Repository navigation
Conversation
🦋 Changeset detectedLatest commit: f18e50f The changes in this PR will be included in the next version bump. This PR includes changesets to release 2 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 13 files
This PR changes authentication, authorization, or input validation. Ultrareviews find 2.4x more serious bugs than standard reviews. Comment @cubic-dev-ai ultrareview to run one.
View guided diff | Turn on auto-fix | Re-trigger cubic
main reached 52 in #8085, so the manifest change needs its own bump to republish. Co-authored-by: Forge Bot <speakeasyforgebot@users.noreply.github.com>
It carries the hooks API key, and extraction honors the archive's Unix mode. Co-authored-by: Forge Bot <speakeasyforgebot@users.noreply.github.com>
- Make the installed speakeasy.json 0600 whatever mode the installer gives it. - Unpack the archive with python3 when unzip is missing. - Print a Gateway restart step instead of restarting from inside the turn. - Say a deleted project, not only a missing one, leaves the agent without hooks. - Correct the SecretRef note on the MCP header. - Run the script tests on a stub-only PATH and name the block-reason test for what it checks. Co-authored-by: Forge Bot <speakeasyforgebot@users.noreply.github.com>
…tall panel Co-authored-by: Forge Bot <speakeasyforgebot@users.noreply.github.com>
…rom the OpenClaw install Co-authored-by: Forge Bot <speakeasyforgebot@users.noreply.github.com>
This was referenced Oct 26, 2026
Contributor
mfbx9da4
changed the base branch from
main
to
cursor/agent-key-outranks-hooks-cache-da9f
October 26, 2026 22:37
Contributor
Author
|
Folded into #8108, which now targets main as a single PR with all of this change. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DNO-1419
Summary
The agent install command connects OpenClaw to the agent gateway, installs the observability plugin for agents with a live project, enables conversation hooks, and prints a hooks check result plus a restart reminder. This original draft now includes the same reviewed tree as its successor #8108. Prefer #8108 for review; do not merge both.
Run the command in a trusted shell. The separate OpenClaw follow-up prompt contains no redeemable code. Gateway and hooks URLs must use HTTPS. OpenClaw configuration uses an owner-only temporary batch file to avoid putting the key in process arguments; rejected updates preserve the previous gateway. Claude Code and Codex read the key from their launch environment.
Plugin ZIPs mark key files owner-only. Installation handles named profiles, supported CLI flags, missing unzip, projectless agents, failed client configuration, and clipboard failures. The docs distinguish the hooks self-check from runtime attribution and cover the Claude CLI routing limitation.
OpenClaw 2026.10.6 rejects structured MCP header SecretRefs; upstream support proposal #69417 was closed without merging. Its supported batch-file path writes valid config with mode 0600. The key remains in OpenClaw's config and the plugin's key file. This PR is stacked on #8109 and the agent plugin now sets
HooksKeyIsAgent: true. Its smoke check clears API-key and org-key environment overrides (including aliases) and isolates cached sign-ins. Agent hooks still depend on #8015 / DNO-1412. Deployment also requires publishing the #8109 hooks binary and updating the server pin: the current 0.3.37 binary predates agent-key precedence. No release is performed by this PR.Motivation
One installation should explain which parts succeeded and preserve working client configuration when an update fails. Short-lived install codes remain credentials until redeemed, so copying them into a model transcript is avoided.
Platform MCP is unchanged: minting an install code requires the plaintext key. Command K adds no page or named resource here. Demo seed changes are excluded because these are one-time credentials.
Gutternote review steps
Fixes DNO-1419
Narrated dashboard recording
This 49-second recording was captured from #8108 head
db38b23597d3c1bc61ef5350eace1b6c4c40f695, whose complete file tree is identical to this PR's current headf18e50fdee8ff67eae7a116bad6d006cf67ab5bb(tree172521930ca707f75c52c40d76a16715a576330b). It therefore demonstrates the same implementation. Prefer #8108 for review; do not merge both PRs.Using synthetic local data, it shows trusted-shell installation guidance, the separate credential-free OpenClaw follow-up prompt, and Copy failed feedback when clipboard access is denied. The generated install code and key remain outside the recording crop.
This is a dashboard walkthrough, not a demonstration of completed OpenClaw installation or runtime hooks attribution. The identical #8108 tree passed all 30 focused installer tests.
narrated.webm