fix(setup): drop leftover gateway tokens during uninstall

[SebTardif]

What Problem This Solves

Uninstall deleted GatewayUrl but left legacy Token and BootstrapToken. The next launch fell back to ws://127.0.0.1:18789 and could import those secrets into a new record.

Why

A token without a persisted gateway URL is uninstall residue, not a safely attributable credential. Binding it to the default local URL could expose it to the next listener on that port.

User Impact

Uninstall removes Token and BootstrapToken with GatewayUrl. URL-less legacy credentials and root identity are not bound to the default URL. The user reconnects explicitly with a fresh setup code or supplied URL and token. An explicitly saved URL and active registry credentials retain their compatibility paths.

Evidence

The original contributor commits remain intact. Current main was merged normally, then the bounded maintainer repair closed two lifecycle bypasses found by rubber-duck review: settings save no longer repersists the in-memory default URL, and operator/node startup backfill no longer binds root identity without an explicitly persisted target. No force push was used.

origin/main at 94006b3672a034983e80a78dafe311e24ba80cce conflicted in ChatPage.xaml.cs. The merge keeps main's credential parameter flow and still passes GetLegacyCredentialGatewayUrlOrNull() into chat resolution, so a URL-less legacy token is not attached to the default gateway URL. No force push was used.

Merge head: 3286b88b66ecc770aed57bdfd8fb35f6da721955. Test-wait head: 285346ac3fece4a95547f7fc8d284506c021a7d4. Rollback head: 999a05c9048dabe670e958e05c803c23a13e8c2a. Final head: 632aae785f9cedfd659be2453693192073388083. The test-wait commit only widens one connection test wait. 999a05c9 keeps an unsaved gateway target unsaved when a settings save or a direct connect rolls back. 632aae78 records the socket check for that behavior. The earlier installer and app proof below was captured on 29c83ff9ca877b39bb7507dea1a0e7b105f6a5c5, except for the rollback checks, the socket check, and the signed alpha matrix recorded later.

ConnectNodeOnlyAsync_StalledRetirementDoesNotBlockManagerDisconnect timed out once on 3286b88b because the test waited 3 seconds while the coordinator allows the previous node disconnect 2 seconds. The test now waits 10 seconds. It passed locally in 3 seconds.

Required proof pools

• windows-clean-installer-upgrade: Partially verified, signed-current-artifact blocked. The exact head built a 146.36 MB x64 Inno candidate on a clean Azure Windows host, installed over the previous release, and installed the current uninstall helper plus migration checker. The current candidate is locally built and unsigned, so it cannot satisfy the exact signed-current-artifact requirement. Published OpenClawCompanion-Setup-x64.exe from v2026.9.5-alpha.61 and v2026.9.5-alpha.97 are Authenticode Valid and signed by CN=OpenClaw Foundation. They are not a signed build of this head. The Server 2022 host also cannot complete the destructive cleanup path: AppX registration discovery returns unknown and its wsl.exe is a non-functional stub. Both conditions correctly activate existing fail-closed state preservation. No product guard was weakened to make the proof pass.
• node-mcp-live: isolated current-head app/MCP proof passed locally for the credential boundary.

Validation

Native Windows validation at head 632aae785f9cedfd659be2453693192073388083:

Command	Passed	Failed	Skipped
.\build.ps1	All five projects	0	0
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore	4,263	0	33
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore	4,017	0	0

Native Windows validation after the main merge, head 3286b88b66ecc770aed57bdfd8fb35f6da721955:

Command	Passed	Failed	Skipped
.\build.ps1	All five projects	0	0
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore	4,263	0	33
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore	4,013	0	0

Connection and SetupEngine suites were not rerun on this merge head.

Native Windows validation at the previous head 29c83ff9:

Command	Passed	Failed	Skipped
.\build.ps1	All five projects	0	0
dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore	4,115	0	32
dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore	3,171	0	0
dotnet test .\tests\OpenClaw.Connection.Tests\OpenClaw.Connection.Tests.csproj --no-restore	1,121	0	1
dotnet test .\tests\OpenClaw.SetupEngine.Tests\OpenClaw.SetupEngine.Tests.csproj --no-restore	1,201	0	1

Focused uninstall, settings lifecycle, credential resolver, startup/chat contract, and installer assertions also passed. The production PowerShell reset helper ran under Windows PowerShell 5.1 in isolated directories for both PreserveNodeSettings modes, including atomic-write failure handling and repeat-call stability.

Rubber-duck review initially found two blocking lifecycle gaps; both were fixed and re-review found no remaining blockers. Autoreview did not invoke its model because its scanner rejected removed pre-existing synthetic credential literals before review. Canonical dummy fixtures were used for new tests; the scanner limitation is not a code-review finding.

Real behavior proof

Local isolated app and MCP

Current-head isolated runtime proof showed:

• zero saved gateway records;
• operator and node remained idle with no gateway target;
• dashboard credential resolution returned unconfigured;
• a forced settings save left GatewayUrl, Token, and BootstrapToken absent;
• retained root identity stayed present but unused;
• explicit saved-URL and active-registry compatibility paths remained covered by focused tests.

This directly verifies that a URL-less retained identity cannot authorize the default-port listener through the app's final credential-selection boundary.

Crabbox clean Windows proof

• Provider: azure
• Target: windows, mode normal
• Lease: cbx_24ba59036876 (silver-barnacle, Standard_D16ads_v6)
• Exact source: 29c83ff9ca877b39bb7507dea1a0e7b105f6a5c5
• Exact-head sync/build run: run_c289cae9bc9e (portal=-, logs=-)
• Upgrade/uninstall trace run: run_01436fd1a997 (portal=-, logs=-)
• Migration admission diagnosis: run_89013bd17492 (portal=-, logs=-)
• Lease cleanup: stopped and deleted successfully.

Observed results:

1. The exact head built the x64 installer successfully and installed it over the previous release.
2. Before uninstall, the installed payload contained the exact current Uninstall-LocalGateway.ps1 token-removal logic and Test-InnoMigration.ps1.
3. Silent uninstall completed, but the existing migration checker returned 2 because Server 2022 could not read Store registration. Inno correctly preserved gateway state rather than performing an unsafe destructive cleanup.
4. A controlled migration-checker pass then reached the WSL boundary, where the host's stub wsl.exe returned usage text for list, terminate, and unregister. The helper correctly failed closed instead of claiming cleanup.
5. The local candidate is unsigned. The prior release installer is signed, but a signed build of head 29c83ff9 is not a GitHub release asset.
6. Published OpenClawCompanion-Setup-x64.exe assets do exist. v2026.9.5-alpha.61 (128,224,112 bytes) and v2026.9.5-alpha.97 (128,706,568 bytes) both returned Authenticode status Valid, subject CN=OpenClaw Foundation, O=OpenClaw Foundation, L=Mill Valley, S=California, C=US. Those files are not a signed build of head 632aae78. Launching the newer exe with /? opened the installer GUI, which was stopped before it installed anything. The upgrade, launch, repair, and uninstall of those two files was run later on this PC. See Signed installer upgrade and uninstall on this PC. That published uninstall left the seeded token keys.

These remote limitations are explicit proof blockers, not successful cleanup claims. The changed token-removal function itself is covered by the passing Windows PowerShell 5.1 production-helper tests and the local isolated runtime proof above. That isolated app/MCP run and the Azure installer trace are from 29c83ff9, not from the final head. Rollback rejection before credential I/O is recorded below. A signed installer built from 632aae78 is still not a release asset.

Signed installer upgrade and uninstall on this PC

Two published x64 installers, both Authenticode Valid, signer CN=OpenClaw Foundation, O=OpenClaw Foundation, L=Mill Valley, S=California, C=US:

Role	SHA-256	Product version
Older	4F5FA904B4353948E443D8F7DE67C4BBA52EB988A941BFE0520529E9FDF3EA8F	2026.9.5-alpha.61+24263d3b06c4f2c3af1c7d9c1c834d43323ea9bc
Newer	96F90A2819BA269C6939229079C398AF26EB960404989F0F22D5D78CE17A3554	2026.9.5-alpha.97+7127c16d537cf9d2d92012cc0c16ea6d3c7c73a7

They are not a signed build of head 632aae78. The install used /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /CURRENTUSER into a temporary directory, not the everyday install folder.

1. Older installer: installation process succeeded. Installed tray product version was alpha.61.
2. A settings file with no GatewayUrl and with Token and BootstrapToken present was seeded before the upgrade.
3. Newer installer: exit 0. Installed tray product version became alpha.97. The same three settings keys were still present.
4. The installed tray started (pid 39388) and was then stopped.
5. Repair with the newer installer: exit 0.
6. unins000.exe /VERYSILENT /SUPPRESSMSGBOXES: exit 0. The installed tray exe and uninstaller were removed. Token and BootstrapToken were still present afterward. That is the published alpha uninstall, not the token removal in this pull.

Silent uninstall unregistered OpenClawGateway. That distro was exported before the run and imported again afterward. It is registered and stopped. Ubuntu-24.04 stayed running. Port 18789 stayed in use by wslrelay. The original tray AppData file was restored after the settings check. The bundled Visual C++ redistributable asked for administrator permission and was stopped so the file copy could finish. That skip only suppresses the installer's automatic tray launch.

Rollback does not admit the setup gateway

On head 999a05c9, a URL-less profile still exposes the setup URL from the GatewayUrl getter. That value is not a saved target.

1. A conflicting UpdateAndSave assigned that getter back through the setter. That was the path that left HasPersistedGatewayUrl true. After the exception, PersistedGatewayUrl and GetLegacyCredentialGatewayUrlOrNull() were null. InteractiveGatewayCredentialResolver.TryResolve returned false for the root device identity and for the leftover token strings. No chat URL was built, and no request was sent to the setup port.
2. The same failed save against an explicitly saved wss://saved.example.invalid kept that URL as the legacy credential target.
3. GatewayDirectConnectService.ConnectAsync from a URL-less profile to wss://candidate.example failed and rolled back. The registry was empty, the saved GatewayUrl was blank, and the resolver returned no credential. A previously saved gateway URL still restored.

On head 632aae78 the same production types also opened sockets:

ALLOWED_LISTENER port=62214 tcp_accepts=1 request=GET /chat token_query=present
SETUP_PORT port=18789 own_tcp_before=0 own_tcp_after=0
DIRECT_CONNECT_ROLLBACK setup_port=18789 own_tcp_before=0 own_tcp_after=0

An explicitly saved ws://127.0.0.1:62214 gateway produced one TCP connection to that listener. The request line was GET /chat and the query included a token. The token value is omitted here. After the failed URL-less save, and after the failed URL-less direct connect, this process had zero TCP connections to port 18789.

The direct-connect rollback directory from that test was then loaded by the current-head tray executable, OpenClaw.Tray.WinUI.exe from this worktree's Debug win-x64 build. The directory had an empty gateway registry, no GatewayUrl, and no Token or BootstrapToken. The isolated process opened its setup window, then logged that the profile has no explicitly managed gateway and skipped lifecycle actions. It then logged that the gateway URL was not configured and that client initialization was skipped. That process had zero TCP connections to port 18789. It was stopped after the log line. The saved settings still had no GatewayUrl, Token, or BootstrapToken.

A second launch of that same executable kept the failed save and the network consumer in one process. The profile still had no GatewayUrl. Auto-start was true, so startup reconciliation tried to save. An external writer changed the file first. That process logged, in order:

Auto-start setting corrected from True to False to match Windows.
Failed to reconcile auto-start with Windows: Settings changed in another writer. Reload before saving.
Isolated profile has no explicitly managed gateway; skipping lifecycle actions.

The next line recorded that the gateway URL was not configured and that client initialization was skipped. The failure was 09:23:21.521 and the skip was 09:23:21.525. The process id was 44676. It had zero TCP connections to port 18789. It was stopped after the log was written.

Release signing for OpenClawCompanion-Setup-x64.exe runs only for a tag or promotion build in the release-signing environment, so this PC still has no signed installer of head 632aae78.

CI reconciliation

The first current-head CI run passed setup/connect, revocation recovery, tray/setup/integration, UI/accessibility, release publish, MSIX, and proof contracts. Its two failures were unrelated baseline flakes:

• Shared test: PiperVoiceExtractionTests.ExtractTarBz2Async_CancellationIsBoundedAndKillsExtractor observed the fixture process still running.
• Network recovery fixture: Gateway restart failed during setup with StateDatabaseCoordinatorContentionError and GATEWAY_RESTART_PREPARATION_REFUSED before either network recovery test executed.

Only the failed jobs were rerun.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed October 7, 2026, 12:38 PM ET / 16:38 UTC (Revision 18).

ClawSweeper review

What this changes

The branch removes leftover gateway credentials during uninstall and prevents unsaved default gateway URLs from acquiring legacy credentials during startup, chat, settings saves, or rollback.

Merge readiness

⛔ Blocked before merge - 4 items remain

The fix remains necessary and the earlier rollback defect is repaired. No new correctness defect was found, but production credential-boundary proof and the required signed-installer lifecycle evidence remain incomplete.

Priority: P2
Reviewed head: 632aae785f9cedfd659be2453693192073388083

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The repaired implementation and expanded runtime evidence are useful, but material authority and installer compatibility proof gates remain open.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: Authority-chain proof required: the matching complete body adds current-head tray rejection after direct-connect rollback and an AutoStart save conflict, but the latter does not trigger the repaired GatewayUrl-setting rollback, and the allowed listener control uses a test HttpClient. Older app/MCP and production-helper evidence remains useful. The expressly blocked exact signed-head installer lifecycle also leaves stored-settings upgrade compatibility insufficient. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Authority-chain proof required: the matching complete body adds current-head tray rejection after direct-connect rollback and an AutoStart save conflict, but the latter does not trigger the repaired GatewayUrl-setting rollback, and the allowed listener control uses a test HttpClient. Older app/MCP and production-helper evidence remains useful. The expressly blocked exact signed-head installer lifecycle also leaves stored-settings upgrade compatibility insufficient. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	9 items	Pinned introduced change: Reviewed the verified merge-base-to-head delta across all 17 files. The checkout equals the original PR head; the supplied stale test merge was not used to infer removal of current-main behavior. Current main still needs the cleanup: Fetched main's production PowerShell reset still removes GatewayUrl without removing Token or BootstrapToken. Its C# reset also retains those fields. The latest release is the pinned base, whose settings loader still reads legacy credentials without requiring a saved URL. Rollback repair retained: UpdateAndSave restores explicit-target provenance after failure, and direct-connect snapshots the persisted URL rather than the default-substituting getter. Regression coverage checks both URL-less rejection and preservation of a previously saved target.
Findings	None	None.
Security	None	None.

How this fits together

Companion loads saved gateway settings and device identities to connect its operator, node, and chat surfaces. Uninstall cleanup and settings rollback determine whether those credentials remain associated with an explicitly selected gateway.

flowchart TD
  A[Uninstall or settings rollback] --> B[Saved gateway settings]
  B --> C[Explicit gateway target?]
  D[Gateway registry and device identity] --> C
  C -->|Configured| E[Credential resolution]
  E --> F[Operator node and chat connections]
  C -->|Unconfigured| G[Setup or Connection guidance]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Authority-chain proof required: the matching complete body adds current-head tray rejection after direct-connect rollback and an AutoStart save conflict, but the latter does not trigger the repaired GatewayUrl-setting rollback, and the allowed listener control uses a test HttpClient. Older app/MCP and production-helper evidence remains useful. The expressly blocked exact signed-head installer lifecycle also leaves stored-settings upgrade compatibility insufficient. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - Production authority proof still lacks an allowed saved-target control and the exact GatewayUrl-setting failed-save rollback reaching the running consumer with retained root identity or credentials present.
• Resolve merge risk (P1) - The required final-head signed-installer fresh-install, upgrade, repair, uninstall, and relaunch matrix remains blocked; preservation of existing settings and external gateway state is not yet established through that lifecycle.
• Complete next step (P2) - Add the focused production authority and signed-installer lifecycle evidence before merge. Redacted logs, terminal output, or recordings with diagnostics count; remove private endpoints, credentials, and personal details. Update the PR body to trigger re-review, or ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test LOC	production +87/-31; tests +835/-17	Production growth supports explicit-target provenance and rollback safety, with most added lines devoted to regression coverage.

Merge-risk options

Maintainer options:

1. Complete the two focused proof boundaries (recommended)
   Provide production-consumer allowed and forbidden-target evidence plus the exact signed-installer lifecycle matrix while retaining the accepted fail-closed policy.

Technical review

Best possible solution:

Keep credentials bound only to explicit gateway targets, preserve unrelated existing state, and demonstrate both guarantees through the production consumer and signed installer lifecycle.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the existing defect: current main removes the saved URL during uninstall while retaining legacy token fields. This review did not execute a current-main reproduction.

Is this the best way to solve the issue?

Yes, removing orphaned credentials and preserving explicit-target provenance is a focused repair consistent with the recorded maintainer decision; its remaining limitation is production and upgrade proof.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 5e3fb40bcc89.

Labels

Label changes:

No label changes.

Label justifications:

• P2: This is a bounded uninstall and credential-lifecycle repair with no demonstrated current emergency.
• merge-risk: 🚨 compatibility: URL-less legacy profiles intentionally require reconnection, an accepted tradeoff, while full installer upgrade preservation remains unverified.
• merge-risk: 🚨 security-boundary: The change controls whether retained credentials can reach a default-port listener, and exact production rollback proof remains incomplete.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Authority-chain proof required: the matching complete body adds current-head tray rejection after direct-connect rollback and an AutoStart save conflict, but the latter does not trigger the repaired GatewayUrl-setting rollback, and the allowed listener control uses a test HttpClient. Older app/MCP and production-helper evidence remains useful. The expressly blocked exact signed-head installer lifecycle also leaves stored-settings upgrade compatibility insufficient. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Pinned introduced change: Reviewed the verified merge-base-to-head delta across all 17 files. The checkout equals the original PR head; the supplied stale test merge was not used to infer removal of current-main behavior. (632aae785f9c)
• Current main still needs the cleanup: Fetched main's production PowerShell reset still removes GatewayUrl without removing Token or BootstrapToken. Its C# reset also retains those fields. The latest release is the pinned base, whose settings loader still reads legacy credentials without requiring a saved URL. (scripts/Uninstall-LocalGateway.ps1:571, 5e3fb40bcc89)
• Rollback repair retained: UpdateAndSave restores explicit-target provenance after failure, and direct-connect snapshots the persisted URL rather than the default-substituting getter. Regression coverage checks both URL-less rejection and preservation of a previously saved target. (src/OpenClaw.Tray.WinUI/Services/SettingsManager.cs:638, 632aae785f9c)
• Accepted reconnect tradeoff: shanselman explicitly accepted fail-closed loading and explicit reconnection for URL-less credentials: fix(setup): drop leftover gateway tokens during uninstall #1481 (comment). This covers the current intentional compatibility change and does not require another product decision.
• Complete captured proof body inspected: The complete body fetched through the pull endpoint matches captured SHA-256 f4ce36bab97e8365a3c29ea7d9b4599a3843ce781cc99a0eb5abf7069794155f and contains 14,508 UTF-16 units. It adds current-head tray startup rejection after direct-connect rollback and after an auto-start persistence conflict. Earlier app/MCP and Azure installer evidence is explicitly attributed to 29c83ff, while the published signed alpha installers do not contain this fix. (632aae785f9c)
• Authority proof coverage remains bounded: The allowed listener receives a request from a test-created HttpClient after production credential resolution. The added running-app conflict changes AutoStart, whereas the repaired rollback trigger assigns GatewayUrl before the failed save. Thus the new app trace improves startup evidence but does not exercise that exact authority-changing rollback in the running consumer. (tests/OpenClaw.Tray.Tests/SettingsManagerIsolationTests.cs, 632aae785f9c)

Likely related people:

• shanselman: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• natalie-aguinaldo: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Show the production consumer preserving an allowed saved target and rejecting the setup-port listener after a failed save that assigns GatewayUrl, with retained identity or credentials present.
• Complete the final-head signed-artifact fresh-install, existing-profile upgrade, repair, uninstall, and relaunch matrix with preserved-state assertions.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (17 earlier review cycles; latest 8 shown)

• reviewed 2026-09-28T17:54:43.675Z sha 29c83ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-07T01:23:19.953Z sha 29c83ff :: needs real behavior proof before merge. :: none
• reviewed 2026-10-07T13:47:45.125Z sha 3286b88 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-07T14:06:28.121Z sha 285346a :: needs real behavior proof before merge. :: [P1] [P1] Preserve explicit-target provenance through settings rollback
• reviewed 2026-10-07T14:38:12.395Z sha 285346a :: needs real behavior proof before merge. :: [P1] [P1] Preserve explicit-target provenance through settings rollback
• reviewed 2026-10-07T14:59:27.134Z sha 999a05c :: needs real behavior proof before merge. :: none
• reviewed 2026-10-07T15:33:30.232Z sha 632aae7 :: needs real behavior proof before merge. :: none
• reviewed 2026-10-07T15:55:28.281Z sha 632aae7 :: needs real behavior proof before merge. :: none

[karkarl]

Global triage: NEEDS_HUMAN_TEST. Take confidence 55%; recommendation confidence 85%; effort small; risk high.

Reviewed exact head 9ec7d05b0378. Direction is right and no correctness defect was found. Clarify and test that nulling legacy tokens affects interactive credential resolution in App and Chat, not only migration, and document that tokens are dropped even when preserveNodeSettings=true. The App.xaml.cs guard is redundant once SettingsManager enforces the invariant. Blocking gate is windows-clean-installer-upgrade: uninstall then relaunch plus upgrade from a pre-change profile, with closeout and Connection tests reported.

[SebTardif]

@shanselman This pull stops loading a saved token when GatewayUrl is missing. The review on 329ea8e3 asks which of these should ship:

1. A guided Connection step that shows the retained credential only after the user confirms the gateway.
2. Leave the fail-closed load as it is, so an older profile with no URL has to be connected again by hand.

Which one do you want?

[shanselman]

Maintainer decision: choose 2, fail closed and reconnect explicitly.

A token left behind with no GatewayUrl is residue from the old uninstall bug, not a safely attributable connection. We should not redisplay it or bind it to a guessed/default gateway. The user should reconnect with a fresh setup code or explicitly supplied URL/token. If this state is surfaced in-product, the message should explain that previous credentials were cleared for safety and route to Connection, without exposing the retained token.

I am taking the original branch through current-main integration and validation. I will also verify the separate retained device-identity path cannot authorize an unintended default-port listener, and determine the strongest installer uninstall/upgrade proof this host can provide.

[shanselman]

@clawsweeper re-reviewnnMaintainer proof update: exact-head local runtime evidence and the clean Azure Windows installer/upgrade trace are now documented in the PR body, including the signed-current-artifact, AppX discovery, and stub WSL blockers. The two unrelated failed CI jobs have been rerun.

[clawsweeper]

🦞👀
ClawSweeper assist is taking a look at your question.

I queued a lightweight read-only assist pass. It will post a separate answer comment and will not edit the durable ClawSweeper review comment or trigger close, merge, repair, label, or branch changes.

Request: re-reviewnnMaintainer proof update: exact-head local runtime evidence and the clean Azure Windows installer/upgrade trace are now documented in the PR body, including the signed-current-artifact, AppX discovery, and stub WSL blockers. The two unrelated failed CI jobs have been rerun.

[shanselman]

@clawsweeper re-review

Exact-head proof is now in the PR body. The two unrelated failed CI jobs are rerunning.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/36460155323
• Updated: 2026-09-28T17:43:51.491Z

[clawsweeper]

ClawSweeper assist: The proof update is documented for head 29c83ff9, but this context cannot establish a new correctness review. The signed current installer proof remains blocked, and the rerun outcomes are not shown.

Evidence:

• The PR body records local runtime proof and the Azure Windows trace, including the unsigned candidate, AppX discovery failure, and stub WSL.
• The previous review predates that proof update.
• The maintainer’s re-review request says the two failed CI jobs were rerun; their results are absent here.

Suggested next action: Check the rerun results and request the full current-head review with @clawsweeper review.

---

Source: #1481 (comment)
Assist reasoning: medium.

[shanselman]

CI reconciliation update: Core and CLI passed on rerun. Network recovery failed a second time before either test executed, again during shared setup fixture initialization with StateDatabaseCoordinatorContentionError and GATEWAY_RESTART_PREPARATION_REFUSED. This is unrelated to the uninstall/credential diff, but required CI remains red. I am pausing active landing rather than overriding the signed-current-artifact proof and branch-protection gates.