fix: local gateway connections recover after listener or token drift by bkudiess · Pull Request #1053 · openclaw/openclaw-windows-node

bkudiess · 2026-07-24T20:31:44Z

What Problem This Solves

Fixes an issue where users connected to a setup-managed local WSL gateway could
be left in misleading re-pair/token states or unstable reconnect loops when a
stale native gateway owned the local port, the WSL gateway was wedged, or a
role-specific device token drifted.

Why This Change Was Made

This makes GatewayConnectionManager the canonical operator/node lifecycle and
user-intent owner, adds a shared local-listener provenance service, and adds a
bounded managed-WSL repair monitor/coordinator. Strong shared/bootstrap
credentials are sent only after the expected local gateway owner is proven;
unknown listeners are never killed, and explicit Disconnect/Stop intent is
never overridden by automatic repair.

The old owners were scattered UI/client reconnect paths and best-effort port
diagnostics. The new owners are the connection manager for lifecycle and
credential recovery, ManagedLocalGatewayPortProvenanceService for endpoint
identity/remediation, and the monitor/coordinator for bounded automatic repair.

User Impact

Setup-managed local gateways now recover automatically from stale listener
collisions, WSL service/VM failures, and role-specific device-token mismatch.
When ownership cannot be proven, the UI reports a local port conflict instead
of incorrectly asking the user to re-pair.

Evidence

Repeated native-vs-WSL fault injection removed only the proven obsolete
OpenClaw native listener, left the task disabled, restored signed
wslrelay.exe ownership, returned the WSL systemd gateway to active, and
refreshed LastConnected.
Inspect the redacted non-isolated recovery, disconnect-intent, and upgrade transcript.
Inspect the current-head endpoint-ownership proof addendum.
Current PR head 0e8756b7 completed the real fresh-distro setup/connect,
revocation-recovery, and network-recovery E2E shards.
Final adversarial sign-off on the feature snapshot: GPT-5.6 Sol max 96/100,
Claude Opus 4.8 95/100, Gemini 3.1 Pro 100/100; no material findings.
Final GPT-5.6 Sol max reviews of the migration/provenance/architecture and
endpoint-ownership remediations found no significant issues.

Change Type

Scope

Validation

.\build.ps1
- All five projects built successfully.
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore
- 3,241 passed, 31 skipped, 0 failed.
dotnet test .\tests\OpenClaw.Connection.Tests\OpenClaw.Connection.Tests.csproj --no-restore
- 504 passed, 0 failed.
dotnet test .\tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --no-restore
- 698 passed, 0 failed.
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
- 2,001 passed, 0 failed.
Unit/closeout total: 6,444 passed, 31 skipped, 0 failed.
CI E2E shards:
- Setup/connect and MXC: 18 passed, 0 failed.
- Network recovery: 2 passed, 0 failed.
- Revocation recovery: 1 passed, 0 failed.

Real Behavior Proof

Environment tested: Windows 11 host, WSL2 OpenClawGateway, setup-managed
loopback gateway on port 18789.
PR head or commit tested: 0e8756b7; live non-isolated recovery was captured
on parent 2ac177a5, whose repair implementation is unchanged. The current
endpoint-ownership delta has current-head focused, full-suite, and E2E proof.
Exact steps or command run: launched
.\run-app-local.ps1 -NoBuild -AllowNonMain; inspected the address-specific
Windows listener and WSL systemd service; ran controlled native-listener
collision/recovery and explicit-disconnect trials; ran the upgrade/edit matrix
and all three CI setup E2E filters.
Evidence after fix: expected signed relay owned the baseline listener; the
proven obsolete native listener was disabled/stopped; signed relay and WSL
returned; LastConnected advanced. After visible UI Disconnect, the same
collision remained untouched beyond the repair threshold and app state stayed
Disconnected / Idle. Changed endpoints now lose explicit and legacy managed
ownership, while exact endpoints and standard localhost aliases retain it.
Observed result: managed-local connection health recovers, explicit user intent
remains authoritative, and manually repointed endpoints remain manual.
Screenshot or artifact links verified? (Yes/No/N/A): Yes; both linked PR
comments are inspectable redacted transcripts.
Not verified or blocked: no technical proof blocker remains. Maintainer approval
is still requested for default-on bounded WSL restart and remediation of a
fully proven obsolete OpenClaw native task/process.

Security Impact

New permissions or capabilities? (Yes/No): No.
Secrets or tokens handling changed? (Yes/No): Yes.
New or changed network calls? (Yes/No): Yes, local listener/provenance and
reconnect probes only.
Command or tool execution surface changed? (Yes/No): Yes, bounded repair
can restart the expected WSL service/VM and disable/stop only a fully proven
obsolete OpenClaw native task/process.
Data access scope changed? (Yes/No): No.
If any answer is Yes, explain the risk and mitigation: shared/bootstrap
credentials are gated by complete Windows IPv4/IPv6 listener capture, signed
relay, expected-distro systemd MainPID target-port ownership, and listener
recapture. Destructive remediation additionally proves native task/profile/
process lineage and PID start identity. Unknown owners fail closed.

Compatibility and Migration

Backward compatible? (Yes/No): Yes.
Config or environment changes? (Yes/No): No.
Migration needed? (Yes/No): Yes, automatic only.
If yes, list the exact upgrade steps: none. Setup-managed ownership migrates or
persists only when setup state or endpoint identity proves the same endpoint.
Manual localhost, repointed endpoints, URL-less state, and SSH-backed records
remain manual. Standard aliases localhost, 127.0.0.1, and ::1 are treated
as equivalent only when scheme, port, path, query, user-info, and fragment match.

Review Conversations

I replied to or resolved every bot review conversation addressed by this PR.
I left unresolved only conversations that still need maintainer judgment.

clawsweeper · 2026-07-24T20:59:48Z

Codex review: found issues before merge. Reviewed July 27, 2026, 5:55 PM ET / 21:55 UTC.

ClawSweeper review

What this changes

This PR adds endpoint-ownership checks, role-specific credential recovery, explicit disconnect intent, and bounded WSL repair so setup-managed local gateways recover from stale listeners, outages, and device-token drift without disclosing strong credentials to an unverified local listener.

Merge readiness

⚠️ Needs maintainer review before merge - 5 items remain

Keep this PR open for maintainer review. The previous endpoint-ownership blocker appears addressed by the current endpoint-equivalence change and focused tests, and the PR provides strong live recovery proof; however, it introduces a default-on upgrade behavior that can restart a user's managed WSL gateway and disable a proven obsolete native task, so the release contract needs an explicit maintainer decision before merge.

Priority: P1
Reviewed head: 0e8756b7888d7add4b6e60abdab29666e775d194
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Strong real behavior proof and focused follow-up coverage are present, but the default-on upgrade contract is a P1 blocker pending maintainer direction.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (logs): The PR includes redacted live Windows and WSL recovery evidence for listener collision, reconnect, and explicit Disconnect preservation, plus a current-head endpoint-ownership proof addendum. Private endpoint and credential values are redacted.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (logs): The PR includes redacted live Windows and WSL recovery evidence for listener collision, reconnect, and explicit Disconnect preservation, plus a current-head endpoint-ownership proof addendum. Private endpoint and credential values are redacted.
Evidence reviewed	5 items	Prior blocker addressed: The current branch changes managed ownership preservation to require component-equivalent endpoints, and the supplied current-head proof lists changed-port, nonstandard loopback, path/query, and standard-alias regression coverage. Default-on upgrade behavior: A newly persisted auto-repair setting defaults to true. Existing settings files without this field will take the new default unless an explicit migration preserves their prior behavior. Destructive remediation path: The repair design can terminate and cold-restart a managed WSL distro after in-place restart failure, while separate provenance logic may disable and stop a fully proven obsolete native gateway process.
Findings	1 actionable finding	[P1] Preserve the pre-upgrade recovery contract
Security	None	None.

How this fits together

The tray's connection layer resolves a saved gateway record into operator and Windows-node connections, then reflects failures in the Connection page. For setup-managed WSL gateways, this PR adds listener provenance before credential use and a bounded repair path that can restart the managed WSL gateway before reconnecting.

flowchart LR
  Record[Saved gateway record] --> Provenance[Local listener provenance]
  Provenance --> Credentials[Credential authorization]
  Credentials --> Manager[Connection lifecycle]
  Manager --> Monitor[Managed-local repair monitor]
  Monitor --> WSL[WSL gateway restart and probe]
  Manager --> Recovery[Connection recovery UI]

Decision needed

Question	Recommendation
Should existing setup-managed local gateway installations be enrolled by default into automatic WSL restart and removal of a fully proven obsolete native gateway task/process after upgrading?	Grandfather existing installs: Migrate settings that lack the new field to automatic repair disabled, while choosing and documenting the desired default for fresh setup.

Why: The implementation is intentionally capable of altering an existing user's local service lifecycle without a new setup step, and repository policy treats startup, recovery, and settings changes as upgrade-sensitive product decisions.

Before merge

Preserve the pre-upgrade recovery contract (P1) - EnableManagedLocalGatewayAutoRepair defaults to true, so an existing settings file that predates this property is enrolled in automatic WSL restart and proven-native-task remediation after upgrade. That silently replaces the prior recovery contract for existing users. Add an explicit upgrade migration that preserves prior behavior, or obtain and document an intentional maintainer-approved default-on policy with focused upgrade coverage.
Resolve merge risk (P1) - Existing setup-managed local gateway users can receive default-on automatic WSL restart and proven-native-task remediation after upgrade because their persisted settings do not contain the new auto-repair field.
Resolve merge risk (P1) - The credential and process-remediation boundaries are security-sensitive even though the branch adds conservative provenance checks, so maintainers should explicitly accept the operator-impact contract before landing.
Complete next step (P2) - A maintainer must choose the upgrade and default-on recovery contract before a safe implementation path can be selected; this is not a narrow automated repair.

Findings

[P1] Preserve the pre-upgrade recovery contract — src/OpenClaw.Shared/SettingsData.cs:112

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	62 files affected; 6,563 added, 141 removed	The implementation crosses connection, setup, shared client, WinUI, documentation, and E2E surfaces, making the upgrade contract more consequential than a localized reconnect fix.
Behavior proof	1 live recovery transcript plus 1 current-head ownership addendum	The supplied evidence directly exercises collision recovery and explicit disconnect preservation on Windows and WSL.

Merge-risk options

Maintainer options:

Grandfather upgrade behavior (recommended)
Migrate existing settings without the new field to repair disabled, then add focused upgrade coverage before merge.
Accept default-on local recovery
Approve automatic WSL restart and fully proven obsolete-native remediation as the intentional upgrade contract, with user-visible disclosure and upgrade proof.
Pause destructive remediation
Keep the PR in review and split the WSL restart and process/task-remediation policy from the non-destructive credential recovery work.

Technical review

Best possible solution:

Preserve pre-upgrade behavior for existing installs unless maintainers explicitly approve default-on repair, then provide a visible user control and fresh-install plus upgrade proof for the chosen contract.

Do we have a high-confidence way to reproduce the issue?

Yes for the proposed recovery path. The supplied redacted Windows 11 and WSL2 transcript reproduces a stale native listener and WSL outage, and the current branch includes targeted source-level regression coverage for endpoint ownership and disconnect intent.

Is this the best way to solve the issue?

Unclear. Listener provenance and explicit intent boundaries are a coherent solution, but default-enrolling existing installations into destructive local recovery is not established as the safest upgrade policy without maintainer confirmation.

Full review comments:

[P1] Preserve the pre-upgrade recovery contract — src/OpenClaw.Shared/SettingsData.cs:112
EnableManagedLocalGatewayAutoRepair defaults to true, so an existing settings file that predates this property is enrolled in automatic WSL restart and proven-native-task remediation after upgrade. That silently replaces the prior recovery contract for existing users. Add an explicit upgrade migration that preserves prior behavior, or obtain and document an intentional maintainer-approved default-on policy with focused upgrade coverage.
Confidence: 0.92

Overall correctness: patch is incorrect
Overall confidence: 0.9

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against acf4ab1d2b02.

Labels

Label justifications:

P1: This PR changes recovery behavior for active setup-managed local gateway users and can affect connection availability immediately after upgrade.
merge-risk: 🚨 compatibility: A newly defaulted setting changes existing managed-local gateway lifecycle behavior during upgrade.
merge-risk: 🚨 auth-provider: Credential use and device-token recovery now depend on local endpoint provenance.
merge-risk: 🚨 security-boundary: The branch authorizes strong credentials and bounded local process or WSL remediation from ownership checks.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (logs): The PR includes redacted live Windows and WSL recovery evidence for listener collision, reconnect, and explicit Disconnect preservation, plus a current-head endpoint-ownership proof addendum. Private endpoint and credential values are redacted.
proof: sufficient: Contributor real behavior proof is sufficient. The PR includes redacted live Windows and WSL recovery evidence for listener collision, reconnect, and explicit Disconnect preservation, plus a current-head endpoint-ownership proof addendum. Private endpoint and credential values are redacted.

Evidence

What I checked:

Prior blocker addressed: The current branch changes managed ownership preservation to require component-equivalent endpoints, and the supplied current-head proof lists changed-port, nonstandard loopback, path/query, and standard-alias regression coverage. (src/OpenClaw.Connection/GatewayRecord.cs:61, 0e8756b7888d)
Default-on upgrade behavior: A newly persisted auto-repair setting defaults to true. Existing settings files without this field will take the new default unless an explicit migration preserves their prior behavior. (src/OpenClaw.Shared/SettingsData.cs:112, 0e8756b7888d)
Destructive remediation path: The repair design can terminate and cold-restart a managed WSL distro after in-place restart failure, while separate provenance logic may disable and stop a fully proven obsolete native gateway process. (src/OpenClaw.Connection/WslGatewayController.cs:98, 0e8756b7888d)
Real behavior proof: The PR's July 27, 2026 redacted Windows and WSL transcript shows recovery from a native-listener collision, advancing LastConnected, and preserving explicit Disconnect intent beyond the repair threshold. The follow-up addendum documents current-head endpoint-ownership coverage. (0e8756b7888d)
Repository policy: The repository guidance requires architecture-led review, real behavior proof, and explicit attention to gateway, setup, permissions, and diagnostics changes; the PR updates the architecture ledger and adds ownership-transfer contract coverage. (docs/ARCHITECTURE.md:59, 0e8756b7888d)

Likely related people:

bkudiess: Authored all four commits in the current recovery, provenance, migration, and endpoint-ownership sequence and supplied the live Windows and WSL proof. (role: recent implementation contributor and collaborator; confidence: high; commits: 309130377f3c, ff2ad8b03d21, 2ac177a5be7c; files: src/OpenClaw.Connection/GatewayConnectionManager.cs, src/OpenClaw.Connection/ManagedLocalGatewayPortProvenanceService.cs, src/OpenClaw.Tray.WinUI/Services/ManagedLocalGatewayRepairCoordinator.cs)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

Decide whether existing installations should retain the previous non-automatic recovery behavior or be enrolled in default-on repair.
If default-on is retained, add focused proof for fresh-install and existing-install upgrade behavior, including the user-visible control or disclosure.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

reviewed 2026-07-24T20:35:30.039Z sha 9d41843 :: needs maintainer review before merge. :: none
reviewed 2026-07-27T07:08:39.232Z sha ff2ad8b :: found issues before merge. :: [P1] Restrict setup-managed migration to verified records | [P2] Record the ownership transfer in the architecture ledger
reviewed 2026-07-27T20:56:00.572Z sha 2ac177a :: found issues before merge. :: [P1] Drop managed ownership when the loopback endpoint changes

Add trusted endpoint provenance, role-aware credential recovery, explicit operator intent, and bounded managed-WSL repair so local gateway failures recover safely without leaking stronger credentials or overriding disconnects. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Preserve WSL shell variables through stdin, isolate the Windows PowerShell module path for Authenticode verification, and account for relay family translation. Update the keepalive E2E contract to recognize an already-proven setup keepalive without spawning a duplicate. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Adopt setup-managed ownership only when setup state proves the same loopback endpoint, preserve manual and SSH-backed records, deduplicate external provenance probes, and record the repair ownership boundary in the architecture ledger. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

bkudiess · 2026-07-27T20:51:00Z

Current-head managed-local recovery proof

Commit: 2ac177a5be7cdcaba066bff937fdcac2ad3c8963
Environment: Windows 11, WSL2 OpenClawGateway, non-isolated Release identity,
ws://localhost:18789
Redaction: No credential values, command output, prompts, or file contents are included.

Proven native-listener collision and automatic recovery

Baseline UTC: 2026-07-27T20:34:41Z
App: PID 39016, exact commit build, responding=True
Gateway: localhost:18789, IsLocal=True, managedDistro=OpenClawGateway
Native task: Disabled
Windows listener: PID 38548, wslrelay,
  C:\Program Files\WSL\wslrelay.exe, Authenticode=Valid
Expected WSL service: MainPID=483, ActiveState=active, SubState=running
LastConnected: 2026-07-27T20:34:09Z

Fault injected:
  wsl.exe --terminate OpenClawGateway
  enabled and started exact legacy task:
    OpenClaw Gateway (OpenClawGateway)

Injected UTC: 2026-07-27T20:36:05Z
Native task: Ready
Windows listener: PID 44460, node.exe,
  C:\Program Files\nodejs\node.exe
Expected WSL service behind collision:
  MainPID=367, ActiveState=active, SubState=running

Tray log:
[2026-07-27 13:36:24.480] [INFO] [GatewayPort] Disabled
'OpenClaw Gateway (OpenClawGateway)' and stopped proven obsolete native
gateway PID 44460.

Recovered UTC: 2026-07-27T20:36:44Z
Native task: Disabled
Native PID 44460 alive: False
Windows listener: PID 38548, wslrelay,
  C:\Program Files\WSL\wslrelay.exe, Authenticode=Valid
Expected WSL service: MainPID=437, ActiveState=active, SubState=running
App: PID 39016, responding=True

Reconnect observed UTC: 2026-07-27T20:37:02Z
LastConnected: 2026-07-27T20:36:47Z
LastConnected advanced: True

Explicit Disconnect remains authoritative

The visible Connection-page control was invoked through Windows UI Automation,
not by calling an internal manager method.

User disconnect UTC: 2026-07-27T20:39:40Z
UI Automation:
  AutomationId=ConnectionToggle
  Name="Disconnect or reconnect"
  ToggleState before action=On
  Action=Toggle

App MCP state after action:
  status=Disconnected
  overallState=Idle
  nodeState=Idle

Same fault injected while disconnected:
  wsl.exe --terminate OpenClawGateway
  started exact legacy native task

Injected UTC: 2026-07-27T20:40:24Z
Native task: Ready
Native listener: PID 33904, node.exe

Observed after 75 seconds (beyond repair threshold):
  Native task: Ready (not disabled)
  Native PID 33904 alive: True (not terminated)
  Listener still native PID 33904
  OpenClawGateway WSL state: Stopped (not restarted)
  LastConnected: 2026-07-27T20:36:47Z (unchanged)
  App status: Disconnected
  overallState: Idle
  nodeState: Idle

After capture, PID 33904 was stopped explicitly, the task was returned to
Disabled, WSL was reset, and the previously running tray from the other
worktree was restored as PID 34812 and verified responsive.

Upgrade ownership matrix

Current-head focused output:

Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_LocalhostWithSetupState_BackfillsManagedDistro
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_ManualLocalhostWithDifferentSetupEndpoint_RemainsManual
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_SetupStateWithoutGatewayUrl_RemainsManual
Passed GatewayRegistryMigrationTests.
  MigrateFromSettings_LocalSshTunnelWithMatchingSetupState_RemainsManual

Test Run Successful.
Total tests: 4
Passed: 4

The migration now assigns setup-managed ownership only when
setup-state.json.GatewayUrl is endpoint-equivalent to the legacy loopback URL.
Ambient setup state alone no longer adopts manual localhost or SSH-backed
records.

Intent regression guards

Passed ManagedLocalGatewayAutoRepairMonitorTests.
  UserDisconnectedIntent_NeverRepairs
Passed ManagedLocalGatewayRepairCoordinatorTests.
  UserDisconnectedIntent_AbortsBeforeProbeOrRestart

Test Run Successful.
Total tests: 2
Passed: 2

Validation

Repository build: passed, all five projects.
Shared: 3,241 passed, 31 skipped.
Connection: 500 passed.
SetupEngine: 698 passed.
Tray: 2,001 passed.
Setup/connect and MXC E2E: 18 passed.
Revocation recovery E2E: 1 passed.
Network recovery E2E: 2 passed.
Final GPT-5.6 Sol max security review: no significant issues.

Maintainer decision still requested

Please confirm that default-on bounded WSL restart and remediation of a fully
proven obsolete OpenClaw native task/process is the intended product contract
for setup-managed local gateways.

bkudiess · 2026-07-27T20:52:25Z

@clawsweeper re-review

clawsweeper · 2026-07-27T20:52:28Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Preserve setup-managed metadata only for component-equivalent endpoints, strip stale explicit and legacy ownership on repoint, and cover standard versus nonstandard loopback aliases plus case-sensitive path and query changes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

bkudiess · 2026-07-27T21:50:35Z

Current-head endpoint-ownership proof addendum

Commit: 0e8756b7
Prior live recovery proof: exact-head transcript for the unchanged repair
implementation

The delta from 2ac177a5 to 0e8756b7 changes only gateway-record endpoint
identity/preservation and its tests. Managed ownership is now retained only
when URI components identify the same endpoint:

scheme and host use URI-appropriate case-insensitive comparison;
localhost, 127.0.0.1, and ::1 are the only interchangeable loopback aliases;
port, user-info, path, query, and fragment must remain ordinally identical;
changed endpoints clear SetupManagedDistroName, RequiresV2Signature, and
any friendly label accepted by the shared legacy Local (<distro>) parser;
stale ownership fields supplied by an edit caller cannot restore ownership.

Current-head focused result:

GatewayRegistryTests + GatewayRegistryMigrationTests
Passed: 59
Failed: 0
Skipped: 0

Covered cases include:

Changed loopback port with stale explicit ownership -> ownership dropped
Legacy label "Local ( OpenClawGateway )" -> ownership dropped
Nonstandard 127.0.0.2 alias -> ownership dropped
Path/query case change -> ownership dropped
localhost -> 127.0.0.1 same endpoint -> ownership retained
localhost -> ::1 same endpoint -> ownership retained
Unchanged non-loopback managed/Tailscale endpoint -> ownership retained
Manual localhost + unrelated setup state -> remains manual
SSH-backed localhost + matching setup state -> remains manual

Full current-head validation:

Build: passed (5 projects)
Shared: 3,241 passed, 31 skipped
Connection: 504 passed
SetupEngine: 698 passed
Tray: 2,001 passed
Setup/connect + MXC E2E: 18 passed
Revocation recovery E2E: 1 passed
Network recovery E2E: 2 passed

Final GPT-5.6 Sol max review of this endpoint-ownership delta reported no
significant issues.

bkudiess · 2026-07-27T21:51:43Z

@clawsweeper re-review

clawsweeper · 2026-07-27T21:51:46Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

bkudiess and others added 2 commits July 26, 2026 23:59

bkudiess force-pushed the bkudiess-connection-analysis branch from c2e1372 to ff2ad8b Compare July 27, 2026 07:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: local gateway connections recover after listener or token drift - #1053

fix: local gateway connections recover after listener or token drift#1053
bkudiess wants to merge 4 commits into
openclaw:mainfrom
bkudiess:bkudiess-connection-analysis

bkudiess commented Jul 24, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jul 24, 2026 •

edited

Loading

Security

Review metrics

Merge-risk options

Technical review

Labels

Evidence

Rank-up moves

Rating scale

Workflow

History

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

clawsweeper Bot commented Jul 27, 2026

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

clawsweeper Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

bkudiess commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Change Type

Scope

Validation

Real Behavior Proof

Security Impact

Compatibility and Migration

Review Conversations

Uh oh!

clawsweeper Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ClawSweeper review

What this changes

Merge readiness

Review scores

Verification

How this fits together

Decision needed

Before merge

Findings

Security

Review metrics

Merge-risk options

Technical review

Labels

Evidence

Rank-up moves

Rating scale

Workflow

History

Uh oh!

bkudiess commented Jul 27, 2026

Current-head managed-local recovery proof

Proven native-listener collision and automatic recovery

Explicit Disconnect remains authoritative

Upgrade ownership matrix

Intent regression guards

Validation

Maintainer decision still requested

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

clawsweeper Bot commented Jul 27, 2026

Uh oh!

bkudiess commented Jul 27, 2026

Current-head endpoint-ownership proof addendum

Uh oh!

bkudiess commented Jul 27, 2026

Uh oh!

clawsweeper Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

bkudiess commented Jul 24, 2026 •

edited

Loading

clawsweeper Bot commented Jul 24, 2026 •

edited

Loading