// Gateway RPC call helper.

// Builds a GatewayClient, resolves auth/scopes, and performs one request.

import { randomUUID } from "node:crypto";

import { isLoopbackIpAddress } from "@openclaw/net-policy/ip";

import { redactSensitiveUrlLikeString } from "@openclaw/net-policy/redact-sensitive-url";

// Gateway client bootstrap resolver.

// Collects URL, auth, and handshake settings before constructing a GatewayClient.

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { resolveGatewayConnectionAuth } from "./connection-auth.js";

import { buildGatewayConnectionDetailsWithResolvers } from "./connection-details.js";

// OpenClaw Gateway client facade.

// Wraps the shared gateway-client package with OpenClaw host dependencies.

import {

GatewayClient as BaseGatewayClient,

GATEWAY_CLOSE_CODE_HINTS as BASE_GATEWAY_CLOSE_CODE_HINTS,

#client: BaseGatewayClient;

constructor(opts: GatewayClientOptions) {

// Inject host deps here so the reusable package stays decoupled from

// OpenClaw device identity, token storage, proxy routing, and logging.

this.#client = new BaseGatewayClient({

...opts,

clientVersion: opts.clientVersion ?? VERSION,

// Gateway connection auth facade.

// Resolves config-backed client credentials with or without async SecretRefs.

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { resolveGatewayCredentialsWithSecretInputs } from "./credentials-secret-inputs.js";

import { resolveGatewayCredentialsFromConfig } from "./credentials.js";

// Gateway HTTP auth helpers.

// Authenticates HTTP endpoints and derives trusted operator scopes.

import type { IncomingMessage, ServerResponse } from "node:http";

import {

normalizeLowercaseStringOrEmpty,

}

export function getBearerToken(req: IncomingMessage): string | undefined {

// Bearer parsing is intentionally minimal: callers pass the extracted token

// into the shared gateway auth verifier for constant-time comparison.

const raw = normalizeOptionalString(getHeader(req, "authorization")) ?? "";

if (!normalizeLowercaseStringOrEmpty(raw).startsWith("bearer ")) {

return undefined;

// Gateway probe auth resolver.

// Adapts gateway credential precedence for local/remote reachability checks.

import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";

import type { OpenClawConfig } from "../config/types.openclaw.js";

import { resolveGatewayCredentialsWithSecretInputs } from "./credentials-secret-inputs.js";

// Gateway probe target resolver.

// Chooses local or remote probe mode from gateway config and URL availability.

import { normalizeOptionalString } from "@openclaw/normalization-core/string-coerce";

import type { OpenClawConfig } from "../config/types.openclaw.js";

// Gateway reachability probe client.

// Connects to a gateway and summarizes auth, health, status, and presence.

import { randomUUID } from "node:crypto";

import path from "node:path";

import {

}

function shouldShortCircuitDeviceRequiredProbe(cacheKey: string, nowMs: number): boolean {

// Repeated unauthenticated probes can trigger pairing/device-required closes.

// Short-circuit briefly so status checks do not spam the gateway.

const entry = deviceRequiredProbeCache.get(cacheKey);

if (!entry) {

return false;

// Gateway startup Control UI origin seeding.

// Adds runtime-only browser origins for non-loopback binds when safe.

import {

ensureControlUiAllowedOriginsForNonLoopbackBind,

type GatewayNonLoopbackBindMode,

if (!seeded.seededOrigins || !seeded.bind) {

return { config: params.config, seededAllowedOrigins: false };

}

// This changes only the runtime config object. Operators still need explicit

// config entries for additional browser origins.

params.log.info(buildSeededOriginsInfoLog(seeded.seededOrigins, seeded.bind));

return { config: seeded.config, seededAllowedOrigins: true };

}