openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #101] [CLOSED] fix: use www.clawhub.ai as default registry to prevent auth header stripping on redirect #256

New Issue
Closed
opened 2026-02-15 17:16:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:31 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/101
Author: @IISweetHeartII
Created: 2/2/2026
Status: ❌ Closed

Base: main ← Head: fix/default-registry-www-#100

📝 Commits (1)

  • 659d816 fix: use www.clawhub.ai as default registry to prevent auth header stripping on redirect (#100)

📊 Changes

10 files changed (+34 additions, -34 deletions)

View changed files

📝 e2e/clawdhub.e2e.test.ts (+2 -2)
📝 packages/clawdhub/src/cli/commands/delete.test.ts (+4 -4)
📝 packages/clawdhub/src/cli/commands/inspect.test.ts (+3 -3)
📝 packages/clawdhub/src/cli/commands/moderation.test.ts (+4 -4)
📝 packages/clawdhub/src/cli/commands/publish.test.ts (+4 -4)
📝 packages/clawdhub/src/cli/commands/skills.test.ts (+3 -3)
📝 packages/clawdhub/src/cli/commands/sync.test.ts (+4 -4)
📝 packages/clawdhub/src/cli/registry.test.ts (+5 -5)
📝 packages/clawdhub/src/cli/registry.ts (+2 -2)
📝 public/.well-known/clawhub.json (+3 -3)

📄 Description

Summary

clawhub.ai returns a 307 redirect to www.clawhub.ai. Per standard HTTP security rules, the Authorization header is stripped on cross-origin redirects. This causes all authenticated CLI commands (publish, whoami, sync, delete, etc.) to fail with "Unauthorized" unless the user manually passes --registry https://www.clawhub.ai.

Root Cause

  • DEFAULT_SITE and DEFAULT_REGISTRY in packages/clawdhub/src/cli/registry.ts point to https://clawhub.ai (without www)
  • .well-known/clawhub.json discovery file also returns non-www URLs
  • CLI sends authenticated requests to https://clawhub.ai
  • Server responds with 307 redirect to https://www.clawhub.ai
  • Browser/fetch follows redirect but strips Authorization header (cross-origin security)
  • Request arrives at www.clawhub.ai without auth → "Unauthorized"

Fix

  • Update DEFAULT_SITE and DEFAULT_REGISTRY to https://www.clawhub.ai
  • Update public/.well-known/clawhub.json to use www.clawhub.ai for all endpoints
  • Update all CLI test mocks and e2e test fallbacks to match

Testing

  • All 305 unit tests pass (46 test files)
  • The fix is a minimal, targeted URL change — no logic modifications

Related Issues

Fixes #100
Also fixes #41, #72, #99

All of these report the same symptom: CLI returns "Unauthorized" after successful login, which is caused by the auth header being stripped during the non-www → www redirect.

Greptile Overview

Greptile Summary

This PR updates the CLI’s default site/registry URLs and the .well-known/clawhub.json discovery document to use https://www.clawhub.ai instead of https://clawhub.ai, avoiding a cross-origin 307 redirect that strips Authorization headers and breaks authenticated commands. Test fixtures and e2e defaults were updated accordingly.

One inconsistency remains: the Convex Discord webhook helper still defaults SITE_URL to the non-www domain, so webhook-generated links may continue pointing at the redirecting host instead of the new canonical URL.

Confidence Score: 4/5

  • This PR is safe to merge with low risk; it’s mostly a targeted URL change with one missed default outside the CLI.
  • The production change is limited to switching default site/registry constants and the discovery document, and tests were updated to match. The primary concern is an inconsistent default URL in convex/lib/webhooks.ts that still points to the redirecting non-www domain, which could lead to inconsistent links.
  • convex/lib/webhooks.ts (and its tests) for URL consistency

(2/5) Greptile learns from your feedback when you react with thumbs up/down!

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/101 **Author:** [@IISweetHeartII](https://github.com/IISweetHeartII) **Created:** 2/2/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/default-registry-www-#100` --- ### 📝 Commits (1) - [`659d816`](https://github.com/openclaw/clawhub/commit/659d816a3157c2b7bce31af8fca720b549927f4f) fix: use www.clawhub.ai as default registry to prevent auth header stripping on redirect (#100) ### 📊 Changes **10 files changed** (+34 additions, -34 deletions) <details> <summary>View changed files</summary> 📝 `e2e/clawdhub.e2e.test.ts` (+2 -2) 📝 `packages/clawdhub/src/cli/commands/delete.test.ts` (+4 -4) 📝 `packages/clawdhub/src/cli/commands/inspect.test.ts` (+3 -3) 📝 `packages/clawdhub/src/cli/commands/moderation.test.ts` (+4 -4) 📝 `packages/clawdhub/src/cli/commands/publish.test.ts` (+4 -4) 📝 `packages/clawdhub/src/cli/commands/skills.test.ts` (+3 -3) 📝 `packages/clawdhub/src/cli/commands/sync.test.ts` (+4 -4) 📝 `packages/clawdhub/src/cli/registry.test.ts` (+5 -5) 📝 `packages/clawdhub/src/cli/registry.ts` (+2 -2) 📝 `public/.well-known/clawhub.json` (+3 -3) </details> ### 📄 Description ## Summary `clawhub.ai` returns a **307 redirect** to `www.clawhub.ai`. Per standard HTTP security rules, the `Authorization` header is **stripped on cross-origin redirects**. This causes all authenticated CLI commands (`publish`, `whoami`, `sync`, `delete`, etc.) to fail with **"Unauthorized"** unless the user manually passes `--registry https://www.clawhub.ai`. ## Root Cause - `DEFAULT_SITE` and `DEFAULT_REGISTRY` in `packages/clawdhub/src/cli/registry.ts` point to `https://clawhub.ai` (without `www`) - `.well-known/clawhub.json` discovery file also returns non-www URLs - CLI sends authenticated requests to `https://clawhub.ai` - Server responds with 307 redirect to `https://www.clawhub.ai` - Browser/fetch follows redirect but strips `Authorization` header (cross-origin security) - Request arrives at `www.clawhub.ai` without auth → **"Unauthorized"** ## Fix - Update `DEFAULT_SITE` and `DEFAULT_REGISTRY` to `https://www.clawhub.ai` - Update `public/.well-known/clawhub.json` to use `www.clawhub.ai` for all endpoints - Update all CLI test mocks and e2e test fallbacks to match ## Testing - All 305 unit tests pass (46 test files) - The fix is a minimal, targeted URL change — no logic modifications ## Related Issues Fixes #100 Also fixes #41, #72, #99 All of these report the same symptom: CLI returns "Unauthorized" after successful login, which is caused by the auth header being stripped during the non-www → www redirect. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates the CLI’s default `site`/`registry` URLs and the `.well-known/clawhub.json` discovery document to use `https://www.clawhub.ai` instead of `https://clawhub.ai`, avoiding a cross-origin 307 redirect that strips `Authorization` headers and breaks authenticated commands. Test fixtures and e2e defaults were updated accordingly. One inconsistency remains: the Convex Discord webhook helper still defaults `SITE_URL` to the non-www domain, so webhook-generated links may continue pointing at the redirecting host instead of the new canonical URL. <h3>Confidence Score: 4/5</h3> - This PR is safe to merge with low risk; it’s mostly a targeted URL change with one missed default outside the CLI. - The production change is limited to switching default site/registry constants and the discovery document, and tests were updated to match. The primary concern is an inconsistent default URL in `convex/lib/webhooks.ts` that still points to the redirecting non-www domain, which could lead to inconsistent links. - convex/lib/webhooks.ts (and its tests) for URL consistency <!-- greptile_other_comments_section --> <sub>(2/5) Greptile learns from your feedback when you react with thumbs up/down!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:31 -05:00
yindo closed this issue 2026-02-15 17:16:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#256
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?