Skip to content

feat: clarify iOS Location Always permission flow#99247

Merged
steipete merged 9 commits into
openclaw:mainfrom
PollyBot13:fix-ios-location-always-flow
Jul 3, 2026
Merged

feat: clarify iOS Location Always permission flow#99247
steipete merged 9 commits into
openclaw:mainfrom
PollyBot13:fix-ios-location-always-flow

Conversation

@PollyBot13

@PollyBot13 PollyBot13 commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Related: #99229
Related: #86217
Related closed candidate: #99235

What Problem This Solves

Resolves a problem where iOS users could select Location Always in OpenClaw without the app clearly explaining whether iOS had actually granted background-capable location access.

Why This Change Was Made

This adds an explicit iOS permission summary that separates the user's selected OpenClaw mode from the effective iOS authorization state. It also wires the background-location contract into the native configuration and location owner path.

User Impact

Users get accurate feedback when Location Always is selected but iOS has not granted background-capable permission. Desired Always is preserved through the mismatch instead of silently reverting. Off remains an app-level gate. Monitoring follows both explicit app intent and effective iOS authorization across in-app requests and later iOS Settings changes.

Evidence

  • External proof media, screenshots, and proof-branch links were removed after merge for privacy.
  • Exact repaired PR head: 31ddea5efa60d6658c002c16d23bf9a81c36b693.
  • Physical iPhone before/after flow proof was reviewed before merge; final exact-head proof used deterministic simulator coverage and screenshots retained in CI/test artifacts.
  • Focused simulator tests: LocationPermissionSummaryTests plus SwiftUIRenderSmokeTests, 28 passed on iPhone 17 / iOS 26.5.
  • Permanent UI regression: OpenClawSnapshotUITests.testLocationAlwaysWaitsForSlowSystemPermissionResponse passed on iPhone 17 / iOS 26.5.
  • Native i18n sync/check: entries=2460 changed=false after sync.
  • SwiftFormat lint clean on repaired Swift files. git diff --check clean.
  • Whole-branch autoreview found and repaired one P1 transition defect; fresh focused autoreview then returned no findings, patch correct, confidence 0.94.
  • Built simulator Info.plist includes UIBackgroundModes = [audio, location, remote-notification].

Known proof boundary: contributor physical-device evidence predated the final prompt-wait/monitor-restart repairs; repaired exact head had deterministic simulator coverage.

AI-assisted: yes, Codex.

@PollyBot13

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Draft PR for #99229/#86217. Please review the iOS Location Always permission contract, background location manager handling, significant-change monitor cleanup, native i18n inventory, and Settings copy. Head a03c848.

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge. Reviewed July 3, 2026, 5:11 PM ET / 21:11 UTC.

Summary
The PR adds an iOS desired/effective Location permission summary, Always authorization reconciliation, UIBackgroundModes=location, native i18n updates, and focused iOS tests.

Reproducibility: yes. at source level: current main has the Always setting and Always-gated background runtime paths, but lacks the desired/effective permission summary and omits UIBackgroundModes=location. I did not run a live iOS device prompt reproduction in this read-only review.

Review metrics: 2 noteworthy metrics.

  • Current merge result: 13 files affected. The stale-base PR file list is broad, but the actual merge ref review surface is the iOS/i18n change set.
  • iOS background mode declarations: 2 added. Adding location in both plist sources changes the app capability and privacy review surface before merge.

Stored data model
Persistent data-model change detected: migration/backfill/repair: src/commands/doctor-whatsapp-responsiveness.test.ts, migration/backfill/repair: src/commands/doctor-whatsapp-responsiveness.ts, migration/backfill/repair: src/commands/doctor/shared/plugin-dependency-cleanup.test.ts, migration/backfill/repair: src/commands/doctor/shared/plugin-dependency-cleanup.ts, migration/backfill/repair: src/commands/doctor/shared/plugin-runtime-symlinks.test.ts, migration/backfill/repair: src/commands/doctor/shared/plugin-runtime-symlinks.ts, and 15 more. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #99229
Summary: This PR is a candidate fix for the open iOS Always-location permission-flow issue and partially addresses the background-mode posture issue, while a previous broader PR was already closed as an unmergeable attempt.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🦪 silver shellfish
Patch quality: 🐚 platinum hermit
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • Attach redacted exact-head device or simulator proof for the normal and slow iOS permission prompt paths, mismatch warning, spinner clearing, and picker usability.
  • Get maintainer approval for UIBackgroundModes=location, or split that declaration out while the posture issue remains open.

Proof guidance:

  • [P1] Needs stronger real behavior proof before merge: Useful linked proof exists, but the public proof artifacts still name earlier heads and the final PR head lacks an attached redacted current-head device/simulator artifact for the latest prompt-wait and monitoring-restart behavior; redact private device, account, endpoint, and location details before posting proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
A short visible iOS/simulator proof would materially help review the permission prompt, mismatch warning, and spinner behavior. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify iOS Settings Location Always prompt flow, mismatch warning, spinner clears, and Always grant summary on PR head.

Risk before merge

  • [P1] Adding UIBackgroundModes=location changes the iOS background-location capability surface and needs explicit maintainer privacy/App Store posture approval before merge.
  • [P1] The linked proof artifacts predate the final head's prompt-wait and monitoring-restart repairs; the PR body claims exact-head simulator proof, but the linked artifacts still do not provide an attached current-head physical or significant-change relaunch trace.
  • [P1] If maintainers do not want background location in shipped iOS builds, this PR should split or remove the plist capability instead of landing the capability change as part of the Settings clarification.

Maintainer options:

  1. Require approval and exact-head proof (recommended)
    Keep the PR open until maintainers explicitly accept the background-location capability and a redacted current-head device or simulator artifact proves the permission and monitoring paths.
  2. Split the background mode
    Remove UIBackgroundModes=location from this branch and leave the sensitive app-capability decision to the linked background-location posture issue.
  3. Accept the capability risk
    Maintainers can intentionally accept the background-location posture if they are satisfied that the Always plus authorizedAlways gates, copy, and tests match product policy.

Next step before merge

  • [P1] Needs maintainer privacy/App Store decision and current-head proof; there is no narrow safe automation repair identified.

Security
Needs attention: The diff intentionally enables iOS background location capability, so maintainers should approve the privacy/App Store posture before merge.

Review details

Best possible solution:

Land this only after maintainers approve the iOS background-location posture and exact-head redacted iOS proof covers the prompt and monitoring-restart paths, or split UIBackgroundModes=location to the canonical posture issue.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main has the Always setting and Always-gated background runtime paths, but lacks the desired/effective permission summary and omits UIBackgroundModes=location. I did not run a live iOS device prompt reproduction in this read-only review.

Is this the best way to solve the issue?

Acceptable but not merge-ready: the desired/effective summary and authorization gates are the right shape if maintainers choose background location, but the capability declaration still needs maintainer approval and exact-head proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1755a9dc5bce.

Label changes

Label justifications:

  • P2: This is a bounded but privacy-sensitive iOS permission-flow improvement with no confirmed emergency runtime regression.
  • merge-risk: 🚨 compatibility: Declaring a new iOS background mode can affect upgrades, App Store review posture, and existing users' privacy expectations.
  • merge-risk: 🚨 security-boundary: The diff enables background behavior around sensitive user location data and consent state.
  • rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Useful linked proof exists, but the public proof artifacts still name earlier heads and the final PR head lacks an attached redacted current-head device/simulator artifact for the latest prompt-wait and monitoring-restart behavior; redact private device, account, endpoint, and location details before posting proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed

Security concerns:

  • [medium] Background location capability needs approval — apps/ios/Sources/Info.plist:99
    Adding location to UIBackgroundModes makes the app eligible for background location execution when runtime gates allow it; this is sensitive location behavior and should land only with explicit maintainer approval.
    Confidence: 0.91

What I checked:

  • Root policy read: Root AGENTS.md was read fully and applied; it treats security-sensitive capability changes, current-main behavior, proof, and compatibility as review inputs. (AGENTS.md:1, 1755a9dc5bce)
  • Scoped iOS policy read: The iOS scoped guide was read fully; it adds iOS release guardrails and does not override the root privacy/security proof requirements. (apps/ios/AGENTS.md:1, 1755a9dc5bce)
  • Live PR state: Live GitHub data shows the PR is open, not draft, contributor-authored, maintainer-editable, mergeable but unstable, with head 31ddea5 and potential merge commit bd8d9df. (31ddea5efa60)
  • Current merge result surface: Against current main, the actual merge result touches 13 iOS/i18n files, while GitHub's stale-base file list still shows 174 files. (bd8d9df6c5e9)
  • Background mode added to committed plist: The merge result adds location to the app UIBackgroundModes array, changing the iOS background capability surface. (apps/ios/Sources/Info.plist:99, bd8d9df6c5e9)
  • Background mode added to generated project config: The merge result also adds location to the generated iOS project UIBackgroundModes source. (apps/ios/project.yml:155, bd8d9df6c5e9)

Likely related people:

  • steipete: Commit e1dd764 added node location support across iOS location service, NodeAppModel, and plist surfaces, and this PR also includes later steipete commits on the permission prompt and monitoring paths. (role: introduced location behavior and latest branch contributor; confidence: high; commits: e1dd764504b1, 8fffea7ea088, 31ddea5efa60; files: apps/ios/Sources/Location/LocationService.swift, apps/ios/Sources/Model/NodeAppModel.swift, apps/ios/Sources/Info.plist)
  • ngutman: Merged history around PR 18260 restored SignificantLocationMonitor, LocationService, and related protocol/plist files that this PR extends. (role: recent iOS location contributor; confidence: high; commits: 5a39e13c929c, f60cd10f6d0b; files: apps/ios/Sources/Location/LocationService.swift, apps/ios/Sources/Location/SignificantLocationMonitor.swift, apps/ios/Sources/Services/NodeServiceProtocols.swift)
  • mbelinky: PR 21226 changed iOS background wake/reconnect behavior and touched NodeAppModel, SignificantLocationMonitor, and Info.plist surfaces implicated by this background-location posture decision. (role: background wake contributor; confidence: high; commits: e98ccc8e17a4, 7705a7741e06; files: apps/ios/Sources/Location/SignificantLocationMonitor.swift, apps/ios/Sources/Model/NodeAppModel.swift, apps/ios/Sources/Info.plist)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@PollyBot13
PollyBot13 force-pushed the fix-ios-location-always-flow branch from a03c848 to cf6328c Compare July 2, 2026 21:54
@PollyBot13

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Rebased draft PR for #99229/#86217 onto current main after the native i18n refresh landed. Please review the iOS Location Always permission contract, background location manager handling, significant-change monitor cleanup, native i18n inventory, and Settings copy. Head cf6328c.

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@PollyBot13
PollyBot13 force-pushed the fix-ios-location-always-flow branch from cf6328c to b89c25a Compare July 2, 2026 21:56
@PollyBot13

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Final rebase tonight onto current main after another native i18n refresh landed. Please review the current draft head b89c25a for the iOS Location Always permission contract, background location manager handling, significant-change monitor cleanup, native i18n inventory, and Settings copy.

@clawsweeper

clawsweeper Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 2, 2026
@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 2, 2026
@PollyBot13
PollyBot13 force-pushed the fix-ios-location-always-flow branch from b89c25a to 21bb750 Compare July 3, 2026 05:40
@PollyBot13

PollyBot13 commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

Updated draft after review. This now links issue #99229, background-mode posture issue #86217, and closed overlapping candidate #99235.

Latest head: 21bb750

The latest head fixes OS-level authorization downgrade cleanup by reconciling CoreLocation delegate changes, disabling background updates, and always unregistering the significant-change monitor even after process relaunch. Please re-review Location Always permission contract, downgrade cleanup, native i18n, Settings copy, and the narrower scope compared with #99235.

@clawsweeper

clawsweeper Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@openclaw-barnacle

Copy link
Copy Markdown

Please don’t spam-ping multiple maintainers at once. Be patient, or join our community Discord for help: https://discord.gg/clawd

@PollyBot13
PollyBot13 marked this pull request as ready for review July 3, 2026 05:44
@PollyBot13
PollyBot13 marked this pull request as draft July 3, 2026 05:59
@PollyBot13
PollyBot13 force-pushed the fix-ios-location-always-flow branch from 21bb750 to 135c91b Compare July 3, 2026 06:17
@PollyBot13

PollyBot13 commented Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Proof branch/media links removed after merge for privacy. Current-head validation evidence is summarized in the sanitized PR body.

@clawsweeper

clawsweeper Bot commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@PollyBot13
PollyBot13 marked this pull request as ready for review July 3, 2026 06:19
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 3, 2026
@PollyBot13
PollyBot13 force-pushed the fix-ios-location-always-flow branch from 135c91b to 74565cb Compare July 3, 2026 06:56
@openclaw-barnacle openclaw-barnacle Bot added channel: whatsapp-web Channel integration: whatsapp-web app: android App: android app: macos App: macos gateway Gateway runtime scripts Repository scripts commands Command implementations agents Agent runtime and tooling channel: feishu Channel integration: feishu extensions: qa-lab plugin: google-meet size: XL and removed size: L labels Jul 3, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed proof: 📸 screenshot Contributor real behavior proof includes screenshot evidence. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels Jul 3, 2026
@steipete

steipete commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Maintainer repair complete on exact PR head 31ddea5efa60d6658c002c16d23bf9a81c36b693.

What changed after review:

  • Removed the 1.5-second timeout race once either real iOS location permission sheet is visible; authorization now waits for dismissal and app reactivation.
  • Guarded Settings permission summaries against stale async refresh completion.
  • Preserved explicit Off and While Using intent under broader iOS grants.
  • Fixed the P1 found by final whole-branch autoreview: external downgrade stops significant-change monitoring, and restored Always authorization restarts it immediately without waiting for gateway reconnect.
  • Added permanent regression coverage for the slow two-sheet permission path and the monitoring restart transition.

Exact local proof on the same tree:

  • xcodebuild test -project apps/ios/OpenClaw.xcodeproj -scheme OpenClaw -destination 'platform=iOS Simulator,id=D0C1D2D4-4B0C-40ED-9BDD-5B705690F2A7' -derivedDataPath /tmp/openclaw-ios-99247-repaired-derived -only-testing:OpenClawTests/LocationPermissionSummaryTests -only-testing:OpenClawTests/SwiftUIRenderSmokeTests — 28 passed.
  • xcodebuild test -project apps/ios/OpenClaw.xcodeproj -scheme OpenClawUITests -destination 'platform=iOS Simulator,id=D0C1D2D4-4B0C-40ED-9BDD-5B705690F2A7' -derivedDataPath /tmp/openclaw-ios-99247-repaired-derived -only-testing:OpenClawUITests/OpenClawSnapshotUITests/testLocationAlwaysWaitsForSlowSystemPermissionResponse — passed. Both real system sheets remained visible for three seconds with Always selected and Requesting visible; final effective background permission verified. The xcresult preserves full-screen first-prompt, upgrade-prompt, and granted-state screenshots.
  • node --import tsx scripts/native-app-i18n.ts sync --write then checkentries=2460 changed=false.
  • SwiftFormat lint on repaired Swift files — 0/4 require formatting. git diff --check — clean.
  • Autoreview: whole-branch pass found the monitoring P1; accepted repair completed; fresh focused pass returned no findings, patch correct, confidence 0.94.
  • Hosted CI run: https://github.com/openclaw/openclaw/actions/runs/28683331918

The PR body retains the contributor's physical iPhone before/after contact sheet. Remaining disclosed boundary: no fresh exact-head physical-device terminated-app significant-change relaunch trace because no device is attached; exact-head simulator behavior, authorization lifecycle, screenshots, and owner transition tests are complete.

@steipete
steipete merged commit 671c315 into openclaw:main Jul 3, 2026
104 checks passed
@steipete

steipete commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Merged via squash.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 4, 2026
* feat: clarify iOS Location Always permission flow

* fix(ios): avoid stale location permission summary

* fix(ios): clarify disabled location permission grants

* fix(ios): sync external location grants into settings

* chore(ios): refresh native i18n inventory

* fix(ios): preserve location off during permission sync

* fix(ios): preserve while using during location sync

* fix(ios): wait for location permission prompts

* fix(ios): reconcile significant location monitoring

---------

Co-authored-by: Peter Steinberger <[email protected]>
@jguida941

Copy link
Copy Markdown

For provenance: #86217 was filed on May 24 and identified the missing UIBackgroundModes=location invariant in both plist sources, including a processed-bundle reproduction and GREEN comparison branch. #99229 and this PR were created on July 2, explicitly reference #86217, and this PR subsequently made those exact two plist additions.

I am not claiming authorship of the broader permission-flow and monitoring implementation. I am asking that the record accurately acknowledge #86217 as the originating report and proof for the lower-level bundle mismatch. Describing it afterward as merely “already implemented” or a duplicate obscures the actual chronology.

Your welcome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling app: android App: android app: ios App: ios app: macos App: macos channel: discord Channel integration: discord channel: feishu Channel integration: feishu channel: imessage Channel integration: imessage channel: matrix Channel integration: matrix channel: signal Channel integration: signal channel: telegram Channel integration: telegram channel: whatsapp-web Channel integration: whatsapp-web commands Command implementations docs Improvements or additions to documentation extensions: qa-lab gateway Gateway runtime merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. plugin: google-meet rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. scripts Repository scripts size: XL status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants