Harden VNC setup calls against expired auth

[jamesachurchill]

Summary

• add a shared setup JSON fetch helper that always requests JSON
• detect both 401 responses and followed redirects whose final path is /login
• stop VNC repair, reboot polling, and clipboard activity immediately when authentication expires
• replace parse errors and misleading HTTP failures with a clear refresh/sign-in prompt

Testing

• added unit coverage for a 401 response and a followed login redirect
• added component coverage for initial VNC probing and stopping repair on auth expiry
• bun run test:unit
• bun run test:components
• bun run build
• targeted ESLint checks for changed files

Closes #231

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of expired authentication across setup, VNC, repair, reboot, and clipboard actions.
  • Displays a clear sign-in prompt and provides a reload option when authentication expires.
  • Redirects expired sessions to the sign-in page when appropriate.
  • Improved API error messages using structured server responses, with fallback messaging when needed.
  • Prevents further repair processing after authentication expires and clears affected session state.

[coderabbitai]

📝 Walkthrough

Walkthrough

VNC setup requests now use fetchSetupJson. The helper detects 401 responses and login redirects. VNCApp displays an expired-authentication state, clears operation state, and stops repair, reboot, polling, and clipboard flows.

Changes

VNC authentication handling

Layer / File(s)	Summary
Setup fetch result contract src/lib/fetch-setup-json.ts, src/tests/unit/fetch-setup-json.test.ts	Added typed fetch results, JSON negotiation, 401 detection, login-redirect detection, tolerant parsing, and unit coverage.
VNC availability and expired-auth state src/components/VNCApp.tsx, src/tests/components/vnc-app.test.tsx	VNC availability checks now use structured results. Authentication expiry clears VNC state and renders a sign-in refresh action. Component tests cover the 401 path.
Repair, reboot, and clipboard flows src/components/VNCApp.tsx, src/tests/components/vnc-app.test.tsx	Repair, reboot polling, and clipboard requests now handle structured API errors and stop when authentication expires. Repair expiry coverage verifies that later requests do not run.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant VNCApp
  participant fetchSetupJson
  participant SetupAPI
  VNCApp->>fetchSetupJson: Send setup request with JSON Accept header
  fetchSetupJson->>SetupAPI: Request setup endpoint
  SetupAPI-->>fetchSetupJson: Return 401 or redirect to /login
  fetchSetupJson-->>VNCApp: Return auth-expired result
  VNCApp->>VNCApp: Clear operation state and stop repair or polling

Loading

Suggested reviewers: georgik77, krasimirkralev, yalexx

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes address all issue #231 requirements, including JSON headers, 401 and login-redirect detection, flow stoppage, clipboard handling, and tests.
Out of Scope Changes check	✅ Passed	The changes are limited to setup JSON fetching, VNC authentication-expiry handling, and related unit and component tests.
Title check	✅ Passed	The title clearly summarizes the main change: protecting VNC setup calls against expired authentication.
Description check	✅ Passed	The description explains the change, links the issue, and lists targeted tests, but omits the template's type and checklist sections.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/fetch-setup-json.ts`:
- Around line 9-12: Update redirectedToLogin to classify any redirect pathname
ending with "/login", including base-path routes such as "/clawbox/login", while
preserving the existing redirect and URL guards. Add a unit test covering a
login URL mounted below the origin root.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6fea7c94-9937-4423-b240-333795042d9b

📥 Commits

Reviewing files that changed from the base of the PR and between 8cb6a43 and 173ed39.

📒 Files selected for processing (4)

• src/components/VNCApp.tsx
• src/lib/fetch-setup-json.ts
• src/tests/components/vnc-app.test.tsx
• src/tests/unit/fetch-setup-json.test.ts

[jamesachurchill]

Prior art and current-version verification

This PR supersedes the unmerged work in #253. That PR proposed the same core approach—request JSON, detect both 401 and followed redirects ending at /login, and stop VNC repair/reboot/clipboard flows on authentication expiry—but was closed during queue cleanup because it had become stale and conflicted with beta.

This implementation applies that design to the current codebase and additionally:

• preserves existing request headers through one shared setup-JSON fetch helper;
• classifies non-JSON and non-success responses without leaking parse errors into the UI;
• centrally latches authentication expiry so polling and repeated clipboard work stop consistently;
• adds component coverage proving the initial availability probe and repair flow halt on expiry.

Compatibility was reverified against current ClawBox main (v3.1.11, 8cb6a433) and beta (aeb34cdf). On main, all 1,471 unit tests and 32 component tests passed, followed by TypeScript and the production build. The patch also cherry-picked cleanly onto current beta; its 13 targeted tests and production build passed.

Both branches pin OpenClaw 2026.7.1. This change is confined to the ClawBox setup UI/middleware boundary and does not call or modify the OpenClaw runtime.

[github-actions]

🦀 ClawReview

Claws waving — here's what this change is about.

This PR fixes the VNC app's handling of expired sessions by replacing all five raw fetch calls (initial probe, repair trigger, reboot, reboot polling, clipboard) with a new shared helper — fetchSetupJson — that sets Accept: application/json and detects both 401 responses and already-followed redirects to /login. When auth expires, all VNC activity stops immediately and a clear 'Refresh to sign in again' button surfaces instead of confusing parse errors or misleading HTTP status messages. The helper lives in src/lib/ and is shaped for reuse across other setup-api callers.

At a glance

• 🔧 Fix · touches VNCApp + new shared setup-api fetch helper
• Base branch: main · +150 source / +117 tests across 4 files
• 🟡 targets main but touches device code — convention is beta-first (main carries tagged releases)
• 🟡 title doesn't follow type: description (feat/fix/chore/docs/…)
• ✅ source changes come with test changes

Good to know

• ℹ️ fetchSetupJson is a new shared utility in src/lib/ — other components still calling raw fetch() against /setup-api/ endpoints could be migrated to it in a follow-up.
• 🟡 PR targets main directly; project convention is to land device-side changes on the beta branch first (main carries tagged releases).
• ℹ️ Comes with both unit tests for the new helper and component tests covering the initial VNC probe and the repair-flow auth-expiry path.

_{— ClawReview 🦀, your resident reef crab. Just orientation — CodeRabbit does the line-by-line, humans do the merge. Conventions: docs.}

[KrasimirKralev]

Retargeted main → beta. This changes device UI code (src/components/VNCApp.tsx), which per our workflow flows through beta first and reaches main via a release, not directly. Please rebase onto beta if the diff needs it.