diff --git a/.openclaw-sync/source.json b/.openclaw-sync/source.json index 702a532fb..0bbd04357 100644 --- a/.openclaw-sync/source.json +++ b/.openclaw-sync/source.json @@ -1,5 +1,5 @@ { "repository": "openclaw/openclaw", - "sha": "24ec2aebe8bec0d4f5a57a9ff69f8bf4b50bb221", - "syncedAt": "2026-05-04T10:44:33.610Z" + "sha": "d5b0083300a61d31d4a57864bfd394f825120592", + "syncedAt": "2026-05-04T11:05:39.085Z" } diff --git a/docs/cli/proxy.md b/docs/cli/proxy.md index f60f52b68..58d937b29 100644 --- a/docs/cli/proxy.md +++ b/docs/cli/proxy.md @@ -23,7 +23,7 @@ captured blobs, and purge local capture data. ```bash openclaw proxy start [--host ] [--port ] openclaw proxy run [--host ] [--port ] -- -openclaw proxy validate [--json] [--proxy-url ] [--allowed-url ] [--denied-url ] [--timeout-ms ] +openclaw proxy validate [--json] [--proxy-url ] [--allowed-url ] [--denied-url ] [--apns-reachable] [--apns-authority ] [--timeout-ms ] openclaw proxy coverage openclaw proxy sessions [--limit ] openclaw proxy query --preset [--session ] @@ -40,7 +40,10 @@ before changing config. By default it verifies that a public destination succeed through the proxy and that the proxy cannot reach a temporary loopback canary. Custom denied destinations are fail-closed: HTTP responses and ambiguous transport failures both fail unless you can verify a deployment-specific denial -signal separately. +signal separately. Add `--apns-reachable` to also open an APNs HTTP/2 CONNECT +tunnel through the proxy and confirm sandbox APNs responds; the probe uses an +intentionally invalid provider token, so an APNs `403 InvalidProviderToken` +response is a successful reachability signal. Options: @@ -48,6 +51,8 @@ Options: - `--proxy-url `: validate this proxy URL instead of config or env. - `--allowed-url `: add a destination expected to succeed through the proxy. Repeat to check multiple destinations. - `--denied-url `: add a destination expected to be blocked by the proxy. Repeat to check multiple destinations. +- `--apns-reachable`: also verify sandbox APNs HTTP/2 is reachable through the proxy. +- `--apns-authority `: APNs authority to probe with `--apns-reachable` (`https://api.sandbox.push.apple.com` by default; production is `https://api.push.apple.com`). - `--timeout-ms `: per-request timeout in milliseconds. See [Network Proxy](/security/network-proxy) for deployment guidance and denial diff --git a/docs/help/testing-live.md b/docs/help/testing-live.md index 8e0336189..ffaf18902 100644 --- a/docs/help/testing-live.md +++ b/docs/help/testing-live.md @@ -203,6 +203,15 @@ Notes: - The live CLI-backend smoke now exercises the same end-to-end flow for Claude, Codex, and Gemini: text turn, image classification turn, then MCP `cron` tool call verified through the gateway CLI. - Claude's default smoke also patches the session from Sonnet to Opus and verifies the resumed session still remembers an earlier note. +## Live: APNs HTTP/2 proxy reachability + +- Test: `src/infra/push-apns-http2.live.test.ts` +- Goal: tunnel through a local HTTP CONNECT proxy to Apple's sandbox APNs endpoint, send the APNs HTTP/2 validation request, and assert Apple's real `403 InvalidProviderToken` response comes back through the proxy path. +- Enable: + - `OPENCLAW_LIVE_TEST=1 OPENCLAW_LIVE_APNS_REACHABILITY=1 pnpm test:live src/infra/push-apns-http2.live.test.ts` +- Optional timeout: + - `OPENCLAW_LIVE_APNS_TIMEOUT_MS=30000` + ## Live: ACP bind smoke (`/acp spawn ... --bind here`) - Test: `src/gateway/gateway-acp-bind.live.test.ts` diff --git a/docs/security/network-proxy.md b/docs/security/network-proxy.md index 72a26b9cc..741e4c4ba 100644 --- a/docs/security/network-proxy.md +++ b/docs/security/network-proxy.md @@ -139,7 +139,7 @@ Validate the proxy from the same host, container, or service account that runs O openclaw proxy validate --proxy-url http://127.0.0.1:3128 ``` -By default, when no custom destinations are provided, the command checks that `https://example.com/` succeeds and starts a temporary loopback canary that the proxy must not reach. The default denied check passes when the proxy returns a non-2xx denial response or blocks the canary with a transport failure; it fails if a successful response reaches the canary. If no proxy is enabled and configured, validation reports a config problem; use `--proxy-url` for a one-off preflight before changing config. Use `--allowed-url` and `--denied-url` to test deployment-specific expectations. Custom denied destinations are fail-closed: any HTTP response means the destination was reachable through the proxy, and any transport error is reported as inconclusive because OpenClaw cannot prove the proxy blocked a reachable origin. On validation failure, the command exits with code 1. +By default, when no custom destinations are provided, the command checks that `https://example.com/` succeeds and starts a temporary loopback canary that the proxy must not reach. The default denied check passes when the proxy returns a non-2xx denial response or blocks the canary with a transport failure; it fails if a successful response reaches the canary. If no proxy is enabled and configured, validation reports a config problem; use `--proxy-url` for a one-off preflight before changing config. Use `--allowed-url` and `--denied-url` to test deployment-specific expectations. Add `--apns-reachable` to also verify direct APNs HTTP/2 delivery can open a CONNECT tunnel through the proxy and receive a sandbox APNs response; the probe uses an intentionally invalid provider token, so `403 InvalidProviderToken` is expected and counts as reachable. Custom denied destinations are fail-closed: any HTTP response means the destination was reachable through the proxy, and any transport error is reported as inconclusive because OpenClaw cannot prove the proxy blocked a reachable origin. On validation failure, the command exits with code 1. Use `--json` for automation. The JSON output contains the overall result, the effective proxy config source, any config errors, and each destination check. Proxy URL credentials are redacted in text and JSON output: @@ -158,6 +158,12 @@ Use `--json` for automation. The JSON output contains the overall result, the ef "url": "https://example.com/", "ok": true, "status": 200 + }, + { + "kind": "apns", + "url": "https://api.sandbox.push.apple.com", + "ok": true, + "status": 403 } ] }