policy: repair denied gateway http endpoints by giodl73-repo · Pull Request #99731 · openclaw/openclaw

giodl73-repo · 2026-07-04T00:56:12Z

Summary

Restack on current main after policy: repair channel ingress findings #99720 merged.
Classify policy/gateway-http-endpoint-enabled as an automatic narrowing repair.
Wire doctor --fix to set the exact reported denied Gateway HTTP endpoint enabled paths to false.
Document that denied Gateway HTTP endpoints can be auto-disabled when workspaceRepairs=true.
Leave URL-fetch allowlist findings manual; this PR only disables denied endpoints and preserves nested endpoint config.

Real behavior proof

Behavior or issue addressed:
doctor --fix can now repair denied Gateway HTTP endpoint findings by disabling the reported endpoint paths while preserving nested endpoint options such as URL-fetch settings.

Real environment tested:
WSL Ubuntu source checkout at PR head c216e7485c5e12df315a70543f092a6cce801b58, rebased on current main. The proof used the real Policy doctor registration plus runDoctorHealthRepairs against an isolated temp workspace with plugins.entries.policy.config.workspaceRepairs=true; no live Gateway server, provider, or network call was started.

Exact steps or command run after this patch:

Seed isolated openclaw.jsonc with gateway.http.endpoints.chatCompletions.enabled=true, gateway.http.endpoints.responses.enabled=true, nested URL-fetch options, and workspaceRepairs=true.
Seed isolated policy.jsonc with gateway.http.denyEndpoints=["chatCompletions","responses"] and gateway.http.requireUrlAllowlists=true.
Run source-entry repair proof: node --import tsx .local/proof-99731.mts, which calls registerPolicyDoctorChecks and runDoctorHealthRepairs for policy/gateway-http-endpoint-enabled.
Run focused validation: node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/metadata.test.ts --reporter=dot.
Run docs/format/diff validation: pnpm docs:map:check; pnpm exec oxfmt --check for touched docs/policy files; git diff --check origin/main...HEAD; git diff --check.

Evidence after fix:

HEAD=local
WORKSPACE=/tmp/policy-gateway-http-proof-icH0OS
CHECKS_RUN=1
CHECKS_REPAIRED=1
CHECKS_VALIDATED=1
BEFORE_FINDINGS=[{"checkId":"policy/gateway-http-endpoint-enabled","ocPath":"oc://openclaw.config/gateway/http/endpoints/chatCompletions/enabled","requirement":"oc://policy.jsonc/gateway/http/denyEndpoints"},{"checkId":"policy/gateway-http-endpoint-enabled","ocPath":"oc://openclaw.config/gateway/http/endpoints/responses/enabled","requirement":"oc://policy.jsonc/gateway/http/denyEndpoints"}]
CHANGES=["Set gateway.http.endpoints.chatCompletions.enabled=false for policy conformance.","Set gateway.http.endpoints.responses.enabled=false for policy conformance."]
AFTER_ENDPOINTS={"chatCompletions":{"enabled":false,"images":{"allowUrl":true}},"responses":{"enabled":false,"files":{"allowUrl":true},"images":{"allowUrl":true,"urlAllowlist":["images.example.test"]}}}
REMAINING_FINDINGS=0
REMAINING=[]

Supporting validation:

[test] passed 1 Vitest shard in 9.88s
Test Files: 2 passed
Tests: 299 passed

docs:map: docs/docs_map.md is up to date.
All matched files use the correct format.
git diff --check origin/main...HEAD passed.
git diff --check passed.

Observed result after fix:
The repair flow detected both denied Gateway HTTP endpoint findings, repaired both reported enabled leaves to false, validated with zero remaining endpoint findings, and preserved the nested URL-fetch options (images.allowUrl, files.allowUrl, and images.urlAllowlist) on the disabled endpoints.

What was not tested:
No live Gateway HTTP server, live provider, network URL-fetch call, or LLM call was run. URL-fetch allowlist findings intentionally remain manual and are not auto-repaired by this PR.

Stack

Directly stacked on current main after policy: repair channel ingress findings #99720 merged.
Next downstream slice remains policy: preview review-required gateway repairs #99776 after this PR is ready.

clawsweeper · 2026-07-04T00:57:38Z

Codex review: needs maintainer review before merge. Reviewed July 7, 2026, 2:17 PM ET / 18:17 UTC.

Summary
The branch changes Policy doctor so policy/gateway-http-endpoint-enabled becomes an automatic repair that disables reported Gateway HTTP endpoint enabled leaves, adds regression coverage, and documents the new repair surface.

PR surface: Source +10, Tests +58, Docs +4. Total +72 across 6 files.

Reproducibility: not applicable. as a feature-style repair expansion rather than a reported bug. The PR body provides a high-confidence source-entry proof path for the new behavior using real Policy doctor registration and an isolated workspace config.

Review metrics: 1 noteworthy metric.

Policy repair classification: 1 changed from reviewRequired to automatic. Changing one Policy finding into an automatic doctor --fix action is the compatibility and security-boundary decision maintainers need to notice before merge.

Stored data model
Persistent data-model change detected: migration/backfill/repair: docs/cli/policy.md, migration/backfill/repair: extensions/policy/src/doctor/automatic-repairs.ts, migration/backfill/repair: extensions/policy/src/doctor/register.test.ts, migration/backfill/repair: extensions/policy/src/doctor/scopes/gateway.ts, serialized state: extensions/policy/src/doctor/register.test.ts, unknown-data-model-change: extensions/policy/src/doctor/register.test.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

none.

Risk before merge

[P1] Existing workspaces that run doctor --fix with workspaceRepairs=true and a policy denying Gateway HTTP endpoints will have those endpoints disabled automatically.
[P1] Gateway HTTP endpoint availability is a security-boundary surface, so final merge should preserve the explicit maintainer acceptance of automatic endpoint disabling.

Maintainer options:

Land accepted automatic repair (recommended)
Proceed after exact-head required checks because the repair edits only denied endpoint enabled leaves under the existing workspaceRepairs=true opt-in.
Keep endpoint repair review-required
Reject or revise the PR if maintainers decide Gateway HTTP endpoint availability should not be mutated automatically by Policy doctor repair.

Next step before merge

No automated repair is needed; the remaining action is maintainer-controlled merge or rejection after exact-head gates because this intentionally changes automatic Policy repair for Gateway HTTP endpoints.

Security
Cleared: The diff narrows Gateway HTTP endpoint exposure under explicit Policy workspace repair opt-in and adds no dependency, workflow, secret, or supply-chain change.

Review details

Best possible solution:

Land the narrow automatic repair after exact-head gates, with URL-fetch allowlist findings staying manual.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a feature-style repair expansion rather than a reported bug. The PR body provides a high-confidence source-entry proof path for the new behavior using real Policy doctor registration and an isolated workspace config.

Is this the best way to solve the issue?

Yes, this is the best narrow implementation if maintainers want the behavior: it reuses the existing automatic narrower helper and exact finding ocPath rather than adding a Gateway-specific rewrite. The safer alternative is to keep this check review-required if automatic endpoint disabling is not accepted.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a6768d9de567.

Label changes

Label justifications:

P2: This is a normal-priority Policy doctor improvement with limited blast radius behind the existing workspaceRepairs=true opt-in.
merge-risk: 🚨 compatibility: Existing workspaces that run doctor --fix with a matching Policy denial can have Gateway HTTP endpoints disabled automatically.
merge-risk: 🚨 security-boundary: The changed repair affects Gateway HTTP API exposure, which is part of OpenClaw's security boundary even though the repair narrows exposure.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix source-entry output showing both denied endpoint findings repaired, zero remaining findings, nested endpoint options preserved, and the Real behavior proof check is green on the reviewed head.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix source-entry output showing both denied endpoint findings repaired, zero remaining findings, nested endpoint options preserved, and the Real behavior proof check is green on the reviewed head.

Evidence reviewed

PR surface:

Source +10, Tests +58, Docs +4. Total +72 across 6 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	3	11	1	+10
Tests	2	59	1	+58
Docs	1	5	1	+4
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	6	75	3	+72

What I checked:

Repository policy applied: Root AGENTS.md plus scoped docs/extensions guides were read; the root review policy treats plugin config repairs and Gateway/security-boundary changes as compatibility-sensitive. (AGENTS.md:23, a6768d9de567)
Current main still needs the PR behavior: On current main, policyGatewayHttpEndpointEnabled is still classified as reviewRequired and is absent from the automatic repair set, so the central PR change is not already implemented. (extensions/policy/src/doctor/fix-metadata.ts:147, a6768d9de567)
Automatic repair wiring: At PR head, the check is added to the automatic repair set and mapped to setFindingConfigValues(..., "enabled", false), reusing the existing targeted leaf update helper. (extensions/policy/src/doctor/automatic-repairs.ts:24, c216e7485c5e)
Gateway check repair hook: At PR head, the Gateway HTTP endpoint check delegates repair to repairPolicyAutomaticNarrower for the same check id. (extensions/policy/src/doctor/scopes/gateway.ts:83, c216e7485c5e)
Exact path and preservation behavior: The finding producer emits the exact endpoint enabled ocPath, and the shared setter updates only that final path segment, which supports preserving nested URL-fetch options. (extensions/policy/src/doctor/scopes/gateway.ts:320, a6768d9de567)
Regression coverage: The PR adds a focused repair test covering chatCompletions and responses, expected change messages, zero remaining findings, and preservation of nested endpoint options. (extensions/policy/src/doctor/register.test.ts:1742, c216e7485c5e)

Likely related people:

giodl73-repo: Authored this PR and the merged Policy doctor repair stack that introduced fix classifications and adjacent automatic repair behavior. (role: recent policy repair owner; confidence: high; commits: 55683d23e35a, 14b2ca11ffa9, 5b06eba9fe9e; files: extensions/policy/src/doctor/automatic-repairs.ts, extensions/policy/src/doctor/fix-metadata.ts, extensions/policy/src/doctor/register.test.ts)
omarshahine: Reviewed this Gateway HTTP repair slice and confirmed the best-fix boundary against the finding producer and repair helper in a PR comment. (role: adjacent reviewer; confidence: medium; files: extensions/policy/src/doctor/automatic-repairs.ts, extensions/policy/src/doctor/scopes/gateway.ts, extensions/policy/src/doctor/fix-metadata.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (20 earlier review cycles; latest 8 shown)

reviewed 2026-07-07T00:49:20.653Z sha e1061f6 :: needs real behavior proof before merge. :: [P2] Document the automatic Gateway HTTP repair
reviewed 2026-07-07T01:08:25.389Z sha e1061f6 :: needs real behavior proof before merge. :: [P2] Document the automatic Gateway HTTP repair
reviewed 2026-07-07T01:44:47.346Z sha 1fcd321 :: needs real behavior proof before merge. :: [P2] Document the automatic Gateway HTTP repair
reviewed 2026-07-07T04:08:25.153Z sha aa72dec :: needs maintainer review before merge. :: none
reviewed 2026-07-07T15:47:52.210Z sha aa72dec :: needs maintainer review before merge. :: none
reviewed 2026-07-07T17:45:12.130Z sha 5b0a96c :: needs maintainer review before merge. :: none
reviewed 2026-07-07T17:53:31.064Z sha 5b0a96c :: needs maintainer review before merge. :: none
reviewed 2026-07-07T18:11:00.987Z sha c216e74 :: needs maintainer review before merge. :: none

giodl73-repo · 2026-07-04T14:19:18Z

@clawsweeper re-review

I restacked the policy series onto current upstream/main with non-force merge commits, resolved the test/scripts/plugin-sdk-surface-report.test.ts conflict, and added the exact Real behavior proof section to this PR body.

Fresh proof from the top of the stack (283c1bb4ca):

node scripts/run-vitest.mjs extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/strictness.test.ts src/flows/doctor-repair-flow.test.ts --reporter=dot passed: 10 core repair-flow tests + 297 policy doctor tests.
node scripts/run-vitest.mjs test/scripts/plugin-sdk-surface-report.test.ts --reporter=dot passed: 7 tests.
pnpm tsgo:extensions passed.
pnpm lint:extensions passed.
git diff --check passed.

clawsweeper · 2026-07-04T14:19:20Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

omarshahine · 2026-07-04T17:21:47Z

Codex review of the Gateway HTTP PR.

No blocking findings in the incremental diff against the Channel Ingress PR.

Best-fix verdict: best for this narrow repair. The finding producer already emits the precise gateway.http.endpoints.<endpoint>.enabled leaf in extensions/policy/src/policy-state.ts:2803 and extensions/policy/src/doctor/scopes/gateway.ts:300, and the new repair hook flips only that denied endpoint leaf while leaving nested endpoint config intact. The metadata change in extensions/policy/src/doctor/fix-metadata.ts:146 also keeps URL-fetch allowlist findings manual, which avoids broad unintended rewrites.

Evidence checked: extensions/policy/src/doctor/automatic-repairs.ts, extensions/policy/src/doctor/scopes/gateway.ts, extensions/policy/src/doctor/fix-metadata.ts, extensions/policy/src/doctor/metadata.test.ts, extensions/policy/src/doctor/register.test.ts, extensions/policy/src/policy-state.ts, and the adjacent gateway policy checks.

Proof gap: this was a source-harness Codex pass only; I did not run a packaged CLI smoke for doctor --fix from this review.

giodl73-repo · 2026-07-04T20:50:36Z

No blocking findings from Omar on this PR. I propagated the lower-stack review fixes through this branch in c6d9e758e9 so it stays consistent with the corrected repair behavior.

giodl73-repo · 2026-07-04T20:50:53Z

@clawsweeper re-review

Reviewer-requested fixes are pushed on this updated head. Fresh local proof before push: focused policy/core/CLI/tooling Vitest passed, pnpm tsgo:extensions passed, pnpm lint:extensions passed, git diff --check passed, and node --import tsx scripts/check-policy-config-coverage.ts --check --json passed.

clawsweeper · 2026-07-04T20:50:56Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-05T00:59:03Z

Updated this PR body with current stack heads and final-stack proof after the #99686 proof refresh. The foundation proof now shows policy-owned policy.fixRecommendation in public policy JSON and recommendation-free attestation hashing, and this PR includes that fix via the forward-merged stack.

@clawsweeper re-review

clawsweeper · 2026-07-05T00:59:05Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-07T03:29:12Z

@clawsweeper re-review

Restacked and updated current head aa72decbe2b422a746cb5269bda9a10705c0f892 on origin/main 118e5bd76223605bef1b7427b3f471c4a2bc34e8 after main advanced again. The PR body now includes the public policy docs change and refreshed real source-entry repair proof.

Validation on this head:

node --import tsx .local/proof-99731.mts
node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/metadata.test.ts --reporter=dot
pnpm docs:map:check
pnpm exec oxfmt --check docs/cli/policy.md extensions/policy/src/doctor/automatic-repairs.ts extensions/policy/src/doctor/fix-metadata.ts extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/scopes/gateway.ts
git diff --check origin/main...HEAD && git diff --check

The proof shows both denied endpoint enabled leaves repaired to false, zero remaining endpoint findings, and nested URL-fetch config preserved; URL-fetch allowlist findings remain manual.

clawsweeper · 2026-07-07T03:29:15Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-07T03:41:16Z

Maintainer decision for this slice: accept policy/gateway-http-endpoint-enabled as an automatic doctor --fix repair after the docs and real proof added here.

Rationale: the repair only narrows the exact reported gateway.http.endpoints.*.enabled leaves to false when workspace policy denies those endpoints, and the refreshed proof on aa72decbe2b422a746cb5269bda9a10705c0f892 shows nested endpoint URL-fetch config is preserved. URL-fetch allowlist findings remain manual.

giodl73-repo · 2026-07-07T15:34:04Z

@clawsweeper re-review

Please reschedule/re-run review for current exact head aa72decbe2b422a746cb5269bda9a10705c0f892.

The prior exact-head re-review was acknowledged but the durable review comment still shows the old blocked verdict for 1fcd3219468694b9b65caf0b69191f3a4c2b16f1. Current PR body includes the requested docs and real source-entry proof, and latest checks on this head pass, including Real behavior proof, QA Smoke CI, and auto-response. Superseded duplicate proof/auto-response runs were cancelled, but newer runs on the same head passed.

giodl73-repo · 2026-07-07T17:41:02Z

@clawsweeper re-review

Restacked and refreshed current head 5b0a96c416da51a739c8091090bb538cb6b4153e on current main for maintainer merge verification. PR body now has refreshed source-entry proof and validation for this head.

Validation on this head:

node --import tsx .local/proof-99731.mts
node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/metadata.test.ts --reporter=dot
pnpm docs:map:check
pnpm exec oxfmt --check docs/cli/policy.md extensions/policy/src/doctor/automatic-repairs.ts extensions/policy/src/doctor/fix-metadata.ts extensions/policy/src/doctor/metadata.test.ts extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/scopes/gateway.ts
git diff --check origin/main...HEAD && git diff --check

The source-entry proof again shows both denied endpoint enabled leaves repaired to false, zero remaining endpoint findings, and nested URL-fetch config preserved; URL-fetch allowlist findings remain manual.

clawsweeper · 2026-07-07T17:41:04Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-07T18:05:24Z

@clawsweeper re-review

Current head: c216e74

Validation rerun after restack:

node --import tsx .local/proof-99731.mts repaired both denied Gateway HTTP endpoint findings, validated REMAINING_FINDINGS=0, and preserved nested endpoint URL-fetch config.
node scripts/run-vitest.mjs extensions/policy/src/doctor/register.test.ts extensions/policy/src/doctor/metadata.test.ts --reporter=dot passed: 2 files, 299 tests, 9.88s.
pnpm docs:map:check, touched-file oxfmt --check, git diff --check origin/main...HEAD, and git diff --check passed.

clawsweeper · 2026-07-07T18:05:27Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

giodl73-repo · 2026-07-07T18:23:53Z

Maintainer acceptance for current head c216e7485c5e12df315a70543f092a6cce801b58: accept policy/gateway-http-endpoint-enabled as an automatic doctor --fix repair.

Rationale: the repair only narrows the exact reported gateway.http.endpoints.*.enabled leaves to false when workspace policy denies those endpoints and workspaceRepairs=true is enabled. Current proof shows both denied endpoint findings repaired, zero remaining endpoint findings, and nested URL-fetch config preserved. URL-fetch allowlist findings remain manual and are not auto-repaired by this PR.

giodl73-repo · 2026-07-07T18:27:02Z

Merged via squash.

Prepared head SHA: c216e7485c5e12df315a70543f092a6cce801b58
Landed commit: 41425bf094ec7f65f673a0d99f8a185354a3b8bf

* policy: repair denied gateway http endpoints * docs(policy): describe gateway http repairs --------- Co-authored-by: Gio Della-Libera <[email protected]>

openclaw-barnacle Bot added docs Improvements or additions to documentation scripts Repository scripts extensions: policy size: XL maintainer Maintainer-authored PR labels Jul 4, 2026

giodl73-repo mentioned this pull request Jul 4, 2026

policy: preview review-required gateway repairs #99776

Merged

clawsweeper Bot mentioned this pull request Jul 4, 2026

policy: repair channel ingress findings #99720

Merged

openclaw-barnacle Bot added the commands Command implementations label Jul 4, 2026

clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. labels Jul 4, 2026

openclaw-barnacle Bot added commands Command implementations and removed commands Command implementations docs Improvements or additions to documentation scripts Repository scripts labels Jul 4, 2026

This was referenced Jul 5, 2026

policy: repair automatic narrowing findings #99690

Merged

policy: repair required deny tool findings #99700

Merged

giodl73-repo force-pushed the policy-doctor-gateway-http-repairs branch from c644a16 to aa72dec Compare July 7, 2026 03:28

clawsweeper Bot mentioned this pull request Jul 7, 2026

policy: preview review-required tool repairs #101336

Draft

giodl73-repo force-pushed the policy-doctor-gateway-http-repairs branch from aa72dec to 5b0a96c Compare July 7, 2026 17:40

Gio Della-Libera and others added 2 commits July 7, 2026 11:02

policy: repair denied gateway http endpoints

570ddd2

docs(policy): describe gateway http repairs

c216e74

giodl73-repo force-pushed the policy-doctor-gateway-http-repairs branch from 5b0a96c to c216e74 Compare July 7, 2026 18:04

giodl73-repo merged commit 41425bf into openclaw:main Jul 7, 2026
99 checks passed

giodl73-repo deleted the policy-doctor-gateway-http-repairs branch July 7, 2026 18:27

github-actions Bot mentioned this pull request Jul 7, 2026

📡 Upstream Digest — 2026-07-07 19:43 UTC curtismercier/openclaw-mods#1232

Open

Uh oh!

Uh oh!

Conversation

giodl73-repo commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Real behavior proof

Stack

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

omarshahine commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

giodl73-repo commented Jul 4, 2026

Uh oh!

clawsweeper Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

clawsweeper Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

Uh oh!

giodl73-repo commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

giodl73-repo commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 4, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading

clawsweeper Bot commented Jul 7, 2026 •

edited

Loading