Repository navigation
Description
Finding (from PR review)
In the configured OpenClaw gateway, the ACP adapter (bin/opencode-acp-adapter.mjs) only authenticates if OPENCODE_SERVER_PASSWORD happens to be inherited, but home/openclaw/default.nix neither supplies that variable nor installs a wrapper to load it. Codex (P1, PR #3997):
The standing server requires the password stored in
~/.local/state/opencode/service-prod.json:bin/openchamber-start.shloads it explicitly, as does the dispatch client. Unlike the previous private-server ACP command, this adapter therefore sends unauthenticated session and event requests in the declared gateway environment, preventing session creation even after the API contract is corrected. Read the standing server's credential at runtime or explicitly wire it into the adapter's launch environment.
Evidence
- Source PR: feat(openclaw): ACP-to-HTTP adapter so OpenClaw shares the standing opencode serve (#1243) #3997 — feat(openclaw): ACP-to-HTTP adapter so OpenClaw shares the standing opencode serve (#1243) #3997 (merged 2026-11-02 as-is)
- Review comment: feat(openclaw): ACP-to-HTTP adapter so OpenClaw shares the standing opencode serve (#1243) #3997 (comment) — chatgpt-codex-connector[bot], 2026-11-01T21:31:18Z,
bin/opencode-acp-adapter.mjs:67 - No-response evidence: the review thread is unresolved (GraphQL
reviewThreads, checked 2026-11-02), the comment has no replies, and PR feat(openclaw): ACP-to-HTTP adapter so OpenClaw shares the standing opencode serve (#1243) #3997 contains a single commit (8e67215, 2026-11-01T21:26:51Z) that predates the comment — no fix followed it before merge. - Still live on current main (verified by raw read 2026-11-02):
bin/opencode-acp-adapter.mjs:65reads the password only fromprocess.env.OPENCODE_SERVER_PASSWORD;home/openclaw/default.nix(lines 59 and 442) launches the adapter with a bare command and noOPENCODE_SERVER_PASSWORDwiring and no reference toservice-prod.json.
Acceptance criteria
- The adapter, as launched by the OpenClaw gateway config in
home/openclaw/default.nix, authenticates to the standing server — either by loading the credential from~/.local/state/opencode/service-prod.jsonat runtime (asbin/openchamber-start.shand the dispatch client do) or by explicit environment wiring in the launch definition. - Verified against the gateway launch path, not only a hand-exported shell environment.
- Or the finding is resolved by a documented decision on this issue.
Activity
dezren39 commentedon Nov 2, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 2, 2026
🤖 Agent note · triaged — CONFIRMED; scoped fix routed
bin/opencode-acp-adapter.mjsauthHeaders reads onlyprocess.env.OPENCODE_SERVER_PASSWORD; both adapter launch sites inhome/openclaw/default.nixomit it and do not load the runtime service-prod credential. Existing consumersbin/openchamber-start.shand the dispatch client demonstrate runtime loading; no open fix PR for openclaw ACP adapter: load the standing-server credential — gateway launch wires no OPENCODE_SERVER_PASSWORD (#3997) #4615.repo-health:v1:fix:developing-today/code:issue:4615) to load the runtime credential or safely wire launch env, and exercise the configured gateway path with a synthetic fixture. No real credential was read or copied; packet/test requirements prohibit logging or storing real values or baking them into Nix.dezren39 commentedon Nov 2, 2026
agent-note:v1
event: already_done
task: 6523 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc)
result: This duplicate triage was already completed by task 6517. Fresh state: issue #4615 remains OPEN/status:triaged; task 6517 is done with confirmed verdict; scoped fix task 6521 is queued. No additional code or duplicate fix task created.
1 remaining item
dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked
Merge pull request #4655 from developing-today/queue/6521-4615-opencl…
dezren39 commentedon Nov 3, 2026
🤖 Agent note · done
Resumed from the prior park on PR #4655 (head 70bbea5): re-verified fresh this shift — laptop
node --test bin/opencode-acp-adapter.test.mjs8/8 pass at that head (including the new gateway-launch-path, auth-file precedence, and malformed-file tests, all with synthetic fixtures; no credential value read or printed), Codex review completed on 70bbea5 with no findings, diff matches the packet intent (runtime-load of~/.local/state/opencode/service-prod.json, env var takes precedence, nothing baked into tracked config). The sole Actions check (metered-provider guard) remained QUEUED in the repo-wide Actions stall, so the merge proceeded on the verified evidence per the standing merge authority. PR #4655 MERGED (merge commit 16e8e34); issue #4615 closed by the merge.