Skip to content

fix(ios): classify TLS fingerprint timeouts - #98429

Merged
joshavant merged 2 commits into
mainfrom
fix/ios-tls-fingerprint-timeout
Jul 1, 2026
Merged

fix(ios): classify TLS fingerprint timeouts#98429
joshavant merged 2 commits into
mainfrom
fix/ios-tls-fingerprint-timeout

Conversation

@joshavant

@joshavant joshavant commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Related: OpenClaw claim report ACTIONABLE-003-C2

What Problem This Solves

Fixes an issue where iOS users connecting to a manual HTTPS gateway could get stuck behind generic connection failure behavior when the gateway accepts TCP but never completes enough TLS handshake work to produce a certificate fingerprint.

This also fixes the root alert-stack breakage where the gateway trust prompt could be prepared but not presented from the app's main root UI.

Why This Change Was Made

The iOS gateway connector now classifies TLS fingerprint probing outcomes separately from plain TCP reachability, including a bounded TLS fingerprint timeout for secure endpoints that stall after TCP connect. The trust prompt presentation was also moved to SwiftUI's current alert(_:isPresented:presenting:actions:message:) API so it survives the root prompt stack alongside deep-link prompts.

The change keeps the timeout decision inside the gateway connection controller instead of adding settings-screen heuristics or widening generic connection fallbacks.

User Impact

Users now see a specific TLS fingerprint timeout message when a secure gateway endpoint is reachable but does not complete fingerprint verification in time. First-time TLS connections can again present the trust prompt from the main iOS app shell, so users can inspect and trust the gateway fingerprint instead of seeing a silent or misleading connection failure.

Evidence

AI-assisted PR.

  • .agents/skills/autoreview/scripts/autoreview --mode local reported no accepted/actionable findings before commit.
  • Focused XCTest before rebasing onto current origin/main: xcodebuild test -project apps/ios/OpenClaw.xcodeproj -scheme OpenClaw -destination 'platform=iOS Simulator,name=iPhone 17,OS=26.5' -only-testing:OpenClawTests/SwiftUIRenderSmokeTests -only-testing:OpenClawTests/RootTabsSourceGuardTests -only-testing:OpenClawTests/GatewayConnectionSecurityTests passed 55 tests.
  • Live simulator proof before rebasing: a local self-signed TLS endpoint on 127.0.0.1:29664 produced the Trust this gateway? prompt with SHA-256 fingerprint and Trust and connect / Cancel actions.
  • Live simulator regression proof before rebasing: a local stalled TCP endpoint on 127.0.0.1:29664 produced TLS fingerprint verification timed out for 127.0.0.1:29664. Secure endpoint was reached, but TLS did not finish in time.
  • After rebasing onto current origin/main, regenerated the ignored local Xcode project with xcodegen generate and confirmed the branch builds with xcodebuild build -project apps/ios/OpenClaw.xcodeproj -scheme OpenClaw -destination 'platform=iOS Simulator,name=iPhone 17 Pro,OS=26.5'.
  • Post-reset focused XCTest on the amended branch: xcodebuild test -project OpenClaw.xcodeproj -scheme OpenClaw -destination 'platform=iOS Simulator,name=iPhone 17 Pro,OS=26.5' -only-testing:OpenClawTests/GatewayConnectionSecurityTests passed 12 tests.
  • A later combined local focused run rebuilt successfully, launched the simulator app, then hung in Xcode/CoreSimulator before materializing the test worker (waiting for workers to materialize, Waiting for -runningDidFinish call). No test assertions failed in that run.
  • swiftlint lint Sources/Design/SettingsProTabActions.swift passed with 0 violations.
  • PR CI on f2a72a02ef295a2c60990b49086c9264974e8703: ios-build, macos-swift, and Scan iOS dead code passed.

@openclaw-barnacle openclaw-barnacle Bot added app: ios App: ios size: M maintainer Maintainer-authored PR labels Jul 1, 2026
@clawsweeper

clawsweeper Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 1, 2026, 1:47 AM ET / 05:47 UTC.

Summary
The PR moves iOS TLS fingerprint reachability and timeout classification into GatewayConnectionController, updates the gateway trust alert presentation, and adds focused iOS gateway/render tests.

PR surface: Other +316. Total +316 across 7 files.

Reproducibility: yes. at source level. Current main collapses nil TLS fingerprint probing into generic TLS failure text, and the PR body supplies live simulator output for both the trust prompt and stalled TLS timeout paths; I did not run simulator tests in this read-only review.

Review metrics: none identified.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] The PR changes first-use iOS gateway TLS fingerprint probing and trust prompt presentation, so a regression could affect a security-sensitive trust boundary even though the patch looks correct.
  • [P1] The PR body notes a later combined simulator run hung before test workers materialized, so maintainers may still choose a fresh final-head simulator run before landing.

Maintainer options:

  1. Land after trust-path review (recommended)
    If maintainers are satisfied with the focused tests, live proof, and CI, they can land this as the iOS gateway TLS trust-path fix.
  2. Ask for a fresh simulator run
    Maintainers can request one final focused simulator XCTest run on the current head if the CoreSimulator hang noted in the PR body is uncomfortable before merge.
  3. Pause if trust UX needs redesign
    If maintainers want a different first-use trust model or broader gateway diagnostics policy, pause this PR rather than merging more TLS prompt behavior now.

Next step before merge

  • [P2] The protected-label iOS gateway TLS trust-path PR needs maintainer review and landing judgment, not an automated repair branch.

Security
Cleared: No concrete security or supply-chain regression found; the diff stays in Swift app/test code and preserves explicit first-use TLS fingerprint trust while improving failure classification.

Review details

Best possible solution:

Land the controller-owned iOS TLS classification and alert-stack fix after maintainer trust-path review is satisfied; no automated repair is indicated from this review.

Do we have a high-confidence way to reproduce the issue?

Yes, at source level. Current main collapses nil TLS fingerprint probing into generic TLS failure text, and the PR body supplies live simulator output for both the trust prompt and stalled TLS timeout paths; I did not run simulator tests in this read-only review.

Is this the best way to solve the issue?

Yes. Moving reachability and TLS-fingerprint classification into GatewayConnectionController is the narrow owner-boundary fix and avoids keeping gateway connection heuristics in settings UI code.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2c7e989686ba.

Label changes

Label changes:

  • add P2: This is a focused iOS gateway TLS setup bugfix with limited blast radius and no concrete blocking patch finding.
  • add merge-risk: 🚨 security-boundary: The diff changes certificate fingerprint probing and first-use gateway trust prompt behavior, which are part of the iOS gateway security boundary.

Label justifications:

  • P2: This is a focused iOS gateway TLS setup bugfix with limited blast radius and no concrete blocking patch finding.
  • merge-risk: 🚨 security-boundary: The diff changes certificate fingerprint probing and first-use gateway trust prompt behavior, which are part of the iOS gateway security boundary.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes after-fix live simulator output for the trust prompt and stalled TLS timeout message, plus focused XCTest, build, lint, and CI evidence on the PR head.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix live simulator output for the trust prompt and stalled TLS timeout message, plus focused XCTest, build, lint, and CI evidence on the PR head.
Evidence reviewed

PR surface:

Other +316. Total +316 across 7 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 0 0 0 0
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 7 403 87 +316
Total 7 403 87 +316

What I checked:

  • Repository policy read: Read the full root AGENTS.md and found no scoped AGENTS.md under the touched apps/ios paths; the root policy's PR review, protected-label, and security-sensitive gateway guidance applies. (AGENTS.md:1, 2c7e989686ba)
  • Live PR state: Live metadata shows the PR is open, cleanly mergeable, has the protected maintainer label, has proof: sufficient, and has successful iOS-related checks including ios-build, macos-swift, and Scan iOS dead code. (f2a72a02ef29)
  • Current-main behavior gap: Current main's first-use manual TLS path calls probeTLSFingerprint(url:) -> String? and maps nil to the generic TLS handshake failed message, so the requested timeout classification is not already implemented on main. (apps/ios/Sources/Gateway/GatewayConnectionController.swift:327, 2c7e989686ba)
  • PR implementation path: The PR head clears stale trust state, performs a bounded TCP reachability precheck before first-use TLS fingerprint probing, and returns distinct endpoint-unreachable, TLS-timeout, TLS-unavailable, and certificate-unavailable messages. (apps/ios/Sources/Gateway/GatewayConnectionController.swift:870, f2a72a02ef29)
  • Trust prompt presentation: The PR replaces the old alert(item:) modifier with the current alert(_:isPresented:presenting:actions:message:) shape while preserving explicit Cancel and Trust actions that call the gateway controller. (apps/ios/Sources/Gateway/GatewayTrustPromptAlert.swift:6, f2a72a02ef29)
  • Focused regression coverage: The PR adds tests for first-use TLS prompt creation, skipping TLS probing when TCP is unreachable, and reporting TLS fingerprint timeout without leaving stale trust state. (apps/ios/Tests/GatewayConnectionSecurityTests.swift:143, f2a72a02ef29)

Likely related people:

  • joshavant: Recent path history shows Josh Avant authored adjacent iOS gateway/protocol recovery and local-network discovery work before this PR, so this is not based only on PR authorship. (role: recent iOS gateway contributor; confidence: high; commits: ad59492d3ca9, 8bddafba658c, 81c8f525ebfd; files: apps/ios/Sources/Gateway/GatewayConnectionController.swift, apps/ios/Sources/Design/SettingsProTabActions.swift)
  • Peter Steinberger: History shows Peter Steinberger introduced or refactored first-time TLS pin trust and related iOS gateway helper paths. (role: adjacent iOS TLS trust contributor; confidence: medium; commits: 054366dea42e, 778959b3dc27, c94c51371457; files: apps/ios/Sources/Gateway/GatewayConnectionController.swift, apps/ios/Sources/Gateway/GatewayTrustPromptAlert.swift)
  • Mariano: History shows Mariano carried broad iOS gateway connect/discovery stability, manual TLS policy, and related security-test work. (role: adjacent iOS gateway stability contributor; confidence: medium; commits: 9a1e1686857c, 6df57d963366, 8fa46d709a1e; files: apps/ios/Sources/Gateway/GatewayConnectionController.swift, apps/ios/Tests/GatewayConnectionSecurityTests.swift)
  • Nimrod Gutman: Recent iOS gateway certificate recovery work touches the same stored TLS pin and certificate-trust behavior family. (role: adjacent certificate recovery contributor; confidence: medium; commits: 00a0858fd9dc, 47dbc675e953; files: apps/ios/Sources/Gateway/GatewayConnectionController.swift, apps/ios/Tests/GatewayConnectionSecurityTests.swift)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@joshavant
joshavant force-pushed the fix/ios-tls-fingerprint-timeout branch from dd9a96f to f2a72a0 Compare July 1, 2026 05:32
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 1, 2026
@joshavant

joshavant commented Jul 1, 2026

Copy link
Copy Markdown
Collaborator Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Jul 1, 2026
@joshavant
joshavant merged commit 0c7bac3 into main Jul 1, 2026
51 of 53 checks passed
@joshavant
joshavant deleted the fix/ios-tls-fingerprint-timeout branch July 1, 2026 06:06
@github-actions github-actions Bot mentioned this pull request Jul 1, 2026
Open
chenyangjun-xy pushed a commit to chenyangjun-xy/openclaw that referenced this pull request Jul 1, 2026
@joshavant chenyangjun-xy
fix(ios): classify TLS fingerprint timeouts (openclaw#98429)
6e67c9d 
* fix(ios): classify gateway TLS fingerprint timeouts

* Add discovered TLS trust regression test
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 2, 2026
@joshavant
fix(ios): classify TLS fingerprint timeouts (openclaw#98429)
b43e0ec 
* fix(ios): classify gateway TLS fingerprint timeouts

* Add discovered TLS trust regression test
Rorqualx pushed a commit to Rorqualx/cortex that referenced this pull request Jul 8, 2026
@joshavant cron
fix(ios): classify TLS fingerprint timeouts (openclaw#98429)
e10ed66 
* fix(ios): classify gateway TLS fingerprint timeouts

* Add discovered TLS trust regression test

(cherry picked from commit 0c7bac3)
@joshavant joshavant mentioned this pull request Jul 10, 2026
Closed
Rorqualx pushed a commit to Rorqualx/cortex that referenced this pull request Jul 15, 2026
@joshavant cron
fix(ios): classify TLS fingerprint timeouts (openclaw#98429)
fea06db 
* fix(ios): classify gateway TLS fingerprint timeouts

* Add discovered TLS trust regression test

(cherry picked from commit 0c7bac3)
@rusty-cole rusty-cole mentioned this pull request Sep 1, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

app: ios App: ios maintainer Maintainer-authored PR merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: L status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@joshavant