Closes #135471

What Problem This Solves

Resolves a problem where operators running gateway status --require-rpc against an auth-none local Gateway receive an explicit-credential error even though they did not supply --url.

Service diagnostics could also select credentials or connection details from a configured remote Gateway instead of the service being inspected. An empty target-scoped credential result could fall back to unrelated config or environment credentials later in the RPC path.

Why This Change Was Made

Service-derived targets now remain distinct from explicit URL overrides throughout the status probe. The selected service target owns its local credentials, merged service environment, and certificate, regardless of the configured client remote mode.

• serviceTargetUrl carries the service URL without classifying it as CLI --url.
• Status uses a nonpersisted command-local config view so downstream resolution cannot borrow remote Gateway credentials or conflicting target settings. Service auth mode remains available for RPC preflight.
• The view preserves only the existing remote URL scope, edgeAuth, and tlsFingerprint. Existing consumers retain their endpoint-scoped transport policy: proxy headers use the existing origin/path selector, and ordinary connectivity probes retain the saved pin only on an exact configured endpoint. Unrelated token/password fallback and service certificate inheritance remain excluded.
• skipImplicitAuth preserves the already-resolved credential set, including an empty set for auth-none.
• Explicit --url uses only explicit RPC token/password and does not inherit the service certificate.
• Saved pins remain configuration input to their existing consumer; they are not promoted to an explicit fingerprint argument, and RPC TLS selection is unchanged.
• Connection details report the same service URL that the probe uses.
• The command-local projection lives with the existing status target helpers, keeping the gather function below its existing size limit.
• Advisory plugin install-record reads use the existing artifact-preserving read-only mode, so status and diagnostics do not create SQLite sidecars beside the inspected source database.

Generic credential precedence, persisted configuration, schemas, and protocols are unchanged. Explicit URL credential requirements and read-only device-auth behavior remain intact.

User Impact

Operators can inspect an auth-none service without inventing a token or password. Service status remains tied to the selected service even when remote client settings or an environment URL are present. Explicit remote probes retain their credential isolation, while configured proxy headers and saved certificate restrictions remain available under their existing endpoint-scoping rules.

Evidence

• Before main integration, 267 focused tests passed: 154 Gateway call tests and 113 daemon status/probe tests.
• Existing coverage includes remote URL present/missing, distinct service/remote/environment credentials and TLS pins, auth-none, explicit URL isolation, existing SecretRef behavior, and local-port selection.
• Real WebSocket tests verify the exact empty/token/password credentials sent by the RPC probe and no first-time identity or pairing-state creation.
• Negative/positive proof: without the implicit-auth freeze, an empty resolved credential set sent a config token and ambient password. With the fix, the empty set stayed empty and the token/password sibling cases passed.
• Scoped lint, formatting, and whitespace checks passed.
• The relevant Gateway test typecheck passed after adding the missing optional serviceTargetUrl field to the exported connection-details wrapper type.
• Independent full-candidate review found one type-declaration omission. That finding was accepted and resolved; it was not an originally clean review.
• Main was merged without replacing contributor ancestry. The integration preserves the reviewed credential behavior, main's cast-free environment value, and the existing credential-trimming import.
• The edge-auth regression is covered by extending the existing gather tests for matching, other-origin, and other-path targets in both probe modes. They use the real selector on captured probe config and check stripped Gateway credentials/local TLS, retained endpoint-scoped fields, and unchanged original config.
• Bounded before/after proof executes the actual producer projection and scope-selector declarations. Matching service-derived and explicit targets lose headers before the correction and retain them afterward; nonmatching scopes withhold them in both versions. This is declaration-level proof, not a full gather or transport run.
• An earlier full-candidate P2 review reported no actionable defects. Subsequent CI and bot review exposed the bounded follow-ups recorded below. A mechanical target-boolean/call-placement cleanup resolved the remaining size violation and passed the focused max-lines check; no size-limit exception was added.
• Targeted formatting and PR-delta whitespace checks passed. Complete runtime, lint, and type validation used hosted CI because the local declaration guard rejects shared dependency links. No dependency or containment workaround was applied.
• Exact-head CI on a94fb88434d8fe96e8076e1ced93cfa118c6e921 exposed three related failures: oxc/no-map-spread in test-case construction, TS2698 from spreading an unknown-typed expected fixture field, and the existing seeded-state diagnostics-export test observing new empty SQLite WAL/SHM files. Evidence: https://github.com/openclaw/openclaw/actions/runs/34083612351
• The constrained follow-up constructs the same test fields explicitly, names the fixture's existing bind: "loopback" expectation without a cast, and opts the status install-record caller into artifactPreservingReadOnly. Storage owners, defaults, schemas, and the existing seeded/absent process-test assertions are unchanged.
• The focused oxc/no-map-spread check reproduced the failure before the test-construction repair and passed after it. Focused lint/max-lines, formatting, and whitespace checks passed for the follow-up.
• Fresh delta-only P2 review against a94fb88434d8fe96e8076e1ced93cfa118c6e921 reported no actionable defects in the caller option or the two test-construction repairs.
• Actual process red/green evidence for the artifact-preserving read repair: the seeded diagnostics-export case failed in run 34083612351, then its process shard passed on exact head 8dd21f205d357ace6e2178f38a3df699c642b666, without changing the seeded/absent assertions. Green job: https://github.com/openclaw/openclaw/actions/runs/34084196955/job/101625141599
• Complete hosted CI for exact head 8dd21f205d357ace6e2178f38a3df699c642b666 finished successfully on September 7, 2026 at 04:52:43 UTC, validating all three follow-up repairs and the existing tests with the complete dependency tree. This predates the saved-pin correction and does not establish its TLS proof. Run: https://github.com/openclaw/openclaw/actions/runs/34084196955
• The later saved-pin finding was accepted: the projection now retains the existing fingerprint alongside URL scope and proxy headers. Bounded before/after proof runs the actual projection and existing saved-pin selector expression; exact endpoints lose the pin before and retain it after, while different endpoints still receive no pin.
• Two new rows in the existing gather suite delegate to the real ordinary status probe and TLS WebSocket transport. They assert a matching saved pin and required proxy header allow the explicit synthetic token through, and a wrong pin fails before decrypted HTTP bytes, upgrades, or connect frames. Both assert no local certificate inspection or explicit fingerprint argument. They reuse existing TLS fixtures and frame helpers; the test mock is restored afterward.
• Fresh delta-only P2 review against 8dd21f205d357ace6e2178f38a3df699c642b666 reported no actionable defects in the saved-pin correction or its TLS test boundary. Focused lint/max-lines, formatting, and whitespace checks passed.
• Complete hosted CI for final head 5819c53f08df82fc495cd63c69c97b1b4ac1fbf8 finished successfully on September 7, 2026 at 05:06:48 UTC. All 155 jobs completed green, including the agentic CLI selection containing the gather suite and its real TLS cases. The matching saved pin admits the required proxy header and explicit synthetic token; the wrong pin fails with zero decrypted HTTP bytes, upgrades, or connect frames. This is hosted production-path test proof, not a local or external-service run. Run: https://github.com/openclaw/openclaw/actions/runs/34084976323
• The current-head bot review found no actionable code defects and recognized the saved-pin repair. Its outstanding request concerned TLS execution that had not completed when its body snapshot was captured; the completed exact-head CI above supplies that evidence.
• The missing-maxPayload scanner annotation was inspected at the new test fixture. It concerns a temporary HTTPS/WebSocket server bound to a free loopback port, driven by synthetic test traffic and closed in finally, not a deployed Gateway listener or a changed production payload limit. No production change or scanner suppression was added.

The socket proofs use isolated state, not a native service manager. The new gather-to-TLS rows were validated by hosted CI, not run locally against the complete integrated dependency tree. No new external live-service proof is claimed. Raw local proof logs are not published.

Earlier Contributor Evidence

The contributor previously reported a managed loopback auth-none Gateway accepting gateway status --deep --require-rpc --json, while an explicit --url without credentials was rejected. This is historical contributor evidence, not a new live-service run against the repaired candidate.

AI Assistance

The contributor reported AI-assisted analysis and implementation using Codex CLI, followed by managed-Gateway proof. Maintainer updates include independent review, scoped target/auth repairs, and targeted regression and typechecking evidence.