$ the-wire · showcase
Gateway auth assertions close two bypasses
By RepoJournal · Filed · About OpenClaw
Two gateway patches remove ways for callers to bypass ownership checks, and a workspace addressing subsystem ships alongside them.
The gateway closes an auth gap where a caller possessing a managed image URL could self-declare the requester-session header and fetch media bytes without proving ownership. Managed outgoing image fetches now require authenticated owner/admin context resolved via `resolveOpenAiCompatibleHttpSenderIsOwner`, replacing the trust in URL/header self-declaration; transcript matching and existing operator scope checks are unchanged [1]. The other gateway fix lets local non-browser backend RPC clients operate when `gateway.auth.mode` is `"none"`. They used to hit `device identity required`, because the backend self-pairing skip was not wired into the missing-device decision path; the bypass remains limited to operator-role, local, non-browser backend connections [2]. A UI fix now reads exec security from the tools config, syncing what the UI shows with the security policy actually applied [3]. "For managed outgoing images, ownership is now derived from the authenticated agent context rather than URL-declared headers," per the patch summary [1].
Browser downloads harden their output writes. The extension routes downloads through `writeExternalFileWithinRoot` for private staging and finalization, updates `@openclaw/fs-safe`, and refuses symlinked output directories when creating managed output roots [4].
ClawHub package publishing gets clearer ownership rules. Scoped plugin package names are now checked against the selected owner in shared schema and backend validation, with the mismatch surfaced in the publish UI [5]. This follows an earlier PR enforcing npm-style scoped package ownership, adding a user-facing package transfer API and CLI command while preserving package history [6]. Skills moderation also tightens: a skill owner can no longer undelete a skill hidden with a `moderationReason`; they now get `NOT_AUTHORIZED` and must route through a moderator or admin [7]. Docs CI commits clean up stale R2 objects [8][9][10][11].
Action items
- → If you self-host the gateway with managed image media, deploy the commit that switches ownership checks to `resolveOpenAiCompatibleHttpSenderIsOwner` before exposing managed image URLs to untrusted callers. openclaw/openclaw [immediate]
- → After deploying the gateway change, verify local backend RPC clients with `auth.mode: "none""` no longer receive `device identity required`. openclaw/openclaw [plan]
- → Review existing ClawHub publishes where plugin package scopes do not match the owner account; they will start failing validation. openclaw/clawhub [plan]
- → For ClawHub skill maintainers, note that owner-initiated undelete of moderator-hidden skills now requires moderator/admin help. openclaw/clawhub [monitor]
References
- [1] fix(gateway): require owner auth for managed image media ↗ openclaw/openclaw
- [2] fix(gateway): include auth mode "none" in backend self-pairing skip ↗ openclaw/openclaw
- [3] fix(ui): read exec security from tools config (#79207) ↗ openclaw/openclaw
- [4] Harden browser download output writes ↗ openclaw/openclaw
- [5] Fix plugin publish ownership visibility ↗ openclaw/clawhub
- [6] Enforce scoped plugin ownership ↗ openclaw/clawhub
- [7] fix(skills): block owner from undeleting moderator-hidden skills ↗ openclaw/clawhub
- [8] fix(ci): delete stale R2 docs objects ↗ openclaw/docs
- [9] fix(ci): purge orphaned R2 docs objects ↗ openclaw/docs
- [10] fix(ci): prevent stale R2 docs uploads ↗ openclaw/docs
- [11] fix(ci): allow forced R2 docs uploads ↗ openclaw/docs
