Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

firewall-ai-gateway-debug

Étoiles116

Forks32

Mis à jour8 mai 2026 à 16:45

Firewall and Vercel AI Gateway debugging for vercel-openclaw: network policy allowlists, OIDC token refresh, AI Gateway transform rules, firewall learning/enforcement, and sandbox.update networkPolicy calls. Use when model calls, egress, token refresh, or firewall policy application fails.

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

vercel-labs

vercel-labs/vercel-openclaw

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Développeurs de logicielsProfessions informatiques et mathématiques·SOC 15-1252

SKILL.md

readonly

name	firewall-ai-gateway-debug
description	Firewall and Vercel AI Gateway debugging for vercel-openclaw: network policy allowlists, OIDC token refresh, AI Gateway transform rules, firewall learning/enforcement, and sandbox.update networkPolicy calls. Use when model calls, egress, token refresh, or firewall policy application fails.

Firewall AI Gateway Debug

Use this skill for model-call failures, egress blocks, network policy drift, or AI Gateway token refresh problems.

Evidence First

Collect:

GET /api/admin/preflight or launch verification preflight evidence.
GET /api/admin/logs filtered for firewall., token., gateway., watchdog..
GET /api/admin/sandbox-diag.
Current firewall mode and learned/allowed domains from admin surfaces.
Sanitized model-call or gateway error body. Do not print Authorization tokens.

Critical Splits

AI Gateway credential unavailable vs expired vs circuit-breaker-open.
Static API key bypass vs OIDC token path.
Firewall learning/allowlist issue vs model provider/API issue.
OPENAI_BASE_URL inside sandbox is present, while Authorization is injected by network policy transform.
Policy object shape changes when an AI Gateway token exists.

Invariants

AI Gateway token never enters sandbox files or env.
ai-gateway.vercel.sh stays allowed even in enforcing mode.
Token refresh applies sandbox.update({ networkPolicy }); it should not rewrite config files or restart the gateway.
Public/admin display URLs must not expose deployment-protection bypass secrets.

Fix Boundaries

Primary: src/server/firewall/{domains,policy,state}.ts.
Token path: src/server/sandbox/lifecycle.ts, src/server/deploy-preflight.ts.
Public URLs: src/server/public-url.ts.
Tests: firewall policy tests, token refresh tests, launch-verify/preflight tests.
Docs: docs/environment-variables.md, docs/deployment-protection.md, lat.md/sandbox-lifecycle.md.

Verification

node scripts/verify.mjs --steps=test,typecheck
lat check

For live incidents, prove a model call succeeds after the policy/token change and that no token value appears in logs, UI, or sandbox config.

Plus depuis ce dépôt

même dépôt

sandbox-lifecycle-debug

vercel-labs/vercel-openclaw

Sandbox lifecycle debugging for vercel-openclaw: create, resume, stop, snapshotting, reset, stale-running reconciliation, persistent Sandbox v2 behavior, hot spares, and lifecycle locks. Use when sandbox state transitions, status polling, stop/resume, reset, or lifecycle recovery is wrong.

2026-05-09116

sandbox-v2-lifecycle

vercel-labs/vercel-openclaw

Vercel Sandbox v2 lifecycle expertise for vercel-openclaw: named persistent OpenClaw sandbox create/resume/stop/delete, persistent auto-save truth, manual snapshot diagnostics, short-lived worker sandboxes, hot spares, and SDK v2 semantics.

2026-05-09116

admin-ui-debug

vercel-labs/vercel-openclaw

Admin UI and operator surface debugging for vercel-openclaw: command shell design, admin actions, request core, status panels, launch verification UI, channel readiness UI, and local read-only production-data workflows. Use when the root admin UI, controls, visual state, or operator copy is wrong.

2026-05-08116

auth-store-debug

vercel-labs/vercel-openclaw

Auth and store debugging for vercel-openclaw: admin-secret mode, Sign in with Vercel, session cookies, CSRF, LOCAL_READ_ONLY, Redis vs memory store, keyspace namespacing, and metadata shape migrations. Use when login, route authorization, Redis persistence, or metadata state is suspect.

2026-05-08116

cron-watchdog-debug

vercel-labs/vercel-openclaw

Cron and watchdog debugging for vercel-openclaw: Vercel Cron auth, persisted OpenClaw jobs, cron wake keys, token refresh, restore oracle, hot spare, and watchdog reports. Use when scheduled OpenClaw jobs fail to wake or run, watchdog status is wrong, cron persistence is suspect, or /api/cron/watchdog behavior changes.

2026-05-08116

gateway-proxy-debug

vercel-labs/vercel-openclaw

Gateway and proxy debugging for vercel-openclaw: /gateway routing, HTML injection, WebSocket rewrite, gateway-token handoff, waiting page, status heartbeat, sandbox port URL cache, and proxy auth. Use when the OpenClaw UI, WebSockets, gateway proxying, or waiting-page flow breaks.

2026-05-08116

name	firewall-ai-gateway-debug
description	Firewall and Vercel AI Gateway debugging for vercel-openclaw: network policy allowlists, OIDC token refresh, AI Gateway transform rules, firewall learning/enforcement, and sandbox.update networkPolicy calls. Use when model calls, egress, token refresh, or firewall policy application fails.

Firewall AI Gateway Debug

Use this skill for model-call failures, egress blocks, network policy drift, or AI Gateway token refresh problems.

Evidence First

Collect:

GET /api/admin/preflight or launch verification preflight evidence.
GET /api/admin/logs filtered for firewall., token., gateway., watchdog..
GET /api/admin/sandbox-diag.
Current firewall mode and learned/allowed domains from admin surfaces.
Sanitized model-call or gateway error body. Do not print Authorization tokens.

Critical Splits

AI Gateway credential unavailable vs expired vs circuit-breaker-open.
Static API key bypass vs OIDC token path.
Firewall learning/allowlist issue vs model provider/API issue.
OPENAI_BASE_URL inside sandbox is present, while Authorization is injected by network policy transform.
Policy object shape changes when an AI Gateway token exists.

Invariants

AI Gateway token never enters sandbox files or env.
ai-gateway.vercel.sh stays allowed even in enforcing mode.
Token refresh applies sandbox.update({ networkPolicy }); it should not rewrite config files or restart the gateway.
Public/admin display URLs must not expose deployment-protection bypass secrets.

Fix Boundaries

Primary: src/server/firewall/{domains,policy,state}.ts.
Token path: src/server/sandbox/lifecycle.ts, src/server/deploy-preflight.ts.
Public URLs: src/server/public-url.ts.
Tests: firewall policy tests, token refresh tests, launch-verify/preflight tests.
Docs: docs/environment-variables.md, docs/deployment-protection.md, lat.md/sandbox-lifecycle.md.

Verification

node scripts/verify.mjs --steps=test,typecheck
lat check

For live incidents, prove a model call succeeds after the policy/token change and that no token value appears in logs, UI, or sandbox config.