fix(kiloclaw): avoid Control UI pairing on fresh installs

apps/web/src/app/(app)/claw/components/changelog-data.ts

@@ -10,6 +10,12 @@ export type ChangelogEntry = {
 
 // Newest entries first. Developers add new entries to the top of this array.
 export const CHANGELOG_ENTRIES: ChangelogEntry[] = [
+  {
+    date: '2026-06-01',
+    description: 'Updated OpenClaw to 2026.5.26.',
+    category: 'feature',
+    deployHint: 'upgrade_required',
+  },
   {
     date: '2026-05-28',
     description: 'Updated OpenClaw to 2026.5.22.',

services/kiloclaw/Dockerfile

@@ -64,7 +64,7 @@ RUN git config --system url."https://github.com/".insteadOf "ssh://git@github.co
 # under boot load routinely need 27-35s for the first TLS+fetch to complete.
 # Match the KiloCode chunk explicitly because OpenClaw also ships other provider
 # discovery timeout constants. Remove this patch once the timeout is configurable.
-RUN npm install -g pnpm openclaw@2026.5.22 clawhub mcporter@0.7.3 @steipete/summarize@0.12.0 @kilocode/cli@7.2.31 \
+RUN npm install -g pnpm openclaw@2026.5.26 clawhub mcporter@0.7.3 @steipete/summarize@0.12.0 @kilocode/cli@7.2.31 \
     && OC_DIST=/usr/local/lib/node_modules/openclaw/dist \
     && PM_FILES=$(grep -l 'KILOCODE_MODELS_URL' "$OC_DIST"/provider-models-*.js 2>/dev/null || true) \
     && PM_FILE_COUNT=$(printf '%s\n' "$PM_FILES" | grep -c .) \
@@ -98,7 +98,7 @@ RUN COMPOSIO_INSTALL_TAG="%40composio%2Fcli%40${COMPOSIO_CLI_VERSION}" \
 # Bake bundled plugin runtime deps into OpenClaw's external stage dir so first
 # boot is pure startup — no npm install from `openclaw doctor` or gateway plugin
 # load on shared-cpu Fly machines. The stage-root naming mirrors OpenClaw
-# 2026.5.22's resolveExternalBundledRuntimeDepsInstallRoot().
+# 2026.5.26's resolveExternalBundledRuntimeDepsInstallRoot().
 RUN cd /usr/local/lib/node_modules/openclaw \
     && OPENCLAW_PACKAGE_ROOT="$(pwd -P)" \
     && OPENCLAW_PACKAGE_VERSION="$(node -p "require('./package.json').version")" \
@@ -257,8 +257,8 @@ RUN mkdir -p /root/.openclaw \
     && mkdir -p /root/clawd/skills
 
 # Copy helper scripts (used at runtime by the controller/gateway)
-# Build cache bust: 2026-05-28-v68-openclaw-2026.5.22
-RUN echo "13"
+# Build cache bust: 2026-06-01-v69-openclaw-2026.5.26
+RUN echo "14"
 COPY openclaw-pairing-list.js /usr/local/bin/openclaw-pairing-list.js
 COPY openclaw-device-pairing-list.js /usr/local/bin/openclaw-device-pairing-list.js
 

services/kiloclaw/controller/src/proxy.test.ts

@@ -289,6 +289,8 @@ describe('WebSocket proxy', () => {
       forwarded: 'for=1.2.3.4;proto=https',
       'x-forwarded-for': '1.2.3.4',
       'x-forwarded-proto': 'https',
+      'x-forwarded-port': '443',
+      'x-forwarded-ssl': 'on',
       'x-real-ip': '1.2.3.4',
       'x-forwarded-host': 'claw.kilo.ai',
     });
@@ -344,6 +346,8 @@ describe('WebSocket proxy', () => {
     expect(forwarded?.['forwarded']).toBeUndefined();
     expect(forwarded?.['x-forwarded-for']).toBeUndefined();
     expect(forwarded?.['x-forwarded-proto']).toBeUndefined();
+    expect(forwarded?.['x-forwarded-port']).toBeUndefined();
+    expect(forwarded?.['x-forwarded-ssl']).toBeUndefined();
     expect(forwarded?.['x-real-ip']).toBeUndefined();
     expect(forwarded?.['x-forwarded-host']).toBeUndefined();
     expect((clientSocket as unknown as FakeSocket).pipe).toHaveBeenCalledWith(backendSocket);

services/kiloclaw/controller/src/proxy.ts

@@ -253,10 +253,12 @@ export function handleWebSocketUpgrade(
   // isLocalDirectRequest check doesn't conclude the request came from a remote client.
   forwardedHeaders['host'] = `${backendHost}:${backendPort}`;
   delete forwardedHeaders['forwarded'];
-  delete forwardedHeaders['x-forwarded-for'];
-  delete forwardedHeaders['x-forwarded-proto'];
   delete forwardedHeaders['x-real-ip'];
-  delete forwardedHeaders['x-forwarded-host'];
+  for (const headerName of Object.keys(forwardedHeaders)) {
+    if (headerName.toLowerCase().startsWith('x-forwarded-')) {
+      delete forwardedHeaders[headerName];
+    }
+  }
 
   const backendReq = http.request({
     hostname: backendHost,

services/kiloclaw/e2e/docker-image-testing.md

@@ -141,7 +141,7 @@ docker rm kiloclaw-gateway
 ```bash
 # Check versions
 docker run --rm kiloclaw:test node --version        # v24.15.0
-docker run --rm kiloclaw:test openclaw --version    # 2026.5.22
+docker run --rm kiloclaw:test openclaw --version    # 2026.5.26
 
 # Check directories
 docker run --rm kiloclaw:test ls -la /root/.openclaw

services/kiloclaw/plugins/kilo-chat/package.json

@@ -28,11 +28,11 @@
     "test": "vitest run"
   },
   "peerDependencies": {
-    "openclaw": "2026.5.22"
+    "openclaw": "2026.5.26"
   },
   "devDependencies": {
     "esbuild": "0.25.12",
-    "openclaw": "2026.5.22",
+    "openclaw": "2026.5.26",
     "vitest": "catalog:"
   },
   "dependencies": {

services/kiloclaw/plugins/kiloclaw-morning-briefing/package.json

@@ -22,12 +22,12 @@
     "typecheck": "tsgo --noEmit"
   },
   "peerDependencies": {
-    "openclaw": "2026.5.22"
+    "openclaw": "2026.5.26"
   },
   "devDependencies": {
     "@sinclair/typebox": "0.34.41",
     "esbuild": "0.25.12",
-    "openclaw": "2026.5.22",
+    "openclaw": "2026.5.26",
     "vitest": "catalog:"
   }
 }