[freeqaz-openai]

An Agent with Repository collaborator access can push a branch and open a pull request in any repository its operator selects. OCE gives stock OpenShell a GitHub App credential scoped to those repository IDs. GitHub enforces the App permissions and branch protections. OCE refuses deploy-key creation. Stock OpenShell 0.1.6 limits each complete Git push request to 4 MiB, including framing. Selected-repository REST JSON is limited to 1 MiB and GraphQL JSON to 64 KiB.

Watch the Agent open a pull request

oce-agent-pr-redacted-v2.mp4

The operator created an Agent on k3d with OCE c9ab6cf6 and stock OpenShell 0.1.6, then sent one message in a new conversation. The Agent committed, ran git push and gh pr create, and replied with the PR link. An independent gh pr view showed the PR open against main at the same commit, 501543d8687f. The operator then closed it without merging and deleted the branch. Test PR #4150

Waits and navigation are trimmed. The model and private runtime selector are masked.

What failed and what now covers it

Fresh deployments refused repository-scoped Git writes at admission. Released OpenShell 0.1.6 provides the hook OCE uses to check the current grant before attaching a credential. Required CI now exercises two selected repositories and a third outside the grant. On 209549c1, GitHub accepted the push, then the first gh pr create GraphQL request returned 403. Replaying the bundled CLI’s captured requests reproduced the old hook’s refusal of its metadata headers. The required suite now exercises those requests.

An earlier stock OpenShell run on OCE ffcbf545 used controlled Git and API origins. A and B accepted writes. C’s Git refs stayed unchanged. The sender denied REST for C, and the provider denied GraphQL for C. After B was removed, the same Agent received a denial on its existing connection. The origin’s HTTP request count stayed at 40 through that response. The next request retired the credential.

Installed denial trace (UTC, OCE ffcbf54)

00:52:02.884  B write accepted                    origin HTTP #40
00:52:03.994  Controller readback: only A         origin count 40
00:52:05.436  Same client and TLS socket: denied  origin count 40
00:52:07.405  Later credential retirement         origin HTTP #41
Fresh socket: one new TLS connection, zero new HTTP requests.

Required CI and First Agent Smoke · AMD64 and ARM64 image verification

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR enables Git and GitHub API access to an Agent’s explicitly selected repositories through OpenShell.

Example: An Agent selects repositories A and B with Repository collaborator access.

• Before: Protected repository collaboration was refused at deployment admission.
• After: The Agent can push and open pull requests in A and B; C remains outside its credential scope, and removing B denies subsequent use of the original credential.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	Useful owner-approved functionality with installed workflow evidence, meaningful authorization coverage, and a verified restore-compatible merge.
Proof confidence	🦞 diamond lobster (5/6) ✨ media proof bonus	Sufficient (screenshot): Supplied screenshots and independent GitHub readback establish the Console-to-Agent Git push and pull-request workflow on k3d with stock OpenShell 0.1.6 at c9ab6cf; the installed controlled-origin trace establishes third-repository refusal and same-connection denial after withdrawal before further HTTP I/O. PostgreSQL coverage additionally checks session replacement and owner restart.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Product

Kind: Feature · Worth it: Yes · Fix scope: Complete
User problem: Agents on OpenShell could not perform ordinary Git and GitHub collaboration across their operator-selected repositories.
Reason: Maintainer direction approves the capability, and the recorded Agent-created pull request demonstrates concrete value within the existing platform boundaries.

Merge readiness

✅ Ready for maintainer review

Keep this PR open for landing: it delivers a maintainer-approved capability, and the published merge preserves restore compatibility without a blocking introduced defect found.

Priority: P2
Reviewed head: 5d670fc09a19a1db4f0b19b579cc5b374bb65ea8

Before merge

None.

Findings

None.

Agent review details

How this fits together

Repository policy resolves operator-approved selections; OCC records admission and live sessions, Token Service prepares scoped credentials, and the OpenShell sender checks current authority before credential injection and GitHub I/O.

flowchart LR
  Operator[Operator repository selection] --> OCC[OCC admission and sessions]
  OCC --> Tokens[Token Service]
  Tokens --> Sender[OpenShell sender]
  Agent[Agent Git and GitHub CLI] --> Sender
  Sender --> Authority[Current authority check]
  Authority --> OCC
  Sender --> GitHub[GitHub repositories]

Loading

Technical review

Best possible solution:

Land the selected-repository path with its mandatory request binding, live session checks, preserved narrow grants, and verified restore fingerprints.

Do we have a high-confidence way to reproduce the issue?

Pinned main explicitly refuses the bundled repository Git sender and lacks selected-set delivery; the supplied installed demonstration establishes the requested workflow after the change.

Is this the best way to solve the issue?

The implementation extends the existing policy, credential, session, and sender owners while keeping installation-wide access separate and preserving explicit historical grants.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5f8ba60705bd.

Provenance checked

• Prepared credential ownership and finite grants keeps the original intent (3115679: Separate repository scope, preparation, delivery, current authorization, and retirement while retaining the original credential owner.)
• Bundled OpenShell qualification refusal changes intended behavior with a stated reason (58c94cc: Refuse delivery before deployment because the bundled sender could not establish mandatory online enforcement; this PR replaces that limitation with configured binding verification and a held-launch denial challenge.)
• Logical-restore catalog acceptance keeps the original intent (5f8ba60: Accept exact measured PostgreSQL restore fingerprints without weakening catalog, privilege, or migration-receipt validation.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Published merge preserves exact restore aliases: The pinned main-to-head diff retains main’s list-valued aliases, classifies the preceding catalog as preSelectedRepositorySet, and records both completed-catalog restore fingerprints, including the checkpoint-51 upgrade spelling. (migrations/meta/_canonical-history.json:545, 5d670fc09a19)
• Upgrade and refusal coverage: The logical-restore test upgrades a populated 51-receipt archive, preserves identities and original receipts, and checks completed history afterward; hostile constraint, grant, and receipt changes remain refused. The maintainer reports 188 migration tests passing on this merge: Enable Git and GitHub API access to an Agent’s assigned repositories on OpenShell #4098 (comment). (tests/integration/postgres-migration-compatibility.test.mjs:2486, 5d670fc09a19)
• Current authority covers every selected member: The shared grant projection retains missing members, checks current selection and expiry, and freezes member session identities; authorization locks member rows and rereads authority before committing an allow. PostgreSQL coverage exercises removal, replacement, expiry, cleared selections, and owner restart. (apps/controller/src/drivers/repo/credentials/protected-repository-git-installation.ts:97, 5d670fc09a19)
• Installed behavior and withdrawal evidence: Inspected downloaded screenshots showing collaborator access, the Agent request, and its resulting pull request; GitHub independently confirms head 501543d at OCE real Agent test c9ab6cf6 #4150. The body records stock OpenShell denial after B’s removal with origin count unchanged at 40. Video preparation failed with ffprobe ENOENT; browser fallback could not prepare artifacts because scratch was read-only. These reviewer limitations do not invalidate the screenshots and recorded trace. (c9ab6cf68755)
• Owner direction and accepted limits: The collaborator-authored direction explicitly accepts operator-configured App permissions and ordinary provider-response limits. Review discussion makes the broader permission-model redesign nonblocking and replaces release-string checks with capability qualification: Enable Git and GitHub API access to an Agent’s assigned repositories on OpenShell #4098 (comment) and Enable Git and GitHub API access to an Agent’s assigned repositories on OpenShell #4098 (comment). (apps/controller/src/drivers/egress-proxy/openshell-request-hook-preview.ts:175, 5d670fc09a19)
• Pinned dependency requires the configured binding: This dependency is directly executed through the changed image pins and its protocol is consumed by OCE. At the pinned source revision, Allowlist and Exact require advertised bindings, reject malformed policies, and prevent missing request bindings from silently becoming dynamic; its root AGENTS.md was read. (crates/openshell-supervisor-middleware/src/binding_policy.rs:55, ac7f615cd12d)

Likely related people:

• Kevin: Raw commit 3afa09a adds packages/contracts/src/sandbox.ts:249 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 3afa09a6b2a2; files: packages/contracts/src/sandbox.ts)

Labels

Label changes:

No label changes.

Label justifications:

• P2: Useful repository collaboration functionality with an explicitly selected scope and no established urgent regression.
• merge-risk: 🚨 compatibility: Adds a persisted grant shape and changes OpenShell defaults; the recorded migration proof and preserved historical selections address the identified compatibility boundary.
• merge-risk: 🚨 security-boundary: Expands credential-backed repository operations; owner-approved permission limits, mandatory binding checks, and allowed/denied withdrawal evidence support the change.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🦞 diamond lobster and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.
• proof: 📸 screenshot: Contributor real behavior proof includes screenshot evidence.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (6 earlier review cycles)

• reviewed 2026-10-29T20:31:18.572Z sha 745ea3c :: needs real behavior proof before merge. :: [P1] Preserve clone-credential custody on the new API path | [P1] Register the new schema's verified logical-restore fingerprint
• reviewed 2026-10-30T00:23:24.098Z sha ffcbf54 :: needs real behavior proof before merge. :: [P3] Add the collaborator state to the maintained Storybook scenarios
• reviewed 2026-10-30T01:29:35.122Z sha 209549c :: needs changes before merge. :: [P3] Update the owning Driver references for selected repository sets
• reviewed 2026-10-30T03:29:46.919Z sha c9ab6cf :: needs maintainer review before merge. :: none
• reviewed 2026-10-30T19:38:14.161Z sha c4180f3 :: needs maintainer review before merge. :: none
• reviewed 2026-10-30T19:57:44.553Z sha a732571 :: needs maintainer review before merge. :: none

Reviewed October 30, 2026, 4:29 PM ET / 20:29 UTC (Revision 7).

[freeqaz-openai]

@clawsweeper re-review

Please review c4180f3dab933e7e7eb6ec5b4221e3f33714aa7a after integrating main. The selected-set tests now use the validated repository policy owner. The enrollment guide explains when to register a Gateway-owned Harness model source before enabling the repository Credential Proxy.

All 78 focused tests and the PostgreSQL standing Git transfer file passed locally with zero skips. The body preserves the real GitHub demonstration on its recorded commit. Recorded test PR · Current native image checks

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41117073215
• Updated: 2026-10-30T19:40:03.664Z

[freeqaz-openai]

@clawsweeper re-review

Please review a732571e9e891541605cdbacf5af031d51df2a5e. The sender now refuses GitHub deploy-key creation before authorizing credential attachment. Selected-repository REST writes accept up to 1 MiB of JSON, and the enrollment guide documents the released OpenShell 4 MiB complete push-request limit. The signed request tests cover the size boundaries, current authority and ordinary GitHub collaboration. The GitHub fixture now uses its explicit repository selection. Native image verification

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41119700102
• Updated: 2026-10-30T19:59:48.085Z

[freeqaz]

Merged main (incl. #4244) to resolve the migration manifest conflict in migrations/meta/_canonical-history.json (merge commit 5d670fc).

How it was resolved:

• Kept main's list-valued logicalRestoreCatalogs (the restored 51-receipt catalog, and both accepted spellings for the 64-receipt schema, which this PR now classifies as preSelectedRepositorySet).
• Kept this PR's 0065_selected_repository_set entry, new completed catalog and preSelectedRepositorySet shape.
• Bound the new completed catalog (fd7ca52d…) to two accepted restore spellings: 5c905f88… (a restore of the 65-receipt schema, as before) and 74bc7d9b… (a restored 51-receipt backup upgraded through 0065). Both digests were measured with catalogDigest on PostgreSQL 18.6 through the logical restore test's scenarios. Without the second alias, --check refuses the upgraded 51-receipt restore. A restored 64-receipt backup upgraded through 0065 produces 5c905f88…, so it needs no extra alias.
• scripts/migration-history.mjs and tests/integration/postgres-migration-compatibility.test.mjs merged automatically.

Checks on the merge commit (on a remote test VM): typecheck; Static Checks + Suite Audit, PostgreSQL Migrations (188/188 tests passed, including the logical restore test and populated canonical preSelectedRepositorySet), PostgreSQL Application, PostgreSQL Platform and Repository Credentials all pass.

[freeqaz-openai]

@clawsweeper re-review

Please review the published merge 5d670fc09a19a1db4f0b19b579cc5b374bb65ea8. Main changed the representation of accepted PostgreSQL restore fingerprints. The merge preserves the main aliases and records the independently reproduced checkpoint-51-to-0065 upgrade spelling. It has the same Git tree as the independently tested integration. The Git sender, repository authorization, and request bounds match the previously reviewed commit. Migration test results

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/41123870777
• Updated: 2026-10-30T20:31:34.311Z