### Fixes

- Slack: preserve Socket Mode SDK error context and structured Slack API fields in reconnect logs, so startup failures no longer collapse to a bare `unknown error`.

- iOS pairing: allow setup-code and manual `ws://` connects for private LAN and `.local` gateways while keeping Tailscale/public routes on `wss://`, and prefer explicit gateway passwords over stale bootstrap tokens in mixed-auth reconnects. Fixes #47887; carries forward #65185. Thanks @draix and @BunsDev.

- Plugins/diagnostics: make source-only TypeScript package warnings actionable by explaining that missing compiled runtime output is a publisher packaging issue and pointing users to update/reinstall or disable/uninstall the plugin. Fixes #77835. Thanks @googlerest.

- TUI: skip the generic CLI respawn wrapper for interactive launches, exit cleanly on terminal loss, and refuse to restore heartbeat sessions as the remembered chat session, preventing stale heartbeat history and orphaned `openclaw-tui` processes on first boot. Thanks @vincentkoc.

- Doctor/sessions: move heartbeat-poisoned default main session store entries to recovery keys and clear stale TUI restore pointers, so `doctor --fix` can repair instances already stuck on `agent:main:main` heartbeat history. Thanks @vincentkoc.

}

private func shouldRequireTLS(host: String) -> Bool {

!Self.isLoopbackHost(host)

!LoopbackHost.isLocalNetworkHost(host)

}

private func shouldForceTLS(host: String) -> Bool {

return trimmed.hasSuffix(".ts.net") || trimmed.hasSuffix(".ts.net.")

}

private static func isLoopbackHost(_ rawHost: String) -> Bool {

var host = rawHost.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()

guard !host.isEmpty else { return false }

if host.hasPrefix("[") && host.hasSuffix("]") {

host.removeFirst()

host.removeLast()

}

if host.hasSuffix(".") {

host.removeLast()

}

if let zoneIndex = host.firstIndex(of: "%") {

host = String(host[..<zoneIndex])

}

if host.isEmpty { return false }

if host == "localhost" || host == "0.0.0.0" || host == "::" {

return true

}

return Self.isLoopbackIPv4(host) || Self.isLoopbackIPv6(host)

}

private static func isLoopbackIPv4(_ host: String) -> Bool {

var addr = in_addr()

let parsed = host.withCString { inet_pton(AF_INET, $0, &addr) == 1 }

guard parsed else { return false }

let value = UInt32(bigEndian: addr.s_addr)

let firstOctet = UInt8((value >> 24) & 0xFF)

return firstOctet == 127

}

private static func isLoopbackIPv6(_ host: String) -> Bool {

var addr = in6_addr()

let parsed = host.withCString { inet_pton(AF_INET6, $0, &addr) == 1 }

guard parsed else { return false }

return withUnsafeBytes(of: &addr) { rawBytes in

let bytes = rawBytes.bindMemory(to: UInt8.self)

let isV6Loopback = bytes[0..<15].allSatisfy { $0 == 0 } && bytes[15] == 1

if isV6Loopback { return true }

let isMappedV4 = bytes[0..<10].allSatisfy { $0 == 0 } && bytes[10] == 0xFF && bytes[11] == 0xFF

return isMappedV4 && bytes[12] == 127

}

}

private func manualStableID(host: String, port: Int) -> String {

"manual|\(host.lowercased())|\(port)"

}

#expect(DeepLinkParser.parse(url) == nil)

}

@Test func parseGatewayLinkAllowsPrivateLanWs() {

let url = URL(

string: "openclaw://gateway?host=openclaw.local&port=18789&tls=0&token=abc")!

#expect(

DeepLinkParser.parse(url) == .gateway(

.init(

host: "openclaw.local",

port: 18789,

tls: false,

bootstrapToken: nil,

token: "abc",

password: nil)))

}

@Test func parseGatewayLinkRejectsInsecurePrefixBypassHost() {

let url = URL(

string: "openclaw://gateway?host=127.attacker.example&port=18789&tls=0&token=abc")!

password: nil))

}

@Test func parseGatewaySetupCodeAllowsPrivateLanWs() {

let payload = #"{"url":"ws://openclaw.local:18789","bootstrapToken":"tok"}"#

let link = GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload))

#expect(link == .init(

host: "openclaw.local",

port: 18789,

tls: false,

bootstrapToken: "tok",

token: nil,

password: nil))

}

@Test func parseGatewaySetupCodeRejectsTailnetPlaintextWs() {

let payload = #"{"url":"ws://gateway.tailnet.ts.net:18789","bootstrapToken":"tok"}"#

let link = GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload))

#expect(link == nil)

}

@Test func parseGatewaySetupInputParsesFullCopiedSetupMessage() {

let payload = #"{"url":"wss://gateway.example.com","bootstrapToken":"tok"}"#

let link = GatewayConnectDeepLink.fromSetupInput("""

let controller = makeController()

#expect(controller._test_resolveManualUseTLS(host: "gateway.example.com", useTLS: false) == true)

#expect(controller._test_resolveManualUseTLS(host: "openclaw.local", useTLS: false) == true)

#expect(controller._test_resolveManualUseTLS(host: "127.attacker.example", useTLS: false) == true)

#expect(controller._test_resolveManualUseTLS(host: "gateway.ts.net", useTLS: false) == true)

#expect(controller._test_resolveManualUseTLS(host: "100.64.0.9", useTLS: false) == true)

#expect(controller._test_resolveManualUseTLS(host: "localhost", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "127.0.0.1", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "0.0.0.0", useTLS: false) == false)

}

@Test @MainActor func manualConnectionsAllowPrivateLanPlaintext() async {

let controller = makeController()

#expect(controller._test_resolveManualUseTLS(host: "openclaw.local", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "192.168.1.20", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "10.0.0.5", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "172.16.1.5", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "169.254.1.5", useTLS: false) == false)

#expect(controller._test_resolveManualUseTLS(host: "fd00::1", useTLS: false) == false)

}

@Test @MainActor func manualDefaultPortUses443OnlyForTailnetTLSHosts() async {

let controller = makeController()

return nil

}

let tls = payload.tls ?? true

if !tls, !LoopbackHost.isLoopbackHost(host) {

if !tls, !LoopbackHost.isLocalNetworkHost(host) {

return nil

}

return GatewayConnectDeepLink(

return nil

}

let tls = scheme == "wss" || scheme == "https"

if !tls, !LoopbackHost.isLoopbackHost(hostname) {

if !tls, !LoopbackHost.isLocalNetworkHost(hostname) {

return nil

}

return GatewayConnectDeepLink(

}

let port = query["port"].flatMap { Int($0) } ?? 18789

let tls = (query["tls"] as NSString?)?.boolValue ?? false

if !tls, !LoopbackHost.isLoopbackHost(hostParam) {

if !tls, !LoopbackHost.isLocalNetworkHost(hostParam) {

return nil

}

return .gateway(

(includeDeviceIdentity && explicitPassword == nil && explicitBootstrapToken == nil

? storedToken

: nil)

let authBootstrapToken = authToken == nil ? explicitBootstrapToken : nil

let authBootstrapToken =

authToken == nil && explicitPassword == nil ? explicitBootstrapToken : nil

let authDeviceToken = shouldUseDeviceRetryToken ? storedToken : nil

let authSource: GatewayAuthSource = if authDeviceToken != nil || (explicitToken == nil && authToken != nil) {

.deviceToken

}

public static func isLocalNetworkHost(_ rawHost: String) -> Bool {

let host = rawHost.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()

let host = self.normalizedHost(rawHost)

guard !host.isEmpty else { return false }

if self.isLoopbackHost(host) { return true }

if host.hasSuffix(".local") { return true }

if host.hasSuffix(".ts.net") { return true }

if host.hasSuffix(".tailscale.net") { return true }

// Allow MagicDNS / LAN hostnames like "peters-mac-studio-1".

if !host.contains("."), !host.contains(":") { return true }

guard let ipv4 = self.parseIPv4(host) else { return false }

return self.isLocalNetworkIPv4(ipv4)

if let ipv4 = self.parseIPv4(host) {

return self.isLocalNetworkIPv4(ipv4)

}

guard let ipv6 = IPv6Address(host) else { return false }

let bytes = Array(ipv6.rawValue)

let isUniqueLocal = (bytes[0] & 0xFE) == 0xFC

let isLinkLocal = bytes[0] == 0xFE && (bytes[1] & 0xC0) == 0x80

return isUniqueLocal || isLinkLocal

}

static func normalizedHost(_ rawHost: String) -> String {

var host = rawHost

.trimmingCharacters(in: .whitespacesAndNewlines)

.lowercased()

.trimmingCharacters(in: CharacterSet(charactersIn: "[]"))

if host.hasSuffix(".") {

host.removeLast()

}

if let zoneIndex = host.firstIndex(of: "%") {

host = String(host[..<zoneIndex])

}

return host

}

static func parseIPv4(_ host: String) -> (UInt8, UInt8, UInt8, UInt8)? {

if a == 127 { return true }

// 169.254.0.0/16 (link-local)

if a == 169, b == 254 { return true }

// Tailscale: 100.64.0.0/10

if a == 100, (64...127).contains(Int(b)) { return true }

return false

}

}

password: nil))

}

@Test func setupCodeAllowsPrivateLanWs() {

let payload = #"{"url":"ws://192.168.1.20:18789","bootstrapToken":"tok"}"#

#expect(

GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == .init(

host: "192.168.1.20",

port: 18789,

tls: false,

bootstrapToken: "tok",

token: nil,

password: nil))

}

@Test func setupCodeAllowsMDNSWs() {

let payload = #"{"url":"ws://openclaw.local:18789","bootstrapToken":"tok"}"#

#expect(

GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == .init(

host: "openclaw.local",

port: 18789,

tls: false,

bootstrapToken: "tok",

token: nil,

password: nil))

}

@Test func setupCodeRejectsTailnetPlaintextWs() {

let payload = #"{"url":"ws://gateway.tailnet.ts.net:18789","bootstrapToken":"tok"}"#

#expect(GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == nil)

}

@Test func setupCodeRejectsCgnatPlaintextWs() {

let payload = #"{"url":"ws://100.64.0.9:18789","bootstrapToken":"tok"}"#

#expect(GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == nil)

}

@Test func setupCodeParsesHostPayload() {

let payload = #"{"host":"gateway.tailnet.ts.net","port":443,"tls":true,"bootstrapToken":"tok"}"#

#expect(

#expect(GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == nil)

}

@Test func setupCodeAllowsPrivateLanHostPayload() {

let payload = #"{"host":"openclaw.local","port":18789,"tls":false,"bootstrapToken":"tok"}"#

#expect(

GatewayConnectDeepLink.fromSetupCode(setupCode(from: payload)) == .init(

host: "openclaw.local",

port: 18789,

tls: false,

bootstrapToken: "tok",

token: nil,

password: nil))

}

@Test func setupInputParsesFullCopiedSetupMessage() {

let payload = #"{"url":"wss://gateway.tailnet.ts.net","bootstrapToken":"tok"}"#

let message = """

await gateway.disconnect()

}

@Test

func passwordTakesPrecedenceOverBootstrapToken() async throws {

let session = FakeGatewayWebSocketSession()

let gateway = GatewayNodeSession()

let options = GatewayConnectOptions(

role: "operator",

scopes: ["operator.read"],

caps: [],

commands: [],

permissions: [:],

clientId: "openclaw-ios-test",

clientMode: "ui",

clientDisplayName: "iOS Test",

includeDeviceIdentity: false)

try await gateway.connect(

url: URL(string: "ws://example.invalid")!,

token: nil,

bootstrapToken: "stale-bootstrap-token",

password: "shared-password",

connectOptions: options,

sessionBox: WebSocketSessionBox(session: session),

onConnected: {},

onDisconnected: { _ in },

onInvoke: { req in

BridgeInvokeResponse(id: req.id, ok: true, payloadJSON: nil, error: nil)

})

let auth = try #require(session.latestTask()?.latestConnectAuth())

#expect(auth["password"] as? String == "shared-password")

#expect(auth["bootstrapToken"] == nil)

#expect(auth["token"] == nil)

await gateway.disconnect()

}

@Test

func bootstrapHelloStoresAdditionalDeviceTokens() async throws {

let tempDir = FileManager.default.temporaryDirectory

Treat the setup code like a password while it is valid.

For Tailscale, public, or other non-loopback mobile pairing, use Tailscale

Serve/Funnel or another `wss://` Gateway URL. Direct non-loopback `ws://` setup

URLs are rejected before QR/setup-code issuance. Plaintext `ws://` setup codes

are limited to loopback URLs; private-network `ws://` clients still require the explicit

`OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1` break-glass described in the remote

Gateway guide.

For Tailscale, public, or other remote mobile pairing, use Tailscale Serve/Funnel

or another `wss://` Gateway URL. Plaintext `ws://` setup codes are accepted only

for loopback, private LAN addresses, `.local` Bonjour hosts, and the Android

emulator host. Tailnet CGNAT addresses, `.ts.net` names, and public hosts still

fail closed before QR/setup-code issuance.

### Approve a node device