From b079b3667788b2ff04de510125e0c02d7f3a947b Mon Sep 17 00:00:00 2001
From: eduardocruz <eduardocruz@users.noreply.github.com>
Date: Fri, 13 Mar 2026 00:54:44 -0300
Subject: [PATCH] fix: address remaining review feedback

- Use base-path-relative manifest URL (no leading slash) so PWA works
  under non-root base paths
- Classify push.web.* methods in WRITE_SCOPE so they work for operator
  sessions without admin scope
- Refresh webPushPermission in the finally block of handleWebPushSubscribe
  so denied permission is immediately reflected in the UI
---
 src/gateway/method-scopes.ts | 4 ++++
 ui/src/ui/app.ts             | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/src/gateway/method-scopes.ts b/src/gateway/method-scopes.ts
index 8c1c8332bdc..8cd32af9d32 100644
--- a/src/gateway/method-scopes.ts
+++ b/src/gateway/method-scopes.ts
@@ -146,6 +146,10 @@ const METHOD_SCOPE_GROUPS: Record<OperatorScope, readonly string[]> = {
     "doctor.memory.repairDreamingArtifacts",
     "doctor.memory.dedupeDreamDiary",
     "push.test",
+    "push.web.vapidPublicKey",
+    "push.web.subscribe",
+    "push.web.unsubscribe",
+    "push.web.test",
     "node.pending.enqueue",
   ],
   [ADMIN_SCOPE]: [
diff --git a/ui/src/ui/app.ts b/ui/src/ui/app.ts
index 9d2bf7794f4..6d104fd9d10 100644
--- a/ui/src/ui/app.ts
+++ b/ui/src/ui/app.ts
@@ -984,6 +984,10 @@ export class OpenClawApp extends LitElement {
       this.lastError = String(err);
     } finally {
       this.webPushLoading = false;
+      // Always refresh permission state — catches denied prompts too.
+      if ("Notification" in window) {
+        this.webPushPermission = Notification.permission;
+      }
     }
   }