* feat(gateway): add device.pair.setupCode RPC for connect QR
The OpenClaw mobile/companion app scans a pairing setup code to connect to the gateway, but that code + QR could only be produced by the openclaw qr CLI (ASCII to stdout). Non-terminal clients driving onboarding had no way to display the connect QR.
Add a device.pair.setupCode gateway method that reuses resolvePairingSetupFromConfig + encodePairingSetupCode + renderQrPngDataUrl to return { setupCode, qrDataUrl?, gatewayUrl, auth, urlSource }. The embedded setup code mints a short-lived bootstrap token that hands off broad operator scopes (read/write/approvals/talk.secrets), so the method requires operator.admin (matching the wizard methods a companion already uses) and is not advertised. auth is a label only; the gateway credential is never returned, and an oversized QR is omitted so the response always satisfies the result schema.
Refs #94661.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(ui): pair mobile devices from Control UI
* docs: refresh generated docs map
* docs: clarify mobile QR auto-connect
* docs: clarify mobile QR auto-connect
* docs: clarify mobile QR auto-connect
---------
Co-authored-by: Barbara Kudiess <76582160+bkudiess@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Summary:
- The branch adds plugin package live-proof guidance to the testing skill and plugin docs, separating npm-pack package validation from official-trust proof and documenting runtime dependency and compiled-entry checks.
- PR surface: Docs +111. Total +111 across 3 files.
- Reproducibility: not applicable. this is a documentation and skill-guidance clarification PR rather than a bug report. I validated the documented claims against current source, adjacent docs, tests, and live PR checks.
Automerge notes:
- No ClawSweeper repair was needed after automerge opt-in.
Validation:
- ClawSweeper review passed for head b56efcffc5.
- Required merge gates passed before the squash merge.
Prepared head SHA: b56efcffc5
Review: https://github.com/openclaw/openclaw/pull/99962#issuecomment-4882084565
Co-authored-by: Mason Huang <masonxhuang@tencent.com>
Approved-by: hxy91819
Claude Fable 5 requests on direct Anthropic API keys now opt into Anthropic's server-side fallback (server-side-fallback-2026-06-01): a safety-classifier decline is re-served by claude-opus-4-8 inside the same call instead of failing the turn with "LLM request failed.". Mid-stream boundaries drop the declined model's thinking/tool blocks per Anthropic's replay contract, keep the partial text as the continuation prefix, record a provider_fallback diagnostic, and cost the turn at the serving model's rates. Docs lead with the coupling: using Fable 5 means also using Opus 4.8. OAuth, proxies, Bedrock, Vertex, and Foundry requests are unchanged.
Live-verified: a benign reasoning_extraction classifier decline through the product path returns an Opus-served answer with the provider_fallback diagnostic; exact-head CI green (67 checks).
Related: #98976
* refactor(ui): dedupe chat styles and make styles.css import order real
* refactor(ui): dedupe chat tool-row styles into chat files
* refactor(ui): keep light bubble skin after role variants
* refactor(ui): keep light bubble skin after role variants
* refactor(ui): keep light bubble skin after role variants
* fix(transcripts): mark delivery mirrors as artifacts
* fix(transcripts): mark delivery mirrors as artifacts
* fix(transcripts): mark delivery mirrors as artifacts
applyFinalEffectiveToolPolicy and collectAttemptExplicitToolAllowlistSources
took ~15 raw identity params each and silently re-resolved a second
capability profile when callers forgot to pass one — with divergent
session inputs (attempt allowlist sources resolved policy off the live
session key while tool construction used the sandbox policy key). The
profile param is now required, the fallback resolution stacks are
deleted, and the attempt threads its single resolved profile into tool
construction, the final bundled pass, and allowlist sources. Doctor and
gateway tools.effective callers resolve their config-scope profile
explicitly at the callsite. createOpenClawCodingTools keeps its optional
self-resolve as public plugin-SDK convenience.
Scope fell back to caller-supplied groupId/groupChannel/groupSpace when
chatType was unknown, while the profile publishes those same fields
trust-checked (null when dropped). A dropped caller group could classify
an unknown-audience conversation as shared for downstream audience and
credential decisions. Scope now classifies only from live chat type,
server-derived session keys (new sessionKeyNamesGroupConversation), and
trust-checked group facts; dropped groups resolve to unknown.
The azure coordinator has been timing out (10m, no lease) while delegated
Blacksmith Testbox leases in about a minute. Make blacksmith-testbox the
.crabbox.yaml default, keep --provider aws/azure for direct VM proof, and
refresh the crabbox/openclaw-testing skill text that still claimed an AWS
default. Formatting proof: sibling-checkout oxfmt --check passed (hook needs
node_modules this worktree lacks). Testbox proof: tbx_01kwp8h31773z2vphbcae1syzr
(node --version, exit 0, 1m07s) via
https://github.com/openclaw/openclaw/actions/runs/28702438266
Session ingest has normalized legacy assistant string content into
[{ type: "text" }] blocks since #98908, which updated the core
cli-runner session-history analog but missed this extension file.
The suite only runs in full local runs and the dispatch-only
plugin-prerelease lane, so push/PR CI stayed green while local
scripts/pr prepare-gates failed on any OS.
refs #99857
