that can change tool availability for configured node-originated turns.
[P1] An explicit empty or mismatched node allow list intentionally leaves node-originated turns with zero tools, so maintainers should accept that fail-closed operator experience.
[P1] The PR creates a new tool-authorization boundary keyed by authenticated paired node identity; the implementation is restriction-only, but the gateway/security contract still needs owner acceptance.

Maintainer options:

Repair metadata and refresh the branch (recommended)
Add FIELD_LABELS entries for the two new help keys, resolve the conflicting base, and rerun the focused config and gateway/tool-policy validation before final review.
Accept the node-scoped boundary deliberately
After the mechanical repair, a gateway/security owner can explicitly accept the restriction-only authenticated-node policy and its fail-closed behavior.
Pause if the config shape is not settled
If maintainers are not ready to make gateway.tools.byNode permanent public config, pause or split the PR into narrower plumbing plus a later approved policy surface.

Next step before merge

[P1] Manual review is needed because the branch is conflicting and the remaining blocker includes maintainer acceptance of a new public fail-closed security/config boundary, not only the mechanical label repair.

Security
Cleared: No concrete supply-chain regression was found; the remaining security-sensitive point is maintainer acceptance of the new restriction-only authorization boundary.

Review findings

[P2] Add labels for the new gateway.tools.byNode help keys — src/config/schema.help.ts:101-104

Review details

Best possible solution:

Add the missing config labels, rebase or resolve the conflicts, and then have maintainers explicitly accept the fail-closed authenticated-node tool boundary before landing this primitive ahead of the stacked browser-routing work.

Do we have a high-confidence way to reproduce the issue?

Yes for the review finding: PR head adds two FIELD_HELP keys without matching FIELD_LABELS, and the existing quality test enforces that parity. The feature itself is new behavior, with paired-node live output supplied in the PR body.

Is this the best way to solve the issue?

No, not merge-ready as-is. The run-scoped authenticated-node design is the right direction compared with the closed client-id approach, but the metadata repair, branch refresh, and explicit owner acceptance are still needed.

Full review comments:

[P2] Add labels for the new gateway.tools.byNode help keys — src/config/schema.help.ts:101-104
The config help quality test requires every FIELD_HELP key to have a matching FIELD_LABELS entry. This PR adds gateway.tools.byNode and gateway.tools.byNode.* help text, but the label map still only covers gateway.tools, .allow, and .deny, so the parity metadata remains incomplete.
Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 21d1e1f0fc9d.

Label changes

Label justifications:

P2: This is a normal-priority gateway hardening feature with bounded scope and concrete pre-merge repair work, not an urgent shipped regression.
merge-risk: 🚨 compatibility: The PR adds a public gateway config key that can change node-originated tool availability for configured deployments.
merge-risk: 🚨 security-boundary: The PR introduces a new tool-authorization boundary keyed by authenticated paired node identity.
merge-risk: 🚨 availability: A configured empty or mismatched node allow policy can intentionally leave node-originated turns with no available tools.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (live_output): The PR body provides paired gateway/node setup steps and copied live output showing node-scoped tool narrowing after the patch, with limitations clearly stated.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body provides paired gateway/node setup steps and copied live output showing node-scoped tool narrowing after the patch, with limitations clearly stated.

Evidence reviewed

PR surface:

Source +136, Tests +150, Docs +19. Total +305 across 15 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	11	155	19	+136
Tests	3	150	0	+150
Docs	1	19	0	+19
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	15	324	19	+305

What I checked:

Current main lacks byNode: A current-main search for byNode, hostingNodeId, resolveNodeScopedToolPolicy, and node-tool-policy found no implementation in source or gateway docs, so this PR is not obsolete on main. (21d1e1f0fc9d)
Missing config labels: PR head adds FIELD_HELP entries for gateway.tools.byNode and gateway.tools.byNode.*, but FIELD_LABELS still only labels gateway.tools, .allow, and .deny in that section. (src/config/schema.help.ts:101, 7a6f52c149a0)
Label parity test: The existing config help quality test fails when any FIELD_HELP key lacks a non-empty FIELD_LABELS entry, making the missing labels a source-reproducible PR defect. (src/config/schema.help.quality.test.ts:668, 7a6f52c149a0)
Run-scoped node threading: The PR passes hostingNodeId: nodeId from a node-originated agent.request into agent command dispatch rather than using a session-global map. (src/gateway/server-node-events.ts:600, 7a6f52c149a0)
Embedded tool filtering: The embedded tool builder resolves the node policy from options.hostingNodeId, applies node deny/allow after the normal policy pipeline, and captures the narrowed surface for inheritance. (src/agents/agent-tools.ts:1205, 7a6f52c149a0)
Live PR state: GitHub reports the PR head as CONFLICTING / DIRTY against its base, so the branch needs a rebase or conflict resolution before normal merge review can finish. (7a6f52c149a0)

Likely related people:

vincentkoc: Recent GitHub commit history shows work on shared node agent dispatch and gateway/tool-resolution paths that this PR threads through. (role: recent area contributor; confidence: high; commits: 335c3a8d3165, 2b05bd7b0d9a, eb9318e9535a; files: src/gateway/server-node-events.ts, src/gateway/tool-resolution.ts, src/agents/agent-tools.ts)
giodl73-repo: Recent history includes fix(policy): recognize declared tool allowlists, touching sibling policy surfaces that this PR extends. (role: tool-policy contributor; confidence: medium; commits: fadbcf8a4e43; files: src/gateway/tool-resolution.ts, src/agents/agent-tools.ts)
steipete: Recent history includes gateway node helper documentation and config diagnostics helper work near the gateway/config surface changed here. (role: adjacent gateway and config-docs contributor; confidence: medium; commits: a3f495eb09d5, 3ad7049cba9d, 8408c16da4db; files: src/gateway/server-node-events.ts, src/gateway/tool-resolution.ts, src/config/schema.help.quality.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

reviewed 2026-06-22T22:28:18.868Z sha 7a6f52c :: needs changes before merge. :: [P2] Add labels for the new help keys

The merge-base extraction pulled the browser extension-driver schema reintroduction into this PR; it belongs to the (separate) extension work, not the byNode primitive. Revert that hunk so the PR is purely the gateway.tools.byNode addition. (ClawSweeper openclaw#93411 P2.)

Address ClawSweeper openclaw#93411 P1: the session-global sessionKey->nodeId map could apply a node's policy to a later/concurrent turn for the same session. Replace it with a run-scoped hosting node id threaded through the run: server-node-events passes hostingNodeId on the node-originated agent.request dispatch -> ingress opts -> runEmbeddedAgent -> attempt params -> createOpenClawCodingTools, which resolves gateway.tools.byNode from that explicit id. resolveNodeScopedToolPolicy now takes the node id directly (no session lookup); the MCP/HTTP scoped resolver passes none (not node-originated). No cross-turn bleed.

Replace the session-global sessionKey->nodeId map with a run-scoped hosting node id threaded through the run, so a node's policy can never bleed onto a later or concurrent turn for the same session. - node-tool-policy.ts (renamed from session-node-id-registry.ts): resolveNode ScopedToolPolicy now takes the authenticated node id directly; the map + set/get are gone. - server-node-events passes hostingNodeId on the node-originated agent.request dispatch -> AgentCommandOpts -> runEmbeddedAgent (RunEmbeddedAgentParams) -> EmbeddedRunAttemptParams -> createOpenClawCodingTools, which resolves byNode from that explicit id. - The MCP/HTTP scoped resolver (resolveGatewayScopedTools) passes no hosting node (not node-originated) -> byNode no-op there. byNode is enforced in the embedded agent tool builder, the path a node-originated turn actually runs through. - Tests: drop the resolver byNode test; add a run-scoped node-tool-policy unit test; the embedded-builder byNode tests now pass hostingNodeId.

anagnorisis2peripeteia · 2026-06-16T10:58:48Z

Updated for ClawSweeper's review:

[P1] run-scoped boundary — replaced the session-global sessionKey→nodeId map with a run-scoped hostingNodeId threaded through the run (dispatch → ingress opts → runEmbeddedAgent → attempt → createOpenClawCodingTools). No cross-turn/concurrent bleed. byNode is now enforced only in the embedded agent tool builder (the path a node-originated turn runs through); the MCP/HTTP scoped resolver carries no hosting node.
[P2] extension driver schema — the stray driver:"extension" change was already reverted; this PR is purely byNode.
Real behavior proof — added: a real authenticated node (loopback-paired) emits a node-originated agent.request; the gateway applies byNode to that turn. Live tool-resolution: allow=[web_search,image] → before=5{tts,web_search,web_fetch,image,canvas} after=2{web_search,image}. See the PR body.

@clawsweeper re-review

clawsweeper · 2026-06-16T10:58:51Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27622344177
Updated: 2026-06-16T14:17:36.969Z

anagnorisis2peripeteia · 2026-06-16T11:38:35Z

@clawsweeper re-review (the prior re-review run failed waiting for Codex capacity, not on the diff — retrying)

anagnorisis2peripeteia · 2026-06-16T13:20:21Z

@clawsweeper re-review

anagnorisis2peripeteia · 2026-06-16T13:48:21Z

@clawsweeper re-review

Add config-help entries (schema.help.ts) for gateway.tools.byNode and its per-node allow/deny, and a Gateway tool policy section in the configuration reference: restriction-only, authenticated-node keyed (unforgeable), fail-closed empty allow, nodeId discovered via /whoami or nodes list.

anagnorisis2peripeteia · 2026-06-16T14:25:21Z

Addressed the re-review:

[P1] proof — added the full Real behavior proof section with redacted paired-node setup steps + live tool-resolution output (byNode narrowing a node-originated turn 5→2, run-scoped).
[P2] docs — gateway.tools.byNode now documented in config help (schema.help.ts) and the gateway configuration reference.
Run-scoped boundary (prior P1) already resolved; patch quality 🦐.

@clawsweeper re-review

clawsweeper · 2026-06-16T14:25:25Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27624738639
Updated: 2026-06-16T14:56:13.972Z

…t hook (private seam) The interim F3 fix (b3e840c) made node-gateway-events-internal a real exported plugin-SDK entrypoint to clear the runtime ERR_PACKAGE_PATH_NOT_EXPORTED, but that re-grew the public SDK surface (the plugin-sdk surface/api budgets correctly flagged it) -- the exact thing F3 was about. Replace it with a true private seam: the node-host injects its emitNodeGatewayEvent into the bridge in-process via the onNodeHostStart hook context (new extensions/browser/.../node-gateway-emitter.ts registry). server-lifecycle emits through the registry; the node-host passes the real emitter when it runs the startup hook. emitNodeGatewayEvent is never on the public plugin-SDK surface -- a third-party plugin cannot import it or forge node-attributed events -- and it still throws without a registered node (gateway-only fallback). Removed the node-gateway-events-internal subpath + entrypoint; re-synced package exports. Verified live on a clean install: relay binds on the node-host eager-start with NO kick, the bundled extension reconnects + attaches, and a side-panel turn routes through the node (gateway log node=ffc1b7d3...). Build clean. (api/surface baselines now reflect only the intended removal of emitNodeGatewayEvent from the public gateway-runtime barrel plus pre-existing openclaw#93411 stacked-base deprecated-export drift, which the rebase drops.)

anagnorisis2peripeteia · 2026-07-14T17:57:00Z

Closing after #100619 merged. Its remote browser-node support (the gateway proxies browser actions to node-hosted Chrome over the existing authenticated node link) removes this primitive's consuming feature: the #93680 side-panel copilot no longer needs node-anchored turn routing, so the byNode confinement boundary would ship with no consumer. Rather than ask maintainers to accept a new public fail-closed security surface nothing uses, I'm closing it. The branch and review history stay available if node-scoped tool confinement finds a real consumer later. #93680 is being rebased onto the merged relay per the coordination note there.

openclaw-barnacle Bot added gateway Gateway runtime agents Agent runtime and tooling size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 15, 2026

anagnorisis2peripeteia marked this pull request as ready for review June 16, 2026 13:43

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jun 16, 2026

openclaw-barnacle Bot added the docs Improvements or additions to documentation label Jun 16, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels Jun 16, 2026

anagnorisis2peripeteia mentioned this pull request Jun 16, 2026

feat(browser): side panel copilot with per-tab agent sessions #93680

Closed

clawsweeper Bot mentioned this pull request Jul 5, 2026

[Bug]: Chrome extension browser relay removed with no cross-machine replacement (regression) #53599

Closed

steipete mentioned this pull request Jul 6, 2026

feat(browser): restore driver "extension" via a loopback Chrome extension relay (no remote-debugging prompt) #100619

Merged

anagnorisis2peripeteia closed this Jul 14, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(gateway): restrict session tools by authenticated hosting node#93411

feat(gateway): restrict session tools by authenticated hosting node#93411
anagnorisis2peripeteia wants to merge 4 commits into
openclaw:mainfrom
anagnorisis2peripeteia:feat/gateway-node-tool-scope

anagnorisis2peripeteia commented Jun 15, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

anagnorisis2peripeteia commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

anagnorisis2peripeteia commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

anagnorisis2peripeteia commented Jun 16, 2026

Uh oh!

clawsweeper Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

anagnorisis2peripeteia commented Jul 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

anagnorisis2peripeteia commented Jun 15, 2026 •

edited

Loading

clawsweeper Bot commented Jun 15, 2026 •

edited

Loading

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading

clawsweeper Bot commented Jun 16, 2026 •

edited

Loading