fix(cli): authorize gateway model probe overrides · openclaw/openclaw@3b593bc
steipete
·
2026-04-29
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -46,6 +46,7 @@ Docs: https://docs.openclaw.ai
|
46 | 46 | - Chat commands: include configured model-catalog reasoning metadata when building `/think` argument menus so Ollama Cloud and other provider-owned reasoning models show supported levels instead of only `off`. Fixes #73515; supersedes #73568. Thanks @danielzinhu99 and @neeravmakwana. |
47 | 47 | - Channels/Telegram: suppress generic tool-progress chatter when preview streaming is off, so non-streaming Telegram turns only deliver final replies while approvals, media, and errors still route normally. Refs #72363 and #72482. Thanks @neeravmakwana and @SweetSophia. |
48 | 48 | - CLI/model probes: add repeatable image `--file` inputs to `infer model run` for local and gateway multimodal model smokes, so vision models such as Ollama Qwen VL and Gemini can be tested through the raw model-probe surface. Fixes #63700. Thanks @cedricjanssens. |
| 49 | +- CLI/model probes: request trusted operator scope for `infer model run --gateway --model <provider/model>` so Gateway raw model smokes can use one-off provider/model overrides instead of being rejected before provider auth resolution. Fixes #73759. Thanks @chrislro. |
49 | 50 | - CLI/image describe: pass `--prompt` and `--timeout-ms` through `infer image describe` and `describe-many`, so custom vision instructions and slow local model budgets reach media-understanding providers such as Ollama, OpenAI, Google, and OpenRouter. Refs #63700. Thanks @cedricjanssens. |
50 | 51 | - WhatsApp/Web: pass explicit Baileys socket timings into every WhatsApp Web socket and expose `web.whatsapp.*` keepalive, connect, and query timeout settings so unstable networks can avoid repeated 408 disconnect and opening-handshake timeout loops. Fixes #56365. (#73580) Thanks @velvet-shark. |
51 | 52 | - Channels/Telegram: persist native command metadata on target sessions so topic, helper, and ACP-bound slash commands keep their session metadata attached to the routed conversation. (#57548) Thanks @GaosCode. |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -135,6 +135,7 @@ This table maps common inference tasks to the corresponding infer command.
|
135 | 135 | - `model run --file` accepts image files, detects their MIME type, and sends them with the supplied prompt to the selected model. Repeat `--file` for multiple images. |
136 | 136 | - `model run --file` rejects non-image inputs. Use `infer audio transcribe` for audio files and `infer video describe` for video files. |
137 | 137 | - `model run --gateway` exercises Gateway routing, saved auth, provider selection, and the embedded runtime, but still runs as a raw model probe: it sends the supplied prompt and any image attachments without prior session transcript, bootstrap/AGENTS context, context-engine assembly, tools, or bundled MCP servers. |
| 138 | +- `model run --gateway --model <provider/model>` requires a trusted operator gateway credential because the request asks the Gateway to run a one-off provider/model override. |
138 | 139 | |
139 | 140 | ## Model |
140 | 141 | |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -589,6 +589,38 @@ describe("capability cli", () => {
|
589 | 589 | ); |
590 | 590 | }); |
591 | 591 | |
| 592 | +it("requests admin scope for gateway model probes with provider/model overrides", async () => { |
| 593 | +await runRegisteredCli({ |
| 594 | +register: registerCapabilityCli as (program: Command) => void, |
| 595 | +argv: [ |
| 596 | +"capability", |
| 597 | +"model", |
| 598 | +"run", |
| 599 | +"--prompt", |
| 600 | +"hello", |
| 601 | +"--gateway", |
| 602 | +"--model", |
| 603 | +"anthropic/claude-haiku-4-5", |
| 604 | +"--json", |
| 605 | +], |
| 606 | +}); |
| 607 | + |
| 608 | +expect(mocks.callGateway).toHaveBeenCalledWith( |
| 609 | +expect.objectContaining({ |
| 610 | +clientName: "gateway-client", |
| 611 | +method: "agent", |
| 612 | +mode: "backend", |
| 613 | +scopes: ["operator.admin"], |
| 614 | +params: expect.objectContaining({ |
| 615 | +provider: "anthropic", |
| 616 | +model: "claude-haiku-4-5", |
| 617 | +modelRun: true, |
| 618 | +promptMode: "none", |
| 619 | +}), |
| 620 | +}), |
| 621 | +); |
| 622 | +}); |
| 623 | + |
592 | 624 | it("rejects empty model run prompts before gateway dispatch", async () => { |
593 | 625 | await expect( |
594 | 626 | runRegisteredCli({ |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -22,6 +22,7 @@ import type { OpenClawConfig } from "../config/types.openclaw.js";
|
22 | 22 | import { callGateway, randomIdempotencyKey } from "../gateway/call.js"; |
23 | 23 | import { buildGatewayConnectionDetailsWithResolvers } from "../gateway/connection-details.js"; |
24 | 24 | import { isLoopbackHost } from "../gateway/net.js"; |
| 25 | +import { ADMIN_SCOPE } from "../gateway/operator-scopes.js"; |
25 | 26 | import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../gateway/protocol/client-info.js"; |
26 | 27 | import { generateImage, listRuntimeImageGenerationProviders } from "../image-generation/runtime.js"; |
27 | 28 | import type { |
@@ -702,6 +703,9 @@ async function runModelRun(params: {
|
702 | 703 | } |
703 | 704 | |
704 | 705 | const { provider, model } = resolveModelRefOverride(params.model); |
| 706 | +// Provider/model overrides require trusted-operator scope. Use the backend |
| 707 | +// shared-secret lane so local gateway smokes do not depend on paired CLI device scopes. |
| 708 | +const hasModelOverride = Boolean(provider || model); |
705 | 709 | const response: { |
706 | 710 | result?: { |
707 | 711 | payloads?: Array<{ text?: string; mediaUrl?: string | null; mediaUrls?: string[] }>; |
@@ -730,8 +734,9 @@ async function runModelRun(params: {
|
730 | 734 | }, |
731 | 735 | expectFinal: true, |
732 | 736 | timeoutMs: 120_000, |
733 | | -clientName: GATEWAY_CLIENT_NAMES.CLI, |
734 | | -mode: GATEWAY_CLIENT_MODES.CLI, |
| 737 | +clientName: hasModelOverride ? GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT : GATEWAY_CLIENT_NAMES.CLI, |
| 738 | +mode: hasModelOverride ? GATEWAY_CLIENT_MODES.BACKEND : GATEWAY_CLIENT_MODES.CLI, |
| 739 | + ...(hasModelOverride ? { scopes: [ADMIN_SCOPE] } : {}), |
735 | 740 | }); |
736 | 741 | return { |
737 | 742 | ok: true, |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。