Skip to content

OpenClaw: fail-closed auth + lazy key resolution + skill_store TRUNCATE #947

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ziomik wants to merge 6 commits into
base: main
Choose a base branch
from
Open

OpenClaw: fail-closed auth + lazy key resolution + skill_store TRUNCATE #947

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
57887db
Fix pinky-memory stdio subprocess missing OPENAI_API_KEY
Jul 30, 2026
fc1e6cc
Fix: guard OPENAI_API_KEY type before json.dumps in stdio_env
Jul 30, 2026
ba902e0
Track openclaw_gateway.py in git (baseline) + move Deepgram key to .env
Jul 30, 2026
ec98160
OpenClaw: resolve Deepgram/OpenAI keys lazily with .env fallback
Jul 30, 2026
84511e1
skill_store: use journal_mode=TRUNCATE for conversations_skills.db
Jul 30, 2026
7951fd2
OpenClaw: fail-closed handshake auth on _auth_ok
Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions src/pinky_daemon/api.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1307,6 +1307,20 @@ def _sse_headers() -> dict:
db_path = getattr(agent_registry, "_db_path", "")
if isinstance(db_path, str) and db_path:
stdio_env["PINKY_AGENTS_DB"] = db_path
# Memory embeddings: the pinky-memory stdio subprocess only reads
# OPENAI_API_KEY from its own environment (embeddings.py resolves
# api_key arg -> os.environ, and build_embedding_client() is called
# without an api_key in pinky_memory/__main__.py), so without this
# the key saved via set_setting() never reaches it and reflect()
# silently falls back to the NoOp embedder (embedded: false).
try:
openai_key = agent_registry.get_setting("OPENAI_API_KEY")
if isinstance(openai_key, str) and openai_key:
stdio_env["OPENAI_API_KEY"] = openai_key
except Exception:
pass
if stdio_env:
mcp_config["mcpServers"]["pinky-memory"]["env"] = dict(stdio_env)

# Pinky-self: heartbeat_ack, schedules, self-management
tool_gates = _get_agent_tool_gates(agent_name, skill_store)
Expand Down Expand Up @@ -4379,6 +4393,10 @@ async def _trigger_librarian() -> None:
"/auth/setup",
"/favicon.svg",
"/icons.svg",
# OpenClaw device WebSocket — external Android client connects here;
# auth is handled inside the WS handshake, not via session cookie.
"/openclaw/ws",
"/gateway/ws",
}
_public_prefixes = (
"/assets/", "/static/", "/p/", "/hooks/",
Expand Down Expand Up @@ -4468,6 +4486,12 @@ async def _trigger_librarian() -> None:
"/soul-templates", # soul template registry
"/sprints", # sprint management
"/triggers", # webhook/url trigger management
# OpenClaw/AIena/leads endpoints (commit 361e6dc) — agent/admin callers
# authenticate via internal auth headers or session cookie. The WS paths
# (/openclaw/ws, /gateway/ws) are carved out as public_exact above.
"/openclaw/", # /openclaw/device (agent→device REST invoke)
"/api/aiena/", # /api/aiena/approve-article (AIena admin action)
"/api/leads/", # /api/leads/promote (lead promotion)
)

# Single source of truth for the auth gate's route classification. Exposed
Expand Down
Loading