fix: route mobile exec approvals to reviewer device (#95175) · openclaw/openclaw@5d1e649

Recent Commits to openclaw:main

joshavant · 2026-06-21 · via Recent Commits to openclaw:main

File tree

extensions/codex/src/app-server
packages/gateway-protocol/src/schema

Original file line number	Diff line number	Diff line change
`@@ -23,6 +23,10 @@ private struct WatchChatPreview {`
`23`	`23`	`var statusText: String?`
`24`	`24`	`}`
`25`	`25`
	`26`	`+private struct ExecApprovalGatewayEventPayload: Decodable {`
	`27`	`+var id: String`
	`28`	`+}`
	`29`	`+`
`26`	`30`	`/// Ensures notification requests return promptly even if the system prompt blocks.`
`27`	`31`	`private final class NotificationInvokeLatch<T: Sendable>: @unchecked Sendable {`
`28`	`32`	`private let lock = NSLock()`
`@@ -895,26 +899,49 @@ final class NodeAppModel {`
`895`	`899`	`for await evt in stream {`
`896`	`900`	`if Task.isCancelled { return }`
`897`	`901`	`guard let payload = evt.payload else { continue }`
`898`		`-switch evt.event {`
`899`		`-case "voicewake.changed":`
`900`		`-struct Payload: Decodable { var triggers: [String] }`
`901`		`-guard let decoded = try? GatewayPayloadDecoding.decode(payload, as: Payload.self) else { continue }`
`902`		`-let triggers = VoiceWakePreferences.sanitizeTriggerWords(decoded.triggers)`
`903`		`-VoiceWakePreferences.saveTriggerWords(triggers)`
`904`		`-case "talk.mode":`
`905`		`-struct Payload: Decodable {`
`906`		`-var enabled: Bool`
`907`		`-var phase: String?`
`908`		`-}`
`909`		`-guard let decoded = try? GatewayPayloadDecoding.decode(payload, as: Payload.self) else { continue }`
`910`		`-self.applyTalkModeSync(enabled: decoded.enabled, phase: decoded.phase)`
`911`		`-default:`
`912`		`-continue`
`913`		`-}`
	`902`	`+await self.handleOperatorGatewayServerEvent(evt)`
`914`	`903`	`}`
`915`	`904`	`}`
`916`	`905`	`}`
`917`	`906`
	`907`	`+private func handleOperatorGatewayServerEvent(_ evt: EventFrame) async {`
	`908`	`+guard let payload = evt.payload else { return }`
	`909`	`+switch evt.event {`
	`910`	`+case "voicewake.changed":`
	`911`	`+struct Payload: Decodable { var triggers: [String] }`
	`912`	`+guard let decoded = try? GatewayPayloadDecoding.decode(payload, as: Payload.self) else { return }`
	`913`	`+let triggers = VoiceWakePreferences.sanitizeTriggerWords(decoded.triggers)`
	`914`	`+VoiceWakePreferences.saveTriggerWords(triggers)`
	`915`	`+case "talk.mode":`
	`916`	`+struct Payload: Decodable {`
	`917`	`+var enabled: Bool`
	`918`	`+var phase: String?`
	`919`	`+}`
	`920`	`+guard let decoded = try? GatewayPayloadDecoding.decode(payload, as: Payload.self) else { return }`
	`921`	`+self.applyTalkModeSync(enabled: decoded.enabled, phase: decoded.phase)`
	`922`	`+case ExecApprovalNotificationBridge.requestedKind:`
	`923`	`+guard let approvalId = Self.execApprovalEventID(from: payload) else { return }`
	`924`	`+await self.presentExecApprovalNotificationPrompt(`
	`925`	`+ExecApprovalNotificationPrompt(approvalId: approvalId))`
	`926`	`+case ExecApprovalNotificationBridge.resolvedKind:`
	`927`	`+guard let approvalId = Self.execApprovalEventID(from: payload) else { return }`
	`928`	`+await self.handleExecApprovalResolvedRemotePush(approvalId: approvalId)`
	`929`	`+default:`
	`930`	`+return`
	`931`	`+}`
	`932`	`+}`
	`933`	`+`
	`934`	`+private nonisolated static func execApprovalEventID(from payload: AnyCodable) -> String? {`
	`935`	`+guard let decoded = try? GatewayPayloadDecoding.decode(`
	`936`	`+ payload,`
	`937`	`+ as: ExecApprovalGatewayEventPayload.self)`
	`938`	`+else {`
	`939`	`+return nil`
	`940`	`+}`
	`941`	`+let approvalId = decoded.id.trimmingCharacters(in: .whitespacesAndNewlines)`
	`942`	`+return approvalId.isEmpty ? nil : approvalId`
	`943`	`+}`
	`944`	`+`
`918`	`945`	`private func applyTalkModeSync(enabled: Bool, phase: String?) {`
`919`	`946`	`_ = phase`
`920`	`947`	`guard self.talkMode.isEnabled != enabled else { return }`
`@@ -5139,6 +5166,14 @@ extension NodeAppModel {`
`5139`	`5166`	`isBackgrounded: isBackgrounded)`
`5140`	`5167`	`}`
`5141`	`5168`
	`5169`	`+nonisolated static func _test_execApprovalEventID(from payload: AnyCodable) -> String? {`
	`5170`	`+self.execApprovalEventID(from: payload)`
	`5171`	`+}`
	`5172`	`+`
	`5173`	`+func _test_handleOperatorGatewayServerEvent(_ event: EventFrame) async {`
	`5174`	`+await self.handleOperatorGatewayServerEvent(event)`
	`5175`	`+}`
	`5176`	`+`
`5142`	`5177`	`nonisolated static func _test_watchExecApprovalIDsNeedingFetch(`
`5143`	`5178`	`candidateIDs: [String],`
`5144`	`5179`	`cachedApprovalIDs: [String]) -> [String]`

Original file line number	Diff line number	Diff line change
`@@ -1160,6 +1160,35 @@ private final class MockBootstrapNotificationCenter: NotificationCentering, @unc`
`1160`	`1160`	`isBackgrounded: false))`
`1161`	`1161`	`}`
`1162`	`1162`
	`1163`	`+@Test func execApprovalEventIDDecodesGatewayPayload() {`
	`1164`	`+ #expect(NodeAppModel._test_execApprovalEventID(from: AnyCodable(["id": " approval-1 "])) == "approval-1")`
	`1165`	`+ #expect(NodeAppModel._test_execApprovalEventID(from: AnyCodable(["id": " "])) == nil)`
	`1166`	`+ #expect(NodeAppModel._test_execApprovalEventID(from: AnyCodable(["other": "approval-1"])) == nil)`
	`1167`	`+}`
	`1168`	`+`
	`1169`	`+@Test @MainActor func operatorGatewayResolvedEventClearsPendingApprovalPrompt() async throws {`
	`1170`	`+let appModel = NodeAppModel()`
	`1171`	`+try appModel._test_presentExecApprovalPrompt(`
	`1172`	`+ #require(`
	`1173`	`+NodeAppModel._test_makeExecApprovalPrompt(`
	`1174`	`+ id: "approval-event-resolved",`
	`1175`	`+ commandText: "echo clear",`
	`1176`	`+ allowedDecisions: ["allow-once", "deny"],`
	`1177`	`+ host: "gateway",`
	`1178`	`+ nodeId: nil,`
	`1179`	`+ agentId: nil,`
	`1180`	`+ expiresAtMs: Int(Date().timeIntervalSince1970 * 1000) + 60000)))`
	`1181`	`+`
	`1182`	`+await appModel._test_handleOperatorGatewayServerEvent(EventFrame(`
	`1183`	`+ type: "event",`
	`1184`	`+ event: ExecApprovalNotificationBridge.resolvedKind,`
	`1185`	`+ payload: AnyCodable(["id": "approval-event-resolved"]),`
	`1186`	`+ seq: nil,`
	`1187`	`+ stateversion: nil))`
	`1188`	`+`
	`1189`	`+ #expect(appModel._test_pendingExecApprovalPrompt() == nil)`
	`1190`	`+}`
	`1191`	`+`
`1163`	`1192`	`@Test func watchExecApprovalHydrateFetchesOnlyMissingIDs() {`
`1164`	`1193`	`let idsToFetch = NodeAppModel._test_watchExecApprovalIDsNeedingFetch(`
`1165`	`1194`	`candidateIDs: ["cached", "pending", "cached", "other", "", " pending "],`

Original file line number	Diff line number	Diff line change
`@@ -961,6 +961,26 @@ describe("Codex app-server dynamic tool build", () => {`
`961`	`961`	`});`
`962`	`962`	`});`
`963`	`963`
	`964`	`+it("passes the approval reviewer device into Codex dynamic tools", async () => {`
	`965`	`+const sessionFile = path.join(tempDir, "session.jsonl");`
	`966`	`+const workspaceDir = path.join(tempDir, "workspace");`
	`967`	`+const params = createParams(sessionFile, workspaceDir);`
	`968`	`+params.disableTools = false;`
	`969`	`+params.approvalReviewerDeviceId = "device-ios-reviewer";`
	`970`	`+params.runtimePlan = createCodexRuntimePlanFixture();`
	`971`	`+const factoryOptions: unknown[] = [];`
	`972`	`+setOpenClawCodingToolsFactoryForTests((options) => {`
	`973`	`+factoryOptions.push(options);`
	`974`	`+return [];`
	`975`	`+});`
	`976`	`+`
	`977`	`+await buildDynamicToolsForTest(params, workspaceDir, { sandbox: null as never });`
	`978`	`+`
	`979`	`+expect(factoryOptions[0]).toMatchObject({`
	`980`	`+approvalReviewerDeviceId: "device-ios-reviewer",`
	`981`	`+});`
	`982`	`+});`
	`983`	`+`
`964`	`984`	`it("forwards tool outcome ordering into Codex dynamic tools", async () => {`
`965`	`985`	`const sessionFile = path.join(tempDir, "session.jsonl");`
`966`	`986`	`const workspaceDir = path.join(tempDir, "workspace");`

Original file line number	Diff line number	Diff line change
`@@ -19,10 +19,7 @@ import {`
`19`	`19`	`} from "openclaw/plugin-sdk/agent-harness-runtime";`
`20`	`20`	`import { resolveAgentDir } from "openclaw/plugin-sdk/agent-runtime";`
`21`	`21`	`import { isToolAllowed } from "openclaw/plugin-sdk/sandbox";`
`22`		`-import {`
`23`		`-readCodexPluginConfig,`
`24`		`-type CodexPluginConfig,`
`25`		`-} from "./config.js";`
	`22`	`+import { readCodexPluginConfig, type CodexPluginConfig } from "./config.js";`
`26`	`23`	`import {`
`27`	`24`	`filterCodexDynamicTools,`
`28`	`25`	`isForcedPrivateQaCodexRuntime,`
`@@ -260,6 +257,7 @@ export async function buildDynamicTools(input: DynamicToolBuildParams) {`
`260`	`257`	`...sessionKeys,`
`261`	`258`	`sessionId: params.sessionId,`
`262`	`259`	`runId: params.runId,`
	`260`	`+approvalReviewerDeviceId: params.approvalReviewerDeviceId,`
`263`	`261`	`agentDir,`
`264`	`262`	`cwd: input.effectiveCwd ?? input.effectiveWorkspace,`
`265`	`263`	`workspaceDir: input.effectiveWorkspace,`
`@@ -593,9 +591,10 @@ export function resolveCodexAppServerExecutionCwd(params: {`
`593`	`591`	`nativeToolSurfaceEnabled: boolean;`
`594`	`592`	`remoteWorkspaceRoot?: string;`
`595`	`593`	`}): string {`
`596`		`-const cwd = params.environment && params.nativeToolSurfaceEnabled`
`597`		`- ? params.environment.cwd`
`598`		`- : params.effectiveCwd;`
	`594`	`+const cwd =`
	`595`	`+params.environment && params.nativeToolSurfaceEnabled`
	`596`	`+ ? params.environment.cwd`
	`597`	`+ : params.effectiveCwd;`
`599`	`598`	`return mapCodexAppServerRemoteWorkspacePath({`
`600`	`599`	`value: cwd,`
`601`	`600`	`localWorkspaceRoot: params.localWorkspaceRoot,`

Original file line number	Diff line number	Diff line change
`@@ -182,6 +182,12 @@ export const ExecApprovalRequestParamsSchema = Type.Object(`
`182`	`182`	`turnSourceTo: Type.Optional(Type.Union([Type.String(), Type.Null()])),`
`183`	`183`	`turnSourceAccountId: Type.Optional(Type.Union([Type.String(), Type.Null()])),`
`184`	`184`	`turnSourceThreadId: Type.Optional(Type.Union([Type.String(), Type.Number(), Type.Null()])),`
	`185`	`+approvalReviewerDeviceIds: Type.Optional(`
	`186`	`+Type.Array(NonEmptyString, {`
	`187`	`+description:`
	`188`	`+"Trusted approval-runtime metadata naming operator devices that may review this approval; ordinary Gateway clients may send the field, but the Gateway only binds it for internal approval-runtime requests.",`
	`189`	`+}),`
	`190`	`+),`
`185`	`191`	`requireDeliveryRoute: Type.Optional(Type.Boolean()),`
`186`	`192`	`suppressDelivery: Type.Optional(Type.Boolean()),`
`187`	`193`	`timeoutMs: Type.Optional(Type.Integer({ minimum: 1 })),`

Original file line number	Diff line number	Diff line change
`@@ -452,6 +452,8 @@ export function createOpenClawCodingTools(options?: {`
`452`	`452`	`oneShotCliRun?: boolean;`
`453`	`453`	`/** Stable run identifier for this agent invocation. */`
`454`	`454`	`runId?: string;`
	`455`	`+/** Device-scoped operator session allowed to review approvals initiated by this run. */`
	`456`	`+approvalReviewerDeviceId?: string;`
`455`	`457`	`/** Diagnostic trace context for hook/log correlation during this run. */`
`456`	`458`	`trace?: DiagnosticTraceContext;`
`457`	`459`	`/** What initiated this run (for trigger-specific tool restrictions). */`
`@@ -869,6 +871,7 @@ export function createOpenClawCodingTools(options?: {`
`869`	`871`	`currentChannelId: options?.currentChannelId,`
`870`	`872`	`currentThreadTs: options?.currentThreadTs,`
`871`	`873`	`accountId: options?.agentAccountId,`
	`874`	`+approvalReviewerDeviceId: options?.approvalReviewerDeviceId,`
`872`	`875`	`backgroundMs: options?.exec?.backgroundMs ?? execConfig.backgroundMs,`
`873`	`876`	`timeoutSec: options?.exec?.timeoutSec ?? execConfig.timeoutSec,`
`874`	`877`	`approvalRunningNoticeMs:`

Original file line number	Diff line number	Diff line change
`@@ -58,6 +58,7 @@ function restoreProcessPlatformForTest(): void {`
`58`	`58`	`}`
`59`	`59`
`60`	`60`	`type ApprovalRequestPayload = {`
	`61`	`+approvalReviewerDeviceIds?: string[];`
`61`	`62`	`commandSpans?: Array<{ startIndex: number; endIndex: number }>;`
`62`	`63`	`};`
`63`	`64`
`@@ -159,6 +160,23 @@ describe("exec approval requests", () => {`
`159`	`160`	`]);`
`160`	`161`	`});`
`161`	`162`
	`163`	`+it("passes approval reviewer devices into host approval registration payloads", async () => {`
	`164`	`+vi.mocked(callGatewayTool).mockResolvedValue({ id: "approval-id", expiresAtMs: 1234 });`
	`165`	`+`
	`166`	`+await registerExecApprovalRequestForHost({`
	`167`	`+approvalId: "approval-id",`
	`168`	`+command: "echo hi",`
	`169`	`+approvalReviewerDeviceIds: ["device-ios-reviewer"],`
	`170`	`+workdir: "/tmp/project",`
	`171`	`+host: "node",`
	`172`	`+security: "allowlist",`
	`173`	`+ask: "always",`
	`174`	`+});`
	`175`	`+`
	`176`	`+const payload = requireApprovalRequestPayload(0);`
	`177`	`+expect(payload?.approvalReviewerDeviceIds).toEqual(["device-ios-reviewer"]);`
	`178`	`+});`
	`179`	`+`
`162`	`180`	`it("does not generate command spans by default", async () => {`
`163`	`181`	`vi.mocked(callGatewayTool).mockResolvedValue({ id: "approval-id", expiresAtMs: 1234 });`
`164`	`182`

Original file line number	Diff line number	Diff line change
`@@ -64,6 +64,7 @@ type RequestExecApprovalDecisionParams = {`
`64`	`64`	`turnSourceTo?: string;`
`65`	`65`	`turnSourceAccountId?: string;`
`66`	`66`	`turnSourceThreadId?: string \| number;`
	`67`	`+approvalReviewerDeviceIds?: string[];`
`67`	`68`	`requireDeliveryRoute?: boolean;`
`68`	`69`	`suppressDelivery?: boolean;`
`69`	`70`	`};`
`@@ -99,6 +100,7 @@ function buildExecApprovalRequestToolParams(`
`99`	`100`	`turnSourceTo: params.turnSourceTo,`
`100`	`101`	`turnSourceAccountId: params.turnSourceAccountId,`
`101`	`102`	`turnSourceThreadId: params.turnSourceThreadId,`
	`103`	`+approvalReviewerDeviceIds: params.approvalReviewerDeviceIds,`
`102`	`104`	`requireDeliveryRoute: params.requireDeliveryRoute,`
`103`	`105`	`suppressDelivery: params.suppressDelivery,`
`104`	`106`	`timeoutMs: DEFAULT_APPROVAL_TIMEOUT_MS,`
`@@ -205,6 +207,7 @@ type HostExecApprovalParams = {`
`205`	`207`	`turnSourceTo?: string;`
`206`	`208`	`turnSourceAccountId?: string;`
`207`	`209`	`turnSourceThreadId?: string \| number;`
	`210`	`+approvalReviewerDeviceIds?: string[];`
`208`	`211`	`requireDeliveryRoute?: boolean;`
`209`	`212`	`suppressDelivery?: boolean;`
`210`	`213`	`};`
`@@ -313,6 +316,7 @@ async function buildHostApprovalDecisionParams(`
`313`	`316`	`resolvedPath: params.resolvedPath,`
`314`	`317`	`requireDeliveryRoute: params.requireDeliveryRoute,`
`315`	`318`	`suppressDelivery: params.suppressDelivery,`
	`319`	`+approvalReviewerDeviceIds: params.approvalReviewerDeviceIds,`
`316`	`320`	`...buildExecApprovalTurnSourceContext(params),`
`317`	`321`	`};`
`318`	`322`	`}`

Original file line number	Diff line number	Diff line change
`@@ -95,6 +95,7 @@ type ProcessGatewayAllowlistParams = {`
`95`	`95`	`/** Session-store template, so the direct/denied followup can detect a rebind. */`
`96`	`96`	`sessionStore?: string;`
`97`	`97`	`bashElevated?: ExecElevatedDefaults;`
	`98`	`+approvalReviewerDeviceId?: string;`
`98`	`99`	`turnSourceChannel?: string;`
`99`	`100`	`turnSourceTo?: string;`
`100`	`101`	`turnSourceAccountId?: string;`
`@@ -695,6 +696,9 @@ export async function processGatewayAllowlist(`
`695`	`696`	`agentId: params.agentId,`
`696`	`697`	`sessionKey: params.sessionKey,`
`697`	`698`	`}),`
	`699`	`+approvalReviewerDeviceIds: params.approvalReviewerDeviceId`
	`700`	`+ ? [params.approvalReviewerDeviceId]`
	`701`	`+ : undefined,`
`698`	`702`	`resolvedPath: resolveApprovalAuditTrustPath(`
`699`	`703`	`allowlistEval.segments[0]?.resolution ?? null,`
`700`	`704`	`params.workdir,`

Original file line number	Diff line number	Diff line change
`@@ -178,6 +178,9 @@ export async function executeNodeHostCommand(`
`178`	`178`	`agentId: prepared.agentId,`
`179`	`179`	`sessionKey: prepared.sessionKey,`
`180`	`180`	`}),`
	`181`	`+approvalReviewerDeviceIds: params.approvalReviewerDeviceId`
	`182`	`+ ? [params.approvalReviewerDeviceId]`
	`183`	`+ : undefined,`
`181`	`184`	`...(options.requireDeliveryRoute !== undefined`
`182`	`185`	`? { requireDeliveryRoute: options.requireDeliveryRoute }`
`183`	`186`	`: {}),`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main

File tree