fix(sandbox): keep gateway daemon self-dialback on loopback by stefanopalmieri · Pull Request #7230 · NVIDIA/NemoClaw

stefanopalmieri · 2026-07-20T09:09:10Z

Summary

OpenClaw 2026.7.1 gateway daemon self-dialback now uses loopback inside OpenShell without removing OPENCLAW_GATEWAY_URL from the daemon environment. Descendant agent processes retain the private sandbox interface route required by OpenShell network policy.

The compatibility patch applies only when process.title === "openclaw-gateway" and OPENSHELL_SANDBOX === "1". Explicit URL overrides, local port overrides, configured remote URLs, pairing, and behavior outside that condition remain unchanged.

Related Issue

Fixes #7215

Changes

Add scripts/openclaw/patch-gateway-daemon-dialback.mts for the OpenClaw 2026.7.1 compiled distribution.
Apply the patch only for OpenClaw 2026.7.1 and include it in the optimized sandbox build context and final-image metadata checks.
Require one recognized compiled shape for each of the three resolvers and validate all targets before writing any file.
Cover gateway daemon self-dialback, descendant routing, explicit URLs, local ports, environment URL exclusion, configured remote URLs, version gating, idempotence, shape drift, audit mode, and the integrity-pinned OpenClaw archive.
Wait for the OpenClaw TUI readiness signal before the live E2E harness sends its first prompt.
Document the version boundary, routing behavior, validation, and removal condition in docs/security/openclaw-2026.7.1-dependency-review.md.
Preserve the contributor branch history and refresh it onto base commit 1608281462923ff8282151c7be1a109ee262b4e9.

Type of Change

Code change (feature, bug fix, or refactor)
Code change with doc updates
Doc only (prose changes, no code sample modifications)
Doc only (includes code sample changes)

Quality Gates

Tests added or updated for changed behavior
Existing tests cover changed behavior — justification:
Tests not applicable — justification:
Docs updated for user-facing behavior changes
Docs not applicable — justification:
Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Exact-head nine-category security review passed with no findings for 9dde9e6ce194abc9c850f57cb2c14bb3460bb04b against base b148bc13ee53b7a1f612d07e42275ec732e71877: fix(sandbox): keep gateway daemon self-dialback on loopback #7230 (review)
Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: No waiver. GitHub Actions and protected E2E are required for exact head cada68e35fffaa12dd132d8b598cda3b26bd07fe.

Documentation Writer Review

Documentation writer subagent reviewed the completed changes
Result: docs-updated
Evidence: Reviewed the complete 12-file diff at head cada68e35fffaa12dd132d8b598cda3b26bd07fe against base 1608281462923ff8282151c7be1a109ee262b4e9. The dependency review accurately records the exact OpenClaw version/shape boundary, daemon-only loopback behavior, preserved descendant routing, fail-closed validation, regression scope, and removal condition. The signed refresh preserves the effective patch (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). The latest base increment adds only the v0.0.103 release-note page. The current base host-local vLLM paths and Hermes health-streak reset do not alter this OpenClaw gateway boundary; no further docs, changelog, navigation, or routing change is required.
Agent: Codex Desktop

DGX Station Hardware Evidence

Tested on DGX Station
Tested commit: Not applicable; scripts/prepare-dgx-station-host.sh is unchanged.
Station profile/scenario: Not applicable.
Result: Not applicable.
Supporting evidence: Not applicable.

Verification

PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub — all 65 commits appear as Verified.
Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: E2E-support readiness tests passed 2/2; related integration tests passed 33 with 1 intentional skip.
Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: exact-head GitHub Actions and protected E2E are running.
Quality Gates section completed with required justifications or waivers
No secrets, API keys, or credentials committed
npm run docs builds without warnings (doc changes only) — exact-head build passed with zero errors and two existing Fern warnings.
Doc pages follow the style guide (doc changes only) — documentation-writer review: PASS.
New doc pages include SPDX header and frontmatter (new pages only)

Sensitive-path Security Review

Secrets and credentials: PASS — no secret source, credential storage, or credential logging changes.
Input validation and injection: PASS — the patch requires one recognized compiled shape per target and stops before writing when any target is missing, duplicated, or changed.
Authentication and authorization: PASS — shared-token authentication and pairing remain unchanged; only gateway daemon self-dialback selects loopback.
Dependencies: PASS — no dependency, lockfile, registry, integrity pin, or image provenance changed.
Error handling and logging: PASS — apply and audit failures report only diagnostic paths and counts; the readiness wait is bounded.
Cryptography and data protection: PASS — no cryptographic or sensitive-data behavior changed.
Configuration and security controls: PASS — descendant private sandbox interface routing remains; no network policy, port, permission, user, capability, or header is broadened.
Security testing: PASS — coverage includes the daemon/descendant boundary, explicit routes, version and shape gates, transactional writes, audit mode, image contracts, the pinned distribution, and prompt-after-readiness behavior.
System security: PASS — the change narrows only gateway daemon self-dialback to loopback and preserves OpenShell network enforcement for descendant agents.

Exact-head local evidence: 62/62 commits are GitHub Verified; exact-head pre-push hooks, npm run docs, and git diff --check passed. Fresh CI and protected E2E remain required before merge.

Signed-off-by: Stefano Palmieri stefano.r.palmieri@gmail.com

…way URL The exported private veth OPENCLAW_GATEWAY_URL makes the gateway daemon's own embedded clients — the agent tool bridge and anything the daemon spawns — dial back through the OpenShell transparent proxy. The gateway then sees a private-IP origin, and its pairing locality check demands device approval that in-sandbox clients can never satisfy (a fresh device identity is minted per run), so channel tools fail on the warm daemon path with "pairing required" and every attempt enqueues an unapprovable gateway-client pairing request (NVIDIA#4616 symptom family). Launch the gateway with `env -u OPENCLAW_GATEWAY_URL` at all three launch/respawn sites, extending the loopback resolution the connect-shell wrappers already force (NVIDIA#6413/NVIDIA#6645): with no URL in the environment, OpenClaw resolves ws://127.0.0.1:<port> from its own config, keeps shared-token auth, and omits the per-run device identity entirely, so dial-backs stop minting pairing records altogether. Verified live on a Jetson Orin appliance (OpenClaw 2026.6.10, pristine dist): channel tools work over tools/invoke, a full /v1/chat/completions agent turn posts to Discord in ~6.5s, `openclaw agent --local` is unaffected, and the pending pairing list stays empty. OPENCLAW_ALLOW_INSECURE_PRIVATE_WS stays exported for other private-ws consumers inside the daemon. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Stefano Palmieri <stefano.r.palmieri@gmail.com>

copy-pr-bot · 2026-07-20T09:09:13Z

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

coderabbitai · 2026-07-20T09:09:41Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
✅ Review completed - (🔄 Check again to review again)

📝 Walkthrough

Walkthrough

The PR adds a version-scoped script that rewrites three OpenClaw gateway daemon dialback paths, validates the rewrites, tests their behavior, and integrates execution into Docker image construction.

Changes

Gateway dialback patch integration

Layer / File(s)	Summary
Dialback patch specifications `scripts/patch-openclaw-gateway-daemon-dialback.mts`	Defines markers, patch metadata, and OpenShell-gated replacements for gateway call context, connection details, and agent-tool targets.
Distribution patching and CLI `scripts/patch-openclaw-gateway-daemon-dialback.mts`	Scans JavaScript files, validates unique upstream or patched matches, applies or audits rewrites, and reports status through the CLI.
Docker packaging and execution `Dockerfile`, `test/openclaw-final-image-layout.test.ts`	Copies and executes the patch script, grants it executable permissions, verifies its metadata, and updates payload layout expectations.
Behavior and patch-contract tests `test/openclaw-gateway-daemon-dialback-patch.test.ts`	Tests loopback selection, explicit URL handling, idempotency, fail-closed matching, and CLI output.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Dockerfile
  participant PatchScript
  participant OpenClawDist
  Dockerfile->>PatchScript: Run patch script against dist
  PatchScript->>OpenClawDist: Scan compiled JavaScript files
  OpenClawDist-->>PatchScript: Return matching gateway code
  PatchScript->>OpenClawDist: Apply validated rewrites
  PatchScript-->>Dockerfile: Return patch status

Possibly related PRs

NVIDIA/NemoClaw#7486: Updates related Dockerfile payload and final-image metadata verification contracts.

Suggested labels: integration: openclaw, area: security, v0.0.95

Suggested reviewers: apurvvkumaria

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: keeping gateway daemon self-dialback on loopback within the sandbox.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-20T09:12:38Z

PR Review Advisor — Informational

Advisor assessment: Informational / low confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: Partial review preserved 0 canonical finding(s) and 2 terminology decision(s) before the advisor stopped.

Model lanes

GPT-5.6 Terra (primary): Failed after a partial review · low confidence · 0 blockers · 0 warnings · 0 suggestions
Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

justified — gateway daemon self-dialback at scripts/openclaw/patch-gateway-daemon-dialback.mts:18: Retain this term for the daemon-only routing case.
justified — private sandbox interface at Dockerfile:989: Retain this modifier where distinguishing descendant routing from daemon loopback routing.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, managed-image-multiarch-startup, security-posture, onboard-repair, onboard-resume

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/nemoclaw-start-gateway-launch-env.test.ts`:
- Around line 131-134: The respawn test’s assertions after reading envDumpPath
do not verify retention of OPENCLAW_ALLOW_INSECURE_PRIVATE_WS. Extend the test
alongside the existing OPENCLAW_GATEWAY_TOKEN assertion to require that
variable’s expected retained value, while preserving the current gateway URL
exclusion check.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: dee38742-3a5d-4adb-8aa5-941eea0b0c33

📥 Commits

Reviewing files that changed from the base of the PR and between 3c4ea5a and f275144.

📒 Files selected for processing (2)

scripts/nemoclaw-start.sh
test/nemoclaw-start-gateway-launch-env.test.ts

Extend the crash-respawn test to require OPENCLAW_ALLOW_INSECURE_PRIVATE_WS survives the launch, matching the two initial-launch tests. Only the gateway URL is scrubbed at respawn; the private-ws contract is retained. Addresses CodeRabbit review feedback on NVIDIA#7230. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Stefano Palmieri <stefano.r.palmieri@gmail.com>

wscurran · 2026-07-20T16:42:56Z

✨ Thanks for the fix. This resolves the gateway pairing failure for channel tools on the warm daemon path by avoiding the private veth URL that triggers the OpenShell transparent proxy locality check. Ready for maintainer review.

Related open issues:

#7215 Sandbox gateway dial-back with valid shared token rejected as "pairing required" — OpenShell transparent proxy erases loopback locality, blocking channel tools on the warm daemon path

Related open PRs:

#6645 fix(whatsapp): pair login over the loopback gateway and preserve npm plugin provenance

Related open issues:

Merge current main and replace daemon-wide gateway URL removal with a process-local OpenClaw patch. Keep descendant agent routing on the private interface while gateway backend RPC uses loopback. Repair the real-dist harness path for the checked-in semantic-version extractor. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

prekshivyas · 2026-07-25T10:29:58Z

Security review for 58c1a2264272ae21cfc6eb15efed8d54053aac7b: PASS

Secrets and credentials: PASS — no secret material added or logged; the gateway token flow is unchanged.
Input handling: PASS — the build-time patch accepts only an internal dist directory and fails closed unless each reviewed OpenClaw shape appears exactly once.
Authentication and authorization: PASS — explicit URL overrides and configured remote mode remain authoritative. Only the OpenShell gateway process (process.title === "openclaw-gateway") ignores its inherited interface URL for self-RPC.
Dependencies and supply chain: PASS — no dependency changes; the patch is verified against the integrity-pinned OpenClaw 2026.7.1 tarball.
Logging and observability: PASS — no sensitive values are emitted.
Cryptography: PASS — no cryptographic behavior changes.
Configuration and defaults: PASS — no user-facing configuration or default changes.
Test security: PASS — tests cover daemon loopback, descendant private-interface routing, explicit URLs, non-OpenShell behavior, fail-closed drift detection, idempotence, optimized build staging, and the real pinned dist.
System-level security: PASS — the change preserves OpenShell's loopback denial for descendant agent processes and avoids widening OpenClaw's locality or device-pairing trust rules.

No security waiver or risk acceptance is required.

Reuse the shared environment helper so the focused dial-back tests stay linear. This keeps the test file within the growth guard. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Around line 870-881: Gate the RUN invoking
patch-openclaw-gateway-daemon-dialback.mts to execute only when OPENCLAW_VERSION
is 2026.7.1. Ensure legacy 2026.3.11 and 2026.4.24 fixture builds skip this
version-scoped patch while preserving the existing command and fail-closed
behavior for 2026.7.1.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2d39f508-881c-459e-9853-db7cc6f5f901

📥 Commits

Reviewing files that changed from the base of the PR and between bd4cef2 and 58c1a22.

📒 Files selected for processing (2)

Dockerfile
scripts/patch-openclaw-gateway-daemon-dialback.mts

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

cv

Blocking compatibility defect at this exact head: the Dockerfile always invokes the fail-closed OpenClaw 2026.7.1 loopback patch, but this repository intentionally builds legacy 2026.3.11 and 2026.4.24 fixtures through the same layer. Those supported test fixtures cannot satisfy the exact-version patch contract. Gate the invocation on OPENCLAW_VERSION=2026.7.1, and add coverage proving both legacy versions skip while the current version applies and audits successfully. The current-main refresh also has one mechanical conflict with merged #7539’s real-dist extractor harness: preserve #7539’s canonical extractor/guard and add only this PR’s dialback apply/audit/target assertions rather than restoring the superseded inline extraction. Fresh exact-head docs/security review and CI/E2E remain required afterward.

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Signed-off-by: Carlos Villela <cvillela@nvidia.com> # Conflicts: # src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts # test/openclaw-real-patched-dist-harness.test.ts

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

cjagwani

Maintainer security review — PASS

Reviewed exact head bdcfb301643ce4e22636340c0b50432437b5d8a5 against base cbabb66bfc985f3474714f95bfbc6ec1992441f9. No security finding blocks the normal repository gates.

Secrets and credentials — PASS. No credential source, token, persistence, or secret logging changes.
Input validation and sanitization — PASS. The OpenClaw patch remains exact-version and exact-shape gated, validates all targets before writing, and fails closed on missing, duplicated, partial, or drifted shapes.
Authentication and authorization — PASS. Shared-token authentication and pairing remain unchanged. Only the OpenShell gateway daemon self-dialback selects loopback; descendant agents and explicit or configured routes retain their established behavior.
Dependencies and supply chain — PASS. No dependency, lockfile, registry, integrity pin, or image provenance change.
Error handling and information exposure — PASS. Apply and audit failures expose only diagnostic paths and counts. The E2E readiness change adds bounded waiting and does not expose runtime data.
Cryptography and data protection — PASS / not applicable. No cryptographic or sensitive-data handling change.
Configuration and infrastructure — PASS. No port, origin, header, permission, user, capability, or network-policy boundary is broadened. OPENCLAW_GATEWAY_URL remains available to descendants.
Security testing — PASS. Existing coverage exercises the daemon/descendant boundary, explicit routes, version and shape gates, transactional writes, audit behavior, build/image contracts, and the pinned distribution. The new regression proves the E2E harness does not send a prompt before the OpenClaw TUI reports readiness.
System security — PASS. The compatibility change narrows only daemon self-dialback to loopback and preserves OpenShell enforcement for descendants. The readiness-only harness delta introduces no new credential, privilege, network, or filesystem behavior.

Exact-head evidence: 54/54 commits are GitHub Verified; focused E2E-support tests passed 2/2; related integration tests passed 33 with 1 intentional skip; npm run build:cli and npm run typecheck:cli passed; npm run docs passed with zero errors and two existing warnings; git diff --check passed. The required documentation-writer review passed with no edits at .agents tree ac7b9bdc521dcba1f2702e7e069b674a8c21f11e. Fresh CI and protected E2E remain required before merge.

cjagwani · 2026-08-05T16:17:41Z

@apurvvkumaria Please review exact head bdcfb301643ce4e22636340c0b50432437b5d8a5 on base cbabb66bfc985f3474714f95bfbc6ec1992441f9. The previously reviewed security patch remains intact; the new signed contributor delta only waits for OpenClaw TUI readiness before sending the first E2E prompt. All 54 commits are GitHub Verified, exact docs/security reviews pass, and the seven-job protected E2E run is active. Branch policy requires approval after the last push.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Security review — exact head 7e452606aaba5affbb5a87d8359fc0bb53d0e808 against base c81f7fc691d62015210c68b38e4c5a9870ee5c0d: PASS with no findings.

Secrets and credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input validation and injection resistance — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at the reviewed launch/respawn sites and does not interpolate caller-controlled commands.
Authentication and authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL, and explicit/configured targets remain unchanged.
Dependencies and supply chain — PASS. No new dependency or external source. The patch is bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed if its expected shapes drift.
Error handling and information exposure — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and data protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and infrastructure — PASS. Only the daemon's self-dialback environment is changed from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and insecure-private-WS handling are otherwise unchanged.
Security testing — PASS. Exact focused suites pass 35 with 1 skipped across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage. npm run check:diff passes; commitlint reports only a pre-existing non-blocking footer-spacing warning in a contributor commit.
System security — PASS. The change prevents daemon-internal clients from being misclassified as remote private-IP peers without disabling pairing or authentication globally. The bounded E2E readiness wait changes test orchestration only.

The signed merge refresh preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). The new base's rebuild diagnostics do not alter this boundary. Fresh CI, protected E2E, and independent post-push approval remain mandatory; no previous failure or result is waived.

cjagwani · 2026-08-05T17:02:07Z

Refreshed onto current main in signed, GitHub-Verified commit 7e452606aaba5affbb5a87d8359fc0bb53d0e808. The effective patch is byte-for-byte unchanged; exact focused tests pass 35 with 1 intentional skip, npm run check:diff passes, and exact documentation and nine-category security reviews pass. This new head/base pair legitimately replaces the prior run whose product behavior passed but provider-selection latency exceeded budget. Fresh CI and protected E2E are required; no prior result is waived. Please review the current head.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Security review — exact head 98764a3253981b5bc15b9e8527cdefcb7c5b32d7 against base 7f429e3588d545398411dd9caae92938eaac1853: PASS with no findings.

Secrets and credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input validation and injection resistance — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at the reviewed launch/respawn sites and does not interpolate caller-controlled commands.
Authentication and authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL, and explicit/configured targets remain unchanged.
Dependencies and supply chain — PASS. No new dependency or external source. The patch is bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed if its expected shapes drift.
Error handling and information exposure — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and data protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and infrastructure — PASS. Only the daemon's self-dialback environment is changed from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and insecure-private-WS handling are otherwise unchanged.
Security testing — PASS. Exact focused suites pass 35 with 1 skipped across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage. npm run check:diff passes; commitlint reports only a pre-existing non-blocking footer-spacing warning in a contributor commit.
System security — PASS. The change prevents daemon-internal clients from being misclassified as remote private-IP peers without disabling pairing or authentication globally. The bounded E2E readiness wait changes test orchestration only.

The signed merge refresh preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). The new base's host-local vLLM serving infrastructure does not alter this gateway boundary. Fresh CI, protected E2E, and independent post-push approval remain mandatory; no previous failure or result is waived.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Security review — exact head d67fc8fd9211632c0562d81a0f26073db6ebc765 against base 6f2cab8aa67bf75337efa7d55330a3bea61c27ee: PASS with no findings.

Secrets and credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input validation and injection resistance — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at the reviewed launch/respawn sites and does not interpolate caller-controlled commands.
Authentication and authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL, and explicit/configured targets remain unchanged.
Dependencies and supply chain — PASS. No new dependency or external source. The patch is bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed if its expected shapes drift.
Error handling and information exposure — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and data protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and infrastructure — PASS. Only the daemon's self-dialback environment is changed from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and insecure-private-WS handling are otherwise unchanged.
Security testing — PASS. Exact focused suites pass 35 with 1 skipped across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage. npm run check:diff passes; commitlint reports only a pre-existing non-blocking footer-spacing warning in a contributor commit.
System security — PASS. The change prevents daemon-internal clients from being misclassified as remote private-IP peers without disabling pairing or authentication globally. The bounded E2E readiness wait changes test orchestration only.

The signed merge refresh preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). The new base's host-local vLLM serving infrastructure and Hermes health-streak reset do not alter this OpenClaw gateway boundary. Fresh CI, protected E2E, and independent post-push approval remain mandatory; no previous failure or result is waived.

cjagwani · 2026-08-05T17:34:51Z

Refreshed onto current main without conflict.

Exact head/base: d67fc8fd9211632c0562d81a0f26073db6ebc765 / 6f2cab8aa67bf75337efa7d55330a3bea61c27ee
Effective 12-file patch unchanged: raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9
Exact-head security review: fix(sandbox): keep gateway daemon self-dialback on loopback #7230 (review)
Documentation-writer review: PASS, no edits; strict docs validation passed
Attribution: all 58 commits are GitHub Verified

Fresh ordinary CI is running. The prior protected-run timing failure is not waived or reused. A first-attempt protected run may be authorized only after the exact risk plan is verified, and an independent approval of this post-push head remains required.

cjagwani

Security review — exact head 52ee1880387081f2d7ca32b4f53dd3cf8411a304 against base 287e4747215dd2407441e3add7a4f4cb46ad13c6: PASS with no findings.

Secrets and credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input validation and injection resistance — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at the reviewed launch/respawn sites and does not interpolate caller-controlled commands.
Authentication and authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL, and explicit/configured targets remain unchanged.
Dependencies and supply chain — PASS. No new dependency or external source. The patch remains bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed if expected shapes drift.
Error handling and information exposure — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and data protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and infrastructure — PASS. Only the daemon's self-dialback environment changes from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and insecure-private-WS handling are otherwise unchanged.
Security testing — PASS. Exact focused suites previously passed 35 with 1 platform skip across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage; strict docs validation and diff hygiene passed. Fresh GitHub Actions remains authoritative for this exact head.
System security — PASS. The change prevents daemon-internal clients from being misclassified as remote private-IP peers without disabling pairing or authentication globally. The bounded E2E readiness wait changes test orchestration only.

The signed merge refresh had no conflict resolution and preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). Base PR #8370 changes internal shared contributor/reviewer guidance and Advisor tooling only; it does not alter the OpenClaw gateway boundary. Fresh CI, protected E2E, documentation receipt, and independent post-push approval remain mandatory; no previous failure or result is waived.

cjagwani

Security review — exact head 5fb80320b43c4d02dd3f69882e63b10748a3ad1a against base c176af5f08595ed748b4eeac8988c554e180183e: PASS with no findings.

Secrets and credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input validation and injection resistance — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at reviewed launch/respawn sites and interpolates no caller-controlled command.
Authentication and authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL; explicit targets remain unchanged.
Dependencies and supply chain — PASS. No new dependency or source. The patch remains bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed on shape drift.
Error handling and information exposure — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and data protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and infrastructure — PASS. Only daemon self-dialback changes from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and private-WS handling are otherwise unchanged.
Security testing — PASS. Exact focused suites previously passed 35 with 1 platform skip across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage; strict docs validation and diff hygiene passed. Fresh GitHub Actions remains authoritative.
System security — PASS. Daemon-internal clients are no longer misclassified as remote private-IP peers; pairing and authentication remain enabled globally.

The signed merge was conflict-free and preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). Base PR #8371 changes internal vLLM model acquisition behind a preserved API and does not alter the OpenClaw gateway boundary. Fresh CI, protected E2E, documentation receipt, and independent post-push approval remain mandatory; no previous failure is waived.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Verdict

Security review — exact head 5c13fcf5f296ab615e72aa9339b757e653c25997 against base 3b208d79e5d3bda4183704145ee5c28d79876ae1: PASS with no findings. The effective patch is safe from the reviewed security perspective, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

Secrets and Credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input Validation and Data Sanitization — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at reviewed launch/respawn sites and interpolates no caller-controlled command.
Authentication and Authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL; explicit targets remain unchanged.
Dependencies and Third-Party Libraries — PASS. No new dependency or source. The patch remains bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed on shape drift.
Error Handling and Logging — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and Data Protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and Security Headers — PASS. Only daemon self-dialback changes from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and private-WS handling are otherwise unchanged.
Security Testing — PASS. Exact focused suites previously passed 35 with 1 platform skip across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage; strict docs validation and diff hygiene passed. Fresh GitHub Actions remains authoritative.
System Security — PASS. Daemon-internal clients are no longer misclassified as remote private-IP peers; pairing and authentication remain enabled globally.

Files Reviewed

Dockerfile
docs/security/openclaw-2026.7.1-dependency-review.md
scripts/openclaw/patch-gateway-daemon-dialback.mts
src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts
src/lib/sandbox/build-context.ts
test/e2e/live/full-e2e.test.ts
test/e2e/live/launch-agent-turn.ts
test/e2e/support/launch-agent-turn.test.ts
test/openclaw-final-image-layout.test.ts
test/openclaw-gateway-daemon-dialback-patch.test.ts
test/openclaw-real-patched-dist-harness.test.ts
test/sandbox-build-context.test.ts

Provenance and Required Gates

The signed refresh merge is conflict-free and preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). Base PR #8372 changes the canonical security rubric and PR Review Advisor machinery only; it does not alter any effective PR file or runtime trust boundary. This review independently applies the new rubric.

Fresh CI, protected E2E, documentation receipt, unresolved-review resolution, and independent exact-head approval remain mandatory. This security review waives none of those gates.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Verdict

Security review — exact head a74720eda85ac21dcff84e6883035d7cdabc902f against base c6713c9dd17a9682654713ccb6829b8714f1b307: PASS with no findings. The effective patch is safe from the reviewed security perspective, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

Secrets and Credentials — PASS. No secret, token, credential store, or logging path changes. Shared-token authentication remains enabled.
Input Validation and Data Sanitization — PASS. The compatibility patch remains exact-version and exact-source-shape gated. It removes only the gateway daemon's inherited private-veth URL at reviewed launch/respawn sites and interpolates no caller-controlled command.
Authentication and Authorization — PASS. The daemon resolves its configured loopback endpoint while retaining shared-token authentication. Descendant agents keep the private-interface URL; explicit targets remain unchanged.
Dependencies and Third-Party Libraries — PASS. No new dependency or source. The patch remains bound to the reviewed OpenClaw 2026.7.1 compiled distribution and fails closed on shape drift.
Error Handling and Logging — PASS. Patch application, final-image layout, readiness, and daemon-shape failures remain blocking. No sensitive diagnostic or fallback is added.
Cryptography and Data Protection — PASS / not applicable. No cryptographic behavior changes; existing gateway token handling remains intact.
Configuration and Security Headers — PASS. Only daemon self-dialback changes from the private veth route to configured loopback. Network policy, ports, privileges, descendant routing, and private-WS handling are otherwise unchanged.
Security Testing — PASS. Exact focused suites previously passed 35 with 1 platform skip across readiness, final-image layout, patch application, compiled-distribution harness, and build-context coverage; strict docs validation and diff hygiene passed. Fresh GitHub Actions remains authoritative.
System Security — PASS. Daemon-internal clients are no longer misclassified as remote private-IP peers; pairing and authentication remain enabled globally.

Files Reviewed

Dockerfile
docs/security/openclaw-2026.7.1-dependency-review.md
scripts/openclaw/patch-gateway-daemon-dialback.mts
src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts
src/lib/sandbox/build-context.ts
test/e2e/live/full-e2e.test.ts
test/e2e/live/launch-agent-turn.ts
test/e2e/support/launch-agent-turn.test.ts
test/openclaw-final-image-layout.test.ts
test/openclaw-gateway-daemon-dialback-patch.test.ts
test/openclaw-real-patched-dist-harness.test.ts
test/sandbox-build-context.test.ts

Provenance and Required Gates

The signed refresh merge is conflict-free and preserves the effective 12-file patch byte-for-byte (raw SHA-256 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a; stable patch ID a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9). Base PR #8383 adds only the v0.0.103 release-note page and does not alter any effective PR file or reviewed runtime trust boundary. Base PR #8372 changes the canonical security rubric and PR Review Advisor machinery only; it does not alter any effective PR file or runtime trust boundary. This review independently applies the new rubric.

Fresh CI, protected E2E, documentation receipt, unresolved-review resolution, and independent exact-head approval remain mandatory. This security review waives none of those gates.

cjagwani · 2026-08-05T19:51:04Z

Protected E2E follow-up for exact head a74720eda85ac21dcff84e6883035d7cdabc902f on base c6713c9dd17a9682654713ccb6829b8714f1b307: the selected run completed with three failures outside this loopback/self-dialback patch. The managed-image job was stopped by an invalid npm registry attestation for unchanged eventsource@3.0.7; cloud inference received HTTP 403 from the external validation endpoint; and full E2E exceeded only the existing provider-selection timing budget (17,021 ms versus 8,000 ms). The other selected jobs passed. The protected gate records no accepted result and exposes no supported retry marker, so I am not rerunning or waiving it. A new validated revision or repository-supported remediation is required before merge.

Signed-off-by: Charan Jagwani <cjagwani@nvidia.com>

cjagwani

Verdict

Security revalidation — exact head cada68e35fffaa12dd132d8b598cda3b26bd07fe against current base 1608281462923ff8282151c7be1a109ee262b4e9: PASS with no findings, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

Secrets and Credentials — PASS. The effective PR patch is unchanged from the prior exact review. The base refresh adds no overlapping secret, credential, environment, or sensitive-logging path.
Input Validation and Data Sanitization — PASS. The reviewed validation and command/path construction are unchanged. The new base delta does not alter an effective PR file.
Authentication and Authorization — PASS. No identity, ownership, permission, or authorization boundary changed in the PR patch or its integration with the refreshed base.
Dependencies and Third-Party Libraries — PASS. The PR's reviewed dependency and artifact identities are unchanged. Base PR #8387 adds verified llama.cpp GGUF acquisition in eight disjoint files and does not change this PR's dependency surface.
Error Handling and Logging — PASS. The reviewed fail-closed behavior and diagnostics are unchanged; the base refresh introduces no overlapping error or logging path.
Cryptography and Data Protection — PASS. The PR's reviewed cryptographic and protected-data behavior is unchanged. No new cross-patch data flow exists.
Configuration and Security Headers — PASS. The effective PR patch preserves its reviewed configuration, network, privilege, capability, port, and header boundaries.
Security Testing — PASS. Raw patch SHA-256 remains 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a and stable patch ID remains a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9. Documentation writer revalidation passed at this exact head; the existing PR documentation remains accurate. Prior targeted test evidence remains applicable; fresh exact-head GitHub Actions is authoritative.
System Security — PASS. The signed refresh is conflict-free, preserves the reviewed patch byte-for-byte, and introduces no new runtime trust-boundary interaction with the disjoint base delta.

Provenance and Required Gates

This exact-head revalidation supplements the full prior nine-category review at #7230 (review). It applies the current rubric from .agents tree 7320c9e331ddbcd9ff83e0fce9387a004e3bd1aa.

Fresh required CI, protected E2E, the exact documentation receipt, unresolved-review resolution, GitHub commit verification, and an independent exact-head approval remain mandatory. This review waives none of those gates.

cjagwani

Verdict

Security review — exact head 9dde9e6ce194abc9c850f57cb2c14bb3460bb04b against current base b148bc13ee53b7a1f612d07e42275ec732e71877: PASS with no findings, subject to every repository merge gate.

Findings Table

No findings.

Detailed Analysis

Secrets and Credentials — PASS. The effective PR patch is unchanged and adds no secret, credential source, environment exposure, or sensitive logging. The refreshed base introduces no overlapping credential path.
Input Validation and Data Sanitization — PASS. Reviewed validation, command construction, and path handling remain unchanged. The portable-profile base delta has no exact file overlap with this PR.
Authentication and Authorization — PASS. No identity, ownership, permission, or authorization boundary is widened by the PR patch or its integration with the refreshed base.
Dependencies and Third-Party Libraries — PASS. The PR's reviewed dependency and artifact identities are unchanged. Base PRs #8333 and #8376 add disjoint E2E artifact restoration and portable experimental onboarding behavior.
Error Handling and Logging — PASS. Reviewed fail-closed behavior and diagnostics remain unchanged; the signed integrations add no overlapping error or logging path.
Cryptography and Data Protection — PASS. Reviewed cryptographic and protected-data behavior remains unchanged, with no new cross-patch data flow.
Configuration and Security Headers — PASS. The effective PR patch preserves its reviewed configuration, network, privilege, capability, port, and header boundaries. The hidden portable profile does not bypass this PR's authority checks.
Security Testing — PASS. Raw patch SHA-256 remains 1ed1be7495143ce5da4760453d398cc36611274bbaea0afb9c85d6c0d687681a and stable patch ID remains a4bf0a98c3a447be8e8770c74d2e40be9ff08ba9. The prior exact gateway-dialback test evidence remains applicable. Exact-head documentation writer revalidation passed; fresh GitHub Actions is authoritative.
System Security — PASS. Both signed refreshes are conflict-free, preserve the effective patch byte-for-byte, and introduce no new runtime trust-boundary interaction. For #7853 specifically, the portable profile supplies onboarding defaults but neither stages messaging credentials nor bypasses registry-driven credential-drift validation.

Provenance and Required Gates

The exact head preserves contributor history through signed merge commits and applies the current rubric from .agents tree 7320c9e331ddbcd9ff83e0fce9387a004e3bd1aa. This supplements the full prior nine-category review at #7230 (review).

Fresh required CI, protected E2E, the exact documentation receipt, unresolved-review resolution, GitHub commit verification, and an independent exact-head approval remain mandatory. This review waives none of those gates.

coderabbitai Bot reviewed Jul 20, 2026

View reviewed changes

Comment thread test/nemoclaw-start-gateway-launch-env.test.ts Outdated

wscurran mentioned this pull request Jul 20, 2026

Sandbox gateway dial-back with valid shared token rejected as "pairing required" — OpenShell transparent proxy erases loopback locality, blocking channel tools on the warm daemon path #7215

Open

2 tasks

wscurran added area: integrations Third-party service integration behavior area: sandbox OpenShell sandbox lifecycle, runtime, config, or recovery bug-fix PR fixes a bug or regression labels Jul 20, 2026

prekshivyas self-assigned this Jul 25, 2026

prekshivyas changed the title ~~fix(sandbox): launch the gateway daemon without the private veth gateway URL~~ fix(sandbox): keep gateway daemon self-dialback on loopback Jul 25, 2026

test(sandbox): centralize gateway env restoration

003265e

Reuse the shared environment helper so the focused dial-back tests stay linear. This keeps the test file within the growth guard. Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

coderabbitai Bot reviewed Jul 25, 2026

View reviewed changes

Comment thread Dockerfile Outdated

prekshivyas and others added 3 commits July 25, 2026 03:52

fix(image): validate gateway dial-back patch payload

c42cd65

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

fix(onboard): refresh dashboard Dockerfile attestation

266ff3f

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Merge branch 'main' into fix/gateway-daemon-loopback-dialback

1bd13e3

coderabbitai Bot mentioned this pull request Jul 25, 2026

fix(test): map OpenClaw patch helper in harness #7539

Merged

23 tasks

apurvvkumaria added the v0.0.96 label Jul 26, 2026

cv requested changes Jul 26, 2026

View reviewed changes

cv and others added 7 commits July 26, 2026 06:55

fix(sandbox): gate gateway dialback patch by version

b333dda

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

docs(security): document gateway dialback boundary

e446b01

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

merge: refresh NVIDIA#7230 onto current main

8c02300

Signed-off-by: Carlos Villela <cvillela@nvidia.com> # Conflicts: # src/lib/onboard/dockerfile-remote-dashboard-bind-contract.ts # test/openclaw-real-patched-dist-harness.test.ts

fix(sandbox): verify complete gateway dialback patch

bd1a5e6

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

test(sandbox): keep dialback gate assertion linear

e7cae42

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

fix(onboard): attest composed dashboard metadata

e3255d3

Signed-off-by: Carlos Villela <cvillela@nvidia.com>

fix(sandbox): apply gateway dialback patch atomically

5d77a4b

Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>

Merge branch 'main' into fix/gateway-daemon-loopback-dialback

bdcfb30