fix(ios): focus missing gateway credentials#98189
Conversation
openclaw-barnacle
Bot
added
app: ios
|
Codex review: stale review; fresh review needed. Summary Next step Review history (3 earlier review cycles)
|
There was a problem hiding this comment.
Pull request overview
Updates iOS onboarding to make gateway connection paths clearer (QR/setup code vs LAN discovery vs Tailscale/remote vs manual), while tightening security around when plaintext tailnet CGNAT (100.64/10) connections are allowed and improving auth recovery messaging.
Changes:
- Replaces the initial onboarding step with a connection-path chooser and adds a dedicated Tailscale entry path (MagicDNS/Serve and raw 100.x handling gated by tailnet presence).
- Persists a
allowTailscalePlaintextflag through last-connection storage and threads it through manual connect + autoconnect decision logic. - Improves gateway auth issue detection/copy (token missing vs password missing vs generic unauthorized) and expands relevant test coverage.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| apps/shared/OpenClawKit/Tests/OpenClawKitTests/DeepLinksSecurityTests.swift | Minor test hardening by using #require for URL construction. |
| apps/ios/Tests/SwiftUIRenderSmokeTests.swift | Adds render smoke coverage for the new onboarding connection-path UI. |
| apps/ios/Tests/GatewaySettingsStoreTests.swift | Adds/updates tests for allowTailscalePlaintext persistence and legacy migration defaults. |
| apps/ios/Tests/GatewayConnectionSecurityTests.swift | Extends TLS/plaintext enforcement tests for tailnet CGNAT gating and removes unnecessary async markers. |
| apps/ios/Tests/GatewayConnectionIssueTests.swift | Adds detection tests for password-missing gateway auth states. |
| apps/ios/Tests/GatewayConnectionControllerTests.swift | Updates tests for new last-connection shape and uses #require for URLs. |
| apps/ios/Sources/Onboarding/OnboardingWizardView.swift | Implements new onboarding entry screen, Tailscale connect/probe flow, and improved auth recovery messaging. |
| apps/ios/Sources/Onboarding/OnboardingWizardSteps.swift | Introduces OnboardingConnectionPathStep UI with discovery/QR/setup/manual path selection. |
| apps/ios/Sources/Onboarding/OnboardingStateStore.swift | Updates the user-facing title for the remote/Tailscale connection mode. |
| apps/ios/Sources/Gateway/GatewaySettingsStore.swift | Extends last-connection storage to include allowTailscalePlaintext and improves diagnostic logging formatting. |
| apps/ios/Sources/Gateway/GatewayConnectionIssue.swift | Adds passwordMissing issue type and updates detection logic for structured/unstructured errors. |
| apps/ios/Sources/Gateway/GatewayConnectionController.swift | Threads allowTailscalePlaintext through manual connect, last-known connect, and autoconnect TLS enforcement logic. |
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
added
proof: sufficient
|
@clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. |
clawsweeper
Bot
removed
the
proof: sufficient
clawsweeper
Bot
removed
proof: sufficient
24585f0 to
04ce9bf
Compare
steipete
changed the title
clawsweeper
Bot
added
proof: 🎥 video
clawsweeper
Bot
removed
the
proof: 🎥 video
5d1dc0a to
b17a074
Compare
|
ClawSweeper status: review started. I am starting a fresh review of this pull request: fix(ios): focus missing gateway credentials This is item 1/1 in the current shard. Shard 0/1. This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking. Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted. |
b17a074 to
a69e91c
Compare
clawsweeper
Bot
removed
rating: 🧂 unranked krab
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a69e91cbba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .font(OpenClawType.footnote) | ||
| .foregroundStyle(.secondary) | ||
| } else if self.issue.needsAuthCredentials { | ||
| Text(verbatim: self.connectMessage ?? self.statusLine) |
There was a problem hiding this comment.
When the status-only path is used (no lastGatewayProblem) and a missing token/password has been detected, updateConnectionIssue deliberately keeps the auth issue sticky across later non-auth statuses, but it still copies every non-empty status into connectMessage afterward. Because this branch now renders that volatile message, reconnect churn can make the auth screen say things like “Connecting…” or “Offline” instead of telling the user which credential is missing; render stable copy from issue or avoid overwriting the message while the sticky auth issue is retained.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
rating: 🧂 unranked krab
|
Land-ready proof for
Ready to merge. |
|
Merged via squash.
|
* fix(ios): focus missing gateway credentials Co-authored-by: Colin <[email protected]> * test(macos): let main actor polling suspend --------- Co-authored-by: Peter Steinberger <[email protected]>
* fix(ios): focus missing gateway credentials Co-authored-by: Colin <[email protected]> * test(macos): let main actor polling suspend --------- Co-authored-by: Peter Steinberger <[email protected]>
What Problem This Solves
iOS onboarding previously treated a missing gateway password like a generic credential rejection. Users could land on the authentication step without the app selecting the credential field that actually needs attention.
Why This Change Was Made
The original onboarding proposal was rewritten on current
main, which already contains the newer QR, setup-code, LAN/Tailscale discovery, and multi-gateway flows. The focused replacement preserves the useful auth-recovery work: it classifies missing tokens and passwords separately, keeps generic unauthorized failures distinct, and selects the matching credential field only on the first transition into authentication so later status updates do not steal focus.The rewrite stays inside the iOS onboarding owner boundary and keeps the existing localized UI copy. Colin remains credited as co-author.
User Impact
When a gateway reports a missing token or password, onboarding opens the authentication step with the corresponding field selected. Missing-credential status remains accurate; only actual unauthorized states use rejection wording.
Evidence
tbx_01kxcphq1a8mfdr65fa2mnmzyf:pnpm check:changedapps lane passed on the final dirty tree.pnpm native:i18n:checkequivalent: 4,200 entries, 21 locale artifacts, no inventory drift.git diff --check: passed.