openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #121] [CLOSED] fix: use www.clawhub.ai in well-known discovery config #264

New Issue
Closed
opened 2026-02-15 17:16:33 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:33 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/121
Author: @jontsai
Created: 2/3/2026
Status: ❌ Closed

Base: main ← Head: fix/well-known-api-base-redirect

📝 Commits (1)

  • 65052d9 fix: use www.clawhub.ai in well-known discovery config

📊 Changes

2 files changed (+6 additions, -6 deletions)

View changed files

📝 public/.well-known/clawdhub.json (+3 -3)
📝 public/.well-known/clawhub.json (+3 -3)

📄 Description

Problem

clawhub login fails with Unauthorized for all users.

Root cause: The .well-known/clawhub.json discovery config advertises https://clawhub.ai as the apiBase, but clawhub.ai 307-redirects to www.clawhub.ai (Vercel hosting).

Node.js's fetch() strips the Authorization header on cross-origin redirects per HTTP spec (clawhub.ai → www.clawhub.ai is considered cross-origin). The CLI sends the auth token to clawhub.ai, gets redirected, and the token is dropped before reaching www.clawhub.ai.

This affects:

  • clawhub login (browser flow callback validation)
  • clawhub login --no-browser --token
  • clawhub whoami
  • clawhub publish
  • Any authenticated API call

Fix

Update apiBase, authBase, and registry in both .well-known/clawhub.json and .well-known/clawdhub.json to use https://www.clawhub.ai directly, bypassing the redirect.

Repro

# Shows the 307 redirect
curl -sI https://clawhub.ai/api/v1/whoami
# HTTP/2 307
# location: https://www.clawhub.ai/api/v1/whoami

# Direct to www works fine
curl -s -H 'Authorization: Bearer <token>' https://www.clawhub.ai/api/v1/whoami

Files Changed

  • public/.well-known/clawhub.json
  • public/.well-known/clawdhub.json

Greptile Overview

Greptile Summary

This PR updates the CLI discovery configuration served from public/.well-known/*.json so the CLI uses https://www.clawhub.ai directly, avoiding the clawhub.ai → www.clawhub.ai redirect that causes Node’s fetch() to drop Authorization headers on cross-origin redirects.

The change fits into the codebase as static discovery metadata (served via the web app’s public/ assets) that the CLI reads to determine apiBase, authBase, and registry locations for authenticated operations.

Confidence Score: 3/5

  • Mostly safe to merge, but verify the discovery JSON actually reflects the intended www endpoints.
  • The change is limited to static JSON config, but the current file contents indicate authBase and registry may still point at https://clawhub.ai, which would undercut the stated fix and likely keep auth flows broken for some calls.
  • public/.well-known/clawhub.json, public/.well-known/clawdhub.json

(5/5) You can turn off certain types of comments like style here!

Context used:

  • Context from dashboard - AGENTS.md (source)

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/121 **Author:** [@jontsai](https://github.com/jontsai) **Created:** 2/3/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/well-known-api-base-redirect` --- ### 📝 Commits (1) - [`65052d9`](https://github.com/openclaw/clawhub/commit/65052d938ca4d9172d40c043a45a20cdc45ffe75) fix: use www.clawhub.ai in well-known discovery config ### 📊 Changes **2 files changed** (+6 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `public/.well-known/clawdhub.json` (+3 -3) 📝 `public/.well-known/clawhub.json` (+3 -3) </details> ### 📄 Description ## Problem `clawhub login` fails with `Unauthorized` for all users. **Root cause:** The `.well-known/clawhub.json` discovery config advertises `https://clawhub.ai` as the `apiBase`, but `clawhub.ai` 307-redirects to `www.clawhub.ai` (Vercel hosting). Node.js's `fetch()` strips the `Authorization` header on cross-origin redirects per HTTP spec (`clawhub.ai` → `www.clawhub.ai` is considered cross-origin). The CLI sends the auth token to `clawhub.ai`, gets redirected, and the token is dropped before reaching `www.clawhub.ai`. This affects: - `clawhub login` (browser flow callback validation) - `clawhub login --no-browser --token` - `clawhub whoami` - `clawhub publish` - Any authenticated API call ## Fix Update `apiBase`, `authBase`, and `registry` in both `.well-known/clawhub.json` and `.well-known/clawdhub.json` to use `https://www.clawhub.ai` directly, bypassing the redirect. ## Repro ```bash # Shows the 307 redirect curl -sI https://clawhub.ai/api/v1/whoami # HTTP/2 307 # location: https://www.clawhub.ai/api/v1/whoami # Direct to www works fine curl -s -H 'Authorization: Bearer <token>' https://www.clawhub.ai/api/v1/whoami ``` ## Files Changed - `public/.well-known/clawhub.json` - `public/.well-known/clawdhub.json` <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR updates the CLI discovery configuration served from `public/.well-known/*.json` so the CLI uses `https://www.clawhub.ai` directly, avoiding the `clawhub.ai` → `www.clawhub.ai` redirect that causes Node’s `fetch()` to drop `Authorization` headers on cross-origin redirects. The change fits into the codebase as static discovery metadata (served via the web app’s `public/` assets) that the CLI reads to determine `apiBase`, `authBase`, and `registry` locations for authenticated operations. <h3>Confidence Score: 3/5</h3> - Mostly safe to merge, but verify the discovery JSON actually reflects the intended www endpoints. - The change is limited to static JSON config, but the current file contents indicate `authBase` and `registry` may still point at `https://clawhub.ai`, which would undercut the stated fix and likely keep auth flows broken for some calls. - public/.well-known/clawhub.json, public/.well-known/clawdhub.json <!-- greptile_other_comments_section --> <sub>(5/5) You can turn off certain types of comments like style [here](https://app.greptile.com/review/github)!</sub> **Context used:** - Context from `dashboard` - AGENTS.md ([source](https://app.greptile.com/review/custom-context?memory=a1d58d20-b4dd-4cbb-973a-9fd7824e1921)) <!-- /greptile_comment --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:33 -05:00
yindo closed this issue 2026-02-15 17:16:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#264
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?