Port mismerged MXC and pairing approval PRs to main

[bkudiess]

What

Ports two PRs that were merged into master instead of main:

• Use wxc-exec --probe for MXC host support; bump mxc-sdk to 0.7.0 #776 — wxc-exec --probe MXC host support and @microsoft/mxc-sdk 0.7.0
• Add inbound pairing approval dialog (Mac-parity) #778 — inbound pairing approval dialog / coordinator flow

Also adapts the #778 port for newer main by reusing OpenClaw.Shared.PairingApprovalKind instead of carrying a duplicate connection-local enum.

Why

main still has the stale MXC hardcoded build/UBR gate and does not include the inbound pairing approval surface. This branch brings the already-merged work onto the active target branch.

Port notes

• Preserved main's direct-argv fail-closed guard while bringing over the MXC probe path.
• Preserved main's newer tray project/test links and toast sessionKey behavior while adding review_pairing routing.
• Reused PairingApprovalKind.DevicePair / NodePair for pending approval routing to align with main's node pairing state model.

Validation

• ./build.ps1
• dotnet test ./tests/OpenClaw.Shared.Tests/OpenClaw.Shared.Tests.csproj --no-restore
• dotnet test ./tests/OpenClaw.Tray.Tests/OpenClaw.Tray.Tests.csproj --no-restore

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed June 24, 2026, 9:43 PM ET / 01:43 UTC.

Summary
Ports the merged master-target MXC wxc-exec --probe/SDK 0.7.0 work and inbound pairing approval dialog/toast flow onto main, with docs, localization, settings, build targets, and tests.

Reproducibility: not applicable. for a feature port. Source inspection confirms current main lacks the MXC probe path and focused pairing approval flow, but the PR still lacks live runtime proof.

Review metrics: 3 noteworthy metrics.

• Changed Surface: 42 files, +3280/-156. The PR spans runtime sandboxing, dependency state, connection logic, tray UI, localization, docs, and tests.
• Source PRs Ported: 2 merged master-target PRs. The branch is a main-target port of two already-merged PRs, so source PR history matters for review context.
• Runtime Dependency Bumped: 1 direct dependency changed. @microsoft/mxc-sdk supplies the wxc-exec.exe binary copied into the tray app output.

Root-cause cluster
Relationship: canonical
Canonical: #816
Summary: This PR is the active main-target port for two related PRs that were merged to master; each related PR covers one half of the combined port.

Members:

• partial_overlap: Use wxc-exec --probe for MXC host support; bump mxc-sdk to 0.7.0 #776 - This merged master-target PR is the source for the MXC probe and SDK 0.7.0 half of the main-target port.
• partial_overlap: Add inbound pairing approval dialog (Mac-parity) #778 - This merged master-target PR is the source for the inbound pairing approval dialog half of the main-target port.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P1] Add redacted terminal/log/video proof for wxc-exec --probe, contained system.run, and live pairing dialog/toast approve and reject behavior; update the PR body so ClawSweeper can re-review automatically, or ask a maintainer to comment @clawsweeper re-review if it does not.

Proof guidance:

• [P1] Needs real behavior proof before merge: The PR body lists commands only; it does not show redacted after-fix Windows MXC output or live gateway pairing approval behavior, so contributor proof is still required before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Mantis proof suggestion
A real Windows desktop or terminal proof would materially verify the visible pairing dialog/toast and MXC runtime behavior that source review cannot show. A maintainer can ask Mantis to capture proof by posting this exact PR comment:

@openclaw-mantis visual task: verify live inbound pairing opens the Windows approval dialog/toast; approve and reject update pending approvals, and show wxc-exec --probe plus contained system.run.

Risk before merge

• [P1] The PR adds a default-on operator approval dialog that can approve or reject gateway pairing requests; without live gateway proof, maintainers cannot verify the security boundary behaves correctly in the real tray/gateway flow.
• [P1] The MXC SDK/config/probe path changes the shipped sandbox binary and host-support behavior; source tests do not prove Windows runtime wxc-exec --probe or contained system.run behavior in this Linux review.
• [P1] This is a large cross-surface main-target port from two master merges, so maintainer review should still check upgrade and UX impact even though the earlier source blockers appear fixed.

Maintainer options:

1. Pause For Real Runtime Proof (recommended)
   Keep the PR open but blocked until the contributor adds redacted Windows terminal/log/video proof for the MXC runtime path and live gateway pairing decisions.
2. Accept The Proof Gap Explicitly
   Maintainers may choose to merge based on source review and claimed validation, but they would own the unproven Windows/gateway runtime behavior.
3. Close If The Main Port Is No Longer Wanted
   If maintainers decide the master-target work should not be carried to main, close this PR and leave the active branch behavior unchanged.

Next step before merge

• [P1] Human review remains required because automation cannot supply the contributor's live Windows/gateway proof for this external PR.

Security
Cleared: No concrete source-level security bug remains after the fallback-ID guard fix, but the security-sensitive pairing approval path still needs real behavior proof before merge.

Review details

Best possible solution:

Land the main-target port only after redacted real Windows proof covers wxc-exec --probe, contained system.run, and live inbound pairing dialog/toast approve and reject behavior.

Do we have a high-confidence way to reproduce the issue?

Not applicable for a feature port. Source inspection confirms current main lacks the MXC probe path and focused pairing approval flow, but the PR still lacks live runtime proof.

Is this the best way to solve the issue?

Yes, pending proof: porting the already-merged master work is a reasonable main-target solution, and the latest head addresses the earlier source blockers. The remaining blocker is proof and maintainer review, not a narrow code defect I can point to in the latest diff.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e7ef2715398c.

Label changes

Label justifications:

• P2: This is a normal-priority main-target feature/compatibility port with bounded but real runtime proof and merge-safety concerns.
• merge-risk: 🚨 compatibility: The MXC SDK/config/probe change can alter sandbox availability and build output behavior for existing developer and release worktrees.
• merge-risk: 🚨 security-boundary: The PR adds a default-on UI path that can approve or reject gateway pairing requests, which requires live proof before maintainers can trust the boundary.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists commands only; it does not show redacted after-fix Windows MXC output or live gateway pairing approval behavior, so contributor proof is still required before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

What I checked:

• AGENTS.md policy read: The full repository AGENTS.md was read; its connection, pairing, node, MCP, and tray UX review guidance applies to this PR, while validation commands were not run because this ClawSweeper pass is read-only. (AGENTS.md:37, e7ef2715398c)
• Current main still uses the stale MXC gate: Current main still gates MXC support on Windows build 26300 and UBR 8289 instead of calling wxc-exec --probe, so the MXC half is not already implemented on main. (src/OpenClaw.Shared/Mxc/MxcAvailability.cs:25, e7ef2715398c)
• Current main lacks the focused pairing approval surface: Current main only refreshes node/device pair lists on pairing broadcasts; there is no PairingApprovalQueue, coordinator, or ShowPairingApprovalDialog surface in the checked-out main tree. (src/OpenClaw.Shared/OpenClawGatewayClient.cs:2530, e7ef2715398c)
• Latest PR head preserves the ambiguous fallback-id guard: The latest head filters ambiguous legacy fallback keys before building the actionable dialog queue and adds regression tests for device and node fallback collisions. (src/OpenClaw.Connection/PairingApprovalQueue.cs:97, 7be0688be885)
• Latest PR head validates the MXC SDK restore version: The tray project now uses a version-stamped restore output and fails before copying when the installed @microsoft/mxc-sdk package version is not 0.7.0. (src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj:202, 7be0688be885)
• Related source PRs were merged to master, not main: The two source PRs were merged with baseRefName master, and their merge commits are not ancestors of the current main branch, so they do not by themselves close this main-target port.

Likely related people:

• bkudiess: Authored the merged master-target MXC and pairing approval PRs being ported, and also has current main history in the MXC/system.run area. (role: source PR author and current area contributor; confidence: high; commits: 62533e2901bd, d86a96c33071, 6cbe06e5ce12; files: src/OpenClaw.Shared/Mxc/MxcAvailability.cs, src/OpenClaw.Shared/Mxc/MxcCommandRunner.cs, src/OpenClaw.Connection/PairingApprovalQueue.cs)
• shanselman: Introduced the current hardcoded MXC support gate on main and authored the latest PR guard commit that fixed the fallback-id and SDK-version blockers. (role: recent MXC gate and PR guard contributor; confidence: high; commits: f52b829a6f3c, 7be0688be885; files: src/OpenClaw.Shared/Mxc/MxcAvailability.cs, src/OpenClaw.Connection/PairingApprovalQueue.cs, src/OpenClaw.Tray.WinUI/OpenClaw.Tray.WinUI.csproj)
• ranjeshj: Recently carried the gateway connection hardening that introduced the shared PairingApprovalKind model this port now reuses. (role: recent pairing and connection state contributor; confidence: high; commits: ea36b12f9e4c, ffeff39c16c5; files: src/OpenClaw.Shared/Models.cs, src/OpenClaw.Connection/GatewayConnectionManager.cs, src/OpenClaw.Shared/WindowsNodeClient.cs)
• Jason (Json): Recently touched node reapproval and Command Center approval-state behavior in the same pairing UX boundary. (role: recent adjacent pairing UX contributor; confidence: medium; commits: cb68abf8e75e; files: src/OpenClaw.Tray.WinUI/Pages/ConnectionPage.xaml.cs, tests/OpenClaw.Tray.Tests/ConnectionPagePlanApprovalBehaviorTests.cs)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.