@ssdavidai/zoclaw 1.3.0-next.0 → 1.3.0-next.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssdavidai/zoclaw",
-  "version": "1.3.0-next.0",
+  "version": "1.3.0-next.2",
   "description": "Set up OpenClaw on Zo with Tailscale access in one command",
   "license": "MIT",
   "repository": {

package/scripts/bootstrap.sh

@@ -20,10 +20,9 @@ fi
 
 echo "Patching openclaw config for Tailscale Serve..."
 
-# Patch gateway config — use OpenClaw's native tailscale integration.
-# Also sets workspace to /home/workspace/.
 node -e "
   const fs = require('fs');
+  const crypto = require('crypto');
   const cfg = JSON.parse(fs.readFileSync(process.argv[1], 'utf8'));
   const gw = cfg.gateway ??= {};
 
@@ -31,28 +30,32 @@ node -e "
   gw.bind = 'loopback';
 
   // Enable OpenClaw's native Tailscale Serve integration.
-  // The gateway will configure tailscale serve on startup
-  // and proxy HTTPS traffic from the tailnet to the local port.
   gw.tailscale = { mode: 'serve' };
 
-  // Trust localhost as a reverse proxy. Tailscale Serve connects
-  // to the gateway on 127.0.0.1 and adds x-forwarded-for headers.
-  // Without this, the gateway ignores proxy headers and can't
-  // resolve the caller's Tailscale identity.
+  // Trust localhost as reverse proxy (Tailscale Serve → loopback).
   gw.trustedProxies = ['127.0.0.1/32'];
 
-  // Trust Tailscale identity headers — valid Tailscale Serve
-  // requests authenticate via x-forwarded-for + tailscale whois
-  // without needing a token or password.
+  // Ensure token auth is configured. The gateway token is how CLI
+  // tools (tui, devices list, etc.) authenticate over WebSocket.
+  // Without this, the gateway rejects all connections as 'pairing required'.
   gw.auth ??= {};
+  gw.auth.mode = 'token';
+  if (!gw.auth.token) {
+    gw.auth.token = crypto.randomBytes(24).toString('hex');
+    console.log('  gateway.auth.token -> generated');
+  } else {
+    console.log('  gateway.auth.token -> preserved');
+  }
+
+  // Trust Tailscale identity headers for browser access via Serve.
   gw.auth.allowTailscale = true;
 
   // Enable the browser Control UI
   gw.controlUi ??= {};
   gw.controlUi.enabled = true;
 
-  // Remove invalid denyCommands entries (default config generates
-  // names that don't match real command IDs, triggering audit warnings)
+  // Remove invalid denyCommands (default config generates names
+  // that don't match real command IDs, triggering audit warnings)
   if (gw.nodes?.denyCommands) delete gw.nodes.denyCommands;
 
   // Set workspace to /home/workspace/ (Zo standard workspace)
@@ -71,18 +74,17 @@ node -e "
 echo "  gateway.bind = loopback"
 echo "  gateway.tailscale.mode = serve"
 echo "  gateway.trustedProxies = [127.0.0.1/32]"
+echo "  gateway.auth.mode = token"
 echo "  gateway.auth.allowTailscale = true"
 echo "  gateway.controlUi.enabled = true"
 echo "  agents.defaults.workspace = /home/workspace/"
-echo "  nodes.denyCommands -> removed"
-echo "  credentials dir -> 700"
 
 # ─── 2. Migrate secrets to Zo secrets ─────────────────────────────────
 
 echo ""
 echo "Migrating secrets to Zo secrets..."
 
-# Extract gateway token from openclaw config
+# Extract gateway token from (now-patched) openclaw config
 GW_TOKEN=$(node -pe "JSON.parse(require('fs').readFileSync('${CONFIG}','utf8')).gateway?.auth?.token ?? ''" 2>/dev/null || true)
 
 # Extract OpenRouter API key from agent auth profiles
@@ -121,25 +123,31 @@ else
   echo "  No OpenRouter API key found (skipping)"
 fi
 
-# Source the updated secrets so they're available for the gateway
-source "$SECRETS_FILE" 2>/dev/null || true
-
 # ─── 3. Register gateway as Zo user service ───────────────────────────
 
 echo ""
 echo "Registering gateway as Zo user service..."
 
-# Kill any existing background gateway process (from previous installs)
+# Remove any openclaw daemon (from --install-daemon during onboarding)
+# that would conflict with our supervisor-managed gateway.
+openclaw daemon uninstall 2>/dev/null || true
+
+# Kill any existing background gateway process
 pkill -f "openclaw gateway run" 2>/dev/null || true
 pkill -f "openclaw-gateway" 2>/dev/null || true
 sleep 1
 
-# Add [program:openclaw-gateway] to user supervisor config if not present
+# Add [program:openclaw-gateway] to user supervisor config if not present.
+# The gateway reads its config (including auth token) from ~/.openclaw/openclaw.json.
+# We do NOT pass OPENCLAW_GATEWAY_TOKEN via env — that would override
+# the config file token and is only needed for the gateway startup, not
+# for CLI tools that read the token from the same config file.
 if ! grep -q "\[program:openclaw-gateway\]" "$USER_SUPERVISOR" 2>/dev/null; then
   cat >> "$USER_SUPERVISOR" << 'SUPERVISOR'
 [program:openclaw-gateway]
-command=bash -c 'source ~/.zo_secrets 2>/dev/null; exec openclaw gateway run'
+command=openclaw gateway run
 directory=/home/workspace
+environment=HOME="/root"
 autostart=true
 autorestart=true
 startretries=10
@@ -171,19 +179,22 @@ sleep 5
 # Verify gateway is running
 if supervisorctl -c "$USER_SUPERVISOR" status openclaw-gateway 2>/dev/null | grep -q RUNNING; then
   echo "  Gateway running (supervised)"
-elif pgrep -f "openclaw-gateway" > /dev/null 2>&1; then
-  echo "  Gateway running"
 else
-  echo "  Warning: gateway is not running. Check: supervisorctl -c $USER_SUPERVISOR status"
-  echo "  Logs: /dev/shm/openclaw-gateway.log"
-  exit 1
+  echo "  Warning: gateway may not be running."
+  echo "  Check: supervisorctl -c $USER_SUPERVISOR status openclaw-gateway"
+  echo "  Logs:  tail /dev/shm/openclaw-gateway.log /dev/shm/openclaw-gateway_err.log"
 fi
 
+# Quick gateway health check
+echo ""
+echo "Gateway health:"
+openclaw gateway health 2>&1 | head -5 || echo "  (health check unavailable)"
+
 # ─── 4. Print access info ─────────────────────────────────────────────
 
 TS_HOSTNAME=$(tailscale status --json 2>/dev/null | node -pe "
   const s = JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
-  (s.Self.DNSName || '').replace(/\\\.\$/, '')
+  (s.Self.DNSName || '').replace(/\\.\$/g, '')
 " 2>/dev/null || true)
 
 echo ""

package/scripts/setup.sh

@@ -73,7 +73,7 @@ else
   echo "  Running interactive setup..."
   echo "  (When the onboarding finishes, setup will continue automatically.)"
   echo ""
-  openclaw onboard --install-daemon
+  openclaw onboard --skip-daemon
 fi
 
 # ─── Step 5: Bootstrap (config + secrets + service) ──────────────────