@swarmclawai/swarmclaw 0.7.6 → 0.7.7

package/src/cli/index.js

@@ -319,10 +319,50 @@ const COMMAND_GROUPS = [
         expectsJsonBody: true,
         defaultBody: { action: 'stop-local' },
       }),
+      cmd('deploy-local-restart', 'POST', '/openclaw/deploy', 'Restart the managed local OpenClaw deployment (use --data JSON for port/token overrides)', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'restart-local' },
+      }),
       cmd('deploy-bundle', 'POST', '/openclaw/deploy', 'Generate an OpenClaw remote deployment bundle (use --data JSON for template/target/token)', {
         expectsJsonBody: true,
         defaultBody: { action: 'bundle' },
       }),
+      cmd('deploy-ssh', 'POST', '/openclaw/deploy', 'Push the official-image OpenClaw bundle to a remote host over SSH (use --data JSON for target/ssh/provider)', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'ssh-deploy' },
+      }),
+      cmd('deploy-verify', 'POST', '/openclaw/deploy', 'Verify an OpenClaw endpoint/token pair (use --data JSON for endpoint/token)', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'verify' },
+      }),
+      cmd('remote-start', 'POST', '/openclaw/deploy', 'Start a remote SSH-managed OpenClaw stack', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-start' },
+      }),
+      cmd('remote-stop', 'POST', '/openclaw/deploy', 'Stop a remote SSH-managed OpenClaw stack', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-stop' },
+      }),
+      cmd('remote-restart', 'POST', '/openclaw/deploy', 'Restart a remote SSH-managed OpenClaw stack', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-restart' },
+      }),
+      cmd('remote-upgrade', 'POST', '/openclaw/deploy', 'Upgrade a remote SSH-managed OpenClaw stack', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-upgrade' },
+      }),
+      cmd('remote-backup', 'POST', '/openclaw/deploy', 'Create a remote backup on an SSH-managed OpenClaw host', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-backup' },
+      }),
+      cmd('remote-restore', 'POST', '/openclaw/deploy', 'Restore a remote backup on an SSH-managed OpenClaw host', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-restore' },
+      }),
+      cmd('remote-rotate-token', 'POST', '/openclaw/deploy', 'Rotate the gateway token on an SSH-managed OpenClaw host', {
+        expectsJsonBody: true,
+        defaultBody: { action: 'remote-rotate-token' },
+      }),
       cmd('directory', 'GET', '/openclaw/directory', 'List directory entries from running OpenClaw connectors'),
       cmd('gateway-status', 'GET', '/openclaw/gateway', 'Check OpenClaw gateway connection status'),
       cmd('gateway', 'POST', '/openclaw/gateway', 'Call OpenClaw gateway RPC/control action', { expectsJsonBody: true }),

package/src/cli/index.test.js

@@ -197,6 +197,74 @@ test('openclaw deploy bundle command merges action with provided JSON body', asy
   assert.equal(stderr.toString(), '')
 })
 
+test('openclaw deploy ssh command merges action with provided JSON body', async () => {
+  const stdout = makeWritable()
+  const stderr = makeWritable()
+  const calls = []
+
+  const fetchImpl = async (url, init) => {
+    calls.push({ url: String(url), init })
+    return jsonResponse({ ok: true, processId: 'remote-1' })
+  }
+
+  const exitCode = await runCli(
+    ['openclaw', 'deploy-ssh', '--data', '{"target":"openclaw.example.com","ssh":{"host":"1.2.3.4"}}', '--json'],
+    {
+      fetchImpl,
+      stdout,
+      stderr,
+      env: {},
+      cwd: process.cwd(),
+    }
+  )
+
+  assert.equal(exitCode, 0)
+  assert.equal(calls.length, 1)
+  assert.match(calls[0].url, /\/api\/openclaw\/deploy$/)
+  assert.equal(calls[0].init.method, 'POST')
+  assert.deepEqual(JSON.parse(String(calls[0].init.body)), {
+    action: 'ssh-deploy',
+    target: 'openclaw.example.com',
+    ssh: { host: '1.2.3.4' },
+  })
+  assert.equal(stdout.toString().trim(), '{"ok":true,"processId":"remote-1"}')
+  assert.equal(stderr.toString(), '')
+})
+
+test('openclaw remote restore command merges action with provided JSON body', async () => {
+  const stdout = makeWritable()
+  const stderr = makeWritable()
+  const calls = []
+
+  const fetchImpl = async (url, init) => {
+    calls.push({ url: String(url), init })
+    return jsonResponse({ ok: true, remote: { status: 'running' } })
+  }
+
+  const exitCode = await runCli(
+    ['openclaw', 'remote-restore', '--data', '{"backupPath":"/opt/openclaw/backups/latest.tgz","ssh":{"host":"1.2.3.4"}}', '--json'],
+    {
+      fetchImpl,
+      stdout,
+      stderr,
+      env: {},
+      cwd: process.cwd(),
+    }
+  )
+
+  assert.equal(exitCode, 0)
+  assert.equal(calls.length, 1)
+  assert.match(calls[0].url, /\/api\/openclaw\/deploy$/)
+  assert.equal(calls[0].init.method, 'POST')
+  assert.deepEqual(JSON.parse(String(calls[0].init.body)), {
+    action: 'remote-restore',
+    backupPath: '/opt/openclaw/backups/latest.tgz',
+    ssh: { host: '1.2.3.4' },
+  })
+  assert.equal(stdout.toString().trim(), '{"ok":true,"remote":{"status":"running"}}')
+  assert.equal(stderr.toString(), '')
+})
+
 test('runCli falls back to platform-api-key.txt when env key is missing', async () => {
   const stdout = makeWritable()
   const stderr = makeWritable()

package/src/cli/spec.js

@@ -224,12 +224,72 @@ const COMMAND_GROUPS = {
         path: '/openclaw/deploy',
         staticBody: { action: 'stop-local' },
       },
+      'deploy-local-restart': {
+        description: 'Restart the managed local OpenClaw deployment (use --data JSON for port/token overrides)',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'restart-local' },
+      },
       'deploy-bundle': {
         description: 'Generate an OpenClaw remote deployment bundle (use --data JSON for template/target/token)',
         method: 'POST',
         path: '/openclaw/deploy',
         staticBody: { action: 'bundle' },
       },
+      'deploy-ssh': {
+        description: 'Push the official-image OpenClaw bundle to a remote host over SSH (use --data JSON for target/ssh/provider)',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'ssh-deploy' },
+      },
+      'deploy-verify': {
+        description: 'Verify an OpenClaw endpoint/token pair (use --data JSON for endpoint/token)',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'verify' },
+      },
+      'remote-start': {
+        description: 'Start a remote SSH-managed OpenClaw stack',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-start' },
+      },
+      'remote-stop': {
+        description: 'Stop a remote SSH-managed OpenClaw stack',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-stop' },
+      },
+      'remote-restart': {
+        description: 'Restart a remote SSH-managed OpenClaw stack',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-restart' },
+      },
+      'remote-upgrade': {
+        description: 'Upgrade a remote SSH-managed OpenClaw stack',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-upgrade' },
+      },
+      'remote-backup': {
+        description: 'Create a remote backup on an SSH-managed OpenClaw host',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-backup' },
+      },
+      'remote-restore': {
+        description: 'Restore a remote backup on an SSH-managed OpenClaw host',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-restore' },
+      },
+      'remote-rotate-token': {
+        description: 'Rotate the gateway token on an SSH-managed OpenClaw host',
+        method: 'POST',
+        path: '/openclaw/deploy',
+        staticBody: { action: 'remote-rotate-token' },
+      },
       directory: { description: 'List directory entries from running OpenClaw connectors', method: 'GET', path: '/openclaw/directory' },
       'gateway-status': { description: 'Check OpenClaw gateway connection status', method: 'GET', path: '/openclaw/gateway' },
       gateway: { description: 'Call OpenClaw gateway RPC/control action', method: 'POST', path: '/openclaw/gateway' },

package/src/components/agents/agent-sheet.tsx

@@ -72,6 +72,24 @@ function parseIdentityList(value: string): string[] {
     })
 }
 
+function formatGatewayTagList(value: string[] | null | undefined): string {
+  return Array.isArray(value) ? value.join(', ') : ''
+}
+
+function parseGatewayTagList(value: string): string[] {
+  const seen = new Set<string>()
+  return value
+    .split(/[,\n]/)
+    .map((entry) => entry.trim())
+    .filter((entry) => {
+      if (!entry) return false
+      const key = entry.toLowerCase()
+      if (seen.has(key)) return false
+      seen.add(key)
+      return true
+    })
+}
+
 export function AgentSheet() {
   const open = useAppStore((s) => s.agentSheetOpen)
   const setOpen = useAppStore((s) => s.setAgentSheetOpen)
@@ -113,6 +131,8 @@ export function AgentSheet() {
   const [credentialId, setCredentialId] = useState<string | null>(null)
   const [apiEndpoint, setApiEndpoint] = useState<string | null>(null)
   const [gatewayProfileId, setGatewayProfileId] = useState<string | null>(null)
+  const [preferredGatewayTagsText, setPreferredGatewayTagsText] = useState('')
+  const [preferredGatewayUseCase, setPreferredGatewayUseCase] = useState('')
   const [routingStrategy, setRoutingStrategy] = useState<AgentRoutingStrategy>('single')
   const [routingTargets, setRoutingTargets] = useState<AgentRoutingTarget[]>([])
   const [platformAssignScope, setPlatformAssignScope] = useState<'self' | 'all'>('self')
@@ -220,6 +240,8 @@ export function AgentSheet() {
         setCredentialId(editing.credentialId || null)
         setApiEndpoint(editing.apiEndpoint || null)
         setGatewayProfileId(editing.gatewayProfileId || null)
+        setPreferredGatewayTagsText(formatGatewayTagList(editing.preferredGatewayTags))
+        setPreferredGatewayUseCase(editing.preferredGatewayUseCase || '')
         setRoutingStrategy(editing.routingStrategy || 'single')
         setRoutingTargets(editing.routingTargets || [])
         setPlatformAssignScope(editing.platformAssignScope || 'self')
@@ -287,6 +309,8 @@ export function AgentSheet() {
         setCredentialId(null)
         setApiEndpoint(null)
         setGatewayProfileId(null)
+        setPreferredGatewayTagsText('')
+        setPreferredGatewayUseCase('')
         setRoutingStrategy('single')
         setRoutingTargets([])
         setPlatformAssignScope('self')
@@ -422,6 +446,8 @@ export function AgentSheet() {
       fallbackCredentialIds,
       apiEndpoint,
       gatewayProfileId,
+      preferredGatewayTags: parseGatewayTagList(preferredGatewayTagsText),
+      preferredGatewayUseCase: preferredGatewayUseCase || null,
       priority: routingTargets.length + 1,
     }
     setRoutingTargets((current) => [...current, nextTarget])
@@ -463,9 +489,13 @@ export function AgentSheet() {
       credentialId,
       apiEndpoint: normalizedEndpoint,
       gatewayProfileId,
+      preferredGatewayTags: parseGatewayTagList(preferredGatewayTagsText),
+      preferredGatewayUseCase: preferredGatewayUseCase || null,
       routingStrategy,
       routingTargets: routingTargets.map((target, index) => ({
         ...target,
+        preferredGatewayTags: parseGatewayTagList(formatGatewayTagList(target.preferredGatewayTags)),
+        preferredGatewayUseCase: target.preferredGatewayUseCase || null,
         priority: typeof target.priority === 'number' ? target.priority : index + 1,
       })),
       subAgentIds: canDelegateToAgents ? subAgentIds : [],
@@ -1698,6 +1728,34 @@ export function AgentSheet() {
         </div>
       )}
 
+      {(provider === 'openclaw' || routingTargets.some((target) => target.provider === 'openclaw') || openclawGatewayProfiles.length > 0) && (
+        <div className="mb-8">
+          <label className="flex items-center gap-2 font-display text-[12px] font-600 text-text-2 uppercase tracking-[0.08em] mb-2">
+            Gateway Preferences <HintTip text="When multiple OpenClaw gateways are available, prefer matching tags or deployment templates before falling back to the default route." />
+          </label>
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-3">
+            <input
+              type="text"
+              value={preferredGatewayTagsText}
+              onChange={(e) => setPreferredGatewayTagsText(e.target.value)}
+              placeholder="gpu, local, research"
+              className={inputClass}
+            />
+            <select value={preferredGatewayUseCase} onChange={(e) => setPreferredGatewayUseCase(e.target.value)} className={inputClass}>
+              <option value="">Any OpenClaw template</option>
+              <option value="local-dev">Local Dev</option>
+              <option value="single-vps">Single VPS</option>
+              <option value="private-tailnet">Private Tailnet</option>
+              <option value="browser-heavy">Browser Heavy</option>
+              <option value="team-control">Team Control</option>
+            </select>
+          </div>
+          <p className="text-[11px] text-text-3/70 mt-2">
+            These preferences bias scheduling toward matching OpenClaw control planes without hard-locking the agent to one gateway.
+          </p>
+        </div>
+      )}
+
       <div className="mb-8">
         <label className="flex items-center gap-2 font-display text-[12px] font-600 text-text-2 uppercase tracking-[0.08em] mb-2">
           Model Routing <HintTip text="Route this agent through a provider/model pool instead of a single fixed model. The base provider remains the default when no route matches." />
@@ -1752,25 +1810,45 @@ export function AgentSheet() {
                   />
                 </div>
                 {target.provider === 'openclaw' && openclawGatewayProfiles.length > 0 && (
-                  <select
-                    value={target.gatewayProfileId || ''}
-                    onChange={(e) => {
-                      const nextId = e.target.value || null
-                      const gateway = openclawGatewayProfiles.find((item) => item.id === nextId)
-                      updateRoutingTarget(target.id, {
-                        gatewayProfileId: nextId,
-                        apiEndpoint: gateway?.endpoint || target.apiEndpoint || null,
-                        credentialId: gateway?.credentialId || target.credentialId || null,
-                        model: target.model || 'default',
-                      })
-                    }}
-                    className={inputClass}
-                  >
-                    <option value="">Custom OpenClaw endpoint</option>
-                    {openclawGatewayProfiles.map((gateway) => (
-                      <option key={gateway.id} value={gateway.id}>{gateway.name}</option>
-                    ))}
-                  </select>
+                  <div className="grid grid-cols-1 md:grid-cols-3 gap-3">
+                    <select
+                      value={target.gatewayProfileId || ''}
+                      onChange={(e) => {
+                        const nextId = e.target.value || null
+                        const gateway = openclawGatewayProfiles.find((item) => item.id === nextId)
+                        updateRoutingTarget(target.id, {
+                          gatewayProfileId: nextId,
+                          apiEndpoint: gateway?.endpoint || target.apiEndpoint || null,
+                          credentialId: gateway?.credentialId || target.credentialId || null,
+                          model: target.model || 'default',
+                        })
+                      }}
+                      className={inputClass}
+                    >
+                      <option value="">Custom OpenClaw endpoint</option>
+                      {openclawGatewayProfiles.map((gateway) => (
+                        <option key={gateway.id} value={gateway.id}>{gateway.name}</option>
+                      ))}
+                    </select>
+                    <input
+                      value={formatGatewayTagList(target.preferredGatewayTags)}
+                      onChange={(e) => updateRoutingTarget(target.id, { preferredGatewayTags: parseGatewayTagList(e.target.value) })}
+                      placeholder="Prefer tags"
+                      className={inputClass}
+                    />
+                    <select
+                      value={target.preferredGatewayUseCase || ''}
+                      onChange={(e) => updateRoutingTarget(target.id, { preferredGatewayUseCase: e.target.value || null })}
+                      className={inputClass}
+                    >
+                      <option value="">Any OpenClaw template</option>
+                      <option value="local-dev">Local Dev</option>
+                      <option value="single-vps">Single VPS</option>
+                      <option value="private-tailnet">Private Tailnet</option>
+                      <option value="browser-heavy">Browser Heavy</option>
+                      <option value="team-control">Team Control</option>
+                    </select>
+                  </div>
                 )}
                 <div className="grid grid-cols-1 md:grid-cols-[1fr_auto] gap-3">
                   <input

package/src/components/auth/setup-wizard.tsx

@@ -54,6 +54,9 @@ interface ConfiguredProvider {
   endpoint: string | null
   defaultModel: string
   gatewayProfileId: string | null
+  notes?: string | null
+  tags?: string[]
+  deployment?: GatewayProfile['deployment'] | null
 }
 
 interface StarterDraftAgent {
@@ -88,6 +91,20 @@ const CONNECTOR_ICONS = [
   { name: 'Telegram', icon: 'T' },
   { name: 'WhatsApp', icon: 'W' },
 ]
+const OPENCLAW_USE_CASE_LABELS: Record<NonNullable<NonNullable<GatewayProfile['deployment']>['useCase']>, string> = {
+  'local-dev': 'Local Dev',
+  'single-vps': 'Single VPS',
+  'private-tailnet': 'Private Tailnet',
+  'browser-heavy': 'Browser Heavy',
+  'team-control': 'Team Control',
+}
+const OPENCLAW_EXPOSURE_LABELS: Record<NonNullable<NonNullable<GatewayProfile['deployment']>['exposure']>, string> = {
+  'private-lan': 'Private LAN',
+  tailscale: 'Tailscale',
+  caddy: 'Caddy',
+  nginx: 'Nginx',
+  'ssh-tunnel': 'SSH Tunnel',
+}
 
 function stepIndex(step: SetupStep): number {
   if (step === 'connect') return STEP_ORDER.indexOf('providers')
@@ -224,6 +241,12 @@ function ConfiguredProviderChips({ providers }: { providers: ConfiguredProvider[
             {cp.provider === 'openclaw' && formatEndpointHost(cp.endpoint)
               ? `· ${formatEndpointHost(cp.endpoint)}`
               : ''}
+            {cp.provider === 'openclaw' && cp.deployment?.useCase
+              ? ` · ${OPENCLAW_USE_CASE_LABELS[cp.deployment.useCase]}`
+              : ''}
+            {cp.provider === 'openclaw' && cp.deployment?.exposure
+              ? ` · ${OPENCLAW_EXPOSURE_LABELS[cp.deployment.exposure]}`
+              : ''}
             {cp.defaultModel ? ` · ${cp.defaultModel}` : ''}
           </span>
         </span>
@@ -332,6 +355,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
   const [endpoint, setEndpoint] = useState('')
   const [apiKey, setApiKey] = useState('')
   const [credentialId, setCredentialId] = useState<string | null>(null)
+  const [providerNotes, setProviderNotes] = useState('')
+  const [providerTags, setProviderTags] = useState<string[]>([])
+  const [providerDeployment, setProviderDeployment] = useState<GatewayProfile['deployment'] | null>(null)
   const [checkState, setCheckState] = useState<CheckState>('idle')
   const [checkMessage, setCheckMessage] = useState('')
   const [checkErrorCode, setCheckErrorCode] = useState<string | null>(null)
@@ -382,6 +408,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
     setEndpoint('')
     setApiKey('')
     setCredentialId(null)
+    setProviderNotes('')
+    setProviderTags([])
+    setProviderDeployment(null)
     setCheckState('idle')
     setCheckMessage('')
     setCheckErrorCode(null)
@@ -432,6 +461,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
     setEndpoint(meta?.defaultEndpoint || '')
     setApiKey('')
     setCredentialId(null)
+    setProviderNotes('')
+    setProviderTags([])
+    setProviderDeployment(null)
     setCheckState('idle')
     setCheckMessage('')
     setCheckErrorCode(null)
@@ -445,6 +477,8 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
     endpoint?: string
     token?: string
     name?: string
+    notes?: string
+    deployment?: GatewayProfile['deployment'] | Record<string, unknown> | null
   }) => {
     if (patch.endpoint) {
       setEndpoint(patch.endpoint)
@@ -456,6 +490,22 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
     if (patch.name && (!providerLabel.trim() || providerLabel.trim() === (selectedProvider?.name || ''))) {
       setProviderLabel(patch.name)
     }
+    if (patch.notes) {
+      setProviderNotes(patch.notes)
+    }
+    if (patch.deployment) {
+      const nextDeployment = patch.deployment as GatewayProfile['deployment']
+      setProviderDeployment((current) => ({
+        ...(current || {}),
+        ...(nextDeployment || {}),
+      }))
+      setProviderTags((current) => Array.from(new Set([
+        ...current,
+        'onboarding',
+        ...(nextDeployment?.useCase ? [nextDeployment.useCase] : []),
+        ...(nextDeployment?.exposure ? [nextDeployment.exposure] : []),
+      ])))
+    }
     setCheckState('idle')
     setCheckMessage('')
     setCheckErrorCode(null)
@@ -552,6 +602,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
         endpoint: supportsEndpoint ? (endpoint.trim() || selectedProvider.defaultEndpoint || null) : null,
         defaultModel: providerSuggestedModel || getDefaultModelForProvider(provider),
         gatewayProfileId: null,
+        notes: providerNotes.trim() || null,
+        tags: providerTags,
+        deployment: providerDeployment,
       }
 
       const nextConfigured = [...configuredProviders, configuredProvider]
@@ -645,8 +698,13 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
             name: configuredProvider.name,
             endpoint: normalizedEndpoint,
             credentialId: configuredProvider.credentialId || null,
-            tags: ['onboarding'],
-            notes: `Created during setup for ${configuredProvider.name}.`,
+            tags: Array.from(new Set([
+              'onboarding',
+              ...(configuredProvider.tags || []),
+            ])),
+            notes: configuredProvider.notes || `Created during setup for ${configuredProvider.name}.`,
+            deployment: configuredProvider.deployment || null,
+            status: configuredProvider.deployment?.lastVerifiedOk ? 'healthy' : 'pending',
             isDefault: shouldCreateDefault,
           })
           gatewayProfileIdsByProviderConfig.set(configuredProvider.id, createdGateway.id)
@@ -1084,6 +1142,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
                       <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
                         If you only have a WebSocket gateway URL, you can still paste it here. SwarmClaw will normalize it for agent chat.
                       </p>
+                      <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
+                        Safer remote defaults: use <code className="text-text-2">private-tailnet</code> with <code className="text-text-2">tailscale</code> or <code className="text-text-2">ssh-tunnel</code> unless you intentionally want public HTTPS ingress.
+                      </p>
                     </div>
                     <div className="rounded-[12px] border border-white/[0.06] bg-bg px-4 py-3">
                       <div className="text-[12px] uppercase tracking-[0.08em] text-text-3 mb-2">Safe defaults</div>
@@ -1093,6 +1154,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
                       <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
                         Local quickstart uses the bundled official OpenClaw CLI. Remote quickstart uses the official OpenClaw Docker image or the official repo for managed hosts.
                       </p>
+                      <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
+                        Choose <code className="text-text-2">local-dev</code> for one-machine setup, <code className="text-text-2">single-vps</code> for most hosted installs, or <code className="text-text-2">private-tailnet</code> when the gateway should stay private.
+                      </p>
                     </div>
                   </div>
 
@@ -1104,6 +1168,9 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
                     <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
                       Current target: <span className="text-text-2">{openClawEndpointHost || 'localhost:18789'}</span>{openClawLocal ? ' · local route' : ' · remote route'}
                     </p>
+                    <p className="mt-2 text-[12px] text-text-3 leading-relaxed">
+                      Use <code className="text-text-2">caddy</code> or <code className="text-text-2">nginx</code> only when you intentionally want HTTPS/public ingress managed on the gateway side.
+                    </p>
                   </div>
                 </div>
               )}
@@ -1314,6 +1381,12 @@ export function SetupWizard({ onComplete }: SetupWizardProps) {
                               {configuredProvider.provider === 'openclaw' && formatEndpointHost(configuredProvider.endpoint)
                                 ? ` · ${formatEndpointHost(configuredProvider.endpoint)}`
                                 : ''}
+                              {configuredProvider.provider === 'openclaw' && configuredProvider.deployment?.useCase
+                                ? ` · ${OPENCLAW_USE_CASE_LABELS[configuredProvider.deployment.useCase]}`
+                                : ''}
+                              {configuredProvider.provider === 'openclaw' && configuredProvider.deployment?.exposure
+                                ? ` · ${OPENCLAW_EXPOSURE_LABELS[configuredProvider.deployment.exposure]}`
+                                : ''}
                               {configuredProvider.defaultModel ? ` · ${configuredProvider.defaultModel}` : ''}
                             </option>
                           ))}