Skip to content

policy: cover gateway node commands#99121

Merged
giodl73-repo merged 5 commits into
openclaw:mainfrom
giodl73-repo:policy-gateway-node-commands
Jul 4, 2026
Merged

policy: cover gateway node commands#99121
giodl73-repo merged 5 commits into
openclaw:mainfrom
giodl73-repo:policy-gateway-node-commands

Conversation

@giodl73-repo

@giodl73-repo giodl73-repo commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary - add policy evidence for gateway.nodes.allowCommands and gateway.nodes.denyCommands entries - add gateway.nodes.denyCommands policy metadata and shape validation - report policy/gateway-node-command-denied when policy-denied node commands are not denied by OpenClaw config - document the new policy rule in the Policy CLI and plugin reference docs - classify gateway.nodes.allowCommands.* in policy config coverage ## Policy syntax / evidence / finding contract Policy syntax added by this PR: jsonc { "gateway": { "nodes": { "denyCommands": ["system.run"] } } } gateway.nodes.denyCommands is an exact, case-sensitive deny-superset rule. An equal-or-stricter policy must include every command required by the baseline deny list. Empty or missing denyCommands means this rule is not active. OpenClaw config evidence collected by policy doctor: jsonc { "gateway": { "nodes": { "allowCommands": ["mcp.help", "mcp.invoke", "system.run"], "denyCommands": ["system.run"] } } } The evidence scanner records concrete config entries as: text kind=nodeAllowCommand command=system.run source=oc://openclaw.config/gateway/nodes/allowCommands/#2 kind=nodeDenyCommand command=system.run source=oc://openclaw.config/gateway/nodes/denyCommands/#0 Finding emitted when policy requires a deny but config does not provide it: json { "checkId": "policy/gateway-node-command-denied", "severity": "error", "message": "Gateway node command 'system.run' is denied by policy but not denied by OpenClaw config.", "path": "openclaw config", "ocPath": "oc://openclaw.config/gateway/nodes/denyCommands", "target": "oc://openclaw.config/gateway/nodes/denyCommands", "requirement": "oc://policy.jsonc/gateway/nodes/denyCommands", "fixHint": "Add 'system.run' to gateway.nodes.denyCommands or update policy after review." } The finding clears when the config deny list contains the required exact command id. allowCommands evidence is collected for coverage and context; this PR only enforces the policy deny-superset contract. ## Real behavior proof Behavior or issue addressed: Managed policy can now require privileged gateway node commands such as system.run to be denied in OpenClaw config via gateway.nodes.denyCommands. The policy doctor reports the missing config deny and clears once the config denylist covers the policy denylist. Real environment tested: Windows 11 PowerShell, C:\src\openclaw-fork checkout at PR head cfe901e17963d9fe1833266a2758f125d7a51762, source-harness invocation of the real policy doctor health checks through runDoctorLintChecks. The harness wrote real temporary openclaw.jsonc and policy.jsonc files under %TEMP%; no cloud gateway or Lobster deployment was involved. Exact steps or command run after this patch: 1. Ran a Node/tsx source harness from the repo root that imported registerPolicyDoctorChecks and runDoctorLintChecks. 2. Case missing-config-deny: wrote policy.jsonc with gateway.nodes.denyCommands: ["system.run"] and openclaw.jsonc with gateway.nodes.allowCommands: ["mcp.help", "mcp.invoke", "system.run"] and no config denyCommands. 3. Case satisfied-config-deny: wrote the same policy plus openclaw.jsonc with gateway.nodes.denyCommands: ["system.run"]. Evidence after fix: text CASE missing-config-deny workspace: C:\Users\giodl\AppData\Local\Temp\oc-policy-missing-config-deny-Xk9xXX openclaw.jsonc gateway.nodes: {"allowCommands":["mcp.help","mcp.invoke","system.run"]} policy.jsonc gateway.nodes.denyCommands: ["system.run"] finding.checkId: policy/gateway-node-command-denied finding.severity: error finding.message: Gateway node command 'system.run' is denied by policy but not denied by OpenClaw config. finding.ocPath: oc://openclaw.config/gateway/nodes/denyCommands finding.target: oc://openclaw.config/gateway/nodes/denyCommands finding.requirement: oc://policy.jsonc/gateway/nodes/denyCommands finding.fixHint: Add 'system.run' to gateway.nodes.denyCommands or update policy after review. CASE satisfied-config-deny workspace: C:\Users\giodl\AppData\Local\Temp\oc-policy-satisfied-config-deny-jngRgn openclaw.jsonc gateway.nodes: {"allowCommands":["mcp.help","mcp.invoke","system.run"],"denyCommands":["system.run"]} policy.jsonc gateway.nodes.denyCommands: ["system.run"] policy/gateway-node-command-denied findings: none Observed result after fix: The missing config-deny case emits exactly one policy/gateway-node-command-denied error targeted at oc://openclaw.config/gateway/nodes/denyCommands. The satisfied config-deny case emits no finding for that check. What was not tested: This was source-harness policy doctor proof, not a live Lobster/cloud gateway run. Cloud gateway rollout behavior for system.run allowlisting remains a separate Lobster deployment concern. ## Validation - node scripts/run-vitest.mjs run extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts --reporter=dot - node --import tsx scripts/check-policy-config-coverage.ts --check --json - ./node_modules/oxfmt/bin/oxfmt --check extensions/policy/src/doctor/metadata.ts extensions/policy/src/doctor/scopes/gateway.ts extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts extensions/policy/src/policy-state.ts scripts/lib/policy-config-coverage.jsonc - ./node_modules/oxlint/bin/oxlint extensions/policy/src/doctor/metadata.ts extensions/policy/src/doctor/scopes/gateway.ts extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts extensions/policy/src/policy-state.ts - ./node_modules/.bin/oxfmt.cmd --check docs/cli/policy.md docs/plugins/reference/policy.md extensions/policy/src/doctor/metadata.ts extensions/policy/src/doctor/scopes/gateway.ts extensions/policy/src/doctor/register.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts extensions/policy/src/policy-state.ts scripts/lib/policy-config-coverage.jsonc - node scripts/check-docs-mdx.mjs docs README.md - git diff --check - pnpm tsgo:test:extensions - codex review --base upstream/main ## Notes This gives managed policy a way to require privileged gateway node commands such as system.run to be present in gateway.nodes.denyCommands unless a deployment intentionally relaxes policy. The rule uses the existing denylist-superset strictness pattern and keeps node command IDs case-sensitive.## Real behavior proofBehavior or issue addressed:Gateway node command policy coverage stays intact after restacking onto current upstream/main; the stack also resolves the plugin-sdk-surface-report.test.ts merge conflict by preserving CI budget-env isolation.Real environment tested:Windows PowerShell in C:\src\openclaw-fork on the restacked policy series, top head 7aebf26a24 with the foundation branch head 8b97698d63. This is a source-harness proof; it does not start a packaged OpenClaw binary or make live LLM calls.Exact steps or command run after this patch:1. node scripts/run-vitest.mjs extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts src/flows/doctor-repair-flow.test.ts --reporter=dot2. node scripts/run-vitest.mjs test/scripts/plugin-sdk-surface-report.test.ts --reporter=dot3. pnpm tsgo:extensions4. pnpm lint:extensions5. git diff --check

  1. node --import tsx scripts/check-policy-config-coverage.ts --check --jsonEvidence after fix:The focused policy/core/CLI/tooling Vitest run passed 10 core repair-flow tests, 7 SDK surface tooling tests, 13 policy CLI tests, and 334 policy doctor/doctor-lint tests. tsgo:extensions, lint:extensions, git diff --check, and node --import tsx scripts/check-policy-config-coverage.ts --check --json all exited 0.Observed result after fix:Gateway node command policy coverage remains green, and the restacked branch no longer has the generated SDK surface test conflict against current main.What was not tested:No packaged CLI smoke, live provider run, or live LLM call was run for this restack proof.

@openclaw-barnacle openclaw-barnacle Bot added scripts Repository scripts extensions: policy size: S maintainer Maintainer-authored PR labels Jul 2, 2026
@clawsweeper

clawsweeper Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 4, 2026, 6:01 PM ET / 22:01 UTC.

Summary
Adds Policy plugin support for policy.jsonc gateway.nodes.denyCommands, including evidence scanning, shape validation, rule metadata, docs, regression tests, coverage inventory, and focused CI test stabilization.

PR surface: Source +157, Tests +154, Docs +32, Other +8. Total +351 across 12 files.

Reproducibility: not applicable. as a bug reproduction; this is a feature PR. The PR body includes after-fix source-harness output showing the missing config-deny finding and the satisfied config-deny clean case.

Review metrics: 1 noteworthy metric.

  • Policy config surface: 1 added: gateway.nodes.denyCommands. The PR adds an authored managed-policy rule over privileged gateway node commands, so maintainers should explicitly review the security-boundary semantics before merge.

Stored data model
Persistent data-model change detected: migration/backfill/repair: extensions/policy/src/doctor/scopes/gateway.ts, unknown-data-model-change: extensions/policy/src/doctor/register.test.ts, unknown-data-model-change: extensions/policy/src/doctor/register.ts, unknown-data-model-change: extensions/policy/src/doctor/scopes/gateway.ts, vector/embedding metadata: extensions/policy/src/doctor/metadata.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] This adds a new managed-policy security assertion for privileged gateway node commands; maintainers need to accept that compliance requires explicit gateway.nodes.denyCommands coverage rather than inferring safety from missing or narrowed allows.
  • [P1] One CI shard was still in progress at review time; this is a normal merge-readiness wait, not a diff-specific correctness finding.

Maintainer options:

  1. Approve the explicit deny contract (recommended)
    A maintainer can accept the security-boundary risk once they confirm policy-required node command denies must be explicit in gateway.nodes.denyCommands and required checks finish green.
  2. Pause for different policy semantics
    If maintainers want policy to infer compliance from narrowed allowlists instead, pause this PR and keep the stacked repair work blocked until the contract is redesigned.

Next step before merge

  • No automated repair target remains; the next action is maintainer approval of the protected security-boundary policy semantics and normal check completion.

Security
Cleared: No concrete security or supply-chain defect was found in the diff; it adds detect-only policy lint plus docs/tests without broadening runtime command execution, secrets, dependencies, or CI permissions.

Review details

Best possible solution:

Land this as a detect-only Policy plugin rule only after maintainer approval of the exact, case-sensitive deny-superset semantics and a green head check set, while keeping runtime gateway command enforcement unchanged.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug reproduction; this is a feature PR. The PR body includes after-fix source-harness output showing the missing config-deny finding and the satisfied config-deny clean case.

Is this the best way to solve the issue?

Yes, with maintainer approval: the Policy plugin is the right owner because it observes the existing gateway.nodes.denyCommands runtime config contract instead of changing gateway enforcement. The safer alternative is to pause only if maintainers want different policy semantics for explicit denies versus narrowed allows.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 27d6c8816721.

Label changes

Label justifications:

  • P2: This is a bounded Policy plugin improvement with security posture value but no evidence of an urgent user-facing regression.
  • merge-risk: 🚨 security-boundary: The new rule changes managed-policy assurance for privileged gateway node commands such as system.run, so incorrect semantics could weaken or misstate operator security posture.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix Windows source-harness live output for the policy doctor showing both the missing-deny finding and the satisfied-deny clean case, plus focused validation commands.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix Windows source-harness live output for the policy doctor showing both the missing-deny finding and the satisfied-deny clean case, plus focused validation commands.
Evidence reviewed

PR surface:

Source +157, Tests +154, Docs +32, Other +8. Total +351 across 12 files.

View PR surface stats
Area Files Added Removed Net
Source 4 159 2 +157
Tests 5 167 13 +154
Docs 2 46 14 +32
Config 0 0 0 0
Generated 0 0 0 0
Other 1 8 0 +8
Total 12 380 29 +351

What I checked:

  • Repository policy applied: Read the full root AGENTS.md plus scoped guides for extensions, docs, scripts, channels, and tests; the review applied the protected-label, security-boundary, and config-surface risk guidance. (AGENTS.md:31, 27d6c8816721)
  • Existing runtime config surface: Current main already defines gateway.nodes.allowCommands and gateway.nodes.denyCommands, with deny commands documented as removing commands even if defaults or node claims include them. (src/config/types.gateway.ts:473, 27d6c8816721)
  • Existing runtime deny behavior: Current main applies gateway.nodes.denyCommands after defaults, runtime approvals, plugin defaults, and explicit allows, so the PR observes the existing runtime owner instead of changing command enforcement. (src/gateway/node-command-policy.ts:342, 27d6c8816721)
  • Policy check implementation: The PR adds a new gateway policy health check and emits policy/gateway-node-command-denied when a policy-required command is missing from config deny evidence. (extensions/policy/src/doctor/scopes/gateway.ts:346, 21347f2b55eb)
  • Policy evidence scanner: The PR scans concrete gateway.nodes.denyCommands entries as nodeDenyCommand evidence and suppresses contextual allow-command evidence when the same command is denied. (extensions/policy/src/policy-state.ts:2860, 21347f2b55eb)
  • Regression coverage: The PR tests both the satisfied explicit deny case and the missing config deny case, including the expected oc://openclaw.config/gateway/nodes/denyCommands target. (extensions/policy/src/doctor/register.test.ts:6771, 21347f2b55eb)

Likely related people:

  • steipete-oai: Live metadata for fix(slack): stop logging inbound message previews #96312 lists this account as author of the merged current-main snapshot that blame attributes to the central gateway policy/config files. (role: current-main snapshot author; confidence: medium; commits: 47d039f9a0fe, 0869edc23b0d; files: extensions/policy/src/doctor/scopes/gateway.ts, extensions/policy/src/policy-state.ts, src/gateway/node-command-policy.ts)
  • steipete: Live PR metadata identifies this account as merger for the current-main snapshot containing the gateway policy and node command config code reviewed here. (role: recent area merger; confidence: medium; commits: 0869edc23b0d; files: extensions/policy/src/doctor/scopes/gateway.ts, extensions/policy/src/policy-state.ts, src/gateway/node-command-policy.ts)
  • omarshahine: The PR discussion contains a targeted coverage finding from this reviewer, and the current head fixed that finding by switching coverage to gateway.nodes.denyCommands.*. (role: recent reviewer and adjacent node-command contributor; confidence: medium; commits: 4f345aa1b0ad, 56b80b6c9d33; files: scripts/lib/policy-config-coverage.jsonc, extensions/policy/src/doctor/scopes/gateway.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (6 earlier review cycles)
  • reviewed 2026-07-03T19:28:22.797Z sha a9f5581 :: found issues before merge. :: [P3] Track denyCommands in policy coverage
  • reviewed 2026-07-04T14:21:42.676Z sha 86e2ee9 :: needs changes before merge. :: [P3] Track denyCommands in policy coverage
  • reviewed 2026-07-04T14:30:08.395Z sha 86e2ee9 :: needs changes before merge. :: [P3] Track denyCommands in policy coverage
  • reviewed 2026-07-04T20:55:03.245Z sha 8b97698 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-04T21:01:28.392Z sha 8b97698 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-04T21:53:28.101Z sha 21347f2 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 2, 2026
@giodl73-repo
giodl73-repo force-pushed the policy-gateway-node-commands branch from 5d963e8 to 529fd4d Compare July 2, 2026 15:08
@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 2, 2026
@giodl73-repo

giodl73-repo commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Added real behavior proof to the PR body for both missing and satisfied gateway.nodes.denyCommands cases. @clawsweeper re-review

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 3, 2026
@giodl73-repo

giodl73-repo commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Maintainer confirmation: this PR's intended managed-policy contract is correct. policy.jsonc gateway.nodes.denyCommands should require OpenClaw config gateway.nodes.denyCommands to cover the policy denylist with exact, case-sensitive command IDs. Deployments that intentionally allow a privileged node command should update policy after review rather than silently relying on an allowCommands widening.

@giodl73-repo
giodl73-repo marked this pull request as ready for review July 3, 2026 03:11
@clawsweeper clawsweeper Bot removed proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jul 3, 2026
@openclaw-barnacle openclaw-barnacle Bot added the docs Improvements or additions to documentation label Jul 3, 2026
@giodl73-repo

giodl73-repo commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Added policy docs for the new gateway.nodes.denyCommands policy rule and updated validation. @clawsweeper re-review

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jul 3, 2026
@giodl73-repo

giodl73-repo commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

CI stabilization update pushed: a9f5581d89 (test: stabilize policy PR CI guardrails).

What changed:

  • plugin-sdk-surface-report.test.ts now strips ambient OPENCLAW_PLUGIN_SDK_MAX_* env vars before spawning the surface checker, while preserving explicit per-test overrides. This addresses the CI failure where stale runner budget env leaked into the test process.
  • Channel plugin loader/read-only tests now normalize file:// URL targets before path suffix assertions, fixing the local Windows channel lane failures seen while validating the PR.

Validation run locally from C:\src\openclaw-fork:

  • pnpm exec vitest run test/scripts/plugin-sdk-surface-report.test.ts --reporter=dot with stale budget env injected: 9 passed
  • pnpm run lint:plugins:no-extension-test-core-imports: passed
  • pnpm exec vitest run src/channels/turn/message-turn-guardrails.test.ts --reporter=dot: 4 passed
  • pnpm exec vitest run src/channels/plugins/module-loader.test.ts src/channels/plugins/read-only.test.ts --reporter=dot: 35 passed
  • pnpm test:channels: 71 files / 686 tests passed
  • git diff --check: passed

@giodl73-repo giodl73-repo mentioned this pull request Jul 3, 2026
Closed
This was referenced Jul 3, 2026
Merged
Merged
Merged
Merged
Merged
Merged
@omarshahine

omarshahine commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

Codex review of the Gateway Node Policy PR.

Findings:

  1. The coverage inventory is tracking the context surface, not the enforced policy surface. scripts/lib/policy-config-coverage.jsonc:29 and scripts/lib/policy-config-coverage.jsonc:412 add coverage for gateway.nodes.allowCommands.*, but the new check is enforcing deny-command policy from gateway.nodes.denyCommands evidence in extensions/policy/src/policy-state.ts:2864 and extensions/policy/src/doctor/scopes/gateway.ts:360. allowCommands is useful context, but the required policy surface that needs coverage is gateway.nodes.denyCommands.*; otherwise the coverage report can say this policy area is covered while the denied-command config keys remain untracked.

Best-fix verdict: close, but not quite the best fix until the inventory tracks gateway.nodes.denyCommands.* as the covered surface.

Evidence checked: extensions/policy/src/policy-state.ts, extensions/policy/src/doctor/scopes/gateway.ts, scripts/lib/policy-config-coverage.jsonc, src/gateway/node-command-policy.ts, src/security/audit-extra.sync.ts, and the focused policy/coverage tests. I also ran node --import tsx scripts/check-policy-config-coverage.ts --check --json and node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts extensions/policy/src/doctor/metadata.test.ts test/scripts/plugin-sdk-surface-report.test.ts --reporter=dot on this PR head; both passed.

@giodl73-repo

giodl73-repo commented Jul 4, 2026

Copy link
Copy Markdown
Contributor Author

Addressed Omar's finding in 8b97698d63: the coverage inventory now tracks gateway.nodes.denyCommands.* instead of the contextual gateway.nodes.allowCommands.* surface. Verified with node --import tsx scripts/check-policy-config-coverage.ts --check --json.

@giodl73-repo

giodl73-repo commented Jul 4, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Reviewer-requested fixes are pushed on this updated head. Fresh local proof before push: focused policy/core/CLI/tooling Vitest passed, pnpm tsgo:extensions passed, pnpm lint:extensions passed, git diff --check passed, and node --import tsx scripts/check-policy-config-coverage.ts --check --json passed.

@clawsweeper

clawsweeper Bot commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@giodl73-repo
giodl73-repo force-pushed the policy-gateway-node-commands branch from 8b97698 to 21347f2 Compare July 4, 2026 21:48
@giodl73-repo
giodl73-repo merged commit 832cb3c into openclaw:main Jul 4, 2026
151 of 152 checks passed
@giodl73-repo

giodl73-repo commented Jul 4, 2026

Copy link
Copy Markdown
Contributor Author

Merged via rebase.

@giodl73-repo
giodl73-repo deleted the policy-gateway-node-commands branch July 4, 2026 22:06
@clawsweeper clawsweeper Bot mentioned this pull request Jul 5, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

docs Improvements or additions to documentation extensions: policy maintainer Maintainer-authored PR merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. scripts Repository scripts size: M status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@giodl73-repo @omarshahine