Surface visible diagnostics for keyless chat events

[shanselman]

PR #457 intentionally drops chat/agent events with missing sessionKey instead of routing them into a synthetic main bucket. That avoids timeline corruption, but if the gateway ever regresses or a mixed-version deployment emits keyless events, users may see a missing reply with only log output.

Follow-up:

• Emit a one-shot user-visible notification or diagnostics/banner when keyless chat/agent events are dropped.
• Include enough context to guide the user toward updating/restarting the gateway, without logging message content.
• Keep the current safety property: do not silently route unknown events into main.

Context: identified during review of #457.

[github-actions]

🤖 This is an automated response from Repo Assist.

This is a good follow-up to the session-key enforcement in #457. Here's a concrete implementation approach:

Current behaviour

In OpenClawGatewayClient, keyless events reach ProcessChatEventAsync. After PR #457, events where sessionKey is null/empty are dropped (no routing to main). The drop is silent — only a debug-level log line is emitted.

Suggested implementation

1. One-shot notification on first drop — keep a HashSet<string> of gateways (or connections) that have already emitted the diagnostic. On first drop, raise a ChatProviderNotification with a user-facing string like:

   "Some chat events were discarded: your gateway may be out of date. Updating or restarting the gateway should resolve this."

   The notification bus already exists (ChatProviderNotificationEventArgs), so no new UI plumbing is needed — the caller that subscribes to notifications can surface this as a banner or status chip.

2. Message content must not appear in the notification — the dropped event's Text or data field should never be included. Include only event type/count.

3. Rate-limiting — one notification per gateway reconnect is sufficient. Track a bool _keylessDropNotified flag in OpenClawGatewayClient (or in the data provider) and reset it on reconnect/disconnect.

4. Test — OpenClawGatewayClientSessionKeyTests.cs already tests the drop behaviour; add a test that verifies the one-shot notification fires on the first keyless event and does not fire again on subsequent keyless events in the same session.

This keeps the PR focused: no routing change, no log-message-content risk, no new dependencies — just a single ChatProviderNotification raise.

Let me know if a PR for this would be welcome.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this issue: Surface visible diagnostics for keyless chat events This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

[github-actions]

🤖 This is an automated response from Repo Assist.

I've implemented the remaining piece of this issue and opened a PR: the keyless-event diagnostic flag was never reset on gateway reconnect, so users who disconnected and reconnected to a still-broken gateway would not receive the notification again.

Fix: Reset _keylessEventDiagnosticRaised to 0 in the justReconnected branch of OnStatusChanged, matching the pattern already used for _historyLoaded, _historyInFlight, and the approval-dedupe LRU.

New test KeylessEvents_DiagnosticResetsOnReconnect verifies:

1. Keyless event fires the diagnostic once.
2. After disconnect+reconnect, the next keyless event fires it again.

Also added 6 new unit tests for DeviceIdentityStore.ClearStoredTokens (previously untested).

All 273 connection tests and 926 tray tests pass.

Generated by 🌈 Repo Assist, see workflow run. Learn more.

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@97143ac59cb3a13ef2a77581f929f06719c7402a