openclaw-brokerkit 0.2.1 → 0.3.1

package/README.md

@@ -120,10 +120,9 @@ When OpenClaw is outside the credential trust boundary, the trusted backend
 must serve the packaged `dist/ui` files at the registered UI path itself. A
 framed popover may receive a server-enforced `read` or `decide` session: a
 `read` session shows requests without action controls, and a `decide` session
-lets the operator act directly in the frame. Hosts that use framed decisions
-accept that the surrounding application controls the iframe's placement and
-can attempt UI redressing; use the navigation-only launcher below when that
-threat must remain out of scope.
+lets the operator act directly in the frame. The OpenClaw Gateway approvals
+popover is an actionable surface and must receive `decide`; the trusted host
+must retain decision authority and validate that access on every request.
 
 ### Session injection
 
@@ -148,7 +147,7 @@ this closed payload:
   "api_version": "brokerkit.io/delegated-web/v1",
   "token": "opaque-short-lived-browser-session",
   "expires_at": "<no more than five minutes from issue time, RFC3339>",
-  "access": "read",
+  "access": "decide",
   "renewal_transport": "direct"
 }
 ```
@@ -192,29 +191,6 @@ and set `Vary: Origin` plus `Cache-Control: no-store`. It must not return
 `Access-Control-Allow-Credentials: true`; delegated API requests deliberately
 omit cookies.
 
-### Secure-navigation launcher
-
-With `access: "read"`, each actionable request renders a **Review securely**
-button instead of decision controls. The button posts this navigation-only
-message:
-
-```text
-{ type: "brokerkit.delegated-web.open", version: 1, nonce }
-```
-
-The host verifies the exact opaque-origin frame source and navigates the
-whole browser tab to the trusted UI URL. The top-level response is
-unframeable and contains a server-enforced decision session, so approval,
-denial, and revocation require a second explicit action in the trusted
-document.
-
-A host that does not provide a framed inbox can inject this marker so the UI
-renders only the secure-navigation launcher:
-
-```html
-<meta name="brokerkit-delegated-top-level" />
-```
-
 ### Parent session bridge
 
 When the parent application is trusted, a sandboxed tab that cannot call the
@@ -230,3 +206,19 @@ frame and must bind each response to the supplied 128-bit nonce. `session` is
 the same `brokerkit.io/delegated-web/v1` object returned by
 `POST <basePath>/session`. The bridge is a BrokerKit interface; it contains
 no host-product namespace or host-specific payload.
+
+### Session rebootstrap
+
+A direct-renewal token can expire while a browser tab is suspended. If the
+host rejects renewal with `not_authorized`, a framed UI sends this
+credential-free message once:
+
+```text
+{ type: "brokerkit.delegated-web.rebootstrap", version: 1 }
+```
+
+The host must accept it only from the embedded BrokerKit frame and reload only
+that protected frame so its HTML response can inject a fresh session. Hosts
+must rate-limit reloads and must not return a token through this message. This
+keeps rebootstrap host-neutral while leaving session issuance at the trusted
+HTTP boundary.

package/dist/src/generated/operator-v1.js

@@ -1,4 +1,4 @@
-export const OPERATOR_V1_SCHEMA_SHA256 = "62065b7c9d09989c66379c6a81dd23f9ae468c7d1a859b69c88a1dee079aa6a6";
+export const OPERATOR_V1_SCHEMA_SHA256 = "306810514cd7e378b194f9d539aae99de07396994ec7de273a18dc5a4aa47118";
 export const operatorV1 = {
     apiVersion: "brokerkit.io/operator/v1",
     statuses: [
@@ -11,7 +11,6 @@ export const operatorV1 = {
         "revoked",
     ],
     actions: ["approve", "deny", "revoke"],
-    risks: ["unknown", "low", "medium", "high", "critical"],
     eventKinds: [
         "request.created",
         "request.approved",