Apply reviewer feedback: fix connect handshake, config error handling, Solar Witch theme, and legacy import banner gating

Agent-Logs-Url: https://github.com/OpenKnots/okcode/sessions/9615af9c-7cb2-409b-93c1-541b906a4a67

Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>

Author: Copilot

apps/server/src/openclawGatewayTest.ts

@@ -11,6 +11,10 @@ import type {
 } from "@okcode/contracts";
 import NodeWebSocket from "ws";
 import { serverBuildInfo } from "./buildInfo.ts";
+import {
+  generateOpenclawDeviceIdentity,
+  signOpenclawDeviceChallenge,
+} from "./openclaw/deviceAuth.ts";
 
 const OPENCLAW_TEST_CONNECT_TIMEOUT_MS = 10_000;
 const OPENCLAW_TEST_RPC_TIMEOUT_MS = 10_000;
@@ -578,6 +582,7 @@ export async function runOpenclawGatewayTest(
   };
 
   let parsedUrlForHints: URL | null = null;
+  const testDeviceIdentity = generateOpenclawDeviceIdentity();
 
   const waitForGatewayEvent = (
     socket: NodeWebSocket,
@@ -783,29 +788,51 @@ export async function runOpenclawGatewayTest(
       }
     });
 
-  const buildConnectParams = (sharedSecret: string | undefined): Record<string, unknown> => ({
-    minProtocol: OPENCLAW_PROTOCOL_VERSION,
-    maxProtocol: OPENCLAW_PROTOCOL_VERSION,
-    client: {
-      id: "okcode",
-      version: serverBuildInfo.version,
-      platform:
-        process.platform === "darwin"
-          ? "macos"
-          : process.platform === "win32"
-            ? "windows"
-            : process.platform,
-      mode: "operator",
-    },
-    role: "operator",
-    scopes: [...OPENCLAW_OPERATOR_SCOPES],
-    caps: [],
-    commands: [],
-    permissions: {},
-    locale: Intl.DateTimeFormat().resolvedOptions().locale || "en-US",
-    userAgent: `okcode/${serverBuildInfo.version}`,
-    ...(sharedSecret ? { auth: { password: sharedSecret } } : {}),
-  });
+  const buildConnectParams = (
+    sharedSecret: string | undefined,
+    challenge: Record<string, unknown> | undefined,
+  ): Record<string, unknown> => {
+    const nonce =
+      typeof challenge?.nonce === "string" && challenge.nonce.length > 0 ? challenge.nonce : "";
+    const signedAt =
+      typeof challenge?.ts === "number" && Number.isFinite(challenge.ts)
+        ? challenge.ts
+        : Date.now();
+    const authToken = sharedSecret ?? "";
+    const signedDevice = signOpenclawDeviceChallenge(testDeviceIdentity, {
+      clientId: "okcode",
+      clientMode: "operator",
+      role: "operator",
+      scopes: [...OPENCLAW_OPERATOR_SCOPES],
+      token: authToken,
+      nonce,
+      signedAt,
+    });
+    return {
+      minProtocol: OPENCLAW_PROTOCOL_VERSION,
+      maxProtocol: OPENCLAW_PROTOCOL_VERSION,
+      client: {
+        id: "okcode",
+        version: serverBuildInfo.version,
+        platform:
+          process.platform === "darwin"
+            ? "macos"
+            : process.platform === "win32"
+              ? "windows"
+              : process.platform,
+        mode: "operator",
+      },
+      role: "operator",
+      scopes: [...OPENCLAW_OPERATOR_SCOPES],
+      caps: [],
+      commands: [],
+      permissions: {},
+      locale: Intl.DateTimeFormat().resolvedOptions().locale || "en-US",
+      userAgent: `okcode/${serverBuildInfo.version}`,
+      ...(authToken.length > 0 ? { auth: { token: authToken } } : {}),
+      device: signedDevice,
+    };
+  };
 
   try {
     const urlStart = Date.now();
@@ -907,13 +934,13 @@ export async function runOpenclawGatewayTest(
 
     const handshakeStart = Date.now();
     try {
-      await waitForGatewayEvent(ws, "connect.challenge");
+      const challenge = await waitForGatewayEvent(ws, "connect.challenge");
       captureEarlyGatewayEvents = false;
       earlyGatewayEvents.length = 0;
       const connectResult = await sendGatewayRequest(
         ws,
         "connect",
-        buildConnectParams(sharedSecret),
+        buildConnectParams(sharedSecret, challenge),
       );
       if (connectResult.error) {
         const detail = formatGatewayError(connectResult.error);

apps/server/src/provider/Layers/ProviderHealth.ts

@@ -615,9 +615,30 @@ const checkOpenClawProviderStatus: Effect.Effect<
 > = Effect.gen(function* () {
   const checkedAt = new Date().toISOString();
   const gatewayConfig = yield* OpenclawGatewayConfig;
-  const resolvedConfig = yield* gatewayConfig
-    .resolveForConnect()
-    .pipe(Effect.orElseSucceed(() => null));
+  const resolvedConfigResult = yield* gatewayConfig.resolveForConnect().pipe(
+    Effect.match({
+      onSuccess: (resolvedConfig) => ({ ok: true as const, resolvedConfig }),
+      onFailure: (cause) => ({ ok: false as const, cause }),
+    }),
+  );
+
+  if (!resolvedConfigResult.ok) {
+    const reason =
+      resolvedConfigResult.cause instanceof Error
+        ? resolvedConfigResult.cause.message
+        : String(resolvedConfigResult.cause);
+
+    return {
+      provider: OPENCLAW_PROVIDER,
+      status: "error" as const,
+      available: false,
+      authStatus: "unknown" as const,
+      checkedAt,
+      message: `OpenClaw gateway configuration could not be read. ${reason}`,
+    } satisfies ServerProviderStatus;
+  }
+
+  const resolvedConfig = resolvedConfigResult.resolvedConfig;
 
   if (!resolvedConfig) {
     return {

apps/web/src/routes/_chat.settings.tsx

@@ -694,7 +694,9 @@ function SettingsRouteView() {
     (openclawGatewayDraft !== null && openclawGatewayDraft !== savedOpenclawGatewayUrl) ||
     openclawSharedSecretDraft.length > 0;
   const canImportLegacyOpenclawSettings =
-    !savedOpenclawGatewayUrl && Boolean(settings.openclawGatewayUrl || settings.openclawPassword);
+    openclawGatewayConfigQuery.isSuccess &&
+    !savedOpenclawGatewayUrl &&
+    Boolean(settings.openclawGatewayUrl || settings.openclawPassword);
   const changedSettingLabels = [
     ...(theme !== "system" ? ["Theme"] : []),
     ...(colorTheme !== DEFAULT_COLOR_THEME ? ["Color theme"] : []),

apps/web/src/themes.css

@@ -63,6 +63,66 @@
   --warning-foreground: #f1a10d;
 }
 
+/* ─── Solar Witch ─── mystical, radiant, high-contrast sunset magic ─── */
+
+:root.theme-solar-witch {
+  color-scheme: light;
+  --background: #fff7ed;
+  --foreground: #3b0764;
+  --card: #ffedd5;
+  --card-foreground: #3b0764;
+  --popover: #fff7ed;
+  --popover-foreground: #3b0764;
+  --primary: oklch(0.68 0.23 35);
+  --primary-foreground: #ffffff;
+  --secondary: rgba(251, 146, 60, 0.12);
+  --secondary-foreground: #7c2d12;
+  --muted: rgba(245, 158, 11, 0.12);
+  --muted-foreground: #9a3412;
+  --accent: rgba(236, 72, 153, 0.12);
+  --accent-foreground: #831843;
+  --destructive: #dc2626;
+  --destructive-foreground: #b91c1c;
+  --border: rgba(234, 88, 12, 0.18);
+  --input: rgba(234, 88, 12, 0.14);
+  --ring: oklch(0.68 0.23 35);
+  --info: #7c3aed;
+  --info-foreground: #6d28d9;
+  --success: #16a34a;
+  --success-foreground: #15803d;
+  --warning: #f59e0b;
+  --warning-foreground: #b45309;
+}
+
+:root.theme-solar-witch.dark {
+  color-scheme: dark;
+  --background: #140b1f;
+  --foreground: #f8e8ff;
+  --card: #1f102b;
+  --card-foreground: #f8e8ff;
+  --popover: #1f102b;
+  --popover-foreground: #f8e8ff;
+  --primary: oklch(0.74 0.21 55);
+  --primary-foreground: #1a1022;
+  --secondary: rgba(251, 146, 60, 0.12);
+  --secondary-foreground: #ffd7a3;
+  --muted: rgba(236, 72, 153, 0.1);
+  --muted-foreground: #d8b4fe;
+  --accent: rgba(168, 85, 247, 0.14);
+  --accent-foreground: #f3e8ff;
+  --destructive: #fb7185;
+  --destructive-foreground: #fda4af;
+  --border: rgba(251, 146, 60, 0.14);
+  --input: rgba(251, 146, 60, 0.18);
+  --ring: oklch(0.74 0.21 55);
+  --info: #a78bfa;
+  --info-foreground: #c4b5fd;
+  --success: #4ade80;
+  --success-foreground: #86efac;
+  --warning: #fbbf24;
+  --warning-foreground: #fcd34d;
+}
+
 /* ─── Carbon ─── stark, modern, performance-focused (Vercel-inspired) ─── */
 
 :root.theme-carbon {