[karkarl]

Related: #1834 (feat(chat): add scoped conversation Files, edits and diffs). Agent administration and agent-wide file editing are deliberately not duplicated here.

What Problem This Solves

Fixes: an open Create agent dialog can follow a replacement Gateway connection, and an incomplete creation acknowledgement can be presented as success.

User Impact

User impact: creation remains on the Gateway connection that opened the dialog; after reconnect or switching Gateways, close and reopen the dialog before creating an agent.

This is a bounded draft of the agents RPC category, not completion of all nine historical methods. Full-suite host failures and missing live Gateway proof remain visible below.

Why This Change Was Made

The existing production route stays Workspace assistant selector -> native creation dialog -> creation service -> Gateway client. The service now captures the original client/authenticated epoch; the transport checks the expected epoch before sending, and the service checks authority again before accepting the acknowledgement. ok: true, agentId, name, and workspace must all be present with the expected types. No automatic retry or local workspace creation is added.

The pinned Mac ownership rule keeps Gateway administration in Dashboard. This PR hardens the Windows creation flow already present rather than inventing a new native admin screen.

Evidence

125 focused cases pass, including 23 creation-service unit cases, three authenticated real-client socket-fixture cases, and 99 existing Workspace navigation/projection cases.

Current-head native fixture proof also passed 1/1, with no skips. The real native dialog submitted one acknowledged agents.create, refreshed the server-issued agent in the selector, and retained the selected conversation and unsent draft. The populated dialog was inspected in an owned-window capture. The selector popup was verified by UI Automation; the main-window after-capture omits that separate popup and is not pixel proof of its contents.

The real service and WebSocket client create a server-assigned agent, consume RequestAgentsListAsync/AgentsListUpdated, and observe catalog growth from two to three agents without changing the default agent. Duplicate creation is rejected without catalog growth. Read-only scope and stale pre-reconnect dispatch epochs send no creation request. Unit cases cover changed client, reconnect/disconnect/scope loss while awaiting a reply, malformed acknowledgements and errors/timeouts without retry.

Per-method reconciliation

Source baseline: openclaw/openclaw@098e991549b7986bcfaebdbe427aeaaf95afb926. Static upstream references are not runtime proof.

Method	Windows production and proof	Remaining scope
agents.create	Existing native dialog, now connection-bound; 23 unit + three real-client socket cases exercise admission/acknowledgement, creation/rejection and reconnect	Explicit workspace only; no optional onboarding/model/identity flow, real config application or persistence proof
agents.list	Existing selector refresh; native projection unit tests and direct tracked RPC/event fixture reads before/after creation	Scoped catalog proof, not every optional ownership/placement field
agents.files.list	Existing Workspace/onboarding fallback; not upgraded to verified by this PR	Direct RPC-owner behavioral proof still missing
agents.files.get	Existing Workspace preview fallback; not upgraded to verified by this PR	Direct RPC-owner behavioral proof still missing
agents.files.set	No new production call	Dashboard editor needs workspace/hash-or-missing guards and dirty-draft/lifecycle coverage; separate seam
agents.update	No new production call	Dashboard identity/workspace/model administration; separate seam
agents.delete	No new production call	Destructive confirmation, session drain and partial purge failures; separate seam
agents.workspace.list	No new production call	Agent-wide paginated read-only browser, distinct from sessions.files.list
agents.workspace.get	No new production call	Agent-wide UTF-8/base64 preview, path/size restrictions, distinct from session preview
agents.avatar.generate	Current-source-only, absent historical schema; excluded from the nine-method denominator	Static avatar preview generation does not save identity; separate pending method

This seam adds evidence for creation and catalog refresh. Seven historical methods remain unverified, including five without a direct Windows production call. It does not claim that the overall cross-category unrecognized-wiring target has been met.

Contracts: creation, list/update/delete, editable files, workspace browser. Native Mac catalog callers: QuickChat and session actions.

Independent rubber-duck review examined production reachability, epoch/authority handling, acknowledgement validation and proof limits. No blocking findings. Duplicate permission checks are intentional defense in depth; valid creation results require ok:true, while Gateway rejection envelopes already propagate as exceptions. Runtime-selected reviewer model identity is unverified. Shared autoreview helper is not installed; no helper scoped-clean verdict is claimed.

Change Type

• Bug fix
• Feature
• Refactor
• Docs or instructions
• Tests or validation
• Security hardening
• Chore or infrastructure

Scope

• Tray or WinUI UX
• Windows node capability
• Local MCP or winnode
• Gateway, connection, or pairing
• Setup or onboarding
• Permissions, privacy, or security
• Tests, CI, or docs

Required proof pools

• windows-winui-interactive: existing native agent creation and selector refresh must remain usable against an isolated fixture.

No WSL/MXC, installer, native dependency, GPU or architecture-specific behavior is changed. An ARM64 build is reported as the host used, not a separate release compatibility claim.

Validation

OPENCLAW_REPO_ROOT was set to this task's isolated worktree before tests.

• .\build.ps1: passed twice, all five projects, Debug win-arm64.
• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore: initial run failed NETSDK1004 because this fresh worktree lacked test assets. After restoring with dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj, 4,642 passed / 1 failed / 26 skipped. Exact no-restore rerun: 4,641 passed / 2 failed / 26 skipped. Failures: known MxcFolderAdmissionTests.OwnedJunctionAndSymbolicLinkAreRejectedWithoutFollowingTheirChildren(symbolic: True) privilege denial; unrelated McpHttpServerTelemetryTests.ShutdownWhileWaitingForHandler_RecordsShutdownNotBusyOrTimeout telemetry wait timeout.
• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter FullyQualifiedName~McpHttpServerTelemetryTests: 16 passed / 0 failed / 0 skipped. The original full-suite failure is retained, not converted into a full-suite pass.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore: 4,511 passed / 4 failed / 0 skipped, same result on both full runs. Failures are the four known ARM64 BuildPrerequisiteTests.CheckOnly_UsesTheAppLocalRuntimeResolver baseline cases.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter FullyQualifiedName~BuildPrerequisiteTests: 0 passed / 4 failed, confirming those baseline cases without modifying prerequisites.
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore --filter 'FullyQualifiedName~AgentCreationServiceTests|FullyQualifiedName~WorkspaceNavigationTests': 125 passed / 0 failed / 0 skipped.
• .\scripts\validate-docs.ps1: passed, 66 Markdown files.
• .\scripts\validate-agent-skills.ps1: passed, 12 skills / 21 Markdown files.
• git diff --check: passed.
• dotnet build .\tests\OpenClaw.Tray.UITests\OpenClaw.Tray.UITests.csproj -c Debug -r win-arm64 -p:Platform=ARM64 -p:DevBuild=false: passed, after an initial --no-restore attempt reported missing fresh-worktree assets; one pre-existing generated Icon deprecation warning.
• dotnet test .\tests\OpenClaw.Tray.UITests\OpenClaw.Tray.UITests.csproj -c Debug -r win-arm64 -p:Platform=ARM64 -p:DevBuild=false --no-build --no-restore --filter FullyQualifiedName~NewAgentUsesGatewayCreationAndRefreshesWithoutReplacingConversation: 1 passed / 0 failed / 0 skipped, 26 seconds. Fixture/screenshot environment selected the explicit freshly built app, isolated artifact root and screenshot opt-in.

No privileged installation, timeout weakening, baseline test edits, shared runtime changes, or monitor/policy changes were made. Pre-fix execution was not collected; regression inputs were characterized from original source, not presented as an executed baseline.

Real Behavior Proof

• Environment tested: Windows ARM64, .NET SDK 10.0.402, authenticated loopback synthetic Gateway, task-owned temporary signing identities, device-token persistence disabled.
• PR head or commit tested: ce446d2ef28e2be7a913498483207240153ff1a9; initial build/test runs used identical production source before commit, with source hashes manually recorded. The native UI project subsequently rebuilt the app from this committed head; the fixture recorded the exact executable and assembly hashes.
• Exact steps or command run: focused command above; RealClient_CreatesAndListsOnlyWithAdminAuthority and RealClient_ReconnectionRejectsOriginalDialogAndOriginalDispatchEpoch run the production creation service/client through actual socket handshake, create and tracked catalog requests.
• Evidence after fix: Passed! - Failed: 0, Passed: 125, Skipped: 0, Total: 125; all three real-client fixture cases executed. Native run e3a1cac1625942258424cc7716fc8cc6 also passed 1/1. Its request log records one successful agents.create, four successful agents.list, no failed requests, no sessions.create, and no unexpected fixture requests.
• Observed result: original stale dialog and stale transport epoch send no mutation after reconnect; a fresh dialog creates fixture-created; tracked list refresh returns three agents including server-confirmed Research; duplicate rejection leaves three. Native UI Automation observed Fixture Created, fixture-created in the refreshed selector while retaining the 240-message conversation and Keep this draft while creating an agent draft. The inspected ready-dialog capture visibly contains Fixture Created, /fixture/new-agent, and an enabled Create agent action. The main-window after-capture omits the selector popup, so it is not claimed as pixel proof of the popup's contents. The owned fixture disposed its app; no matching task-owned app process remained, and the desktop lease was released.
• Screenshot or artifact links verified? (Yes/No/N/A): N/A. Local TRX/evidence artifacts are retained but not presented as public links.
• Not verified or blocked: Shared autoreview installation absent. Full Shared/Tray suites are not green. No live/published Gateway config application/persistence, optional onboarding, Mac execution, or deferred methods are proven. Matching package version does not bind published Gateway source to the pinned commit.

Evidence source identities (SHA-256)

• Pinned schema/agents-create.ts: df74cc336e706d932275086b67d379750be7b0f5af132b0678d72e65355b1a70.
• Pinned server-methods/agents.ts: b82850bdc4da32ddf18f92e6b1453f5526f55593914c661a5fda7854a78abd99.
• AgentCreationService.cs: a604e71515d1a2c6ea2e17a8e410eb949b11476705370ca1d3a7fd21ff652ea5.
• OpenClawGatewayClient.cs: 010f311ca05fc94f6b448647fded1746d8267f9665f5252d5171ff934a7960a2.
• AgentCreationServiceTests.cs: a6faa0fa737c6fda86203ab5c25e90214e4b2abca2d94eda4fe143331304a722.
• GatewayFixtureUiTests.cs: f88a4f2aa4e489ca7e02a037f4d9ad5d679f248f2fdc125d8a405117588823bf.
• Native proof EXE: 2ab42c8bf51e84a91759567ea3ce1007d007340ee5ccf0d840c3a88bb520b485.
• Native proof assembly: 2e6c639c6836c23ec3520fba3764dc13742038b1e810543c9d3966518312d73b.
• Native TRX: 6c3b2e071fc397b2252b4134e93c2a43bf21777dd7d160f7e017cd73411d122d.
• Ready-dialog PNG: 37d527f73eddd2a9f0bfb3056329b5f80e6da8cbeeacce4a80e9cd0cf3894161.

Security Impact

• New permissions or capabilities? (Yes/No) No.
• Secrets or tokens handling changed? (Yes/No) No.
• New or changed network calls? (Yes/No) Yes, existing agents.create now uses connection-bound dispatch.
• Command or tool execution surface changed? (Yes/No) No.
• Data access scope changed? (Yes/No) No.
• If any answer is Yes, explain the risk and mitigation: administrator scope is checked at admission and dispatch; a changed connection epoch fails before send. An uncertain acknowledgement is not retried. Remote workspace paths are never resolved or created on Windows.

Compatibility and Migration

• Backward compatible? (Yes/No) Yes for the supported creation result contract; malformed/incomplete acknowledgements now fail closed.
• Config or environment changes? (Yes/No) No.
• Migration needed? (Yes/No) No.
• If yes, list the exact upgrade steps: N/A. Close and reopen an existing creation dialog after connection replacement or reconnect.

Review Conversations

• I replied to or resolved every bot review conversation addressed by this PR.
• I left unresolved only conversations that still need maintainer judgment.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR binds agent creation to the dialog’s original authenticated Gateway connection and validates the complete creation acknowledgement.

Example: Open Create agent on Gateway A, enter Research and ~/research, then switch to Gateway B.

• Before: Submitting the original dialog can create Research on Gateway B.
• After: The original dialog cannot submit; reopening it explicitly targets the current Gateway connection.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A useful, focused repair with production-client authority coverage and native application proof; the synthetic Gateway scope and explicitly reported local full-suite failures limit the evidence without establishing a patch defect.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): The supplied current-head Windows ARM64 report exercises the native dialog through the production service and WebSocket client, and separately records allowed creation, read-only rejection and stale-epoch rejection before mutation after reconnect; native catalog refresh preserves the selected conversation and draft.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Complete
User problem: An open creation dialog can submit to a different Gateway after switching connections or report success from an incomplete acknowledgement.
Reason: The collaborator-authored direction repairs the existing supported creation flow without expanding native agent administration.

Merge readiness

✅ Ready for maintainer review

Keep open: this collaborator-authored draft fixes a source-confirmed connection-targeting bug still present on main; no introduced correctness defect was found.

Priority: P2
Reviewed head: ce446d2ef28e2be7a913498483207240153ff1a9

Before merge

None.

Findings

None.

Tests

• Missing end-to-end proof: Pre-fix execution was not collected; the PR explicitly distinguishes source-characterized regression inputs from its passing current-head socket and native-app scenarios.

Agent review details

How this fits together

Workspace opens the native creation dialog, which passes a name and remote workspace path through AgentCreationService and the authenticated WebSocket client; the Gateway owns creation and the returned agent catalog.

flowchart LR
  A[Workspace selector] --> B[Creation dialog]
  B --> C[AgentCreationService]
  C --> D[Gateway client]
  D --> E[Generation fenced socket]
  E --> F[Gateway agent catalog]
  F --> A

Loading

Technical review

Best possible solution:

Land the focused repair through the existing creation service and transport owners when the author considers the draft ready and its required checks pass.

Do we have a high-confidence way to reproduce the issue?

Current main resolves the Gateway client when CreateAsync runs rather than when the dialog opens, so switching connected Gateways before submission follows the replacement client; no target code was executed during this read-only review.

Is this the best way to solve the issue?

The patch is a focused repair: it reuses the existing authenticated generation fence, preserves Gateway-owned workspace creation, rejects incomplete acknowledgements and adds no retry or competing owner.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f6406247a0f7.

Provenance checked

• Workspace agent creation and acknowledgement handling keeps the original intent (3a58bf3: The original Workspace implementation introduced administrator-gated Gateway creation with response validation and draft retention, as documented in feat(workspace): add native Home and Sessions workspace #1541.)
• Authenticated connection generation fencing keeps the original intent (791574d: The existing confirmed-session work bound mutations to their original Gateway connection in feat(workspace): sidebar session context menu, busy ring, and faster session switching #1629; this PR applies that transport mechanism to agent creation.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Current main still resolves the client at submission: The main implementation calls getClient inside CreateAsync and validates only ok and agentId, establishing both reported failure paths independently of the PR title. (src/OpenClaw.Tray.WinUI/Services/AgentCreationService.cs:15, f6406247a0f7)
• Pinned patch preserves existing ownership: The introduced diff captures the original client and epoch, reuses the existing response-request transport, and checks authority again before accepting success; the verified test merge retains unrelated main changes. (src/OpenClaw.Tray.WinUI/Services/AgentCreationService.cs:12, ce446d2ef28e)
• Connection fence reaches the socket write: The response-request owner forwards the captured generation to SendRawAsync, which checks socket identity under the send lock immediately before WebSocket transmission. (src/OpenClaw.Shared/WebSocketClientBase.cs:845, ce446d2ef28e)
• Authoritative dependency contract: The patch explicitly validates this Gateway protocol schema, establishing dependency relevance; it requires ok:true and nonempty agentId, name and workspace, as did the original schema cited by the existing implementation. (packages/gateway-protocol/src/schema/agents-create.ts:22, 098e991549b7)
• Supplied current-head behavior evidence: The fully read PR body reports passing production-client socket scenarios for allowed creation, read-only rejection and stale reconnect epochs, plus native dialog submission and selector refresh with conversation and draft retention; published Gateway persistence is explicitly outside that proof. (tests/OpenClaw.Tray.Tests/AgentCreationServiceTests.cs:192, ce446d2ef28e)
• Exact-head validation remains in progress: Core/CLI, Tray/setup/integration, network recovery and revocation recovery checks passed; UI/accessibility and setup/connect checks were still running, with no failing completed check observed. (ce446d2ef28e)

Likely related people:

• Karen: Raw commit 3a58bf3 adds src/OpenClaw.Tray.WinUI/Services/AgentCreationService.cs:18 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 3a58bf34902f; files: src/OpenClaw.Tray.WinUI/Services/AgentCreationService.cs)
• Pedro Larroy: Raw commit 791574d adds src/OpenClaw.Shared/OpenClawGatewayClient.cs:1312 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 791574ddf557; files: src/OpenClaw.Shared/OpenClawGatewayClient.cs)

Review metrics

Metric	Value	Why it matters
Production and regression coverage	Production +40/-11 lines; tests +187/-2 lines	The larger test change covers distinct acknowledgement, permission and reconnect boundaries while reusing the existing socket fixture.

Labels

Label changes:

• add P2: Creating an agent through a dialog retained across a Gateway switch can target the wrong Gateway, but the affected workflow is bounded and no urgent widespread regression is established.
• add proof: sufficient: Contributor real behavior proof is sufficient.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P2: Creating an agent through a dialog retained across a Gateway switch can target the wrong Gateway, but the affected workflow is bounded and no urgent widespread regression is established.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• proof: sufficient: Contributor real behavior proof is sufficient.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 23, 2026, 5:36 PM ET / 21:36 UTC.

[github-actions]

This pull request has been automatically marked as stale due to inactivity.
Please update it or it will be closed.

[roboclaw-bot]

PR cleanup review

Reviewed head: ce446d2ef28e2be7a913498483207240153ff1a9. Main comparison: e59374c064f43d68f5c72d070d4c89ef2d20ec3b.

The creation-targeting defect is still present on main: the service resolves its Gateway when Submit runs, not when the dialog opens. This patch uses the existing transport generation fence and retains the Gateway as workspace owner. Keep it open. Before landing, reconcile the three current-main conflicts, refresh the original-client/reconnect and native-dialog evidence on the resulting head, and remove the draft hold through the authorized owner.

Action in this cleanup pass: leaving this PR open. No branch changes or runtime-proof waiver. The findings above come from source, discussion and recorded-CI review; Windows validation was not rerun in this pass.

[roboclaw-bot]

Refreshing #1854 (fix: keep agent creation on its original Gateway connection) against current main in an isolated worktree. I will preserve the original client/authenticated-epoch binding and current-main identity contracts while resolving the architecture, interface and test conflicts. The existing draft/body and contributor history stay intact. Independent security-sensitive review precedes a non-force update to the original branch. Windows build/runtime proof is not yet verified on this Linux host; final results and any blockers will be recorded here.

[roboclaw-bot]

Main refresh completed for #1854 (fix: keep agent creation on its original Gateway connection), with a non-force push to the original contributor branch. The PR remains a draft; its body and attribution are unchanged. This is not a ready-to-merge claim.

• Original head: ce446d2ef28e2be7a913498483207240153ff1a9
• Merged main: 3d5f14270dd6bd8b260a723ff2e73a68ea858ca8
• New merge head: 5abcab222c8ab15fc18d13dd69a20690a98b84d6

Conflict choices:

• Kept current-main architecture/identity owners, updating only the agent-creation ownership row with this PR's original-client/epoch invariant.
• Retained both connection-bound interface APIs and current-main transport identity/cancellation behavior. No RPC expansion or automatic retry.
• Combined creation/epoch test support with main's avatar, cancellation and timeout support. Independent Sol P0-P3 review found one merge-integration issue: a derived profile-test proxy duplicated the new inherited epoch field. Removed only that redundant field, preserving all assertions. Independent follow-up found no remaining actionable P0-P3 findings in the repair and surrounding integration.

Validation on the new source tree:

• 10 source-preservation/static assertions passed; PR delta whitespace check passed; no conflict markers or unmerged entries. Local merge composition with the captured main is conflict-free. GitHub's original PR head and contributor branch both equal the new head.
• ./build.ps1: blocked on Linux (exit 126); PowerShell invocation also blocked because pwsh is absent.
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore: blocked, dotnet absent (exit 127); 0 tests executed.
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore: same blocker; 0 tests executed.
• Focused Tray selection AgentCreationServiceTests|ChatToolDetailsProfileTests|WorkspaceIdentitySourceTests|WorkspaceNavigationTests: same blocker; 0 tests executed. Required commands were attempted again after the proxy repair.
• setup-dev.ps1 -CheckOnly and validate-docs.ps1 could not run without PowerShell. WinApp is absent. Native dialog, real-socket fixture and live Gateway proof were not rerun; historical original-head results are not new-head validation.

New-head hosted Build and Test run 43296631248 is in progress, not passed. CodeQL 43296631270 and automatic ClawSweeper dispatch 43296630876 were also created. No CI rerun or re-review request was submitted. Handing back with Windows/current-head proof and CI outcomes still pending; removing the temporary actively-landing label.