clawdbot 2026.1.4-1

package/dist/gateway/auth.js

@@ -0,0 +1,121 @@
+import { timingSafeEqual } from "node:crypto";
+function safeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+function isLoopbackAddress(ip) {
+    if (!ip)
+        return false;
+    if (ip === "127.0.0.1")
+        return true;
+    if (ip.startsWith("127."))
+        return true;
+    if (ip === "::1")
+        return true;
+    if (ip.startsWith("::ffff:127."))
+        return true;
+    return false;
+}
+function isLocalDirectRequest(req) {
+    if (!req)
+        return false;
+    const clientIp = req.socket?.remoteAddress ?? "";
+    if (!isLoopbackAddress(clientIp))
+        return false;
+    const host = (req.headers.host ?? "").toLowerCase();
+    const hostIsLocal = host.startsWith("localhost") ||
+        host.startsWith("127.0.0.1") ||
+        host.startsWith("[::1]");
+    const hasForwarded = Boolean(req.headers["x-forwarded-for"] ||
+        req.headers["x-real-ip"] ||
+        req.headers["x-forwarded-host"]);
+    return hostIsLocal && !hasForwarded;
+}
+function getTailscaleUser(req) {
+    if (!req)
+        return null;
+    const login = req.headers["tailscale-user-login"];
+    if (typeof login !== "string" || !login.trim())
+        return null;
+    const nameRaw = req.headers["tailscale-user-name"];
+    const profilePic = req.headers["tailscale-user-profile-pic"];
+    const name = typeof nameRaw === "string" && nameRaw.trim()
+        ? nameRaw.trim()
+        : login.trim();
+    return {
+        login: login.trim(),
+        name,
+        profilePic: typeof profilePic === "string" && profilePic.trim()
+            ? profilePic.trim()
+            : undefined,
+    };
+}
+function hasTailscaleProxyHeaders(req) {
+    if (!req)
+        return false;
+    return Boolean(req.headers["x-forwarded-for"] &&
+        req.headers["x-forwarded-proto"] &&
+        req.headers["x-forwarded-host"]);
+}
+function isTailscaleProxyRequest(req) {
+    if (!req)
+        return false;
+    return (isLoopbackAddress(req.socket?.remoteAddress) &&
+        hasTailscaleProxyHeaders(req));
+}
+export function assertGatewayAuthConfigured(auth) {
+    if (auth.mode === "token" && !auth.token) {
+        throw new Error("gateway auth mode is token, but no token was configured (set gateway.auth.token or CLAWDBOT_GATEWAY_TOKEN)");
+    }
+    if (auth.mode === "password" && !auth.password) {
+        throw new Error("gateway auth mode is password, but no password was configured");
+    }
+}
+export async function authorizeGatewayConnect(params) {
+    const { auth, connectAuth, req } = params;
+    const localDirect = isLocalDirectRequest(req);
+    if (auth.mode === "none") {
+        if (auth.allowTailscale && !localDirect) {
+            const tailscaleUser = getTailscaleUser(req);
+            if (!tailscaleUser) {
+                return { ok: false, reason: "unauthorized" };
+            }
+            if (!isTailscaleProxyRequest(req)) {
+                return { ok: false, reason: "unauthorized" };
+            }
+            return {
+                ok: true,
+                method: "tailscale",
+                user: tailscaleUser.login,
+            };
+        }
+        return { ok: true, method: "none" };
+    }
+    if (auth.mode === "token") {
+        if (auth.token && connectAuth?.token === auth.token) {
+            return { ok: true, method: "token" };
+        }
+    }
+    if (auth.mode === "password") {
+        const password = connectAuth?.password;
+        if (!password || !auth.password) {
+            return { ok: false, reason: "unauthorized" };
+        }
+        if (!safeEqual(password, auth.password)) {
+            return { ok: false, reason: "unauthorized" };
+        }
+        return { ok: true, method: "password" };
+    }
+    if (auth.allowTailscale) {
+        const tailscaleUser = getTailscaleUser(req);
+        if (tailscaleUser && isTailscaleProxyRequest(req)) {
+            return {
+                ok: true,
+                method: "tailscale",
+                user: tailscaleUser.login,
+            };
+        }
+    }
+    return { ok: false, reason: "unauthorized" };
+}

package/dist/gateway/call.js

@@ -0,0 +1,94 @@
+import { randomUUID } from "node:crypto";
+import { loadConfig, resolveGatewayPort } from "../config/config.js";
+import { GatewayClient } from "./client.js";
+import { PROTOCOL_VERSION } from "./protocol/index.js";
+export async function callGateway(opts) {
+    const timeoutMs = opts.timeoutMs ?? 10_000;
+    const config = loadConfig();
+    const isRemoteMode = config.gateway?.mode === "remote";
+    const remote = isRemoteMode ? config.gateway?.remote : undefined;
+    const authToken = config.gateway?.auth?.token;
+    const localPort = resolveGatewayPort(config);
+    const url = (typeof opts.url === "string" && opts.url.trim().length > 0
+        ? opts.url.trim()
+        : undefined) ||
+        (typeof remote?.url === "string" && remote.url.trim().length > 0
+            ? remote.url.trim()
+            : undefined) ||
+        `ws://127.0.0.1:${localPort}`;
+    const token = (typeof opts.token === "string" && opts.token.trim().length > 0
+        ? opts.token.trim()
+        : undefined) ||
+        (isRemoteMode
+            ? typeof remote?.token === "string" && remote.token.trim().length > 0
+                ? remote.token.trim()
+                : undefined
+            : process.env.CLAWDBOT_GATEWAY_TOKEN?.trim() ||
+                (typeof authToken === "string" && authToken.trim().length > 0
+                    ? authToken.trim()
+                    : undefined));
+    const password = (typeof opts.password === "string" && opts.password.trim().length > 0
+        ? opts.password.trim()
+        : undefined) ||
+        process.env.CLAWDBOT_GATEWAY_PASSWORD?.trim() ||
+        (typeof remote?.password === "string" && remote.password.trim().length > 0
+            ? remote.password.trim()
+            : undefined);
+    return await new Promise((resolve, reject) => {
+        let settled = false;
+        let ignoreClose = false;
+        const stop = (err, value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (err)
+                reject(err);
+            else
+                resolve(value);
+        };
+        const client = new GatewayClient({
+            url,
+            token,
+            password,
+            instanceId: opts.instanceId ?? randomUUID(),
+            clientName: opts.clientName ?? "cli",
+            clientVersion: opts.clientVersion ?? "dev",
+            platform: opts.platform,
+            mode: opts.mode ?? "cli",
+            minProtocol: opts.minProtocol ?? PROTOCOL_VERSION,
+            maxProtocol: opts.maxProtocol ?? PROTOCOL_VERSION,
+            onHelloOk: async () => {
+                try {
+                    const result = await client.request(opts.method, opts.params, {
+                        expectFinal: opts.expectFinal,
+                    });
+                    ignoreClose = true;
+                    stop(undefined, result);
+                    client.stop();
+                }
+                catch (err) {
+                    ignoreClose = true;
+                    client.stop();
+                    stop(err);
+                }
+            },
+            onClose: (code, reason) => {
+                if (settled || ignoreClose)
+                    return;
+                ignoreClose = true;
+                client.stop();
+                stop(new Error(`gateway closed (${code}): ${reason}`));
+            },
+        });
+        const timer = setTimeout(() => {
+            ignoreClose = true;
+            client.stop();
+            stop(new Error("gateway timeout"));
+        }, timeoutMs);
+        client.start();
+    });
+}
+export function randomIdempotencyKey() {
+    return randomUUID();
+}

package/dist/gateway/chat-attachments.js

@@ -0,0 +1,41 @@
+export function buildMessageWithAttachments(message, attachments, opts) {
+    const maxBytes = opts?.maxBytes ?? 2_000_000; // 2 MB
+    if (!attachments || attachments.length === 0)
+        return message;
+    const blocks = [];
+    for (const [idx, att] of attachments.entries()) {
+        if (!att)
+            continue;
+        const mime = att.mimeType ?? "";
+        const content = att.content;
+        const label = att.fileName || att.type || `attachment-${idx + 1}`;
+        if (typeof content !== "string") {
+            throw new Error(`attachment ${label}: content must be base64 string`);
+        }
+        if (!mime.startsWith("image/")) {
+            throw new Error(`attachment ${label}: only image/* supported`);
+        }
+        let sizeBytes = 0;
+        const b64 = content.trim();
+        // Basic base64 sanity: length multiple of 4 and charset check.
+        if (b64.length % 4 !== 0 || /[^A-Za-z0-9+/=]/.test(b64)) {
+            throw new Error(`attachment ${label}: invalid base64 content`);
+        }
+        try {
+            sizeBytes = Buffer.from(b64, "base64").byteLength;
+        }
+        catch {
+            throw new Error(`attachment ${label}: invalid base64 content`);
+        }
+        if (sizeBytes <= 0 || sizeBytes > maxBytes) {
+            throw new Error(`attachment ${label}: exceeds size limit (${sizeBytes} > ${maxBytes} bytes)`);
+        }
+        const safeLabel = label.replace(/\s+/g, "_");
+        const dataUrl = `![${safeLabel}](data:${mime};base64,${content})`;
+        blocks.push(dataUrl);
+    }
+    if (blocks.length === 0)
+        return message;
+    const separator = message.trim().length > 0 ? "\n\n" : "";
+    return `${message}${separator}${blocks.join("\n\n")}`;
+}

package/dist/gateway/client.js

@@ -0,0 +1,180 @@
+import { randomUUID } from "node:crypto";
+import { WebSocket } from "ws";
+import { rawDataToString } from "../infra/ws.js";
+import { logDebug, logError } from "../logger.js";
+import { PROTOCOL_VERSION, validateEventFrame, validateRequestFrame, validateResponseFrame, } from "./protocol/index.js";
+export class GatewayClient {
+    ws = null;
+    opts;
+    pending = new Map();
+    backoffMs = 1000;
+    closed = false;
+    lastSeq = null;
+    // Track last tick to detect silent stalls.
+    lastTick = null;
+    tickIntervalMs = 30_000;
+    tickTimer = null;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    start() {
+        if (this.closed)
+            return;
+        const url = this.opts.url ?? "ws://127.0.0.1:18789";
+        // Allow node screen snapshots and other large responses.
+        this.ws = new WebSocket(url, { maxPayload: 25 * 1024 * 1024 });
+        this.ws.on("open", () => this.sendConnect());
+        this.ws.on("message", (data) => this.handleMessage(rawDataToString(data)));
+        this.ws.on("close", (code, reason) => {
+            const reasonText = rawDataToString(reason);
+            this.ws = null;
+            this.flushPendingErrors(new Error(`gateway closed (${code}): ${reasonText}`));
+            this.scheduleReconnect();
+            this.opts.onClose?.(code, reasonText);
+        });
+        this.ws.on("error", (err) => {
+            logDebug(`gateway client error: ${String(err)}`);
+        });
+    }
+    stop() {
+        this.closed = true;
+        if (this.tickTimer) {
+            clearInterval(this.tickTimer);
+            this.tickTimer = null;
+        }
+        this.ws?.close();
+        this.ws = null;
+        this.flushPendingErrors(new Error("gateway client stopped"));
+    }
+    sendConnect() {
+        const auth = this.opts.token || this.opts.password
+            ? {
+                token: this.opts.token,
+                password: this.opts.password,
+            }
+            : undefined;
+        const params = {
+            minProtocol: this.opts.minProtocol ?? PROTOCOL_VERSION,
+            maxProtocol: this.opts.maxProtocol ?? PROTOCOL_VERSION,
+            client: {
+                name: this.opts.clientName ?? "gateway-client",
+                version: this.opts.clientVersion ?? "dev",
+                platform: this.opts.platform ?? process.platform,
+                mode: this.opts.mode ?? "backend",
+                instanceId: this.opts.instanceId,
+            },
+            caps: [],
+            auth,
+        };
+        void this.request("connect", params)
+            .then((helloOk) => {
+            this.backoffMs = 1000;
+            this.tickIntervalMs =
+                typeof helloOk.policy?.tickIntervalMs === "number"
+                    ? helloOk.policy.tickIntervalMs
+                    : 30_000;
+            this.lastTick = Date.now();
+            this.startTickWatch();
+            this.opts.onHelloOk?.(helloOk);
+        })
+            .catch((err) => {
+            const msg = `gateway connect failed: ${String(err)}`;
+            if (this.opts.mode === "probe")
+                logDebug(msg);
+            else
+                logError(msg);
+            this.ws?.close(1008, "connect failed");
+        });
+    }
+    handleMessage(raw) {
+        try {
+            const parsed = JSON.parse(raw);
+            if (validateEventFrame(parsed)) {
+                const evt = parsed;
+                const seq = typeof evt.seq === "number" ? evt.seq : null;
+                if (seq !== null) {
+                    if (this.lastSeq !== null && seq > this.lastSeq + 1) {
+                        this.opts.onGap?.({ expected: this.lastSeq + 1, received: seq });
+                    }
+                    this.lastSeq = seq;
+                }
+                if (evt.event === "tick") {
+                    this.lastTick = Date.now();
+                }
+                this.opts.onEvent?.(evt);
+                return;
+            }
+            if (validateResponseFrame(parsed)) {
+                const pending = this.pending.get(parsed.id);
+                if (!pending)
+                    return;
+                // If the payload is an ack with status accepted, keep waiting for final.
+                const payload = parsed.payload;
+                const status = payload?.status;
+                if (pending.expectFinal && status === "accepted") {
+                    return;
+                }
+                this.pending.delete(parsed.id);
+                if (parsed.ok)
+                    pending.resolve(parsed.payload);
+                else
+                    pending.reject(new Error(parsed.error?.message ?? "unknown error"));
+            }
+        }
+        catch (err) {
+            logDebug(`gateway client parse error: ${String(err)}`);
+        }
+    }
+    scheduleReconnect() {
+        if (this.closed)
+            return;
+        if (this.tickTimer) {
+            clearInterval(this.tickTimer);
+            this.tickTimer = null;
+        }
+        const delay = this.backoffMs;
+        this.backoffMs = Math.min(this.backoffMs * 2, 30_000);
+        setTimeout(() => this.start(), delay).unref();
+    }
+    flushPendingErrors(err) {
+        for (const [, p] of this.pending) {
+            p.reject(err);
+        }
+        this.pending.clear();
+    }
+    startTickWatch() {
+        if (this.tickTimer)
+            clearInterval(this.tickTimer);
+        const interval = Math.max(this.tickIntervalMs, 1000);
+        this.tickTimer = setInterval(() => {
+            if (this.closed)
+                return;
+            if (!this.lastTick)
+                return;
+            const gap = Date.now() - this.lastTick;
+            if (gap > this.tickIntervalMs * 2) {
+                this.ws?.close(4000, "tick timeout");
+            }
+        }, interval);
+    }
+    async request(method, params, opts) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error("gateway not connected");
+        }
+        const id = randomUUID();
+        const frame = { type: "req", id, method, params };
+        if (!validateRequestFrame(frame)) {
+            throw new Error(`invalid request frame: ${JSON.stringify(validateRequestFrame.errors, null, 2)}`);
+        }
+        const expectFinal = opts?.expectFinal === true;
+        const p = new Promise((resolve, reject) => {
+            this.pending.set(id, {
+                resolve: (value) => resolve(value),
+                reject,
+                expectFinal,
+            });
+        });
+        this.ws.send(JSON.stringify(frame));
+        return p;
+    }
+}