mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-02 18:41:33 +00:00
6251343384
* feat(sessions): enforce visibility and membership * feat(ui): add session sharing controls * docs: add session sharing implementation report * refactor(sessions): use canonical creator identity * fix(sessions): adopt creator ownership contract * docs: refresh session sharing rebase report * docs: record final creator integration proof * docs: record final main rebase * chore: drop worktree report artifact * fix(sessions): keep drafts owner-only * fix(ui): preserve redacted session restrictions * fix(sessions): preserve scoped sharing authorization * fix(sessions): re-verify session instance inside sharing mutation queue * test(sessions): cover stale sharing mutation * fix(sessions): bind membership to session instance, gate absence blocking on sharing * fix(sessions): preserve entry normalization on rebase * fix(sessions): atomic visibility instance guard, reset visibility on recreate * docs(ui): name the absence-heuristic tradeoff and link follow-up * feat(protocol): expose session sharing row state * docs: note generated creator identity type * fix(sessions): bind member writes and visibility rollback to session instance * fix(ui): discard stale-connection sharing loads; drop worktree scratch files * fix(ui): block composer only on observed sharing state, never on list absence * fix(gateway): authorize agent runs against the resolved session (close keyless bypass) * chore(protocol): allowlist Control UI-only session.sharing event for mobile * test(config): record session.sharing keys in common-tier snapshot * refactor(sessions): unexport internal sharing helpers * test(gateway): update sessions changed routing assertions * fix(sessions): align sharing identity with created actor * fix(sessions): align membership identities and storage keys * fix(gateway): re-filter drafts against fresh sharing state in sessions.list * fix(gateway): drafts stay owner+admin only in the sessions.list fresh filter * fix(ui): re-export sharing protocol types for the Control UI * fix(ui): keep SessionSharingRole internal to satisfy deadcode gate * fix(gateway): read runtime config lazily in session-mutation authorization authorizeSessionMutation ran on every gateway request but eagerly called context.getRuntimeConfig() — a non-trivial config resolve — for methods that are never session mutations. Read config only once a real session-mutation target is resolved. Also register the four session sharing methods in the 2026.7 release-train inventory test. * fix(gateway): share one config snapshot across session-mutation authorization Group rename/delete discovery and the authorization loop were each resolving runtime config separately after the lazy-read change. Memoize the resolve so non-session requests still pay nothing, while any session mutation resolves config at most once and both discovery and authorization use that single snapshot (no double reload, no mid-request config-change split). * fix(gateway): resolve session-sharing CI gates - isGatewayAdmin: null-safe connect access so internal/plugin-runtime runs (which reach authorization with a connect-less client) do not crash. - emitSessionsChanged: scope only to a concrete session key; a [undefined] sessionKeys scope filters nothing correctly and would strip draft gating. - session stores: mark the sync TOCTOU re-read and the sqlite_master existence probe as narrowly-justified raw SQLite primitives. - tests: provide getRuntimeConfig to the session-action contract context, drop a shadowed 'call' binding, use structuredClone, and assert the agent-scoped sessions.changed broadcast shape. * docs(gateway): note best-effort participation gate + refresh native i18n baseline Session ownership/visibility are usability features, not a security boundary (docs/concepts/multi-user.md, SECURITY.md); document that the pre-dispatch authorization is intentionally not commit-bound to the resolved instance. Also refresh apps/.i18n/native-source.json after the session-sharing protocol codegen shifted line numbers of existing native strings (position-only). * test(gateway): reset session sharing snapshots * style(gateway): format sharing reset import
58 lines
5.9 KiB
JSON
58 lines
5.9 KiB
JSON
{
|
|
"$comment": "Gateway events each mobile client intentionally does not handle yet, with a one-line reason. Consumed by scripts/check-protocol-event-coverage.mjs (pnpm check:protocol-coverage). Adding a gateway event without a client handler requires either handling it or adding an entry here; the check also fails when an entry goes stale (event removed or now handled).",
|
|
"ios": {
|
|
"session.operation": "Chat UI derives run state from chat/agent events; no session.operation consumer yet.",
|
|
"session.tool": "Session tool stream is not rendered by the iOS chat surface yet.",
|
|
"task.suggestion": "Task suggestion cards are a Control UI-only surface; iOS does not render them.",
|
|
"ui.command": "Web Control UI-only layout commands; iOS does not consume them.",
|
|
"presence": "Presence roster is a control-UI (web/desktop) surface; iOS does not render it.",
|
|
"shutdown": "iOS relies on socket close plus reconnect/backoff instead of the shutdown notice.",
|
|
"heartbeat": "iOS liveness uses tick and WebSocket-level ping; heartbeat is unused.",
|
|
"cron": "Cron run activity is not surfaced in the iOS app.",
|
|
"task": "Background task activity is not surfaced in the iOS app.",
|
|
"node.pair.requested": "Node pairing state is fetched on demand; no push consumer on iOS yet.",
|
|
"node.pair.resolved": "Node pairing state is fetched on demand; no push consumer on iOS yet.",
|
|
"node.presence": "Node activity is reported by macOS nodes and consumed by gateway routing; iOS has no presence reporter yet.",
|
|
"device.pair.requested": "Device pairing flows poll via device.pair.* methods on iOS.",
|
|
"device.pair.resolved": "Device pairing flows poll via device.pair.* methods on iOS.",
|
|
"voicewake.routing.changed": "iOS only consumes voicewake.changed trigger updates; routing changes are not surfaced.",
|
|
"plugin.approval.requested": "Plugin approval prompts are not implemented on iOS.",
|
|
"plugin.approval.resolved": "Plugin approval prompts are not implemented on iOS.",
|
|
"openclaw.approval.requested": "OpenClaw system-agent config approvals are a web/desktop operator surface; iOS has no operator-approval prompt.",
|
|
"openclaw.approval.resolved": "OpenClaw system-agent config approvals are a web/desktop operator surface; iOS has no operator-approval prompt.",
|
|
"terminal.data": "Embedded terminal is a web/desktop surface; iOS has no terminal client.",
|
|
"terminal.exit": "Embedded terminal is a web/desktop surface; iOS has no terminal client.",
|
|
"update.available": "Gateway self-update notices do not apply to iOS; app updates ship via the App Store.",
|
|
"session.approval": "Native approval review uses exec.approval push/nudge delivery; the session-scoped approval stream is a Control UI chat surface.",
|
|
"session.sharing": "Session visibility/membership management is a Control UI operator surface; iOS reads visibility/sharingRole from session rows and has no sharing editor."
|
|
},
|
|
"android": {
|
|
"session.operation": "Chat UI derives run state from chat/agent events; no session.operation consumer yet.",
|
|
"session.tool": "Session tool stream is not rendered by the Android chat surface yet.",
|
|
"task.suggestion": "Task suggestion cards are a Control UI-only surface; Android does not render them.",
|
|
"ui.command": "Web Control UI-only layout commands; Android does not consume them.",
|
|
"presence": "Presence roster is a control-UI (web/desktop) surface; Android does not render it.",
|
|
"talk.mode": "Android toggles talk mode locally; gateway talk.mode sync is not consumed.",
|
|
"shutdown": "Android relies on socket close plus reconnect/backoff instead of the shutdown notice.",
|
|
"heartbeat": "Android liveness uses tick and WebSocket-level ping; heartbeat is unused.",
|
|
"cron": "Cron run activity is not surfaced in the Android app.",
|
|
"task": "Background task activity is not surfaced in the Android app.",
|
|
"node.pair.requested": "Android's bounded operator session lacks operator.pairing; onboarding refreshes node approval with explicit node.list requests.",
|
|
"node.pair.resolved": "Android's bounded operator session lacks operator.pairing; onboarding refreshes node approval with explicit node.list requests.",
|
|
"node.presence": "Node activity is reported by macOS nodes and consumed by gateway routing; Android has no presence reporter yet.",
|
|
"device.pair.requested": "Device pairing flows poll via device.pair.* methods on Android.",
|
|
"device.pair.resolved": "Device pairing flows poll via device.pair.* methods on Android.",
|
|
"voicewake.routing.changed": "Android reads voicewake state on demand via voicewake.get; no push consumer yet.",
|
|
"plugin.approval.requested": "Plugin approval prompts are not implemented on Android.",
|
|
"plugin.approval.resolved": "Plugin approval prompts are not implemented on Android.",
|
|
"openclaw.approval.requested": "OpenClaw system-agent config approvals are a web/desktop operator surface; Android has no operator-approval prompt.",
|
|
"openclaw.approval.resolved": "OpenClaw system-agent config approvals are a web/desktop operator surface; Android has no operator-approval prompt.",
|
|
"terminal.data": "Embedded terminal is a web/desktop surface; Android has no terminal client.",
|
|
"terminal.exit": "Embedded terminal is a web/desktop surface; Android has no terminal client.",
|
|
"session.approval": "Native approval review uses exec.approval push/nudge delivery; the session-scoped approval stream is a Control UI chat surface.",
|
|
"session.sharing": "Session visibility/membership management is a Control UI operator surface; Android reads visibility/sharingRole from session rows and has no sharing editor.",
|
|
"node.invoke.cancel": "Cancel targets streaming agent.cli.claude.run.v1 invokes; app nodes never advertise agent runs, so no cancel can address them.",
|
|
"node.invoke.input": "Carries terminal keystrokes/resize to a node PTY relay invoke; the relay runs on gateway/CLI node hosts and app nodes never host it, so Android has no consumer."
|
|
}
|
|
}
|