Repository navigation
Conversation
Rebuild reset OpenClaw gateway.controlUi.allowedOrigins to loopback because the managed replacement profile and the custom-image recreate path hardcoded http://127.0.0.1:<port>. Replay the registry's dashboardExternalUrl instead, falling back to the previous profile's external URL for older records, and rebind it to the replacement dashboard port. An exported CHAT_UI_URL during rebuild is ignored with an explicit warning that names how to change the origin. --control-ui-port now selects only the port and keeps the CHAT_UI_URL host. Re-onboarding a running OpenClaw sandbox with a new or removed origin says that a rebuild applies it.
…g generator Add NEMOCLAW_DASHBOARD_ORIGINS to the OpenClaw config generator. Each entry is a bare origin that keeps its own port; a remote origin must use https. The generator adds the origins to gateway.controlUi.allowedOrigins after the loopback and CHAT_UI_URL origins. Add the host-side parser that onboarding will use for the flag and environment value. Refs #13177
Add a repeatable onboard --dashboard-origin flag and NEMOCLAW_DASHBOARD_ORIGINS for browser origins that keep their own port, such as a proxy on 8443 in front of the dashboard on 18789. Each value is a bare origin; a remote origin must use https. The origins are recorded in the sandbox registry and in an optional extraOrigins key of the OpenClaw managed startup profile. The managed image adds them to gateway.controlUi.allowedOrigins. The profile omits the key when no origin is set, so existing profiles stay unchanged. Rebuild replays the recorded origins, and re-running onboard records or clears them with a note that a rebuild applies the change. Onboarding refuses the flag for Dockerfile builds and for agents other than OpenClaw. Refs #13177
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
Important Review skippedWe couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting You can disable this status message by setting the Use the checkbox below for a quick retry:
Walkthrough
Merge Risk:
 |
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title "feat(onboard): add --dashboard-origin for managed OpenClaw dashboards" matches the main change. The changeset adds a repeatable --dashboard-origin flag and NEMOCLAW_DASHBOARD_ORIGINS suppor… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Title check
-
Explanation
The title "feat(onboard): add --dashboard-origin for managed OpenClaw dashboards" matches the main change. The changeset adds a repeatable --dashboard-origin flag and NEMOCLAW_DASHBOARD_ORIGINS support to onboarding for managed OpenClaw dashboards. The changes also cover validation, registry and profile recording, rebuild replay, clone, and resume, which the title does not name. The title is specific, concise, and follows the conventional-commit style. It does not describe anything absent from the changeset.
Finishing Touches
-
Generate docstrings
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
CodeRabbit Verify
- Run CodeRabbit Verify to test the changes in this pull request.
Code coverage overviewLanguages: TypeScript TypeScript / code-coverage/plugin
View coverage of the 10 most impacted files.
TypeScript / code-coverage/cli
View coverage of the 10 most impacted files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Live onboard and rebuild with an extra originRun against this PR's head
Local setup differences from a release install:
|
The managed startup runtime bundle changed for dashboard origins, and Pi images copy that bundle. Refresh both Pi qualification receipts from the AMD64 and ARM64 Pi candidate contracts published by workflow run 38661431968, attempt 1, for 1e1ee70. Update the candidate authority to their exact SHA-256 digests and the image contract test to the reviewed bundle digest. Refs #13177
Address the PR Review Advisor findings on #13218: - The config generator no longer repeats the origin policy. The managed startup profile validates origins with parseDashboardOrigins before mapping them; the generator only refuses an entry that is not a bare origin. - A clone now records the rebound profile's extra origins on its registry entry, so a later rebuild of the clone keeps them. - The removal procedure now says to unset NEMOCLAW_DASHBOARD_ORIGINS too. Refs #13177
PR Review Advisor findings on
|
…nored Rebuild replays the dashboard origins recorded at onboarding. An exported NEMOCLAW_DASHBOARD_ORIGINS was ignored without a word, unlike CHAT_UI_URL. Print the same kind of warning when the export names different origins, with the onboard command that changes them. Equivalent spellings of the recorded origins stay quiet. Refs #13177
Address the second PR Review Advisor pass on #13218: - Onboarding refuses --dashboard-origin and NEMOCLAW_DASHBOARD_ORIGINS for agents other than OpenClaw before it changes state. The startup profile builder refuses them too, instead of dropping them. - parseDashboardOrigins rejects more than 16 origins, and the docs state the limit. - The config generator enforces the same rules before it writes allowedOrigins: a bare http(s) origin, https unless loopback, and at most 16. It runs in the image without the shared module; tests keep the two in step. - Regenerate the reviewed runtime bundle and update its pin. The Pi qualification receipts are refreshed in a following commit, once CI publishes Pi candidate images for this change. Refs #13177
Pi images copy the managed startup runtime bundle, which changed in db164d1. Refresh both Pi qualification receipts from the AMD64 and ARM64 Pi candidate contracts published by workflow run 38713442902, attempt 1, for db164d1, and update the candidate authority to their exact SHA-256 digests. Refs #13177
PR Review Advisor findings on
|
Address the third PR Review Advisor pass on #13218: - The config generator now normalizes origins the same way parseDashboardOrigins does, so a trailing slash, uppercase scheme or host, or a default port that onboarding accepts no longer fails the image build. A test compares the generator output with the shared parser. - The docs say --dashboard-origin is refused with --from-image as well as --from and the Dockerfile fallback. Refs #13177
PR Review Advisor findings on
|
Address the PR Review Advisor findings on #13198: - Test that a failed inner onboard still receives the recorded dashboard origin and that the ambient CHAT_UI_URL is restored afterwards. - Document that changing or clearing CHAT_UI_URL for an existing sandbox takes effect only after a rebuild. Refs #13177
Address the PR Review Advisor findings on #13218: - Canonicalize NEMOCLAW_AGENT before the OpenClaw-only dashboard-origin check, so an alias such as nemoclaw is accepted and nemohermes is still refused. - The config generator names a rejected NEMOCLAW_DASHBOARD_ORIGINS entry by position instead of echoing it, so user information is not printed. - Document that origins added or changed for an existing sandbox apply only after a rebuild. Refs #13177
PR Review Advisor findings on
|
The image config generator kept its own copy of the dashboard-origin rules, and the copy already differed: it accepted control characters and over-long values that parseDashboardOrigins refuses. The generator now imports parseDashboardOrigins, so onboarding, the startup profile, and the generator share one owner. - Copy src/lib/dashboard/url.ts and its two core imports into the image and the local build context. This adds two root Dockerfile lines; the growth exception for this PR is recorded separately on main. - Keep naming a rejected entry by position, so user information in it is not printed. - Test that control characters and over-long values are refused like parseDashboardOrigins refuses them. Refs #13177
Root Dockerfile growth approved for this PRMaintainer decision: approve root
The guardrail reads exceptions only from the base branch, so the exception goes to |
Addresses the Review Advisor finding on 270f759. parseDashboardOrigins appended the raw rejected value to its errors for a malformed URL, a non-http scheme, a path, query, or fragment, and remote http. A token in any of those parts could reach the terminal and logs. Errors now name the entry by its position ("Dashboard origin 2 must ..."), matching how the image's config generator already reports them. New tests cover each case. The managed startup bundle includes this parser, so its pin is updated. Refs #13177
PR Review Advisor finding on
|
Addresses the Review Advisor finding on 663f273. Re-onboarding can change or remove dashboard origins without a rebuild, so the managed receipt's profile may still carry the old list. A snapshot clone copied that stale list into the new sandbox and its registry entry. The clone rebinder now takes extraOrigins from the source's registry record, which the registry validates on load, and drops them when the source records none. An invalid record fails the clone before any change. The clone's registry fields follow the rebound profile, so both agree. Refs #13177
Live E2E:
|
PR Review Advisor findings on
|
Brings in the Deep Agents Code 0.1.87 inputs (#13878) that main's staging QA workflow expects. No conflicts.
Addresses the Review Advisor finding on 2250b00. A 75-minute test limit left no room for the shared 10-minute cleanup inside the 80-minute catalogue job. The limit returns to 60 minutes, which leaves 20 minutes for cleanup and workflow finalization. Real runs take 6 to 8 minutes; the per-step budgets, including the 25-minute rebuild, are ceilings. Refs #13177
PR Review Advisor finding on
|
Addresses the Review Advisor finding on 53be77a. The registry loader keeps a sandbox's dashboardOrigins as recorded, and rebuild turned a malformed list into no origins, so the replacement sandbox silently lost them. Rebuild now stops in its preflight step, before changing anything, and tells the operator to run onboard again with valid origins, or without them to remove them. An absent record still means no origins. Refs #13177
PR Review Advisor findings on
|
rsliter
left a comment
rsliter
left a comment
There was a problem hiding this comment.
Reviewed d33862449f400cadd3ff8c03fb4b55fcd2bc6ac2 against the recorded base. Comment only; current conflicts prevent approval.
The dashboard-origin implementation follows the accepted #13177 scope: separately validated dashboard origins, managed OpenClaw-only support, persisted replay, and redacted invalid-input diagnostics. The reviewed source and tests did not establish a blocking correctness/security defect or an additional mandatory test gap. This does not authorize a broader runtime/provider integration.
GitHub currently reports CONFLICTING / DIRTY. Please resolve the integration conflicts and then validate the resulting revision; this is a merge-readiness condition, not a claim that the dashboard-origin design is wrong. Current CI and the incomplete Advisor coordination also need a revision-specific disposition before approval.
This is a bounded source/feedback review. I did not execute tests or live dashboard onboarding, and historical author-reported validation is not treated as independently reproduced current-head evidence. No merge performed.
main now runs dashboard-remote-bind for OpenClaw and Hermes. The merged test keeps that coverage: the Hermes API-isolation phases stay as main has them, and the dashboard-origin assertions run only for OpenClaw using each agent's generated sandbox name. The OpenClaw phase order, contracts, and rebuild checks from this branch are preserved, and the timeout note reflects the shared target. Generated files take main's copies and are regenerated: the assertion budget, the startup bundle and its pin, and this PR's assertion exception entry with the approved digest, which is unchanged against main. The Pi receipts are refreshed from this commit's CI run.
The merge with main changed Pi image inputs. Both receipts come from the managed-images run for a6a71e9, collected with the reviewed collector from main, and the candidate authority lists their SHA-256 digests.
…dget main's platform-vitest-main workflow contract budgets this test's TEST_TIMEOUT_MS inside WSL shard 1. A 60-minute value exceeded the shard budget, so the value returns to main's 50 minutes. The per-step budgets stay as ceilings; live runs on this target finish in 6 to 8 minutes.
|
PR Review Advisor finished for commit Request review only when Require no Advisor blockers is green. |
Revision-specific disposition for the conflict resolutionThe conflicts are resolved and the revision is validated. The PR is now Revisions
Merge behavior for the shared target
Validation on
Not done: no new live run on the earlier |
Signed-off-by: Kao Félix <me@kaofelix.dev>
Signed-off-by: Kao Félix <me@kaofelix.dev>
Signed-off-by: Kao Félix <me@kaofelix.dev>
Signed-off-by: Kao Félix <me@kaofelix.dev>
wscurran
added
area: cli
Outcome
Onboarding a managed OpenClaw sandbox can now allow extra dashboard browser origins that keep their own port, such as
https://launchpad.example.com:8443in front of the dashboard on 18789. Before, the only input wasCHAT_UI_URL, whose port onboarding replaces with the dashboard port, so OpenClaw rejected a proxy origin on another port.This PR builds on #13198, which merged on October 16, and targets
main.Reason
The decision on #13177 accepts a separate onboard setting for this case: #13177 (comment).
nemoclaw <sandbox> config setrefusesgateway.*keys, so there was no supported host-side way to add such an origin.Related issues
Refs #13177
Changes
nemoclaw onboard --dashboard-origin <origin>flag andNEMOCLAW_DASHBOARD_ORIGINS(comma-separated). Each value must be a bare origin, and a remote origin must usehttps. Invalid values fail before onboarding starts.scripts/generate-openclaw-config.mtsreadsNEMOCLAW_DASHBOARD_ORIGINS, validates it again, and appends the origins togateway.controlUi.allowedOrigins. It does not change the dashboard bind ormode.extraOriginskey. It is omitted when no origin is set, so existing profiles encode the same as before. The image maps the key toNEMOCLAW_DASHBOARD_ORIGINSonly when it is present. The reviewed in-image runtime bundle is regenerated.dashboardOriginsis recorded at creation and on reuse. The registry and gateway index accept only a normalized list.NEMOCLAW_DASHBOARD_ORIGINSdoes not change a rebuild.--fromor the Dockerfile fallback) and for agents other than OpenClaw, instead of dropping it.docs/reference/commands.mdxdocuments the flag and the variable.The decision comment originally described a Dockerfile build argument as well. The root Dockerfile has a growth budget that requires new onboarding behavior to use the managed startup profile, so the comment was edited to make the setting managed-image only.
Verification
Validation for merge commit
7336192b76against997d5748a4ran in a container without host credentials:Historical evidence:
npm run docspassed on179e1ae951with zero errors and two warnings.dashboard-remote-bindonb95f6a5c3passed for OpenClaw and Hermes, including the OpenClaw rebuild-origin assertions. These results do not establish live evidence for the merged revision.Receipt refresh
452aeabc9frecords the Linux AMD64 and ARM64 Pi images qualified together by successful managed-images run 41696614823 for source7336192b76. The trusted-main collector authenticated both artifacts and checked their digests, source revision, cohort, platforms, and release. Both receipt hashes match the updated authority, and strict source-parity validation passed. The refresh changes only the two receipts and their authority hashes.CI on
7336192b76finished with the expected missing-receipt rejection and inherited synthetic hook-test timeouts. The adapter shard passed its one retry. Formatting and plugin shards repeated the 15-second deadline on their one retry each; those failures remain unresolved. The tests and their copied inputs match main997d5748a4; focused unchanged Linux runs passed all 9 formatting, 9 plugin, and 18 adapter cases. The precise CI timing cause remains unproven. CI and automated reviews on the receipt refresh are pending; these results do not establish merge readiness.Review notes
7336192b76resolves the three qualification-file conflicts with main997d5748a4. The origin feature and main's security and rebuild recovery changes are retained. The combined source was qualified by managed-images run41696614823; receipt refresh452aeabc9frecords that evidence.COPYinstructions now share one statement with the same destination paths. This keeps the Dockerfile at main's line count and reduces its byte count by 31, without relying on the PR-specific growth exception.7336192b76against997d5748a4inNVIDIA/NemoClaw, including qualification conflict resolution, retained origin handling, and auto-merged build staging. No additional source defect was identified. CodeRabbit skipped incremental review on7336192b76, and no full review or Advisor specialist review was scheduled for that revision. Independent review of the combined revision is pending. The nine clear Advisor specialist results onb95f6a5c3remain historical evidence.extraOrigins. This affects only a sandbox onboarded with the flag, after a downgrade or with an older CLI sharing~/.nemoclaw. Rebuild, clone, and managed snapshot restore then fail before changing anything.--dashboard-originandNEMOCLAW_DASHBOARD_ORIGINSfor managed OpenClaw images, and that a rebuild applies recorded changes. This PR does not add a dateddocs/changelog/file, because release entries are written per release; the flag is documented indocs/reference/commands.mdx.Signed-off-by: Kao Félix me@kaofelix.dev
Summary by CodeRabbit