fix: make Windows Launcher isolation status informational

[ChazGo]

Why is this change being made?

Windows Launcher should report the packaged Gateway's required isolation, not present isolation as a configurable mode. Its informational page should appear by default without overwriting an operator's explicit plugin decision.

What changed?

• Removed isolation controls and enable/disable guidance. The captured launcher signal reports Gateway Isolation: Active; missing, malformed or unsupported reports produce neutral Invalid status.
• Added seven accessible, copy-only command references with user-session and agent-session guidance. The page never executes commands.
• Enabled the bundled plugin by default while preserving explicit disable, global disable, denylist and restrictive allowlist decisions.
• Preserved authenticated read-only access, operator.read, hardened headers, the opaque iframe sandbox and validated live theme forwarding.
• Selected stable OpenClaw v2026.9.5 at ec9c1a13db8938e5a3eaa51fca2e981cde2395a9, aligned workflow defaults and release policy, and removed the development override.
• Required matching Windows/Node architecture for native payload inspection. ARM64 payload jobs use windows-11-vs2026-arm; cross-composition remains available with a qualified payload.
• Fixed an expected-failure test leaking $LASTEXITCODE=1 into the Actions wrapper without suppressing unexpected native failures.

Head: 872e72958c6cd1dedd1d15de48334d02ab7e0f96. The merged #75 native-staging fix is included. The coordinated runtime update, default activation and native payload-build requirement still need maintainer acceptance.

How was the change tested?

Installed x64 recovery and fresh-install proof: Tested the exact-head, locally test-signed MSIX 2026.9.500.0 with OpenClaw 2026.9.5 and matching build/runtime Node 24.20.0. Package SHA-256: 917260192f2ce977badc745ab4512600a7b0b863ea5cabfb7b49f6ac3f27d47d.

• Recovery preserved configuration, a workspace canary, session identity and Node bytes, then passed startup, readiness, native-command and browser checks.
• Clean fresh installation passed setup, native-command, default-activation and browser checks.
• Explicit false survived restart and supported setup. The plugin was not imported, registered no routes and exposed no tab or iframe; the unregistered route returned 404.
• Both browser runs used the actual launcher signal, not an injected enabled fixture. Authenticated requests returned 200 inside an allow-scripts iframe without allow-same-origin. Four themes switched on the same frame with zero post-mount navigations, page errors or command-execution requests.
• Final stop, collection, teardown, uninstall and owned test-certificate removal passed. Independent final inventory showed no product package, state records, scheduled tasks, listeners or processes; owned provider tasks/children and the SSH tunnel were removed. Official trust was unchanged.

Important limitation: Official baseline 2026.9.4.1001 installed and setup passed, but its Gateway exited with a native Koffi loading error before becoming ready. That failure remains recorded. The completed lane is failed-baseline recovery, not healthy-baseline upgrade proof. Fresh-install proof is separate. No PR86 changes were incorporated.

Source and CI checks: Exact-head local validation passed 52 plugin tests, 807 managed tests, zero-warning static analysis, 18 NativeAOT scenarios plus the expected wrong-alias negative, and the owning plugin, workflow/signing, release/version, Node runtime, payload/build-identity and documentation checks. Initial failures and successful recoveries remain separate records.

PR integration CI used merge commit 20ce92b7aefae10954776573777cf1547bc59fe5, combining main 288521d5 with this head. Host checks, upstream full build, x64/ARM64 MSIX jobs and multiarchitecture bundling passed. The native ARM64 job used ARM64 Node 24.20.0, built a fresh payload, validated Gateway/UI identity and completed NativeAOT composition. This is merge-ref integration evidence, not exact-head or installed ARM64 proof.

The local candidate combines the exact-head host with separately validated CI payload 10665831515; its producer contract and injected plugin bytes match this head. Genuine CI metadata remains unchanged. The upstream tarball SHA-256 is 8b1a6569f24d0c3739bd62371b1e75c5d0fc8ff2f95c498bbe923d1825f9a991. Registry TLS failures were recovered through supported, integrity-checked payload and MXC archive reuse, without weakening verification.

Actual clipboard values and denial recovery

Independent checks of both hash-bound browser results verified 28 exact copy actions and 28 fallback calls. Mouse and keyboard actions produced each value below in both runs; keyboard focus stayed on Copy.

Expected and actual clipboard value	Keyboard activation
clawctl pwsh	Enter
clawctl gateway-service status	Space
clawctl gateway-service stop && clawctl gateway-service start	Enter
clawctl --help	Space
openclaw tui	Enter
openclaw dashboard --no-open	Space
openclaw --help	Enter

With deliberately injected denial, writeText threw and execCommand("copy") returned false. Both runs retained UI proof sentinel on the clipboard, selected exactly clawctl gateway-service status, and displayed:

Copy unavailable. Gateway status command selected; press Ctrl+C to copy.

Actual manual Ctrl+C then copied that exact command. This proves recovery from an injected denial, not a naturally observed permission failure.

Actual fresh-installed runtime: four themes

These captures were inspected visually and identify the exact tested source, runtime, package and local test signing. Earlier recovery images had a stale harness footer and are retained but excluded here; their separate behavioral results identify the correct candidate.

Healthy-baseline upgrade and installed ARM64 remain unproven. Cleanup covers owned product/provider state, not a global MXC backend inventory. Local test signing and passing checks do not establish official release readiness or replace maintainer scope acceptance.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 21, 2026, 8:39 PM ET / September 22, 2026, 00:39 UTC (Revision 5).

ClawSweeper review

What this changes

Makes Windows Launcher an informational page with seven copyable commands, enables its plugin by default, and updates runtime approval and architecture-specific packaging checks.

Merge readiness

⛔ Blocked before merge - 5 items remain

Keep open: current main retains the old isolation-control guidance, so the informational page remains useful, distinct work. No blocking code defect was found in the pinned diff.

Priority: P2
Reviewed head: 872e72958c6cd1dedd1d15de48334d02ab7e0f96
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Strong installed behavior evidence supports a sound patch, with healthy-upgrade coverage still limiting compatibility confidence.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (live_output): Exact-head installed x64 results and inspected screenshots demonstrate the changed plugin's real launcher signal, themes, clipboard recovery and explicit-disable behavior. Captured runtime observations supplement the images; healthy-baseline upgrade and installed ARM64 coverage remain separately bounded.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): Exact-head installed x64 results and inspected screenshots demonstrate the changed plugin's real launcher signal, themes, clipboard recovery and explicit-disable behavior. Captured runtime observations supplement the images; healthy-baseline upgrade and installed ARM64 coverage remain separately bounded.
Evidence reviewed	13 items	Pinned introduction boundary: Reviewed the complete introduced hunks across 17 files from the pinned merge base to the original PR head. The checkout matches that head; no current-main deletion claim was inferred from endpoint differences. Central UI work remains necessary: The plugin directory is unchanged between the pinned base and fetched main. It still accepts a disabled isolation report, displays the planned isolation-control command, and ships disabled by default. Latest release boundary: GitHub's latest-release endpoint identifies v2026.9.4-msix.3, published September 19, with target ee41ab7. That source retains the old plugin behavior.
Findings	None	None.
Security	None	None.

How this fits together

The packaging-owned Windows Launcher plugin displays the isolated Gateway's launch report inside OpenClaw's Control UI. Packaging selects and validates the upstream runtime; upstream plugin policy controls activation and authenticated access.

flowchart LR
  A[Runtime and package inputs] --> B[Payload validation]
  B --> C[Packaged Gateway]
  D[Operator plugin settings] --> C
  C --> E[Authenticated launcher tab]
  F[Captured isolation report] --> E
  E --> G[Status and copyable commands]

Loading

Decision needed

Question	Recommendation
Should default activation land with this informational page while official v2026.9.5 runtime approval proceeds separately?	Separate official release approval: Accept the informational default-on tab with explicit disables preserved, reconcile with current main, and handle official runtime approval in its release-policy review.

Why: The UI improvement is distinct from approving an upstream release for official signing, and the supplied evidence does not resolve healthy-upgrade compatibility.

Before merge

• Resolve merge risk (P1) - Existing profiles without a plugin decision gain an active tab, and the branch approves a new officially signable upstream runtime; maintainer acceptance of those scope changes is not recorded.
• Resolve merge risk (P1) - Failed-baseline recovery does not establish that a healthy existing Gateway retains working runtime behavior through the proposed upgrade.
• Resolve merge risk (P1) - The head has merge conflicts against current main; the earlier successful integration run does not validate reconciliation with the merged stable-source selection owner.
• Complete next step (P2) - Resolve conflicts with current main's stable-source selection and native payload validation, then refresh integration review for the resulting head.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Net code growth	Production/config +137 lines; tests/fixtures +338 lines	Growth supports command references and packaging validation; the broader runtime/default scope still requires acceptance.

Merge-risk options

Maintainer options:

1. Resolve the healthy-upgrade gap (recommended)
   Provide healthy-baseline runtime upgrade evidence for the reconciled candidate while preserving existing configuration and explicit plugin disables.
2. Accept the bounded evidence
   A maintainer may explicitly accept fresh-install and failed-baseline recovery coverage while recording that healthy runtime upgrades remain unproven.

Technical review

Best possible solution:

Keep one read-only launcher tab governed by upstream plugin settings, reuse main's source-selection owners, and separate official runtime approval unless maintainers accept it with upgrade evidence.

Do we have a high-confidence way to reproduce the issue?

Yes, source establishes the mismatch: current main displays planned isolation controls while the launcher always supplies an enabled isolation report. No current-main runtime reproduction was executed.

Is this the best way to solve the issue?

Yes for the informational page and preservation of upstream plugin policy; the broader packaging edits should be reconciled with main's existing source-selection owner rather than retained as parallel policy.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 207d19d0fd28.

Labels

Label justifications:

• P2: This is a bounded launcher UX and packaging improvement without evidence of an urgent user-facing regression.
• merge-risk: 🚨 compatibility: Default activation affects existing undecided profiles, and the runtime promotion lacks healthy-baseline upgrade proof.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Exact-head installed x64 results and inspected screenshots demonstrate the changed plugin's real launcher signal, themes, clipboard recovery and explicit-disable behavior. Captured runtime observations supplement the images; healthy-baseline upgrade and installed ARM64 coverage remain separately bounded.
• proof: sufficient: Contributor real behavior proof is sufficient. Exact-head installed x64 results and inspected screenshots demonstrate the changed plugin's real launcher signal, themes, clipboard recovery and explicit-disable behavior. Captured runtime observations supplement the images; healthy-baseline upgrade and installed ARM64 coverage remain separately bounded.

Evidence

What I checked:

• Pinned introduction boundary: Reviewed the complete introduced hunks across 17 files from the pinned merge base to the original PR head. The checkout matches that head; no current-main deletion claim was inferred from endpoint differences. (872e72958c6c)
• Central UI work remains necessary: The plugin directory is unchanged between the pinned base and fetched main. It still accepts a disabled isolation report, displays the planned isolation-control command, and ships disabled by default. (plugins/gateway-isolation/index.js:54, 207d19d0fd28)
• Latest release boundary: GitHub's latest-release endpoint identifies v2026.9.4-msix.3, published September 19, with target ee41ab7. That source retains the old plugin behavior. (ee41ab70e76c)
• Current-main overlap and integration: GitHub verifies feat: track stable OpenClaw releases for MSIX builds #42 as merged. Current main already selects verified stable sources through Get-WorkflowSource.ps1 and builds with matching Node architectures. This supersedes part of the packaging rationale, not the launcher page. The current PR remains dirty, and its historical CI merge used an older main revision. (.github/workflows/gateway-msix.yml:269, 207d19d0fd28)
• Real installed behavior evidence: The captured body at source revision 856eff7214811a8156e178ff462afaf598aa5f6ef7b8b586cf1c7cda0dcc7a68 records exact-head x64 fresh installation and failed-baseline recovery using package SHA-256 917260192f2ce977badc745ab4512600a7b0b863ea5cabfb7b49f6ac3f27d47d. Results include actual launcher-signal rendering, authenticated HTTP 200, opaque sandboxing, four live themes, exact clipboard values, denial recovery, and explicit-disable persistence with no registration and HTTP 404. All four prepared screenshots were inspected and match the page and tested-head footer. (plugins/gateway-isolation/index.js:108, 872e72958c6c)
• Upgrade evidence remains bounded: The body explicitly reports that baseline 2026.9.4.1001 failed before Gateway readiness with a Koffi loading error. Recovery and fresh installation succeeded, but healthy-baseline runtime upgrade and installed ARM64 behavior remain unproven. Native ARM64 composition passed in the historical integration run; that is distinct from installed runtime proof. (release-policy.json:3, 872e72958c6c)

Likely related people:

• unknown: The claimed source-line change could not be verified from bounded local history. (role: source history unknown; confidence: low)
• RomneyDa: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• xlinush: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Add healthy-baseline runtime upgrade evidence for the reconciled candidate, or obtain explicit acceptance of that specific coverage limitation.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-18T18:44:35.810Z sha 1b2ea92 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-18T18:59:05.767Z sha 1b2ea92 :: needs real behavior proof before merge. :: [P2] Clear the expected native failure before returning from the test
• reviewed 2026-09-21T21:17:36.718Z sha 872e729 :: needs real behavior proof before merge. :: none
• reviewed 2026-09-22T00:29:49.390Z sha 872e729 :: blocked before merge. :: none

[ChazGo]

@copilot please fix the merge conflicts in this pull request.