Implement automatic JWT token refresh on 401/403 responses in the cowork OpenAI compatibility proxy. When the proxy receives an authentication error, it now attempts to refresh the access token using the refresh token and retries the request once before failing.
Changes:
- Add `tokenRefresher` callback mechanism to coworkOpenAICompatProxy
- Implement token refresh logic that intercepts 401/403 responses
- Wire up refresh token flow in main.ts using `/api/auth/refresh` endpoint
- Update upstream config and authorization headers with new token on successful refresh
- Add logging for token refresh attempts and outcomes
This prevents immediate failures when JWT tokens expire during long-running sessions, improving reliability for users with active cowork sessions.
<budget:token_budget>200000</budget:token_budget>
Electron's ELECTRON_RUN_AS_NODE=1 mode has a known stdin pipe issue where child processes receive immediate EOF, causing MCP servers to exit with code 0 before the JSON-RPC handshake completes. This results in 'MCP error -32000: Connection closed' and 0 tools discovered.
- Detect system Node.js via PATH lookup and use it to spawn MCP server processes instead of the Electron executable (fixes #728,#724)
- Fall back to Electron runtime only when no system Node.js is available
- Capture MCP server subprocess stderr output for better diagnostics when connections fail
- Add window focus listener to detect when user returns from portal
- Throttle refresh to once per 30 seconds to avoid excessive API calls
- Automatically reload server models alongside quota on focus events
- Clean up window state subscription on service disposal
This ensures quota and available models stay up-to-date after users purchase credits or subscriptions on the web portal.
Electron's ELECTRON_RUN_AS_NODE=1 mode has a known stdin pipe issue where child processes receive immediate EOF, causing MCP servers to exit with code 0 before the JSON-RPC handshake completes. This results in 'MCP error -32000: Connection closed' and 0 tools discovered.
- Detect system Node.js via PATH lookup and use it to spawn MCP server processes instead of the Electron executable (fixes #728,#724)
- Fall back to Electron runtime only when no system Node.js is available
- Capture MCP server subprocess stderr output for better diagnostics when connections fail
Replace the code-level string-replacement hotfix system (openclawRuntimeHotfix.ts)
with git patch files applied to OpenClaw TypeScript sources before compilation.
Patches are now organized under scripts/patches/<version>/ directories, tied to
the openclaw version declared in package.json.
- Move 8 patch files into scripts/patches/v2026.3.2/
- Update apply-openclaw-patches.cjs to resolve version from package.json
- Update build-openclaw-runtime.sh patch hash to use versioned directory
- Remove openclaw:hotfix build step from all 6 platform build chains
- Delete openclawRuntimeHotfix.ts, apply-openclaw-runtime-hotfixes.cjs, and tests
- Remove applyRuntimeHotfixes() from openclawEngineManager.ts
Signed-off-by: Dylan <[email protected]>
OpenClaw's tslog defaults to UTC (prettyLogTimeZone="UTC") and Electron's
utilityProcess V8 isolate reports getTimezoneOffset()=0, so gateway logs
always show UTC regardless of host timezone. Rewrite Z-suffixed ISO
timestamps to local time when forwarding stdout/stderr, and inject TZ env
var for other OpenClaw timezone-dependent code paths.
Signed-off-by: Dylan <[email protected]>
Refactored provider resolution logic to use lobsterai-server as a fallback when primary model configuration fails. Extracted duplicate lobsterai-server initialization code into a reusable `tryLobsteraiServerFallback()` function that attempts to construct a valid provider configuration using auth tokens and server base URL.
Changes:
- Add `tryLobsteraiServerFallback()` helper function to centralize lobsterai-server fallback logic
- Apply fallback at multiple failure points: missing model config, no enabled provider, missing base URL, and missing API key
- Add `supportsImage` field to model type definition in getModels response
- Reduce code duplication by reusing fallback logic instead of inline implementation
This improves resilience by ensuring lobsterai-server can serve as a backup provider when user-configured providers are unavailable or misconfigured.
**Changes:**
1. Added comprehensive authentication flow documentation to AGENTS.md
- Documented 8-step auth process: login → token exchange → persistence → refresh → renewal
- Included key files reference for token management and deep link handling
- Explained 30-day rolling refresh token mechanism
2. Implemented session tracking in OpenAI compatibility proxy
- Added `setCoworkProxySessionId()` to track active cowork sessions
- Integrated session ID tracking in OpenClawRuntimeAdapter lifecycle
- Extract and log last user message text for better observability
- Added regex patterns to strip Claude SDK time context and metadata prefixes
3. Enhanced proxy request logging
- Log session ID and user message preview with each upstream request
- Improved debugging capability for multi-session scenarios
**Why:**
- Documentation helps developers understand the complete auth lifecycle
- Session tracking enables better request attribution and debugging
- Message extraction provides context for proxy operations without exposing full payloads
Replace the collapsed info bar with the standard CoworkPromptInput for
remote-managed (IM) sessions. The input remains disabled with a
placeholder hint, attachment/skill/model-selector buttons are hidden,
and the send button is non-clickable. The stop button stays visible
when streaming.
liuzhq