Skip to content

Introduce auth for codex/claude code & Fix agent not receiving messages after server restarted#24

Merged
RussellLuo merged 11 commits intoOpenCSGs:mainfrom
xxx7xxxx:dev
Apr 30, 2026
Merged

Introduce auth for codex/claude code & Fix agent not receiving messages after server restarted#24
RussellLuo merged 11 commits intoOpenCSGs:mainfrom
xxx7xxxx:dev

Conversation

@xxx7xxxx
Copy link
Copy Markdown
Collaborator

Summary

  • Added CLIProxy auth bridge for Codex and Claude Code, including Codex auth import, macOS Claude Keychain probing, auth status/login APIs, CLI auth commands, and UI auth states.
  • Fixed agent reply loss after csgclaw serve restart by reconnecting/recreating agent gateways, retrying transient BoxLite runtime-lock failures, and replaying missed PicoClaw messages.
  • Updated docs and tests for auth flows, restart recovery, and PicoClaw delivery.

@xxx7xxxx xxx7xxxx requested a review from RussellLuo April 29, 2026 11:40
Comment thread internal/api/picoclaw.go Outdated
}
}

func (h *Handler) replayRecentPicoClawMessages(botID string) {
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How can we ensure that replayed messages do not get duplicated before and after the server restarts?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: Replay finds that message ID in persisted IM history, uses its timestamp as a cursor, and skips messages at or before it.

Comment thread docs/cli.md Outdated
Usage:

```bash
csgclaw auth login <provider> [flags]
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since it has nothing to do with csgclaw's own auth, it is suggested to change the command to: csgclaw model auth login.

Reference: OpenClaw Auth profiles.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My mind: too ugly long.
My hand: fix without question.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Personally, I think csgclaw model auth is sufficient. There's no need to add "login" unless there's a "logout" action.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we will add it in the future, so be it.

Comment thread cli/model/model.go
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

auth/auth.go/auth_test.go => model/model.go/model_test.go?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done, plus adding shell completion subcommand.

Comment thread internal/api/picoclaw.go

_, _ = io.WriteString(w, ": connected\n\n")
flusher.Flush()
h.replayRecentPicoClawMessages(botID, r.Header.Get("Last-Event-ID"))
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does this Last-Event-Id come from?

Copy link
Copy Markdown
Collaborator Author

@xxx7xxxx xxx7xxxx Apr 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it’s expected from the PicoClaw SSE client / EventSource implementation. It's a standard header for SSE protocol.[1]

[1] https://http.dev/last-event-id

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, so this is partially done. PicoClaw will need to be adjusted later to match it.

@RussellLuo
Copy link
Copy Markdown
Collaborator

LGTM (will merge it once the conflict's fixed).

@xxx7xxxx
Copy link
Copy Markdown
Collaborator Author

Conflict fixed

@xxx7xxxx
Copy link
Copy Markdown
Collaborator Author

@RussellLuo

  • I Restored the v0.2.5-style restart path which works after restarting server.
  • Fixed the csgclaw agent logs -f side effect by reading the host-mounted gateway.log directly instead of holding the sandbox runtime lock, which will cause reconnecting failure
  • Adds one-click “All members” selection when creating rooms and adding members to existing rooms.

@xxx7xxxx
Copy link
Copy Markdown
Collaborator Author

@RussellLuo Fixed gateway.log mounting problem

Comment thread internal/agent/box.go Outdated
hostPath: hostWorkspaceRoot,
guestPath: boxWorkspaceDir,
hostPath: hostConfigRoot,
guestPath: boxPicoClawDir,
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the previous discussion, here we should not mount the hostConfigRoot anymore?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's leave the mount for hostWorkspaceRoot as it is for now.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

corrected

Comment thread internal/agent/box.go
hostPath: projectsRoot,
guestPath: boxProjectsDir,
},
}
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why delete projectsRoot? This directory’s supposed to let all agents see the same shared projects folder, otherwise they can’t share build outputs at all!

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My bad, mis-deleting, reverted.

Comment thread internal/agent/workspace.go Outdated
if strings.TrimSpace(template) == "" {
return "", fmt.Errorf("workspace template is required")
}
if err := migrateLegacyAgentWorkspace(agentName, hostRoot); err != nil {
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Performing migration here doesn’t make sense:

  1. Right now, only when we create an agent do we call ensureAgentWorkspace(), and at that point the agent usually doesn’t even exist (or it got deleted already);
  2. Even if it does migrate successfully, the copyEmbeddedWorkspace() step is just gonna overwrite everything right after anyway.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good gotcha, fixed.

@RussellLuo RussellLuo merged commit 75e9327 into OpenCSGs:main Apr 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants