Skip to content

Surface pending scope upgrades in gateway auth errors#69226

Merged
obviyus merged 8 commits intoopenclaw:mainfrom
obviyus:fix/control-ui-scope-upgrade-feedback
Apr 20, 2026
Merged

Surface pending scope upgrades in gateway auth errors#69226
obviyus merged 8 commits intoopenclaw:mainfrom
obviyus:fix/control-ui-scope-upgrade-feedback

Conversation

@obviyus
Copy link
Copy Markdown
Contributor

@obviyus obviyus commented Apr 20, 2026

Summary

When a paired read-only device reconnects asking for wider operator scopes, surface the real approval state instead of a generic pairing/auth failure.

Changes

  • format pairing rejection details into actionable scope/role/metadata upgrade messages
  • surface those messages in CLI/status/probe flows and show a dedicated pending-approval state in Control UI

Verification

  • OPENCLAW_LOCAL_CHECK=0 pnpm test src/gateway/protocol/connect-error-details.test.ts src/gateway/probe.test.ts src/cli/daemon-cli/probe.test.ts src/commands/status.test.ts src/commands/status.command-sections.test.ts ui/src/ui/views/overview.node.test.ts ui/src/ui/views/overview.render.test.ts ui/src/ui/app-gateway.node.test.ts src/gateway/server.auth.control-ui.suite.ts
  • pnpm build
  • manual repro against a throwaway local gateway + live Control UI session

@obviyus obviyus requested a review from a team as a code owner April 20, 2026 06:25
@openclaw-barnacle openclaw-barnacle Bot added app: web-ui App: web-ui gateway Gateway runtime cli CLI command changes commands Command implementations size: L maintainer Maintainer-authored PR labels Apr 20, 2026
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps Bot commented Apr 20, 2026

Greptile Summary

This PR surfaces structured pairing-rejection details (scope/role/metadata upgrade reasons and requestId) across the gateway auth error path — replacing a single generic "gateway pairing required" message with actionable, reason-specific copy in the CLI status command, daemon probe, and Control UI overview view. The round-trip is: gateway emits structured ConnectPairingRequiredDetailsformatConnectPairingRequiredMessage encodes them into the human-readable error string → readConnectPairingRequiredMessage re-parses the string on the consumer side to drive UI branching. requestId values are validated against a strict allowlist regex at both encode and decode, so there is no injection risk in the constructed approve command.

Confidence Score: 5/5

Safe to merge — changes are additive, well-tested, and handle all existing pairing code paths correctly.

All findings are P2. The logic for the new resolvePairingHint/readConnectPairingRequiredMessage round-trip is correct and backward-compatible; existing shouldShowPairingHint callers are unaffected. requestId sanitisation is validated by a dedicated test. Coverage includes unit tests for all new branches plus integration tests for the UI rendering.

No files require special attention.

Prompt To Fix All With AI
This is a comment left during a code review.
Path: ui/src/ui/views/overview-hints.ts
Line: 45-60

Comment:
**Fallback `null` for unknown `reason` maps to `"pairing-required"`**

When `readConnectPairingRequiredMessage` returns a truthy object but `reason` is undefined (can happen if `resolvePairingRequiredReasonFromMessage` falls through its last `"pairing required"` branch and returns `"not-paired"`, or future server-sent reasons that don't match any known value), the ternary chain falls through to `"pairing-required"` — which is the correct safe default and matches the existing `PAIRING_HINT_COPY` entry. No action needed, but it's worth a comment that this is intentional, since the type `PairingHint["kind"]` doesn't include an explicit `null`/`unknown` arm.

How can I resolve this? If you propose a fix, please make it concise.

Reviews (1): Last reviewed commit: "fix(control-ui): show scope upgrade pend..." | Re-trigger Greptile

Comment thread ui/src/ui/views/overview-hints.ts
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b11d47f41

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/gateway/protocol/connect-error-details.ts
@obviyus obviyus force-pushed the fix/control-ui-scope-upgrade-feedback branch from b672de2 to ad73956 Compare April 20, 2026 06:43
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad7395687c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/gateway/client.ts
@openclaw-barnacle openclaw-barnacle Bot added the agents Agent runtime and tooling label Apr 20, 2026
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 21dd622b8d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread ui/src/ui/views/overview.ts Outdated
@obviyus obviyus force-pushed the fix/control-ui-scope-upgrade-feedback branch from 21dd622 to 0520e89 Compare April 20, 2026 07:48
@obviyus obviyus self-assigned this Apr 20, 2026
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 018dd966d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread ui/src/ui/views/overview.ts Outdated
@obviyus obviyus merged commit aff96ea into openclaw:main Apr 20, 2026
9 checks passed
@obviyus
Copy link
Copy Markdown
Contributor Author

obviyus commented Apr 20, 2026

Landed on main via rebase.

Source commit: 758ebe7
Merge commit: aff96ea

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 758ebe7fd6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread src/gateway/probe.ts
settleProbe({
ok: false,
error: formatProbeCloseError(close),
error: connectError || formatProbeCloseError(close),
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Detect pairing-pending from surfaced connect errors

This branch now prefers connectError, so pairing rejections can surface as messages like scope upgrade pending approval ... even when the close reason is generic (connect failed). However, probe capability classification still prioritizes close.reason in isPairingPendingProbeFailure, so these cases are reported as generic failures instead of pairing_pending, which suppresses pairing-specific recovery UX in probe/daemon status flows.

Useful? React with 👍 / 👎.

Comment on lines +410 to +411
if (readConnectErrorDetailCode(params.details) === ConnectErrorDetailCodes.PAIRING_REQUIRED) {
return formatConnectPairingRequiredMessage(params.details);
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Preserve server text when pairing details are partial

This unconditional rewrite for PAIRING_REQUIRED drops the original server message and always formats from structured details; if reason/requestId are missing (both are optional in PairingConnectErrorDetails), the output collapses to a generic device pairing required. That loses actionable upgrade context from message text and can remove request-id guidance that callers parse from error strings.

Useful? React with 👍 / 👎.

zhongmairen pushed a commit to agencyos-cn/openclaw that referenced this pull request Apr 20, 2026
* 'main' of https://github.com/openclaw/openclaw: (38 commits)
  fix(ui): restore pairing connect error formatting
  chore(ui): refresh pl control ui locale
  chore(ui): refresh id control ui locale
  chore(ui): refresh uk control ui locale
  chore(ui): refresh tr control ui locale
  chore(ui): refresh fr control ui locale
  chore(ui): refresh ko control ui locale
  chore(ui): refresh ja-JP control ui locale
  chore(ui): refresh es control ui locale
  chore(ui): refresh pt-BR control ui locale
  chore(ui): refresh de control ui locale
  chore(ui): refresh zh-CN control ui locale
  chore(ui): refresh zh-TW control ui locale
  fix: avoid preview-only pairing approval hint (openclaw#69226)
  fix: surface pending scope upgrade feedback (openclaw#69226)
  fix(ui): localize pairing upgrade hint copy
  fix(agents): preserve pairing guidance for node invoke upgrades
  test(cli): align probe status expectation after rebase
  fix(cli): preserve local pairing fallback for upgrades
  fix(control-ui): show scope upgrade pending state
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

agents Agent runtime and tooling app: web-ui App: web-ui cli CLI command changes commands Command implementations gateway Gateway runtime maintainer Maintainer-authored PR size: L

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant