Skip to content

Fix auth-none-only cleanup#98788

Closed
chenyangjun-xy wants to merge 1 commit into
openclaw:mainfrom
chenyangjun-xy:fix/issue-98614-sessions-spawn-scope
Closed

Fix auth-none-only cleanup#98788
chenyangjun-xy wants to merge 1 commit into
openclaw:mainfrom
chenyangjun-xy:fix/issue-98614-sessions-spawn-scope

Conversation

@chenyangjun-xy

@chenyangjun-xy chenyangjun-xy commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

When auth mode is "none" (e.g., Google Chat loopback deployments), sessions_spawn and other gateway calls requiring operator.write scope fail with missing scope: operator.write.

Root cause: Commit 65b460f234 introduced allowAuthNone which was tied to requireLocalBackendSharedAuth — a flag only set by the nodes CLI path. When callSubagentGateway (the actual sessions_spawn code path) calls callGateway without requireLocalBackendSharedAuth, allowAuthNone evaluates to false even when auth mode is "none". This causes shouldOmitDeviceIdentityForGatewayCall to return false (no token → hasDirectLocalBackendAuth is false), so deviceIdentity is resolved from disk instead of being set to null. The server receives a device identity without a paired token, clears requested scopes to [], and the agent method fails with missing scope: operator.write.

Why This Change Was Made

Two concerns are now cleanly separated:

  1. Shared-auth guard (hasLocalBackendSharedAuth): tied to requireLocalBackendSharedAuth — only matters for callers that explicitly request local backend shared auth (e.g., nodes CLI)
  2. Device-identity omission (omitDeviceIdentity): isAuthNone is computed independently of requireLocalBackendSharedAuth, so auth-none always triggers device identity omission for all callers, including callSubagentGateway
- const allowAuthNone =
-   opts.requireLocalBackendSharedAuth === true &&
-   resolveGatewayCallAuth(context.config).mode === "none";
+ const isAuthNone = resolveGatewayCallAuth(context.config).mode === "none";
+ const allowAuthNone = opts.requireLocalBackendSharedAuth === true && isAuthNone;
  const hasLocalBackendSharedAuth = Boolean(token || password) || allowAuthNone;
  const omitDeviceIdentity = shouldOmitDeviceIdentityForGatewayCall({
-   ..., allowAuthNone,
+   ..., allowAuthNone: isAuthNone,  // always true for auth-none
  });

User Impact

  • Auth-none loopback deployments: sessions_spawn and all subagent gateway calls no longer fail with missing scope: operator.write
  • No impact on token/password auth paths (isAuthNone is false)
  • No impact on remote URLs (isLoopbackGatewayUrl gates the omission)
  • No impact on CLI mode (different mode/clientName)

Evidence

Changed Files

File Diff
src/gateway/call.ts +11/-8 — compute isAuthNone independently, pass to both shouldOmitDeviceIdentityForGatewayCall and resolveDeviceIdentityForGatewayCall
src/gateway/call.test.ts +17/-0 — add test for auth-none without requireLocalBackendSharedAuth (simulates callSubagentGateway path)

Unit Tests

 ✓ src/gateway/call.test.ts (460 tests, 4 files, all passed)

New test: omits device identity for auth-none without requireLocalBackendSharedAuth (callSubagentGateway path) — verifies that auth-none triggers device identity omission even when requireLocalBackendSharedAuth is not set, covering the actual callSubagentGatewaycallGateway spawn path.

Real-Machine Verification — Auth-None (the fix)

Check RunId Result
Gateway startup - Gateway auth mode=none explicitly configured
Agent RPC e2bc5456 ⇄ res ✓ agent 53ms
Agent done e2bc5456 ended with stopReason=stop

No missing scope or shared auth requires errors.

Real-Machine Verification — Token-Auth (no regression)

Config: "auth": { "mode": "token" }, loopback, local mode.

Check RunId Result
Gateway config - "mode": "token"
Agent RPC 1cae301f ⇄ res ✓ agent 195ms
Agent done 1cae301f ended with stopReason=stop

No regression on the token-auth path.

Before/After Comparison

Before (broken) After (fixed)
✗ sessions.spawn ... missing scope: operator.admin ✓ agent 53ms ... stopReason=stop
Auth-none gateway calls: GatewayLocalBackendSharedAuthUnavailableError Auth-none gateway calls: successful

Environment

Item Version/Info
Node.js v22.19.0
pnpm v11.2.2
Vitest v4.1.8
OS Linux 4.19.112-2.el8.x86_64

🤖 Generated with Claude Code

@openclaw-barnacle openclaw-barnacle Bot added gateway Gateway runtime size: XS triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. labels Jul 1, 2026
@clawsweeper

clawsweeper Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 1, 2026, 7:41 PM ET / 23:41 UTC.

Summary
The PR splits local-backend shared-auth eligibility from Gateway device-identity omission for auth-none calls and updates the related Gateway unit-test wording/comment.

PR surface: Source +6, Tests +3. Total +9 across 2 files.

Reproducibility: yes. at source level for the review blocker: current sessions_spawn calls callSubagentGateway without requireLocalBackendSharedAuth, while this PR’s runtime change is behind that option. I did not run a live Google Chat/Gateway reproduction in this read-only review.

Review metrics: 1 noteworthy metric.

  • Gateway auth guard changed: 1 guard changed. The diff changes the decision that lets local-backend Gateway calls proceed and controls which auth/device-identity state they carry.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #98614
Summary: This PR is an open candidate fix for the linked sessions_spawn regression, but the current patch only covers an adjacent auth-none local-backend path.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Retarget the change or tests to the actual token-auth sessions_spawn/callSubagentGateway path, or remove the closing link.
  • [P1] Add redacted after-fix sessions_spawn output, logs, recording, or linked artifact proof from a real Google Chat or equivalent local Gateway flow.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: The PR body includes tests, node.list output, screenshots, and provider-auth logs, but it still does not show an after-fix sessions_spawn run in the reported Google Chat or equivalent local Gateway flow; redacted logs, terminal output, recording, or linked artifacts would count. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

Maintainer options:

  1. Retarget And Prove Spawn Path (recommended)
    Change or test the actual token-auth sessions_spawn/callSubagentGateway path and add redacted after-fix live output, logs, recording, or linked artifact proof before merge.
  2. Review As Auth-None Cleanup
    Maintainers could remove the closing relationship and review this branch only as a smaller auth-none Gateway cleanup if that behavior is still desired.
  3. Pause For Canonical Work
    If the intended fix is the broader token-auth spawn failure, pause this PR and continue through the canonical issue or a replacement branch.

Next step before merge

  • [P1] Needs contributor or maintainer retargeting plus real behavior proof; the remaining blocker is not a safe automated repair on this branch.

Security
Cleared: No concrete supply-chain or secret-handling regression was found in the two-file diff; the Gateway auth-boundary mismatch is covered as functional merge risk.

Review findings

  • [P1] Retarget the fix to the sessions_spawn caller — src/gateway/call.ts:1169
Review details

Best possible solution:

Retarget this to the actual token-auth sessions_spawn/callSubagentGateway path with focused regression coverage and redacted real behavior proof, or narrow it to auth-none Gateway cleanup without closing the linked issue.

Do we have a high-confidence way to reproduce the issue?

Yes at source level for the review blocker: current sessions_spawn calls callSubagentGateway without requireLocalBackendSharedAuth, while this PR’s runtime change is behind that option. I did not run a live Google Chat/Gateway reproduction in this read-only review.

Is this the best way to solve the issue?

No. The auth-none guard split may be reasonable cleanup, but the best fix for the linked regression needs to exercise the actual token-auth sessions_spawn path or stop claiming to close that issue.

Full review comments:

  • [P1] Retarget the fix to the sessions_spawn caller — src/gateway/call.ts:1169
    The changed guard only affects callers that set requireLocalBackendSharedAuth; current callSubagentGateway either dispatches in process or calls callGateway(request) without that option. Merging this as the closing fix would leave the linked token-auth sessions_spawn regression untouched, so please add coverage through the actual spawn path or remove the closing relationship.
    Confidence: 0.91

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against cdaafe198cb7.

Label changes

Label changes:

  • add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
  • add status: 🛠️ actively grinding: The PR author has acted after the latest ClawSweeper review and work remains. Needs stronger real behavior proof before merge: The PR body includes tests, node.list output, screenshots, and provider-auth logs, but it still does not show an after-fix sessions_spawn run in the reported Google Chat or equivalent local Gateway flow; redacted logs, terminal output, recording, or linked artifacts would count. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
  • remove rating: 🦪 silver shellfish: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.
  • remove merge-risk: 🚨 compatibility: Current PR review merge-risk labels are merge-risk: 🚨 auth-provider.
  • remove merge-risk: 🚨 security-boundary: Current PR review merge-risk labels are merge-risk: 🚨 auth-provider.
  • remove status: 📣 needs proof: Current PR status label is status: 🛠️ actively grinding.
  • remove proof: 📸 screenshot: Current real behavior proof evidence kind is logs.

Label justifications:

  • P1: The PR targets a current sessions_spawn regression affecting channel-triggered delegation and touches Gateway auth behavior.
  • merge-risk: 🚨 auth-provider: The changed code sits on Gateway credential and device-identity handling, and the linked token-auth behavior is not covered by the patch.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
  • status: 🛠️ actively grinding: The PR author has acted after the latest ClawSweeper review and work remains. Needs stronger real behavior proof before merge: The PR body includes tests, node.list output, screenshots, and provider-auth logs, but it still does not show an after-fix sessions_spawn run in the reported Google Chat or equivalent local Gateway flow; redacted logs, terminal output, recording, or linked artifacts would count. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

PR surface:

Source +6, Tests +3. Total +9 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 1 7 1 +6
Tests 1 4 1 +3
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 2 11 2 +9

What I checked:

  • Root and scoped policy read: Root AGENTS.md and scoped Gateway/agent guides were read; Gateway auth/device identity review requires caller and sibling-path evidence, not diff-only review. (AGENTS.md:28, cdaafe198cb7)
  • PR changed guard: The patch changes the requireLocalBackendSharedAuth failure condition from !omitDeviceIdentity to !hasLocalBackendSharedAuth. (src/gateway/call.ts:1169, 893abf627a20)
  • Current spawn gateway wrapper: Current callSubagentGateway computes admin-only scopes and then calls callGateway(request) without setting requireLocalBackendSharedAuth. (src/agents/subagent-spawn.ts:235, cdaafe198cb7)
  • Current sessions_spawn agent call: The native subagent start path calls callSubagentGateway({ method: "agent", ... }) with no requireLocalBackendSharedAuth option, so the changed guard is not on the claimed caller path. (src/agents/subagent-spawn.ts:1552, cdaafe198cb7)
  • Auth-none bypass source: The server-side shouldSkipLocalBackendSelfPairing does preserve scopes for auth mode none, but the linked issue reports a token-auth Google Chat sessions_spawn regression. (src/gateway/server/ws-connection/handshake-auth-helpers.ts:258, cdaafe198cb7)
  • Linked issue context: The linked issue reports OpenClaw 2026.6.11, local Gateway bind: lan, token auth, and Google Chat-triggered sessions_spawn failing with missing scope: operator.write.

Likely related people:

  • fuller-stack-dev: Authored the merged node diagnostics PR whose commit history introduced the allowAuthNone and local-backend shared-auth area edited by this PR. (role: introduced adjacent auth behavior; confidence: high; commits: 65b460f2345a; files: src/gateway/call.ts, src/gateway/call.test.ts)
  • lanzhi-lee: Authored the merged in-process sessions_spawn Gateway dispatch work that owns the central spawn path adjacent to the claimed fix. (role: recent adjacent contributor; confidence: high; commits: 58bab0c2761e; files: src/agents/subagent-spawn.ts, src/agents/subagent-spawn.test.ts, src/gateway/server-plugins.ts)
  • openperf: Authored earlier merged subagent Gateway scope work in callSubagentGateway, part of the same sessions_spawn scope-history trail. (role: related feature-history contributor; confidence: medium; commits: b40ef364b71c; files: src/agents/subagent-spawn.ts, src/agents/subagent-spawn.test.ts)
  • vincentkoc: Authored the release commit identified by the linked issue’s bisection around allowAuthNone and Gateway call behavior. (role: adjacent auth-boundary contributor; confidence: medium; commits: e085fa1a3ffd; files: src/gateway/call.ts)
  • steipete: Merged the adjacent auth and in-process subagent dispatch PRs and authored follow-up commits in those merged stacks. (role: recent merger and committer; confidence: medium; commits: 65b460f2345a, 58bab0c2761e; files: src/gateway/call.ts, src/agents/subagent-spawn.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. labels Jul 1, 2026
@chenyangjun-xy
chenyangjun-xy force-pushed the fix/issue-98614-sessions-spawn-scope branch from 46265cc to 893abf6 Compare July 1, 2026 23:29
@clawsweeper clawsweeper Bot added status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. and removed status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 1, 2026
@chenyangjun-xy

chenyangjun-xy commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author
image image image image image image

@clawsweeper clawsweeper Bot added status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. and removed status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. labels Jul 1, 2026
@chenyangjun-xy

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@openclaw-barnacle openclaw-barnacle Bot removed the triage: needs-pr-context Candidate: external PR body lacks required problem context or evidence. label Jul 2, 2026
@clawsweeper clawsweeper Bot added proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. and removed proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. labels Jul 2, 2026
@chenyangjun-xy
chenyangjun-xy force-pushed the fix/issue-98614-sessions-spawn-scope branch from 4101e83 to e972df9 Compare July 2, 2026 03:43
@clawsweeper clawsweeper Bot added status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. labels Jul 2, 2026
@clawsweeper clawsweeper Bot added the merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. label Jul 2, 2026
@chenyangjun-xy

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@chenyangjun-xy
chenyangjun-xy force-pushed the fix/issue-98614-sessions-spawn-scope branch from 2b1c580 to 8fca119 Compare July 2, 2026 07:09
@clawsweeper clawsweeper Bot added proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. and removed proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. labels Jul 2, 2026
@danieljimz

Copy link
Copy Markdown

Filed #98614 — thanks for picking it up, but I don't think this PR fixes the case reported there.

Our environment uses token auth (auth.mode: "token", bind: "lan", Google Chat → sessions_spawncallSubagentGatewayagent method needing operator.write). The diff here only computes isAuthNone independently and threads it through shouldOmitDeviceIdentityForGatewayCall / resolveDeviceIdentityForGatewayCall — it doesn't change the Boolean(token || password) branch that governs the token-auth path, which is what #98614 is actually about. The two new tests you added under "token auth" (call.test.ts) assert the existing, unchanged behavior for that path rather than exercising a fix.

ClawSweeper's own review flagged the same gap (confidence 0.9): the closing reference can auto-close #98614 without the token-auth regression being fixed or proven.

Given the maintainer options ClawSweeper listed, would it make sense to either:

  1. Retarget this to also cover the token-auth callSubagentGateway/sessions_spawn path (with server-handshake-level proof, not just mocked client-option assertions), or
  2. Drop the "Fixes [Regression]: sessions_spawn missing scope operator.write — introduced between v2026.6.1 and v2026.6.11 #98614" reference and land this as an auth-none-only cleanup, leaving [Regression]: sessions_spawn missing scope operator.write — introduced between v2026.6.1 and v2026.6.11 #98614 open for a token-auth-specific fix?

Happy to help verify against a live token-auth deployment once there's a build that changes that path.

@chenyangjun-xy chenyangjun-xy changed the title Fix/issue 98614 sessions spawn scope Fix auth-none-only cleanup Jul 2, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 2, 2026
…-auth check

Auth mode "none" independently satisfies two concerns that were
previously conflated behind requireLocalBackendSharedAuth:

1. Shared-auth check (hasLocalBackendSharedAuth) — when the caller
   explicitly requests local-backend shared auth, auth-none fulfills
   it without a token.
2. Device-identity omission — auth-none always omits device identity so
   the server-side device-less self-pairing bypass preserves requested
   scopes without requiring paired-device checks.

Previously isAuthNone was gated behind requireLocalBackendSharedAuth,
so callers that did not set the flag would still resolve device
identity for auth-none deployments. Compute isAuthNone independently
and pass it to both shouldOmitDeviceIdentityForGatewayCall and
resolveDeviceIdentityForGatewayCall.
@chenyangjun-xy
chenyangjun-xy force-pushed the fix/issue-98614-sessions-spawn-scope branch from 36812ea to cd0b19e Compare July 2, 2026 09:39
@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains. and removed proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

gateway Gateway runtime merge-risk: 🚨 auth-provider 🚨 May break OAuth, tokens, provider routing, model choice, or credentials. P1 High-priority user-facing bug, regression, or broken workflow. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. size: XS status: 🛠️ actively grinding The PR author has acted after the latest ClawSweeper review and work remains.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants