openclaw
diff --git a/‎src/OpenClaw.Chat/ChatModels.cs‎
Lines changed: 29 additions & 2 deletions b/‎src/OpenClaw.Chat/ChatModels.cs‎
Lines changed: 29 additions & 2 deletions
diff --git a/‎src/OpenClaw.Chat/ChatTimelineReducer.cs‎
Lines changed: 105 additions & 8 deletions b/‎src/OpenClaw.Chat/ChatTimelineReducer.cs‎
Lines changed: 105 additions & 8 deletions
diff --git a/‎src/OpenClaw.SetupEngine.UI/Pages/ProgressPage.xaml.cs‎
Lines changed: 16 additions & 2 deletions b/‎src/OpenClaw.SetupEngine.UI/Pages/ProgressPage.xaml.cs‎
Lines changed: 16 additions & 2 deletions
diff --git a/‎src/OpenClaw.Tray.WinUI/Chat/IChatGatewayBridge.cs‎
Lines changed: 65 additions & 1 deletion b/‎src/OpenClaw.Tray.WinUI/Chat/IChatGatewayBridge.cs‎
Lines changed: 65 additions & 1 deletion
@@ -23,7 +23,32 @@ public enum ChatTimelineItemKind
     ToolCall,
     Reasoning,
     Status,
-    Raw
+    Raw,
+    PermissionRequest
+}
+
+/// <summary>
+/// Outcome of an exec-approval prompt, attached to a
+/// <see cref="ChatTimelineItemKind.PermissionRequest"/> timeline entry.
+/// </summary>
+/// <remarks>
+/// <para><see cref="Pending"/> is the initial state — Allow/Deny buttons
+/// render and the matching <see cref="ChatTimelineState.PendingPermission"/>
+/// slot is non-null.</para>
+/// <para><see cref="Allowed"/> / <see cref="Denied"/> are set locally as
+/// soon as the user clicks a button, so the inline bubble collapses to a
+/// "decided" badge without waiting for the gateway round-trip.</para>
+/// <para><see cref="Expired"/> is the backstop set when the gateway emits
+/// a terminal approval phase (resolved / cancelled / timed-out) before the
+/// user picked an option — e.g. another client decided, or the gateway
+/// timed the prompt out. Visually distinguishes it from a user choice.</para>
+/// </remarks>
+public enum ChatPermissionDecision
+{
+    Pending,
+    Allowed,
+    Denied,
+    Expired
 }
 
 public enum ChatToolCallStatus
@@ -76,7 +101,9 @@ public record ChatTimelineItem(
     string? IntentSummary = null,
     JsonObject? ToolArgs = null,
     ChatTone? Tone = null,
-    string? ToolCallId = null);
+    string? ToolCallId = null,
+    string? PermissionRequestId = null,
+    ChatPermissionDecision PermissionDecision = ChatPermissionDecision.Pending);
 
 public record ChatPermissionRequest(string RequestId, string PermissionKind, string ToolName, string Detail);
 
 
@@ -24,10 +24,7 @@ public static ChatTimelineState Apply(ChatTimelineState state, ChatEvent evt)
             ChatRestoredEvent e => PushEntry(state, ChatTimelineItemKind.Status, e.Text, ChatTone.Info),
             ChatContextChangedEvent => state,
             ChatModelChangedEvent e => PushEntry(state, ChatTimelineItemKind.Status, $"Model -> {e.Model}", ChatTone.Success),
-            ChatPermissionRequestEvent e => state with
-            {
-                PendingPermission = new ChatPermissionRequest(e.RequestId, e.PermissionKind, e.ToolName, e.Detail)
-            },
+            ChatPermissionRequestEvent e => ApplyPermissionRequest(state, e),
             ChatRawEvent e => e.Text is { Length: > 0 } t ? PushEntry(state, ChatTimelineItemKind.Raw, t) : state,
             _ => state
         };
@@ -59,7 +56,102 @@ public static ChatTimelineState AddSystem(ChatTimelineState state, string text,
         => PushEntry(state, ChatTimelineItemKind.Status, text, tone);
 
     public static ChatTimelineState ClearPermission(ChatTimelineState state)
-        => state with { PendingPermission = null };
+        => ResolvePermission(state, requestId: state.PendingPermission?.RequestId, decision: ChatPermissionDecision.Expired);
+
+    /// <summary>
+    /// Marks the timeline entry for <paramref name="requestId"/> with a
+    /// terminal <paramref name="decision"/> and (if it is the live one)
+    /// clears <see cref="ChatTimelineState.PendingPermission"/>.
+    /// </summary>
+    /// <remarks>
+    /// <para>This is the source of truth for "the inline approval bubble
+    /// is now decided". UI callers route Allow/Deny clicks here with
+    /// <see cref="ChatPermissionDecision.Allowed"/> / <see cref="ChatPermissionDecision.Denied"/>
+    /// so the bubble collapses to its decided badge immediately, without
+    /// waiting for the gateway round-trip.</para>
+    /// <para>Gateway-side terminal events (the legacy ClearPermission
+    /// path) call this with <see cref="ChatPermissionDecision.Expired"/>
+    /// as a backstop in case the user never clicked — visually
+    /// distinguishes "decided by user" from "decided elsewhere or timed
+    /// out".</para>
+    /// <para>If <paramref name="requestId"/> is null or no matching entry
+    /// exists, the entry list is left untouched and only
+    /// <see cref="ChatTimelineState.PendingPermission"/> is cleared (mirrors
+    /// the prior ClearPermission contract).</para>
+    /// <para>Entries whose <see cref="ChatTimelineItem.PermissionDecision"/>
+    /// is already non-Pending are not overwritten — once the user has made
+    /// a choice locally, a later gateway "Expired" event won't downgrade it.</para>
+    /// </remarks>
+    public static ChatTimelineState ResolvePermission(ChatTimelineState state, string? requestId, ChatPermissionDecision decision)
+    {
+        var entries = state.Entries;
+        if (!string.IsNullOrEmpty(requestId))
+        {
+            for (int i = entries.Count - 1; i >= 0; i--)
+            {
+                var entry = entries[i];
+                if (entry.Kind != ChatTimelineItemKind.PermissionRequest) continue;
+                if (!string.Equals(entry.PermissionRequestId, requestId, StringComparison.Ordinal)) continue;
+                if (entry.PermissionDecision != ChatPermissionDecision.Pending) break;
+                entries = entries.SetItem(i, entry with { PermissionDecision = decision });
+                break;
+            }
+        }
+
+        var clearedPending = state.PendingPermission is null
+            || (requestId is null)
+            || string.Equals(state.PendingPermission.RequestId, requestId, StringComparison.Ordinal)
+                ? null
+                : state.PendingPermission;
+
+        return state with { Entries = entries, PendingPermission = clearedPending };
+    }
+
+    static ChatTimelineState ApplyPermissionRequest(ChatTimelineState state, ChatPermissionRequestEvent e)
+    {
+        // A second exec-approval can arrive before the first is resolved.
+        // Mark any still-Pending prior approval entry as Expired so the
+        // timeline doesn't show two live Allow/Deny prompts at once — the
+        // gateway has implicitly superseded the earlier one by issuing a
+        // new approval. This mirrors the prior single-slot PendingPermission
+        // behavior, which silently replaced the older request.
+        var entries = state.Entries;
+        for (int i = entries.Count - 1; i >= 0; i--)
+        {
+            var existing = entries[i];
+            if (existing.Kind != ChatTimelineItemKind.PermissionRequest) continue;
+            if (existing.PermissionDecision != ChatPermissionDecision.Pending) continue;
+            entries = entries.SetItem(i, existing with { PermissionDecision = ChatPermissionDecision.Expired });
+        }
+
+        var detail = e.Detail;
+        // Defensive: an empty/whitespace RequestId in the gateway event
+        // would otherwise be committed to state. ResolvePermission's
+        // entry-scan guard skips on IsNullOrEmpty, so PendingPermission
+        // would be cleared by ClearPermission while the Pending entry
+        // stays stuck with disabled buttons. Drop such malformed events.
+        if (string.IsNullOrWhiteSpace(e.RequestId))
+        {
+            return state;
+        }
+
+        var id = $"e{state.NextId}";
+        var entry = new ChatTimelineItem(
+            id,
+            ChatTimelineItemKind.PermissionRequest,
+            detail,
+            ToolName: e.ToolName,
+            IntentSummary: e.PermissionKind,
+            PermissionRequestId: e.RequestId,
+            PermissionDecision: ChatPermissionDecision.Pending);
+
+        return state with
+        {
+            Entries = entries.Add(entry),
+            NextId = state.NextId + 1,
+            PendingPermission = new ChatPermissionRequest(e.RequestId, e.PermissionKind, e.ToolName, detail)
+        };
+    }
 
     static ChatTimelineState ApplyUserMessage(ChatTimelineState state, ChatUserMessageEvent e)
     {
@@ -123,7 +215,11 @@ static ChatTimelineState ApplyToolOutput(ChatTimelineState state, ChatToolOutput
             // Don't remove from ActiveToolCalls here: multiple output events can arrive
             // for the same tool (command_output + item end). Mapping is cleared at turn end.
             ActiveToolCallId = (entryId == state.ActiveToolCallId) ? null : state.ActiveToolCallId,
-            PendingPermission = null
+            // NOTE: PendingPermission intentionally preserved. Exec-approval
+            // events interleave with tool item events (chip start → approval
+            // → tool output), so wiping the banner on tool output would race
+            // it off-screen. Callers clear via ClearPermission on user click
+            // or on phase=resolved.
         };
     }
 
@@ -147,7 +243,7 @@ static ChatTimelineState ApplyToolError(ChatTimelineState state, ChatToolErrorEv
             Entries = entries,
             ActiveToolCallId = (entryId == state.ActiveToolCallId) ? null : state.ActiveToolCallId,
             ActiveToolCalls = e.ToolCallId is { } k ? state.ActiveToolCalls.Remove(k) : state.ActiveToolCalls,
-            PendingPermission = null
+            // PendingPermission preserved — see ApplyToolOutput note.
         };
     }
 
@@ -312,7 +408,8 @@ static ChatTimelineState ApplyTurnEnd(ChatTimelineState state)
             ActiveReasoningId = null,
             ActiveToolCallId = null,
             ActiveToolCalls = System.Collections.Immutable.ImmutableDictionary<string, string>.Empty,
-            PendingPermission = null
+            // PendingPermission preserved — exec approvals may outlive their
+            // originating turn (gateway emits phase=resolved to clear).
         };
     }
 
 
@@ -332,14 +332,28 @@ public void SetStatus(StepStatus status)
 
     private static Border CreateEmptyBadge()
     {
-        return new Border
+        // Use a theme-aware stroke brush so the pending-step ring is visible
+        // in both light and dark mode. The previous hard-coded translucent
+        // white was invisible against light backgrounds.
+        var border = new Border
         {
             Width = 22,
             Height = 22,
             CornerRadius = new CornerRadius(11),
             BorderThickness = new Thickness(1),
-            BorderBrush = new SolidColorBrush(Color.FromArgb(80, 255, 255, 255)),
         };
+
+        if (Application.Current.Resources.TryGetValue("ControlStrongStrokeColorDefaultBrush", out var brush)
+            && brush is Brush themed)
+        {
+            border.BorderBrush = themed;
+        }
+        else
+        {
+            border.BorderBrush = new SolidColorBrush(Color.FromArgb(140, 128, 128, 128));
+        }
+
+        return border;
     }
 
     private static Border CreateIconBadge(string glyph, Color background, Color foreground)
 
@@ -1,4 +1,5 @@
 using OpenClaw.Shared;
+using OpenClawTray.Services;
 
 namespace OpenClawTray.Chat;
 
@@ -18,6 +19,21 @@ public interface IChatGatewayBridge : IDisposable
     SessionInfo[] GetSessionList();
     ModelsListInfo? GetCurrentModelsList();
 
+    /// <summary>
+    /// If the underlying gateway client was already Connected by the time
+    /// the bridge was constructed (so the bridge missed the
+    /// <see cref="StatusChanged"/> → Connected edge), proactively re-request
+    /// the models list and sessions snapshot so the chat composer's
+    /// dropdowns populate without waiting for the user to send a message.
+    ///
+    /// Callers should invoke this AFTER subscribing to
+    /// <see cref="ModelsListUpdated"/> and <see cref="SessionsUpdated"/> so
+    /// they actually receive the resulting frames — firing the request
+    /// before subscription leaves the response handler unset and the
+    /// dropdowns stale until the next gateway-driven update.
+    /// </summary>
+    void StartProactiveBootstrap();
+
     Task SendChatMessageAsync(string message, string? sessionKey, string? sessionId, IReadOnlyList<ChatAttachment>? attachments = null);
     Task PatchSessionModelAsync(string sessionKey, string model);
     Task PatchSessionThinkingLevelAsync(string sessionKey, string thinkingLevel);
@@ -42,7 +58,16 @@ public sealed class GatewayClientChatBridge : IChatGatewayBridge
     private readonly EventHandler<ChatMessageInfo> _chatMessageReceivedHandler;
     private readonly EventHandler<AgentEventInfo> _agentEventReceivedHandler;
     private readonly EventHandler<ModelsListInfo> _modelsListUpdatedHandler;
-    private ConnectionStatus _currentStatus = ConnectionStatus.Disconnected;
+    // _currentStatus is written from the gateway client's StatusChanged
+    // callback (arbitrary thread) and read from CurrentStatus on the UI
+    // thread. ``volatile`` gives us a memory barrier so the reader can't
+    // observe a torn or stale value after the writer fires. Atomicity for
+    // ConnectionStatus (4-byte enum) is guaranteed by the CLR.
+    //
+    // Seeded from the client's current state *before* the StatusChanged
+    // handler is subscribed (see ctor) so a real StatusChanged edge that
+    // fires during construction can't be stomped back by a stale seed.
+    private volatile ConnectionStatus _currentStatus = ConnectionStatus.Disconnected;
     private ModelsListInfo? _currentModels;
     private bool _disposed;
 
@@ -58,6 +83,7 @@ public GatewayClientChatBridge(OpenClawGatewayClient client)
             // the Hub's SessionsPage first.
             if (e == ConnectionStatus.Connected)
             {
+                Logger.Info("[ChatBridge] StatusChanged→Connected: requesting models.list");
                 _ = _client.RequestModelsListAsync();
             }
         };
@@ -70,11 +96,48 @@ public GatewayClientChatBridge(OpenClawGatewayClient client)
             ModelsListUpdated?.Invoke(s, e);
         };
 
+        // Subscribe StatusChanged BEFORE reading the seed so any
+        // ``StatusChanged → X`` edge that fires during construction is
+        // captured by our handler. We then read the live property and
+        // reconcile ``_currentStatus`` so callers that hit
+        // ``CurrentStatus`` immediately (before any further edge) see
+        // truth rather than the default ``Disconnected``.
+        //
+        // The seed only writes if ``_currentStatus`` is still
+        // ``Disconnected`` (its default). If a handler edge fired in
+        // the subscribe→read window — including intermediate states
+        // like ``Connecting`` — the handler's write is preserved
+        // rather than collapsed by the 2-state read of
+        // ``IsConnectedToGateway``. ``volatile`` covers atomic reads.
         _client.StatusChanged += _statusChangedHandler;
         _client.SessionsUpdated += _sessionsUpdatedHandler;
         _client.ChatMessageReceived += _chatMessageReceivedHandler;
         _client.AgentEventReceived += _agentEventReceivedHandler;
         _client.ModelsListUpdated += _modelsListUpdatedHandler;
+
+        if (_currentStatus == ConnectionStatus.Disconnected)
+        {
+            _currentStatus = _client.IsConnectedToGateway
+                ? ConnectionStatus.Connected
+                : ConnectionStatus.Disconnected;
+        }
+
+        Logger.Info($"[ChatBridge] ctor: IsConnectedToGateway={_client.IsConnectedToGateway}");
+        // The actual proactive models.list/sessions.list request is
+        // deferred to StartProactiveBootstrap() — kicking it off here
+        // would race the provider's subscription to ModelsListUpdated:
+        // the response can arrive before the provider has wired its
+        // handler, leaving the composer dropdowns empty until the next
+        // gateway-driven update.
+    }
+
+    public void StartProactiveBootstrap()
+    {
+        if (_disposed) return;
+        if (!_client.IsConnectedToGateway) return;
+        Logger.Info("[ChatBridge] proactive: requesting models.list and sessions.list");
+        try { _ = _client.RequestModelsListAsync(); } catch (Exception ex) { Logger.Warn($"[ChatBridge] proactive models.list failed: {ex.Message}"); }
+        try { _ = _client.RequestSessionsAsync(); } catch (Exception ex) { Logger.Warn($"[ChatBridge] proactive sessions.list failed: {ex.Message}"); }
     }
 
     public bool IsConnected => _client.IsConnectedToGateway;
@@ -122,3 +185,4 @@ public void Dispose()
         ModelsListUpdated = null;
     }
 }
+