Skip to content

refactor(openclaw): migrate chat-send and device self-approval patch tools to .mts #6967

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cv merged 4 commits into from
Jul 16, 2026
Merged

refactor(openclaw): migrate chat-send and device self-approval patch tools to .mts #6967

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5a488d2
refactor(openclaw): migrate chat-send patch tool to .mts
laitingsheng Jul 15, 2026
cf0fdd8
refactor(openclaw): migrate device self-approval patch tool to .mts
laitingsheng Jul 15, 2026
cc5046e
Merge remote-tracking branch 'origin/main' into refactor/6928-6930-op…
laitingsheng Jul 15, 2026
ed3f6eb
merge(main): finish OpenClaw patch tool migrations
prekshivyas Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,16 +211,16 @@ RUN npm ci --prefix /usr/local/lib/nemoclaw/wechat-runtime \
&& chmod -R a+rX,go-w /usr/local/lib/nemoclaw/wechat-runtime \
/usr/local/share/nemoclaw/wechat-npm-cache
COPY scripts/patch-openclaw-tool-catalog.mts /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts
COPY scripts/patch-openclaw-chat-send.js /usr/local/lib/nemoclaw/patch-openclaw-chat-send.js
COPY scripts/patch-openclaw-chat-send.mts /usr/local/lib/nemoclaw/patch-openclaw-chat-send.mts
COPY scripts/patch-openclaw-mcp-npx.mts /usr/local/lib/nemoclaw/patch-openclaw-mcp-npx.mts
COPY scripts/patch-openclaw-issue-4434-diagnostics.ts /usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts
COPY scripts/patch-openclaw-device-self-approval.ts /usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.ts
COPY scripts/patch-openclaw-device-self-approval.mts /usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.mts
COPY scripts/verify-wechat-runtime-lock.mts /usr/local/lib/nemoclaw/verify-wechat-runtime-lock.mts
RUN chmod 755 /usr/local/lib/nemoclaw/patch-openclaw-tool-catalog.mts \
/usr/local/lib/nemoclaw/patch-openclaw-chat-send.js \
/usr/local/lib/nemoclaw/patch-openclaw-chat-send.mts \
/usr/local/lib/nemoclaw/patch-openclaw-mcp-npx.mts \
/usr/local/lib/nemoclaw/patch-openclaw-issue-4434-diagnostics.ts \
/usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.ts \
/usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.mts \
/usr/local/lib/nemoclaw/verify-wechat-runtime-lock.mts

# Pre-install the codex-acp package so the embedded ACPx runtime can
Expand Down Expand Up @@ -729,7 +729,7 @@ RUN set -eu; \
# Removal criteria: drop when upstream OpenClaw fixes openclaw/openclaw#70164
# and openclaw/openclaw#50298, or when NemoClaw no longer ships an affected OpenClaw.
# hadolint ignore=DL3059
RUN node /usr/local/lib/nemoclaw/patch-openclaw-chat-send.js \
RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-chat-send.mts \
/usr/local/lib/node_modules/openclaw/dist

# Keep OpenClaw 2026.6.10 scope-upgrade approvals inside the gateway's
Expand All @@ -744,7 +744,7 @@ RUN node /usr/local/lib/nemoclaw/patch-openclaw-chat-send.js \
# Removal criteria: drop when upstream OpenClaw can approve the same bounded
# self-upgrade through the gateway using only operator.pairing.
# hadolint ignore=DL3059
RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.ts \
RUN node --experimental-strip-types /usr/local/lib/nemoclaw/patch-openclaw-device-self-approval.mts \
/usr/local/lib/node_modules/openclaw/dist

# Patch OpenClaw TUI unreachable-inference diagnostics for #4434.
Expand Down
4 changes: 2 additions & 2 deletions docs/security/openclaw-2026.6.10-dependency-review.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,7 +155,7 @@ Invalid state: a caller bypasses the helper, the audit inventory diverges from a

The OpenClaw 2026.6.10 compiled-dist patches are localized compatibility patches for sandbox fetch routing, cron preflight proxying, `host.openshell.internal` web_fetch scoping, unconfigured strict-fetch managed-proxy activation, `chat.send`/`get-reply` correlation, bounded same-device approval, and #4434 TUI unreachable-inference diagnostics. The long-term source of truth for these behaviors remains upstream OpenClaw; NemoClaw's Dockerfile and patch scripts carry fail-closed version-shape patches only so the reviewed package can run inside the current NemoClaw/OpenShell sandbox contract.

Invalid state: a real installed `openclaw@2026.6.10` dist changes semantics while fixture-compatible recognizers still pass. Source boundary: the installed OpenClaw generated `dist` files, the Dockerfile fetch-guard patch block, `scripts/patch-openclaw-chat-send.js`, `scripts/patch-openclaw-device-self-approval.ts`, and `scripts/patch-openclaw-issue-4434-diagnostics.ts`. Source-fix constraint: upstream OpenClaw should own permanent fixes; NemoClaw patches must stay version-scoped, fail closed on unknown shapes, and be removed when upstream ships reviewed behavior. Regression tests: `test/fetch-guard-patch-regression.test.ts`, `test/openclaw-chat-send-patch.test.ts`, `test/openclaw-device-self-approval-patch.test.ts`, and `test/openclaw-issue-4434-diagnostics-patch.test.ts` execute patched fixtures for the reviewed shapes. `test/openclaw-real-patched-dist-harness.test.ts` is the checked-in real-package harness: when run with `NEMOCLAW_REAL_OPENCLAW_DIST_HARNESS=1`, it downloads the reviewed tarball URL, verifies the committed SRI, extracts the actual `openclaw@2026.6.10` dist, applies the Dockerfile patch block, runs and audits all three focused patch scripts, and verifies Patch 2, Patch 2b, Patch 4, Patch 6, Patch 7, Patch 8, chat-send/get-reply/followup-runner markers, and the #4434 assistant-error formatter marker. For Patch 8 it also verifies the exact compiled session producer, dispatcher, device handler, canonical authz-resolver, and fixed-version journal linkage; invokes the exported real handler to deny shared-auth and cross-device requests and rotate the matching device token; retains successful concurrent-approval proof; and injects both one-sided publication directions plus a rejected rename to verify bounded rollback and fresh-process recovery without losing unrelated pending or paired/token entries.
Invalid state: a real installed `openclaw@2026.6.10` dist changes semantics while fixture-compatible recognizers still pass. Source boundary: the installed OpenClaw generated `dist` files, the Dockerfile fetch-guard patch block, `scripts/patch-openclaw-chat-send.mts`, `scripts/patch-openclaw-device-self-approval.mts`, and `scripts/patch-openclaw-issue-4434-diagnostics.ts`. Source-fix constraint: upstream OpenClaw should own permanent fixes; NemoClaw patches must stay version-scoped, fail closed on unknown shapes, and be removed when upstream ships reviewed behavior. Regression tests: `test/fetch-guard-patch-regression.test.ts`, `test/openclaw-chat-send-patch.test.ts`, `test/openclaw-device-self-approval-patch.test.ts`, and `test/openclaw-issue-4434-diagnostics-patch.test.ts` execute patched fixtures for the reviewed shapes. `test/openclaw-real-patched-dist-harness.test.ts` is the checked-in real-package harness: when run with `NEMOCLAW_REAL_OPENCLAW_DIST_HARNESS=1`, it downloads the reviewed tarball URL, verifies the committed SRI, extracts the actual `openclaw@2026.6.10` dist, applies the Dockerfile patch block, runs and audits all three focused patch scripts, and verifies Patch 2, Patch 2b, Patch 4, Patch 6, Patch 7, Patch 8, chat-send/get-reply/followup-runner markers, and the #4434 assistant-error formatter marker. For Patch 8 it also verifies the exact compiled session producer, dispatcher, device handler, canonical authz-resolver, and fixed-version journal linkage; invokes the exported real handler to deny shared-auth and cross-device requests and rotate the matching device token; retains successful concurrent-approval proof; and injects both one-sided publication directions plus a rejected rename to verify bounded rollback and fresh-process recovery without losing unrelated pending or paired/token entries.

The harness remains explicit opt-in for PR and local proof. Trusted main CI sets `NEMOCLAW_REAL_OPENCLAW_DIST_HARNESS=1` and materializes the reviewed archive automatically with a bounded download retry and a 12-minute job budget. PR CI intentionally does not treat PR-authored harness code as its own security gate.
This source-package proof is not a substitute for focused nightly E2E proof of affected runtime workflows, image builds for the current PR head commit, or final full E2E proof before merge.
Expand All @@ -170,7 +170,7 @@ Removal condition: delete the localized patches and harness when OpenClaw ships
| Patch 4: managed-proxy activation for `OPENSHELL_SANDBOX=1` | Unconfigured strict fetches in the sandbox bypass the OpenShell L7 proxy, or explicit dispatcher/direct policies are overwritten by the fallback. | Reviewed fetch-guard managed-proxy gate in `openclaw@2026.6.10`; the Dockerfile patch extends activation only when `OPENSHELL_SANDBOX=1` and no explicit `dispatcherPolicy` is present. | The compiled dist is package output. NemoClaw can keep sandbox egress compatible for this bump, but upstream OpenClaw should own a first-class managed-proxy behavior for sandboxed runtimes. | `test/fetch-guard-patch-regression.test.ts` asserts the unconfigured strict-fetch fallback while preserving explicit dispatcher policy behavior. | Remove the patch when OpenClaw routes sandbox strict fetches through the configured env proxy without NemoClaw mutation, or when sandbox egress no longer depends on that proxy. |
| Patch 6: cron model-provider preflight trusted env-proxy mode | Cron preflight resolves `inference.local` directly and fails with DNS/egress errors, or the rewrite widens multiple call sites without a reviewed shape. | Reviewed cron isolated-agent preflight call in `openclaw@2026.6.10` that uses `auditContext: "cron-model-provider-preflight"` with `fetchWithSsrFGuard` and `buildLocalProviderSsrFPolicy`. | The preflight call site lives in upstream OpenClaw source; NemoClaw only patches the reviewed compiled call site so scheduled runs can reach the OpenShell-managed inference route. | `test/fetch-guard-patch-regression.test.ts` guards the single-callsite shape, exact trusted-env-proxy insertion, and ambiguous multi-callsite failure mode. | Remove the patch when OpenClaw sets `mode: "trusted_env_proxy"` or equivalent env-proxy routing for managed inference preflight. |
| Patch 7: #4434 TUI unreachable-inference diagnostic enrichment | The TUI reports only `TypeError: fetch failed` or `LLM request timed out.` for blocked sandbox inference egress, or enrichment applies outside `OPENSHELL_SANDBOX=1`. | Reviewed assistant error formatter dist file containing `formatRawAssistantErrorForUi`; `scripts/patch-openclaw-issue-4434-diagnostics.ts` adds missing cause, gateway/upstream reporting, and recovery hint fields. | The formatter source lives in upstream OpenClaw. NemoClaw can patch the reviewed compiled artifact for the OpenShell sandbox contract, but the durable fix belongs upstream. | `test/openclaw-issue-4434-diagnostics-patch.test.ts` verifies both reviewed failure shapes, env gating, partial-field completion, full-message preservation, and fail-closed selectors; the #4434 live guards require all fields. | Remove the patch when OpenClaw emits HTTP/cause, gateway/upstream layer, and recovery hint directly for unreachable inference errors. |
| Patch 8: bounded same-device device scope approval | The CLI requests the scope it is trying to approve, never reaches `device.pair.approve`, loses concurrent requests/devices/tokens, or publishes only one half of the `pending.json` / `paired.json` transition and cannot converge after restart. | Reviewed 2026.6.10 devices CLI, session producer, canonical session-authz resolver, gateway dispatcher/device handler, and canonical `approveDevicePairing` pairing-state module; `scripts/patch-openclaw-device-self-approval.ts` changes exactly one selected CLI file, handler file, and pairing-state module. Host callers do not read or publish device state. | The handshake and pairing state machine are upstream OpenClaw behavior, but its reviewed `persistState(..., "both")` uses two independent writes without a cross-file recovery record. The version-scoped in-module patch routes only the exact signed CLI self-upgrade through the existing lock and a fixed-version journal; ordinary approval and bootstrap paths retain upstream `persistState`. | `test/openclaw-device-self-approval-patch.test.ts` covers exact-dist cardinality, caller and pending identity/role/scope denials, in-lock revalidation, and journal patch shape; `test/openclaw-real-patched-dist-harness.test.ts` validates the exact device-token session linkage, canonical token rotation, successful concurrent approvals, both one-sided crash directions, rejected-rename settlement, and fresh-process recovery while unrelated pending and paired/token entries survive. | Remove the patch only when OpenClaw both accepts the same complete operator-only self-upgrade through the gateway using the already-approved `operator.pairing` scope and publishes its pending/paired transition atomically or with equivalent durable restart recovery. |
| Patch 8: bounded same-device device scope approval | The CLI requests the scope it is trying to approve, never reaches `device.pair.approve`, loses concurrent requests/devices/tokens, or publishes only one half of the `pending.json` / `paired.json` transition and cannot converge after restart. | Reviewed 2026.6.10 devices CLI, session producer, canonical session-authz resolver, gateway dispatcher/device handler, and canonical `approveDevicePairing` pairing-state module; `scripts/patch-openclaw-device-self-approval.mts` changes exactly one selected CLI file, handler file, and pairing-state module. Host callers do not read or publish device state. | The handshake and pairing state machine are upstream OpenClaw behavior, but its reviewed `persistState(..., "both")` uses two independent writes without a cross-file recovery record. The version-scoped in-module patch routes only the exact signed CLI self-upgrade through the existing lock and a fixed-version journal; ordinary approval and bootstrap paths retain upstream `persistState`. | `test/openclaw-device-self-approval-patch.test.ts` covers exact-dist cardinality, caller and pending identity/role/scope denials, in-lock revalidation, and journal patch shape; `test/openclaw-real-patched-dist-harness.test.ts` validates the exact device-token session linkage, canonical token rotation, successful concurrent approvals, both one-sided crash directions, rejected-rename settlement, and fresh-process recovery while unrelated pending and paired/token entries survive. | Remove the patch only when OpenClaw both accepts the same complete operator-only self-upgrade through the gateway using the already-approved `operator.pairing` scope and publishes its pending/paired transition atomically or with equivalent durable restart recovery. |

### OpenClaw Diagnostics OTEL Host Gateway Boundary

Expand Down
Loading
Loading