Repository navigation
feat(api): add credential-free Google API relays - #1226
Conversation
…uests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
…E_URL Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review blockedAutomated review did not run, so no review verdict was produced. Reason: The input-safety check rejected material in this revision. No detected value, path, or scanner output is reproduced here. Automatic review is on hold, including after source changes. Request a fresh re-review after resolving the failure; maintainers can also release the hold through an intentional scanner-policy update. Next step: If this is a genuine credential, remove and rotate it. If it is an intentional test fixture, a maintainer must review and qualify it. |
clawsweeper
Bot
added
the
clawsweeper:intake:feature
…cross-origin redirects Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
…G_GOOGLE_API_BASE_URL Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
km-tr
changed the title
Keep and YouTube no longer require local credentials while the base URL is set, invalid values are not echoed in errors, and redirects to the relay's own origin are followed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
…URL host Absolute redirects to the base URL keep the original Google host, api call lets the transport enforce redirects while the base URL is set, and values with an empty host name are rejected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
Redirect Locations on the base URL's origin are rewritten to the original Google origin, so redirected requests are rewritten again with X-Forwarded-Host and --readonly and Discovery redirect checks keep seeing Google URLs. This replaces the relay-origin exceptions added earlier. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
…_URL Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DUrLxHVpdzbQGkSefPpGr7
Route explicitly configured Google API traffic through a plain transport without resolving or attaching local credentials. Preserve path/query and original host routing, reject cross-origin redirects, and retain command/read-only policy checks. Closes openclaw#1225 Co-authored-by: km-tr <kumagai@bear.tokyo>
steipete
changed the title
|
Landed as d891746. Thanks @km-tr; your contribution is credited in the changelog and squash commit. The full Linux |
2 participants
Closes #1225.
Add
GOG_GOOGLE_API_BASE_URLfor local mocks, emulators, and relays that attach credentials outside gog. Requests keep their path and query and identify the original Google host withX-Forwarded-Host.The relay client has no OAuth, ADC, service-account, or API-key credential provider. It rejects cross-origin redirects and preserves read-only enforcement and Discovery URL validation. Account labels do not select per-account MCP grants in this mode; the global policy still applies.
Scope excludes token endpoints, gRPC, Maps/Places, and unauthenticated non-Google-API downloads. README and MCP docs explain these boundaries. Thanks @km-tr.
Validation: focused transport tests pass, including credential isolation and cross-origin redirects. Independent Codex review found no actionable P0–P2 issues. The full Linux
make cigate passed on Node 26 and Go 1.27.2.govulncheck ./...found no reachable vulnerabilities. A built-CLI check against a synthetic relay succeeded without an Authorization header; a cross-origin redirect was refused and the target received zero requests.