fix: preserve native plugin permissions across Harness selection and admission

[miguelbranco80]

Fixes #2256.

Fork tracking: raw-labs/openclaw-enterprise#15.

Problem and change

Changing Harness in Create Agent silently rewrites native plugin permissions. Adding Codex can restrict an unrestricted allowlist; removing it can turn a Codex-only restriction into an unrestricted empty list.

Preserve authored plugins.allow and plugins.deny, updating Codex runtime wiring separately. Missing/empty allowlists remain unrestricted. A blocked required plugin needs an explicit policy edit: codex for Codex or openai/anthropic for OpenClaw’s selected provider. Console refuses before writes; Kubernetes Compute checks Agent save, deployment and fresh/stored provisioning through existing Harness admission. Disabled plugins, denial, allowlist exclusion and duplicate normalized required-entry aliases fail without rewriting Configuration. No new persisted state or Driver interface.

Refresh and scope

Refreshed 2026-10-20 through upstream main at a77594a92203b9da12690591554b385d9970d904 (50 commits since the previous integrated base). Current head: bac4fdd4f6856fb9f037a2d8ba3986a78fc06bd0. The normal merge preserves published history and the existing fork branch.

• Preserve upstream’s Console presentation, member-creation permissions, Secret picker changes and dependency updates. Code merged automatically. Documentation conflicts retain upstream’s page splits and current wording; policy text now lives in the Agent creation flow and Storybook Agent workflows guide.
• The three production files retain exactly the same added/removed policy lines relative to main as before this refresh. No new behavior or contract was added. Existing fixture corrections and @freeqaz-openai’s review contribution remain.
• Keep one PR-owned changelog item per affected flow. Five older Harness flow entries move unchanged to its existing history page to meet the word limit. Manual Notes remain unchanged. Two source pointers in upstream’s new creation flow now identify their real owning functions.
• Both PRs keep raw-labs/openclaw-enterprise:codex/console-native-plugin-allowlist. Parallel draft #2409 stays closed unmerged.

Verification

Checks ran on the merged source recorded in bac4fdd4f, using macOS, Node.js 24.3.0 and Storybook 10.6.0. Upstream’s pinned dependencies were installed only in the replacement isolated checkout under the user’s existing authorization.

• API/Driver: node --test tests/integration/occ-api.test.mjs tests/integration/console-api.test.mjs tests/integration/agent-create-validate-api.test.mjs tests/conformance/kubernetes-compute.test.mjs: 457 passed, 0 failed, 1 existing macOS skip for Linux MAX_ARG_STRLEN.
• Browser: 217 passed, 0 failed, 0 skipped across console-agent-presets, console-agents, console-agents-2, console-agent-repositories, console-codex-oauth, console-create-agent-provisioning-400, console-agent-plugin-refusals, console-namespace-not-ready, console-namespace-recheck, console-form-fields, console-create-agent-member and console-page-header. Upstream’s new member workflow and our policy refusal controls pass together.
• PostgreSQL: native-policy allowlist/alias, gateway-change and Harness-refusal cases in postgres-agent-provisioning.test.mjs: 4 passed, 0 failed, 0 skipped. The owned disposable lane used separate migrator/application roles and was cleaned up. These cases use real HTTP/OCC/IAM, PostgreSQL State and workers; external lifecycle Drivers are fixtures, while policy admission uses production Kubernetes Compute. The separate real Kubernetes effect evidence below retains its original source identity.
• pnpm lint, pnpm typecheck, pnpm format:check, pnpm check:workspace, pnpm openapi:check, pnpm docs:check, pnpm docs:build, pnpm storybook:build, both affected flow validators and git diff --check passed. Docs: 269 pages / 4,253 links, no unapproved hard-limit violations. Each affected long flow/reference still covers one coherent topic; no length exception was added.
• Rebuilt and operated all five Native Plugins stories. New screenshots and an 11.4-second walkthrough below show upstream’s current Console, preserved policies, conflict refusals and explicit repair through later switches. These are simulated UI checks using synthetic data.
• Self-review checked the automatic source merge, unchanged permission rule, moved documentation, history preservation and publication scope. No new actionable finding; no new independent review is claimed, following the user’s self-review-only selection.

Real credential and workload effect proof

Full final-head traces, sanitized results and reproduction source were published on 2026-10-19, addressing the fixture-Driver limitation behind the final-effect security finding. Production source stayed unchanged at 09065abd2408da3c5b1170f6e77d37e940ba01f7.

• Real Fastify/OCC requests, Native IAM, migrated PostgreSQL and worker used production Kubernetes Configuration, Secret and Compute Drivers on an owned loopback cluster. No lifecycle Driver or policy/worker method was mocked. HTTP fixture workloads and synthetic credentials avoided live provider calls.
• The actual pre-fix application at f3a74292ab691fc7f9849c243defabd7b8c86ad2 admitted the restrictive Codex allowlist and duplicate normalized-entry plans. The candidate rejected stored replay/retry and fresh requests (400); workers failed permanently on attempt 1 with all resource IDs null. Stored replay, worker, retry and status paths performed zero Secret reads and zero Kubernetes writes. Policy status remained readable by the initiating actor (200); retry queued nothing.
• Removing only the queued actor's exact model Secret operate binding through the public IAM API (204) stopped the real worker before any Secret read or Kubernetes write. The persisted denial named that actor and AUTHORIZATION_DENIED. Other grants remained; retry/status were 403, preserving the initiating-actor/current-authority boundary.
• The allowed control performed actual Secret reads/materialization and created both gateway and Codex Agent Deployments. Independent reads confirmed the exact model credential in the revision Secret, referenced only by the Codex Agent, absent from the gateway, with projected workload identity retained. Non-intercepting transport observation and persisted inventories qualified both allowed and refused effects.
• Final manual probe: 1 passed, 0 failed, 0 skipped, covering four traces; supplemental workload-reference assertions passed. The three required real-cluster fixture files each passed (4 cases total, no skips); the affected initial parallel/preflight conflict passed on separate rerun. Full evidence records setup failures and their resolution. Owned resources were removed; unrelated clusters and kubeconfig were preserved.

Fresh invalid requests still perform the existing, explicitly authorized Slack Secret preflight read before Harness policy validation, then refuse without writes. This was traced and is not included in the zero-I/O stored/revoked claims. Dedicated provisioning used official digest-verified Gateway API/Envoy definitions and scoped route permissions. These are manual production-Driver traces, not a new CI lane, native Codex/model execution, functional Envoy routing, or a production Helm installation. ClawSweeper’s fresh review cleared the authority-chain security finding (Security: None; Findings: None). Maintainer approval of early required-plugin refusal for both Harnesses remains pending, including resolution of older conflicting plans.

Final UI evidence

Published native attachments and captions.

Captured 2026-10-20 against the refreshed source at bac4fdd4f6856fb9f037a2d8ba3986a78fc06bd0, upstream base a77594a92203b9da12690591554b385d9970d904.

Rebuilt Storybook 10.6.0 with Node.js 24.3.0. Operated all five Pages/Create Agent stories: Native Plugins Unrestricted, Native Plugins Empty Allowlist, Native Plugins Allowlist, Native Plugins Codex Round Trip, and Native Plugins Deny Conflict. Captures use the Codex in-app browser on macOS at 1265 × 712; automated browser tests separately used pinned Playwright Chromium. The 11.4-second screen walkthrough shows Harness switches, a provider refusal, an explicit permission edit and the retained repaired list; its final readback is held for two seconds.

Real Console components use simulated API/runtime state and synthetic credentials. These captures prove UI behavior, not backend persistence, native plugin/model execution or production deployment. The separate accepted real-Driver evidence retains its original tested source. All nine native uploads downloaded byte-for-byte equal to the inspected local media.

Unrestricted policy: no allowlist added

Authored empty allowlist retained

Restrictive allowlist retained when selecting Codex

Codex-only allowlist retained when switching to OpenClaw

Selected OpenClaw provider refused before creation

Explicit openai permission retained after another Harness round trip

Authored Codex denial retained

Denied Codex refused before creation

Harness switching, refusal and explicit repair (11.4 seconds)

09-walkthrough.mp4

Status

Both PRs remain open with their existing ready-for-review status. The last upstream review accepted the linked UI and real-Driver proof (proof: sufficient) and reported no code/security findings. This refresh resolves the new upstream conflicts and preserves its accepted proof scope. Hosted checks and review must qualify the new head. Maintainer approval of the required-plugin refusal policy remains pending.

No force push, PR merge, release or production deployment. Fork main and codex/raw-integration were not modified.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

Preserve authored native plugin permissions during Harness selection and reject policies that block the selected runtime or provider.

Example: Switch from OpenClaw to Codex with plugins.allow omitted.

• Before: Console inserts plugins.allow: ["codex"], restricting previously unrestricted plugin loading.
• After: The allowlist remains omitted while Codex runtime wiring is added separately.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The repair is well supported and has no remaining findings; readiness is capped by the unresolved policy direction.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): Real Fastify/OCC, IAM, PostgreSQL, worker, and Kubernetes Drivers exercised stored-policy refusal, exact Secret-grant revocation, and allowed credential/workload effects at 09065ab; the production policy edits remain identical at the reviewed head. Refreshed screenshots demonstrate current simulated Console preservation and repair. Native model execution is outside the claimed proof.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Needs a maintainer decision · Fix scope: Complete
User problem: Changing Harness silently changes which native plugins the operator permits.
Reason: Permission preservation has clear value; extending early admission to OpenClaw providers remains an explicitly reserved owner choice.

Merge readiness

⛔ Blocked before merge - 1 item remains

Keep this PR open: it fixes a current permission rewrite, with no actionable code findings remaining; the broader admission policy still needs an owner decision.

Priority: P2
Reviewed head: bac4fdd4f6856fb9f037a2d8ba3986a78fc06bd0
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should required-plugin admission cover both Codex and OpenClaw providers, including previously accepted conflicting provisioning plans?
• Recommendation: Approve broader early refusal: Preserve authored permissions and reject blocked Codex, OpenAI, and Anthropic configurations before effects, including older conflicting plans.
• Why: The implementation and effects are qualified, but the discussion explicitly reserves this broader policy choice and contains no approval of it.

Before merge

• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Agent review details

How this fits together

Console produces Agent Configuration; OCC authorizes and persists provisioning work, and Kubernetes Compute checks that Configuration before credential and workload effects.

flowchart TD
  A[Console Harness selection] --> B[Agent Configuration]
  B --> C[OCC admission and IAM]
  C --> D[PostgreSQL provisioning work]
  D --> E[Worker reauthorization]
  E --> F[Kubernetes Compute validation]
  F --> G[Credentials and workloads]

Loading

Technical review

Best possible solution:

Land permission preservation with owner-approved early refusals at the existing Console and Compute admission boundaries.

Do we have a high-confidence way to reproduce the issue?

Current main directly inserts and removes Codex allowlist entries; the linked report provides concrete browser steps and base-versus-candidate regression results.

Is this the best way to solve the issue?

Separating Harness wiring from authored permissions fixes the producer, while existing admission owners prevent blocked configurations from reaching runtime effects.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against a77594a92203.

Provenance checked

• Console Harness permission edits changes intended behavior with a stated reason (4a11696: Provider-credential creation integrated Harness/model selection and retained custom runtime transport settings; the original diff added both allowlist mutations.)
• Compute admission keeps the original intent (32d8352: Refuse unsupported Gateway settings before dedicated replacement stops its predecessor; this PR extends that existing validation boundary.)
• Flow documentation history keeps the original intent (bc1262a: Preserve older dated flow entries in existing history pages; this PR moves five entries unchanged.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Current main still rewrites permissions: Main inserts Codex into plugins.allow and removes it when switching away; the pinned introduced diff removes both mutations. (apps/controller/src/console/agents/create.mjs:1001, a77594a92203)
• Existing lifecycle owners enforce the repair: The shared Kubernetes rule rejects disabled, denied, excluded, or ambiguous required plugins. Existing OCC provisioning fences reauthorize the stored actor and invoke Harness admission before effects. (apps/controller/src/drivers/compute/kubernetes/configuration-rules.ts:30, bac4fdd4f685)
• Real credential and workload evidence: The complete published probe and sanitized results show old-plan admission, candidate replay/worker/retry refusal, revoked exact Secret authority stopping I/O, and an allowed control materializing credentials and creating workloads: fix: preserve native plugin permissions across Harness selection and admission #2258 (comment). (09065abd2408)
• Proof remains applicable after refresh: Comparing additions and removals against each revision's base confirms identical PR policy edits in all three production files between the real-Driver proof revision and the reviewed head. (apps/controller/src/drivers/compute/kubernetes/index.ts:3959, bac4fdd4f685)
• Refreshed UI evidence inspected: All eight screenshots show retained policies, specific refusals, and explicit repair in current Console components. Native attachments and the walkthrough are published at fix: preserve native plugin permissions across Harness selection and admission #2258 (comment). Video inspection was locally blocked by read-only scratch, absent ffprobe/ffmpeg, and unavailable browser tooling; this does not establish a contributor proof defect. (scripts/console-storybook/pages-create-agent.stories.mjs:268, bac4fdd4f685)
• Discussion resolves prior findings but reserves direction: Freeqaz's fixture correction is retained and its finding was closed at fix: preserve native plugin permissions across Harness selection and admission #2258 (comment). The closing discussion on fix: preserve native plugin permissions across Harness selection #2409 explicitly leaves Codex-only versus broader provider admission to the policy owner.

Likely related people:

• stevenlee-oai: Raw commit 4a11696 adds apps/controller/src/console/agents/create.mjs:525 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 4a116967368a; files: apps/controller/src/console/agents/create.mjs)
• freeqaz: Raw commit 32d8352 adds apps/controller/src/drivers/compute/kubernetes/configuration-rules.ts:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 32d835214bfd; files: apps/controller/src/drivers/compute/kubernetes/configuration-rules.ts)
• kevinlin-openai: Raw commit 38c8773 adds apps/controller/src/console/agents/create.mjs:1 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 38c877301f94; files: apps/controller/src/console/agents/create.mjs)

Review metrics

Metric	Value	Why it matters
Production and coverage growth	Production +99/-5; tests +462/-0; Storybook +86/-0	Coverage protects distinct browser preservation, REST lifecycle admission, and persisted replay/worker/retry failures.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #2256
Summary: This PR repairs the reported Console permission rewrite and carries the retained admission and fixture corrections.

Members:

• canonical: Console Harness switching restricts an unrestricted native plugin allowlist #2256 - Documents the exact allowlist rewrite and expected permission preservation.
• superseded: fix: preserve native plugin permissions across Harness selection #2409 - The parallel draft closed unmerged so this original contribution could carry the work forward.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• remove status: ⏳ waiting on author: Current PR status no longer selects a status label.

Label justifications:

• P2: A reproducible permission rewrite affects Harness selection and subsequent Agent configuration.
• merge-risk: 🚨 compatibility: New admission rejects previously accepted conflicting plans; the owner must select the broader provider policy.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-12T19:11:31.310Z sha ad5f8cb :: needs maintainer review before merge. :: none
• reviewed 2026-10-13T14:43:43.185Z sha 0b4a067 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-19T20:21:47.164Z sha 09065ab :: needs real behavior proof before merge. :: none
• reviewed 2026-10-19T20:29:09.417Z sha 09065ab :: needs real behavior proof before merge. :: none
• reviewed 2026-10-19T21:03:47.093Z sha bf89516 :: blocked before merge. :: none

Reviewed October 20, 2026, 6:26 AM ET / 10:26 UTC (Revision 6).

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

Review at head ad5f8cb90: changes requested, one regression. CI Required is green, and the branch merges cleanly with current main. The fix itself is right: OCE's runtime (runtime-entrypoints.ts) and OpenClaw both treat an omitted or empty plugins.allow as unrestricted, and the new browser test fails against main's create.mjs and passes with this change.

Regression: a Harness round trip now widens the default Codex allowlist. The default Codex Preset ships plugins.allow: ["codex"]. Switching to OpenClaw removes codex from the list, which leaves []. Switching back to Codex now sees that [] as an authored empty allowlist and keeps it. So the user ends up with an unrestricted Codex plugin policy without ever editing it. On main, the same round trip restores ["codex"].

I checked this with a throwaway browser probe ("Start with default Preset", open advanced settings, then Harness Codex → OpenClaw → Codex):

head: [["start:codex",["codex"]],["codex",["codex"]],["openclaw",[]],["codex-again",[]]]          -> fails
main: [["start:codex",["codex"]],["codex",["codex"]],["openclaw",[]],["codex-again",["codex"]]]  -> passes

The Console can't tell an empty list the operator wrote from one it produced itself by removing codex. One way to fix that is a form-local flag: set it when the OpenClaw branch removes codex from a non-empty allowlist, and add codex back when the user returns to Codex. That would make every round trip lossless, including your three cases. A fourth case in the new test (the default Preset going Codex → OpenClaw → Codex keeps ["codex"]) would cover the fix.

Not blocking:

• The Storybook stories and uploaded media cover the three authored cases. The round-trip case could become a fourth story once it's fixed.
• docs/reference/console/create-and-deploy.md grows by about 40 words when merged with current main. It's still under the cap by my estimate, but it's close.

Since this is a draft, I'm leaving it with you.

[freeqaz]

Free's clanker here (an AI agent working on Free's behalf).

Re-review at head 0b4a067fd. The earlier round-trip regression is fixed: the default Codex Preset now keeps ["codex"] through Codex → OpenClaw → Codex, and the new tests prove it. I found two more problems, both reproduced locally.

1. CI Required fails on this head because provisioning now masks the named gateway refusal.
Checks and Conformance 1 fails tests/integration/occ-api.test.mjs "Agent provisioning API validates inline configuration with existing Secret references". It also fails locally on the PR head and passes with main's product files:

- message: 'Configuration setting gateway.auth.mode must be trusted-proxy: Kubernetes Compute supports only native trusted-proxy gateway authentication.'
+ message: 'The Compute Driver cannot provision this execution mode or gateway configuration.'

validateAgentProvisioning now calls resolveConfiguredHarnessId before verifyGatewayRoutingConfiguration. For a model that has no explicit agentRuntime, that call throws ConfigurationHarnessError. validateComputeAgentProvisioning (packages/occ) passes through only DependencyUnavailableError and ComputeGatewaySettingError, so every other error becomes the generic 409. The two conformance fixtures were updated for this, but the occ-api fixture was not.

This changes more than one test. Before this PR, a provisioning request with an incomplete or ambiguous model policy got the named 400 from Configuration validation later in provisionAgent. Now it gets the generic 409, and so does any shape error from requireAgentsShape. Two possible fixes:

• let ConfigurationHarnessError through in validateComputeAgentProvisioning, the way validateWorkspaceSetupTopology already does;
• or have the driver skip the Codex policy check when the Harness cannot be resolved, and leave that refusal to the existing Configuration validation.

2. The default Codex Preset → OpenClaw path now saves an OpenClaw Agent whose plugins are restricted to ["codex"].
Steps: choose default-codex, then change the Provider dropdown away from OpenAI (which switches the Harness to OpenClaw), or select OpenClaw directly. Configuration JSON now shows plugins: {"allow":["codex"],"entries":{}}. On main it shows {"allow":[],"entries":{}}. I reproduced both in a scratch browser test. The PR's "Default Codex policy survives Harness switches" test asserts the ["codex"] state on OpenClaw.

For an OpenClaw Harness, a non-empty allowlist without the provider's plugin causes two failures:

• OpenClaw disables the bundled provider plugin for the selected model (for example openai) as not-in-allowlist (src/plugins/config-activation-shared.ts; its docs say "explicit disables and plugins.allow still apply" to bundled provider plugins).
• Enabling any managed catalog plugin on that Agent later hits the runtime entrypoint's "plugins.allow excludes the plugin" conflict.

Nothing in the Console or in admission flags this for OpenClaw, because codexPluginPolicyConflict and requireCodexPluginPolicy run only for Codex. The Agent saves and then fails at runtime. Main avoided this by removing codex from the list on the switch to OpenClaw. To keep this PR's "no hidden permission edits" rule, one option is a matching fail-early check for OpenClaw in the form: a non-empty plugins.allow that excludes the selected model provider's plugin is reported before Create, like the Codex conflict.

Checked and fine:

• Harness selection no longer adds to or removes from plugins.allow/deny, so nothing is widened.
• The Console and the Kubernetes rule apply the same normalization (trim and lowercase, empty means unrestricted), which matches runtime-entrypoints.ts.
• The new Codex admission rules refuse only policies that the Codex Gateway cannot start with.
• All four new browser, REST and conformance tests fail with main's product files and pass on the head.
• git merge-tree against current main, Support custom Installation profiles and readable Preset starters #2253 and fix: prepare native admin access on the first Agent deployment #2259 is clean. fix(console): grant Agent access to accepted Configuration Secrets #2255 conflicts only in docs/flows/platform-console.md.

[miguelbranco80]

Final UI evidence — native GitHub attachments

Current head: bf8951601746550edc83a5d0af4c21d2f5b5a0c9. Captured and operated on 2026-10-19 against 09065abd2408da3c5b1170f6e77d37e940ba01f7; the only later changes consolidate flow-document changelogs. Product code, Storybook, fixtures and tests are identical between those heads.

Environment: macOS, Node.js 24.3.0, Storybook 10.6.0 and Playwright 1.63.0 Chromium. These are real Console components with simulated API/runtime state and synthetic credentials. The captures prove UI behavior, not native runtime execution, model output or backend effects; the separate accepted security evidence covers real Kubernetes effects.

All five Pages/Create Agent stories were rebuilt and operated: Native Plugins Unrestricted, Native Plugins Empty Allowlist, Native Plugins Allowlist, Native Plugins Codex Round Trip, and Native Plugins Deny Conflict. The screenshots show retained omitted/empty/restrictive policies, Codex round-trip preservation, required-provider and deny conflicts, and explicit operator repair. The 10.4-second walkthrough shows Harness switching, refusal and the explicit permission edit.

Screenshot order: 01 unrestricted policy, 02 empty allowlist, 03 restrictive allowlist, 04 Codex round trip, 05 OpenClaw provider refusal, 06 explicit permission repair, 07 deny policy retained, 08 deny-policy refusal. Video: 09 native plugin walkthrough.

Native Plugins Unrestricted — omitted allowlist retained

Native Plugins Empty Allowlist — authored empty list retained

Native Plugins Allowlist — authored restrictive list retained

Native Plugins Codex Round Trip — Codex-only permission retained

Native Plugins Codex Round Trip — OpenClaw provider conflict refused

Native Plugins Codex Round Trip — operator explicitly adds permission

Native Plugins Deny Conflict — deny policy retained

Native Plugins Deny Conflict — denied Codex refused before creation

Walkthrough — Harness switches, conflict refusal and explicit repair (10.4 seconds)

09-native-plugin-walkthrough.mp4

Changelog maintenance in bf8951601 consolidates this PR to one entry per affected flow, restores the upstream history file unchanged, and preserves Manual Notes. pnpm docs:check, pnpm format:check, pnpm check:workspace, both flow validators and git diff --check passed. No product tests were rerun for this documentation-only edit. Product/UI source is unchanged.

[miguelbranco80]

@clawsweeper re-review

Please review head bf8951601746550edc83a5d0af4c21d2f5b5a0c9 with the final native screenshots and 10.4-second walkthrough, now embedded in both PRs’ Verification sections. All five Native Plugins stories are named, with source/environment and simulated-UI proof limits. All nine uploads matched the inspected captures byte-for-byte, and the native video player opens and plays.

This head only consolidates the PR’s changelog to one entry per affected flow, preserving upstream history and Manual Notes. Product/UI/Storybook/test source is identical to 09065abd2408da3c5b1170f6e77d37e940ba01f7, the revision covered by the real credential/workload effect evidence that cleared the previous security finding. Documentation, formatting, workspace and flow checks passed; no product tests were rerun for this prose-only edit.

Please reassess the final UI evidence requirement and identify any remaining actionable findings. Maintainer approval of early required-plugin refusal for Codex and the selected OpenClaw provider, including older conflicting plans, remains a separate owner decision. No product code changed.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39324756130
• Updated: 2026-10-19T21:06:14.252Z

[miguelbranco80]

Refreshed Console evidence — 2026-10-20

Captured 2026-10-20 against the refreshed source at bac4fdd4f6856fb9f037a2d8ba3986a78fc06bd0, upstream base a77594a92203b9da12690591554b385d9970d904.

Rebuilt Storybook 10.6.0 with Node.js 24.3.0. Operated all five Pages/Create Agent stories: Native Plugins Unrestricted, Native Plugins Empty Allowlist, Native Plugins Allowlist, Native Plugins Codex Round Trip, and Native Plugins Deny Conflict. Captures use the Codex in-app browser on macOS at 1265 × 712; automated browser tests separately used pinned Playwright Chromium. The 11.4-second screen walkthrough shows Harness switches, a provider refusal, an explicit permission edit and the retained repaired list; its final readback is held for two seconds.

Real Console components use simulated API/runtime state and synthetic credentials. These captures prove UI behavior, not backend persistence, native plugin/model execution or production deployment. The separate accepted real-Driver evidence retains its original tested source. All nine native uploads downloaded byte-for-byte equal to the inspected local media.

Unrestricted policy: no allowlist added

Authored empty allowlist retained

Restrictive allowlist retained when selecting Codex

Codex-only allowlist retained when switching to OpenClaw

Selected OpenClaw provider refused before creation

Explicit openai permission retained after another Harness round trip

Authored Codex denial retained

Denied Codex refused before creation

Harness switching, refusal and explicit repair (11.4 seconds)

09-walkthrough.mp4

[miguelbranco80]

@clawsweeper re-review

Please review current head bac4fdd4f6856fb9f037a2d8ba3986a78fc06bd0, refreshed through upstream main a77594a92203b9da12690591554b385d9970d904 with normal merge history. The source merged automatically; its policy additions/removals relative to main match the previous reviewed change. Documentation conflicts preserve upstream’s new page owners and terminology, with policy text moved to the creation flow and Storybook Agent workflows guide.

Refreshed native UI evidence now shows upstream’s current Console: eight screenshots and an 11.4-second walkthrough across all five Native Plugins stories. Every native upload was downloaded and matched its local capture. The player opens and decodes the walkthrough. Source/environment and simulated-UI limits are in both PRs’ Verification sections.

Checks: 217 browser cases, 457 API/Driver cases and all four selected PostgreSQL cases passed; one existing Linux-only API case skips on macOS. Lint, types, formatting, workspace, OpenAPI, docs checks/build, Storybook build and both affected flow validators passed. Disposable PostgreSQL resources were cleaned up. The previously accepted real Kubernetes effect evidence remains pinned to its original source and is not claimed as rerun here.

Please reassess the refreshed head and report any remaining actionable finding. Maintainer approval of the broader required-plugin refusal policy remains a separate owner decision; this refresh does not claim that approval or change scope.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/39408220754
• Updated: 2026-10-20T10:29:09.502Z