Cherry-pick: Gateway fixes and improvements (2/2) (50 commits) #1870
Description
Cherry-pick from upstream — Gateway fixes and improvements (batch 2/2)
Source: openclaw/openclaw main branch
Scan session: 2026-03-24 (rescan after cursor reset)
Commits: 50 (50 clean, 0 partial)
Commits
| # | Hash | Subject | Author | Files | Tier |
|---|---|---|---|---|---|
| 1 | 5f34391f75 |
refactor: share gateway client auth retry helpers | Peter Steinberger | 1 | PICK |
| 2 | 5fc43ff0ec |
fix(gateway): bound unanswered client requests (openclaw#45689) | Tak Hoffman | 5 | PICK |
| 3 | 60c1577860 |
Gateway: preserve discovered session store paths | Gustavo Madeira Santana | 2 | PICK |
| 4 | 6245b4f3d8 |
test: import vi in gateway chat server test | Peter Steinberger | 1 | PICK |
| 5 | 644fb76960 |
refactor: share node pending test client | Peter Steinberger | 1 | PICK |
| 6 | 69217164f7 |
fix: add null guards to usage sort comparators | Stephen Schoettler | 2 | PICK |
| 7 | 6cc86ad211 |
refactor: share gateway credential secretref assertions | Peter Steinberger | 1 | PICK |
| 8 | 727fc79ed2 |
fix: force-stop lingering gateway client sockets | Peter Steinberger | 2 | PICK |
| 9 | 776e5d8a08 |
Gateway: lazily resolve channel runtime | Vincent Koc | 2 | PICK |
| 10 | 7b00a0620a |
test: stabilize gateway alias coverage | Peter Steinberger | 2 | PICK |
| 11 | 7b2a7da549 |
Gateway: import normalizeAgentId in hooks | Vincent Koc | 1 | PICK |
| 12 | 7dc447f79f |
fix(gateway): strip unbound scopes for shared-auth connects | Peter Steinberger | 2 | PICK |
| 13 | 8225b9edbb |
test: share gateway hook and cron helpers | Peter Steinberger | 2 | PICK |
| 14 | 8661c271e9 |
Gateway: preserve trusted-proxy browser scopes | Vincent Koc | 2 | PICK |
| 15 | 8cc0c9baf2 |
fix(gateway): run before_tool_call for HTTP tools | Peter Steinberger | 2 | PICK |
| 16 | 91d4f5cd2f |
test: simplify control ui http coverage | Peter Steinberger | 1 | PICK |
| 17 | 91f1894372 |
test: tighten server method helper coverage | Peter Steinberger | 1 | PICK |
| 18 | 92fc8065e9 |
fix(gateway): remove re-introduced auth.mode=none pairing bypass | Andrew Demczuk | 1 | PICK |
| 19 | 937f118d8e |
Gateway: add docs hint for plugin override trust error (openclaw#49513) | Josh Lehman | 2 | PICK |
| 20 | 93df5f613e |
fix(gateway): avoid probe false negatives after connect | Vincent Koc | 2 | PICK |
| 21 | 9bffa3422c |
fix(gateway): skip device pairing when auth.mode=none | Andrew Demczuk | 2 | PICK |
| 22 | 9ee0fb52e9 |
Gateway: cover lazy channel runtime resolution | Vincent Koc | 1 | PICK |
| 23 | a1520d70ff |
fix(gateway): propagate real gateway client into plugin subagent runtime | Robin Waslander | 7 | PICK |
| 24 | a2999c6cfb |
test: normalize rebase fallout (openclaw#52428) (thanks @karanuppal) | Peter Steinberger | 1 | PICK |
| 25 | a3ece09d19 |
refactor: share control ui hardlink asset setup | Peter Steinberger | 1 | PICK |
| 26 | a60a4b4b5e |
test(gateway): avoid hoisted reply mock tdz | Peter Steinberger | 1 | PICK |
| 27 | a60fd3feed |
Nodes tests: prove pull-time policy revalidation | Vincent Koc | 1 | PICK |
| 28 | a69f6190ab |
fix(gateway): pin plugin webhook route registry (openclaw#47902) | Peter Steinberger | 10 | PICK |
| 29 | ad24fccff5 |
test(gateway): stabilize suite session-store config (openclaw#52193) | Luke | 4 | PICK |
| 30 | b5349f7563 |
refactor: share startup auth token assertions | Peter Steinberger | 1 | PICK |
| 31 | b64466953a |
test: share plugin http auth helpers | Peter Steinberger | 1 | PICK |
| 32 | b6b5e5caac |
refactor: deduplicate push test fixtures | Peter Steinberger | 1 | PICK |
| 33 | b72ac7936a |
test: share gateway reload helpers | Peter Steinberger | 1 | PICK |
| 34 | ba34266e89 |
test: dedupe cron config setup | Peter Steinberger | 1 | PICK |
| 35 | bec76be592 |
test: simplify talk config and path env coverage | Peter Steinberger | 2 | PICK |
| 36 | c8898034f9 |
refactor: share agent wait dedupe cleanup | Peter Steinberger | 1 | PICK |
| 37 | c91d1622d5 |
fix(gateway): split conversation reset from admin reset | Peter Steinberger | 6 | PICK |
| 38 | ccba943738 |
test(gateway): restore agent request route mock | Ayaan Zaidi | 1 | PICK |
| 39 | ccf16cd889 |
fix(gateway): clear trusted-proxy control ui scopes | Peter Steinberger | 3 | PICK |
| 40 | d40a4e343c |
fix: add gateway session reset routing coverage (openclaw#44773) (thanks @Lanfei) | Ayaan Zaidi | 2 | PICK |
| 41 | dafd61b5c1 |
fix(gateway): enforce caller-scope subsetting in device.token.rotate | Robin Waslander | 3 | PICK |
| 42 | db9c755045 |
refactor: share readiness test harness | Peter Steinberger | 1 | PICK |
| 43 | e1b9250dea |
test: simplify method scope coverage | Peter Steinberger | 1 | PICK |
| 44 | e351a86290 |
refactor: share node wake test apns fixtures | Peter Steinberger | 1 | PICK |
| 45 | e94ac57f80 |
refactor: reuse gateway talk provider schema fields | Peter Steinberger | 1 | PICK |
| 46 | ebed3bbde1 |
fix(gateway): enforce browser origin check regardless of proxy headers | Robin Waslander | 3 | PICK |
| 47 | eece586747 |
refactor(security): reuse hook agent routing normalization | Peter Steinberger | 3 | PICK |
| 48 | eff0d5a947 |
Hardening: tighten preauth WebSocket handshake limits (openclaw#44089) | Vincent Koc | 5 | PICK |
| 49 | f8efa30305 |
test: share gateway chat run helpers | Peter Steinberger | 1 | PICK |
| 50 | feba7ea8fd |
refactor: share shared auth scope assertion | Peter Steinberger | 1 | PICK |
Execution
Pick up with: /pick-from-openclaw execute issue #N
Recommended strategy: staging branch