jishushell 0.4.10 → 0.4.24-beta.2

package/dist/services/runtime/adapters/openclaw-routes.js

@@ -0,0 +1,946 @@
+/**
+ * OpenClaw-specific HTTP routes — physically migrated from routes/instances.ts
+ * as part of §32.2.5 full decoupling.
+ *
+ * These endpoints know about the OpenClaw workspace layout (mcporter.json,
+ * .openclaw/workspace/skills/, sessions.json), OpenClaw's Feishu/WeChat
+ * channel plugins, and the OpenClaw gateway's control-UI HTML that needs
+ * boot-script injection. None of them are generic enough for the framework
+ * to host, so they live next to the OpenClaw adapter and are registered
+ * via `RuntimeAdapter.registerRoutes()`.
+ */
+import { createHash } from "crypto";
+import { existsSync, realpathSync } from "fs";
+import { readFile, stat } from "fs/promises";
+import { request as httpRequest } from "http";
+import { join } from "path";
+import { PROXY_IDENTITY_HEADERS } from "../../../constants.js";
+import { assertNotLocked } from "../../backup-manager.js";
+import * as instanceManager from "../../instance-manager.js";
+import * as pluginInstaller from "../../plugin-installer.js";
+import { supportsGatewayChatPanel } from "../instance.js";
+import { getAdapter, resolveAgentType } from "../index.js";
+import { writeConfigFile, ensureDirContainer } from "../../../utils/fs.js";
+import { HOP_BY_HOP, ensureControlUiAllowedOrigin, getSvc, inferRequestOrigin, restartRunningInstanceForControlUiOrigin, validateId, } from "../../../routes/instances.js";
+/**
+ * Register all OpenClaw-specific HTTP endpoints on the given Fastify app.
+ * Called via `OpenClawAdapter.registerRoutes(app)` at server startup.
+ */
+export function registerOpenclawRoutes(app) {
+    // ── Plugin check & install — host-side, no container dependency ────
+    app.get("/api/instances/:id/plugins/check/:channelId", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const inst = instanceManager.getInstance(req.params.id);
+        const agentType = resolveAgentType(inst);
+        const adapter = getAdapter(agentType);
+        const installed = typeof adapter.isChannelPluginInstalled === "function"
+            ? adapter.isChannelPluginInstalled(req.params.id, req.params.channelId)
+            : false;
+        return { channelId: req.params.channelId, installed };
+    });
+    app.get("/api/instances/:id/plugins/status", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        return { plugins: pluginInstaller.getAllPluginStatuses(req.params.id) };
+    });
+    app.get("/api/instances/:id/quick-status", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const id = req.params.id;
+        const cfg = instanceManager.getConfig(id) ?? {};
+        const channels = cfg.channels ?? {};
+        const feishuCh = channels["feishu"] ?? channels["lark"] ?? {};
+        const weixinCh = channels["openclaw-weixin"] ?? {};
+        const feishuBound = !!(feishuCh.enabled &&
+            (feishuCh.appId || feishuCh.token || feishuCh.deviceToken || feishuCh.accessToken));
+        const weixinBound = !!(weixinCh.enabled &&
+            weixinCh.accounts &&
+            Object.keys(weixinCh.accounts).length > 0);
+        const { readdirSync: fsReaddir, readFileSync: fsRead } = await import("fs");
+        const { join: fsJoin } = await import("path");
+        const workspaceDir = fsJoin(instanceManager.getOpenclawHome(id), ".openclaw", "workspace");
+        const stateDir = fsJoin(workspaceDir, "skills");
+        let installedSkillDirs = [];
+        try {
+            installedSkillDirs = fsReaddir(stateDir, { withFileTypes: true })
+                .filter((e) => e.isDirectory())
+                .map((e) => e.name);
+        }
+        catch {
+            /* no skills dir */
+        }
+        const mcporterInstalled = installedSkillDirs.some((d) => d.toLowerCase() === "mcporter");
+        let mcporterServers = {};
+        const mcporterCfgPath = fsJoin(workspaceDir, "config", "mcporter.json");
+        try {
+            const raw = JSON.parse(fsRead(mcporterCfgPath, "utf8"));
+            mcporterServers = raw.mcpServers ?? {};
+        }
+        catch {
+            /* no mcporter config */
+        }
+        return {
+            im: { feishu: feishuBound, weixin: weixinBound },
+            installedSkillDirs,
+            mcporterInstalled,
+            mcporterServers,
+        };
+    });
+    // ── MCPorter server CRUD ──────────────────────────────────────────
+    app.get("/api/instances/:id/mcporter/list", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const id = req.params.id;
+        const openclawHome = instanceManager.getOpenclawHome(id);
+        const workspaceDir = join(openclawHome, ".openclaw", "workspace");
+        const mcporterBinPath = join(workspaceDir, ".npm-global", "bin", "mcporter");
+        const mcporterCfg = join(workspaceDir, "config", "mcporter.json");
+        if (!existsSync(mcporterBinPath)) {
+            return { servers: [], installed: false };
+        }
+        const { execFile } = await import("child_process");
+        const { promisify } = await import("util");
+        const execFileAsync = promisify(execFile);
+        try {
+            const { stdout } = await execFileAsync(mcporterBinPath, ["list", "--json"], {
+                env: { ...process.env, HOME: openclawHome, MCPORTER_CONFIG: mcporterCfg },
+                timeout: 60_000,
+            });
+            const parsed = JSON.parse(stdout);
+            return { servers: parsed.servers ?? [], installed: true };
+        }
+        catch (err) {
+            const raw = err?.stdout ?? "";
+            try {
+                const parsed = JSON.parse(raw);
+                return { servers: parsed.servers ?? [], installed: true };
+            }
+            catch {
+                /* fall through */
+            }
+            return { servers: [], installed: true, error: err?.message ?? "unknown" };
+        }
+    });
+    app.post("/api/instances/:id/mcporter/add", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const { servers } = req.body;
+        if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+            return reply.status(400).send({ detail: "servers must be an object" });
+        }
+        const openclawHome = instanceManager.getOpenclawHome(req.params.id);
+        const workspaceDir = join(openclawHome, ".openclaw", "workspace");
+        const mcporterCfgPath = join(workspaceDir, "config", "mcporter.json");
+        const { readFileSync } = await import("fs");
+        let cfg = { mcpServers: {}, imports: [] };
+        try {
+            cfg = JSON.parse(readFileSync(mcporterCfgPath, "utf8"));
+        }
+        catch {
+            /* start fresh */
+        }
+        if (!cfg.mcpServers)
+            cfg.mcpServers = {};
+        // Prototype-pollution guard.
+        const PROTO_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+        for (const [k, v] of Object.entries(servers)) {
+            if (!PROTO_KEYS.has(k))
+                cfg.mcpServers[k] = v;
+        }
+        try {
+            ensureDirContainer(join(workspaceDir, "config"));
+            writeConfigFile(mcporterCfgPath, JSON.stringify(cfg, null, 2));
+        }
+        catch (err) {
+            return reply.status(500).send({ detail: `Write failed: ${err.message}` });
+        }
+        return { ok: true, mcpServers: cfg.mcpServers };
+    });
+    app.delete("/api/instances/:id/mcporter/:serverName", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const { serverName } = req.params;
+        if (!serverName || typeof serverName !== "string") {
+            return reply.status(400).send({ detail: "serverName is required" });
+        }
+        const openclawHome = instanceManager.getOpenclawHome(req.params.id);
+        const workspaceDir = join(openclawHome, ".openclaw", "workspace");
+        const mcporterCfgPath = join(workspaceDir, "config", "mcporter.json");
+        const { readFileSync } = await import("fs");
+        let cfg = { mcpServers: {}, imports: [] };
+        try {
+            cfg = JSON.parse(readFileSync(mcporterCfgPath, "utf8"));
+        }
+        catch {
+            /* start fresh */
+        }
+        if (!cfg.mcpServers || !(serverName in cfg.mcpServers)) {
+            return reply.status(404).send({ detail: `Server '${serverName}' not found` });
+        }
+        delete cfg.mcpServers[serverName];
+        try {
+            writeConfigFile(mcporterCfgPath, JSON.stringify(cfg, null, 2));
+        }
+        catch (err) {
+            return reply.status(500).send({ detail: `Write failed: ${err.message}` });
+        }
+        return { ok: true, mcpServers: cfg.mcpServers };
+    });
+    // ── Skills CRUD ───────────────────────────────────────────────────
+    app.delete("/api/instances/:id/skills/:skillDir", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const { skillDir } = req.params;
+        if (!skillDir || skillDir.includes("/") || skillDir.includes("..") || skillDir.startsWith(".")) {
+            return reply.status(400).send({ detail: "Invalid skill directory name" });
+        }
+        const openclawHome = instanceManager.getOpenclawHome(req.params.id);
+        const skillPath = join(openclawHome, ".openclaw", "workspace", "skills", skillDir);
+        const { existsSync: fsEx, rmSync } = await import("fs");
+        if (!fsEx(skillPath)) {
+            return reply.status(404).send({ detail: `Skill '${skillDir}' not found` });
+        }
+        try {
+            rmSync(skillPath, { recursive: true, force: true });
+        }
+        catch (err) {
+            return reply.status(500).send({ detail: `Delete failed: ${err.message}` });
+        }
+        return { ok: true };
+    });
+    // ── Plugin install ────────────────────────────────────────────────
+    app.post("/api/instances/:id/plugins/install", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        try {
+            assertNotLocked(req.params.id);
+        }
+        catch (e) {
+            return reply.status(e.statusCode || 409).send({ detail: e.message });
+        }
+        const { channelId } = req.body;
+        if (!channelId || typeof channelId !== "string") {
+            return reply.status(400).send({ detail: "channelId is required" });
+        }
+        const inst2 = instanceManager.getInstance(req.params.id);
+        const agentType2 = resolveAgentType(inst2);
+        const pkg = getAdapter(agentType2).channelPluginMap?.[channelId];
+        if (!pkg) {
+            return reply.status(400).send({ detail: `Unknown channel: ${channelId}` });
+        }
+        const pStatus = pluginInstaller.getPluginStatus(req.params.id, channelId);
+        if (pStatus.status === "installed")
+            return { ok: true, status: "already_installed" };
+        if (pStatus.status === "installing")
+            return { ok: true, status: "installing" };
+        pluginInstaller.enqueueInstall(req.params.id, channelId);
+        return { ok: true, status: "queued" };
+    });
+    // Check-only helper; throws if the plugin needed by an IM login is missing.
+    async function ensurePluginInstalled(instanceId, channelId) {
+        const inst = instanceManager.getInstance(instanceId);
+        const agentType = resolveAgentType(inst);
+        const adapter = getAdapter(agentType);
+        if (!adapter.channelPluginMap?.[channelId])
+            return;
+        const installed = typeof adapter.isChannelPluginInstalled === "function"
+            ? adapter.isChannelPluginInstalled(instanceId, channelId)
+            : false;
+        if (!installed) {
+            throw new Error(`Plugin ${channelId} is not installed. Please install it from the config page.`);
+        }
+    }
+    // ── Feishu/Lark OAuth Device Code Login ───────────────────────────
+    const FEISHU_AUTH_URL = "https://accounts.feishu.cn";
+    const MAX_LOGIN_SESSIONS = 100;
+    const feishuLogins = new Map();
+    app.post("/api/instances/:id/feishu/login", async (req, reply) => {
+        const channelKey = req.body?.channelKey || "feishu";
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const svc = await getSvc();
+        const svcStatus = await svc.getStatus(req.params.id);
+        if (svcStatus.status !== "running") {
+            return reply.status(400).send({ detail: "Instance must be running first" });
+        }
+        try {
+            await ensurePluginInstalled(req.params.id, channelKey);
+        }
+        catch (e) {
+            return reply.status(400).send({ detail: e.message });
+        }
+        try {
+            await fetch(`${FEISHU_AUTH_URL}/oauth/v1/app/registration`, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: "action=init",
+                signal: AbortSignal.timeout(30_000),
+            });
+            const beginResp = await fetch(`${FEISHU_AUTH_URL}/oauth/v1/app/registration`, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: "action=begin&archetype=PersonalAgent&auth_method=client_secret&request_user_info=open_id",
+                signal: AbortSignal.timeout(30_000),
+            });
+            if (!beginResp.ok)
+                throw new Error(`Feishu API error: ${beginResp.status}`);
+            const beginData = (await beginResp.json());
+            const sessionKey = `${req.params.id}-${channelKey}-${Date.now()}`;
+            feishuLogins.set(sessionKey, {
+                instanceId: req.params.id,
+                deviceCode: beginData.device_code,
+                startedAt: Date.now(),
+                interval: beginData.interval || 5,
+                expireIn: beginData.expire_in || 600,
+                channelKey,
+            });
+            for (const [k, v] of feishuLogins) {
+                if (Date.now() - v.startedAt > v.expireIn * 1000)
+                    feishuLogins.delete(k);
+            }
+            while (feishuLogins.size > MAX_LOGIN_SESSIONS) {
+                feishuLogins.delete(feishuLogins.keys().next().value);
+            }
+            return { qrcodeUrl: beginData.verification_uri_complete, sessionKey };
+        }
+        catch (e) {
+            return reply.status(502).send({ detail: e.message || "Failed to start Feishu login" });
+        }
+    });
+    app.get("/api/instances/:id/feishu/login/:sessionKey", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        const login = feishuLogins.get(req.params.sessionKey);
+        if (!login)
+            return reply.status(404).send({ detail: "Login session not found or expired" });
+        if (login.instanceId !== req.params.id) {
+            return reply.status(403).send({ detail: "Session belongs to a different instance" });
+        }
+        if (Date.now() - login.startedAt > login.expireIn * 1000) {
+            feishuLogins.delete(req.params.sessionKey);
+            return { status: "expired", connected: false, message: "QR code expired, please regenerate." };
+        }
+        try {
+            const resp = await fetch(`${FEISHU_AUTH_URL}/oauth/v1/app/registration`, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: `action=poll&device_code=${encodeURIComponent(login.deviceCode)}`,
+                signal: AbortSignal.timeout(10_000),
+            });
+            const data = (await resp.json());
+            if (data.client_id && data.client_secret) {
+                const storedChannelKey = login.channelKey || "feishu";
+                feishuLogins.delete(req.params.sessionKey);
+                const domain = data.user_info?.tenant_brand === "lark" ? "lark" : "feishu";
+                instanceManager.saveFeishuCredentials(req.params.id, {
+                    appId: data.client_id,
+                    appSecret: data.client_secret,
+                    domain,
+                    channelKey: storedChannelKey,
+                });
+                return {
+                    status: "confirmed",
+                    connected: true,
+                    domain,
+                    message: domain === "lark" ? "Lark bot configured!" : "Feishu bot configured!",
+                };
+            }
+            if (data.error === "authorization_pending") {
+                return { status: "waiting", connected: false, message: "Waiting for scan..." };
+            }
+            if (data.error === "expired_token") {
+                feishuLogins.delete(req.params.sessionKey);
+                return { status: "expired", connected: false, message: "QR code expired, please regenerate." };
+            }
+            return { status: "waiting", connected: false, message: "Waiting for scan..." };
+        }
+        catch (e) {
+            return reply.status(502).send({ detail: e.message || "Poll failed" });
+        }
+    });
+    // ── WeChat accounts + QR Login ────────────────────────────────────
+    app.get("/api/instances/:id/weixin/accounts", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        return { accounts: instanceManager.getWeixinAccounts(req.params.id) };
+    });
+    const WEIXIN_API_BASE = "https://ilinkai.weixin.qq.com";
+    const WEIXIN_BOT_TYPE = "3";
+    const weixinLogins = new Map();
+    app.post("/api/instances/:id/weixin/login", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        if (!instanceManager.getInstance(req.params.id)) {
+            return reply.status(404).send({ detail: "Instance not found" });
+        }
+        const svc = await getSvc();
+        const svcStatus = await svc.getStatus(req.params.id);
+        if (svcStatus.status !== "running") {
+            return reply.status(400).send({ detail: "Instance must be running first" });
+        }
+        try {
+            await ensurePluginInstalled(req.params.id, "openclaw-weixin");
+        }
+        catch (e) {
+            return reply.status(400).send({ detail: e.message });
+        }
+        try {
+            const resp = await fetch(`${WEIXIN_API_BASE}/ilink/bot/get_bot_qrcode?bot_type=${WEIXIN_BOT_TYPE}`, { signal: AbortSignal.timeout(30_000) });
+            if (!resp.ok)
+                throw new Error(`WeChat API error: ${resp.status}`);
+            const data = (await resp.json());
+            const sessionKey = `${req.params.id}-${Date.now()}`;
+            weixinLogins.set(sessionKey, {
+                instanceId: req.params.id,
+                qrcode: data.qrcode,
+                qrcodeUrl: data.qrcode_img_content,
+                startedAt: Date.now(),
+            });
+            for (const [k, v] of weixinLogins) {
+                if (Date.now() - v.startedAt > 5 * 60_000)
+                    weixinLogins.delete(k);
+            }
+            while (weixinLogins.size > MAX_LOGIN_SESSIONS) {
+                weixinLogins.delete(weixinLogins.keys().next().value);
+            }
+            return { qrcodeUrl: data.qrcode_img_content, sessionKey };
+        }
+        catch (e) {
+            return reply.status(502).send({ detail: e.message || "Failed to get QR code" });
+        }
+    });
+    app.get("/api/instances/:id/weixin/login/:sessionKey", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        const login = weixinLogins.get(req.params.sessionKey);
+        if (!login)
+            return reply.status(404).send({ detail: "Login session not found or expired" });
+        if (login.instanceId !== req.params.id) {
+            return reply.status(403).send({ detail: "Session belongs to a different instance" });
+        }
+        if (Date.now() - login.startedAt > 5 * 60_000) {
+            weixinLogins.delete(req.params.sessionKey);
+            return { status: "expired", connected: false, message: "QR code expired, please regenerate." };
+        }
+        try {
+            const resp = await fetch(`${WEIXIN_API_BASE}/ilink/bot/get_qrcode_status?qrcode=${encodeURIComponent(login.qrcode)}`, { headers: { "iLink-App-ClientVersion": "1" }, signal: AbortSignal.timeout(35_000) });
+            if (!resp.ok)
+                throw new Error(`Status poll failed: ${resp.status}`);
+            const data = (await resp.json());
+            if (data.status === "confirmed") {
+                // iLink occasionally returns `confirmed` with an empty payload
+                // (seen when the upstream QR session raced an internal refresh
+                // on their side). Without all four fields the runtime can't
+                // actually pair — write it anyway and the next `docker pull` of
+                // updates 401s with a cryptic "token missing" error. Reject at
+                // the route layer so the UI surfaces a clear failure instead.
+                if (!data.ilink_bot_id || !data.bot_token) {
+                    console.error(`[weixin-login] iLink returned confirmed but payload incomplete: ` +
+                        `bot_id=${data.ilink_bot_id ? "<present>" : "<missing>"}, ` +
+                        `bot_token=${data.bot_token ? "<present>" : "<missing>"}`);
+                    weixinLogins.delete(req.params.sessionKey);
+                    return reply.status(502).send({
+                        status: "error",
+                        connected: false,
+                        detail: "WeChat confirmed the scan but returned an incomplete credential payload. " +
+                            "Please retry the QR login.",
+                    });
+                }
+                weixinLogins.delete(req.params.sessionKey);
+                try {
+                    instanceManager.saveWeixinCredentials(req.params.id, {
+                        accountId: data.ilink_bot_id,
+                        token: data.bot_token,
+                        baseUrl: data.baseurl || WEIXIN_API_BASE,
+                        userId: data.ilink_user_id || "",
+                    });
+                }
+                catch (e) {
+                    console.error(`[weixin-login] Failed to save credentials: ${e.message}`);
+                    return reply.status(500).send({
+                        status: "confirmed",
+                        connected: false,
+                        detail: "WeChat authenticated but failed to save credentials: " + e.message,
+                    });
+                }
+                return {
+                    status: "confirmed",
+                    connected: true,
+                    accountId: data.ilink_bot_id,
+                    message: "WeChat connected!",
+                };
+            }
+            if (data.status === "expired") {
+                try {
+                    const refreshResp = await fetch(`${WEIXIN_API_BASE}/ilink/bot/get_bot_qrcode?bot_type=${WEIXIN_BOT_TYPE}`, { signal: AbortSignal.timeout(30_000) });
+                    if (refreshResp.ok) {
+                        const refreshData = (await refreshResp.json());
+                        login.qrcode = refreshData.qrcode;
+                        login.qrcodeUrl = refreshData.qrcode_img_content;
+                        login.startedAt = Date.now();
+                        return {
+                            status: "refreshed",
+                            connected: false,
+                            qrcodeUrl: refreshData.qrcode_img_content,
+                            message: "QR code refreshed, please scan again.",
+                        };
+                    }
+                }
+                catch {
+                    /* fall through */
+                }
+                weixinLogins.delete(req.params.sessionKey);
+                return { status: "expired", connected: false, message: "QR code expired, please regenerate." };
+            }
+            return {
+                status: data.status,
+                connected: false,
+                message: data.status === "scaned" ? "Scanned, please confirm on WeChat..." : "Waiting for scan...",
+            };
+        }
+        catch (e) {
+            return reply.status(502).send({ detail: e.message || "Status poll failed" });
+        }
+    });
+    // ── Usage (reads OpenClaw sessions.json) ──────────────────────────
+    app.get("/api/instances/:id/usage", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        const inst = instanceManager.getInstance(req.params.id);
+        if (!inst)
+            return reply.status(404).send({ detail: "Instance not found" });
+        const openclawHome = instanceManager.getOpenclawHome(req.params.id);
+        const sessionsIndex = join(openclawHome, ".openclaw", "agents", "main", "sessions", "sessions.json");
+        const emptyTotals = {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            totalTokens: 0,
+            costTotal: 0,
+            messages: 0,
+        };
+        if (!existsSync(sessionsIndex))
+            return { sessions: [], totals: emptyTotals };
+        const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB
+        const indexStat = await stat(sessionsIndex);
+        if (indexStat.size > MAX_FILE_SIZE) {
+            return reply.status(400).send({ detail: "sessions.json exceeds 10MB size limit" });
+        }
+        let sessionsMap;
+        try {
+            const raw = await readFile(sessionsIndex, "utf-8");
+            sessionsMap = JSON.parse(raw);
+        }
+        catch {
+            return reply.status(500).send({ detail: "Failed to parse sessions.json" });
+        }
+        const sessions = [];
+        const totals = { ...emptyTotals };
+        for (const [sessionKey, sessionMeta] of Object.entries(sessionsMap)) {
+            const sessionFile = sessionMeta?.sessionFile;
+            if (!sessionFile || !existsSync(sessionFile))
+                continue;
+            try {
+                const resolvedSession = realpathSync(sessionFile);
+                const resolvedHome = realpathSync(openclawHome);
+                if (!resolvedSession.startsWith(resolvedHome + "/") && resolvedSession !== resolvedHome)
+                    continue;
+            }
+            catch {
+                continue;
+            }
+            let sessionStat;
+            try {
+                sessionStat = await stat(sessionFile);
+            }
+            catch {
+                continue;
+            }
+            if (sessionStat.size > MAX_FILE_SIZE)
+                continue;
+            const sessionUsage = {
+                input: 0,
+                output: 0,
+                cacheRead: 0,
+                cacheWrite: 0,
+                totalTokens: 0,
+                costTotal: 0,
+                messages: 0,
+            };
+            let model = "";
+            let firstTs = "";
+            let lastTs = "";
+            const originLabel = sessionMeta?.origin?.label || "";
+            const channel = sessionMeta?.origin?.provider || "";
+            let sessionContent;
+            try {
+                sessionContent = await readFile(sessionFile, "utf-8");
+            }
+            catch {
+                continue;
+            }
+            for (const line of sessionContent.split("\n")) {
+                let entry;
+                try {
+                    entry = JSON.parse(line.trim());
+                }
+                catch {
+                    continue;
+                }
+                if (entry.type !== "message")
+                    continue;
+                const msg = entry.message || {};
+                const ts = entry.timestamp || "";
+                if (ts && !firstTs)
+                    firstTs = ts;
+                if (ts)
+                    lastTs = ts;
+                if (msg.role === "assistant") {
+                    if (!model && msg.model)
+                        model = msg.model;
+                    const usage = msg.usage;
+                    if (usage) {
+                        sessionUsage.input += usage.input || 0;
+                        sessionUsage.output += usage.output || 0;
+                        sessionUsage.cacheRead += usage.cacheRead || 0;
+                        sessionUsage.cacheWrite += usage.cacheWrite || 0;
+                        sessionUsage.totalTokens += usage.totalTokens || 0;
+                        if (typeof usage.cost === "object")
+                            sessionUsage.costTotal += usage.cost.total || 0;
+                    }
+                    sessionUsage.messages++;
+                }
+                else if (msg.role === "user") {
+                    sessionUsage.messages++;
+                }
+            }
+            sessions.push({
+                key: sessionKey,
+                model,
+                channel,
+                origin: originLabel,
+                firstMessage: firstTs,
+                lastMessage: lastTs,
+                usage: sessionUsage,
+            });
+            for (const k of ["input", "output", "cacheRead", "cacheWrite", "totalTokens", "messages"]) {
+                totals[k] += sessionUsage[k];
+            }
+            totals.costTotal += sessionUsage.costTotal;
+        }
+        sessions.sort((a, b) => (b.lastMessage || "").localeCompare(a.lastMessage || ""));
+        return { sessions, totals };
+    });
+    // ── Gateway launch (OpenClaw control-UI iframe boot) ──────────────
+    app.get("/api/instances/:id/gateway-launch", async (req, reply) => {
+        const idErr = validateId(req.params.id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        const inst = instanceManager.getInstance(req.params.id);
+        if (!inst)
+            return reply.status(404).send({ detail: "Instance not found" });
+        if (!(await supportsGatewayChatPanel(req.params.id, inst))) {
+            return reply
+                .status(501)
+                .send({ detail: "Gateway chat panel is not supported for this runtime" });
+        }
+        const panelOrigin = inferRequestOrigin(req);
+        if (panelOrigin) {
+            let addedAllowedOrigin = false;
+            try {
+                addedAllowedOrigin = await ensureControlUiAllowedOrigin(req.params.id, panelOrigin);
+            }
+            catch (err) {
+                console.warn(`[gateway-launch] failed to add allowed origin for ${req.params.id}:`, err.message || err);
+            }
+            if (addedAllowedOrigin) {
+                await restartRunningInstanceForControlUiOrigin(req.params.id, panelOrigin);
+            }
+        }
+        const baseUrl = `/api/instances/${req.params.id}/gateway/`;
+        const cfg = instanceManager.getStoredConfig(req.params.id);
+        const token = cfg?.gateway?.auth?.token;
+        if (typeof token !== "string" || !token.trim()) {
+            return { url: baseUrl };
+        }
+        return { url: `${baseUrl}#token=${encodeURIComponent(token.trim())}` };
+    });
+    // ── Gateway HTTP proxy (with control-UI HTML injection) ───────────
+    const gatewayProxy = async (request, reply) => {
+        const { id } = request.params;
+        const idErr = validateId(id);
+        if (idErr)
+            return reply.status(400).send({ detail: idErr });
+        const inst = instanceManager.getInstance(id);
+        if (!inst)
+            return reply.status(404).send({ detail: "Instance not found" });
+        if (!(await supportsGatewayChatPanel(id, inst))) {
+            return reply.status(501).send({ detail: "Gateway proxy is not supported for this runtime" });
+        }
+        const port = instanceManager.getGatewayPort(id);
+        const gwHost = await instanceManager.getGatewayHost(id);
+        const suffix = request.params["*"] || "";
+        const qs = request.url.includes("?") ? request.url.slice(request.url.indexOf("?")) : "";
+        const urlGwHost = instanceManager.urlHost(gwHost);
+        const targetUrl = `http://${urlGwHost}:${port}/${suffix}${qs}`;
+        try {
+            const fwdHeaders = {};
+            const rawHeaders = request.raw.headers;
+            for (const [k, v] of Object.entries(rawHeaders)) {
+                if (v === undefined)
+                    continue;
+                const lk = k.toLowerCase();
+                if (HOP_BY_HOP.has(lk) ||
+                    PROXY_IDENTITY_HEADERS.has(lk) ||
+                    lk === "host" ||
+                    lk === "cookie" ||
+                    lk === "authorization")
+                    continue;
+                fwdHeaders[k] = Array.isArray(v) ? v.join(", ") : v;
+            }
+            fwdHeaders["host"] = `${urlGwHost}:${port}`;
+            // NOTE: the cli branch (commit 94163bc) stripped the browser's Origin
+            // and rewrote it to `http://<gwHost>:<gwPort>`. In multi-agents the
+            // panel instead auto-adds the browser's origin to
+            // `gateway.controlUi.allowedOrigins` and restarts the instance (see
+            // ensureControlUiAllowedOrigin in routes/instances.ts). Forwarding the
+            // real Origin is what lets that whitelist entry match — rewriting
+            // breaks the configured allowlist.
+            fwdHeaders["accept-encoding"] = "identity";
+            const upstreamRes = await new Promise((resolve, reject) => {
+                const proxyReq = httpRequest(targetUrl, { method: request.method, headers: fwdHeaders }, resolve);
+                proxyReq.on("error", reject);
+                if (request.method !== "GET" && request.method !== "HEAD") {
+                    request.raw.pipe(proxyReq);
+                }
+                else {
+                    proxyReq.end();
+                }
+            });
+            reply.status(upstreamRes.statusCode || 502);
+            for (const [k, v] of Object.entries(upstreamRes.headers)) {
+                if (v === undefined)
+                    continue;
+                const lk = k.toLowerCase();
+                if (HOP_BY_HOP.has(lk))
+                    continue;
+                if (lk === "x-frame-options") {
+                    reply.header("x-frame-options", "SAMEORIGIN");
+                    continue;
+                }
+                if (lk === "content-security-policy") {
+                    const csp = Array.isArray(v) ? v.join(", ") : v;
+                    const rewritten = csp.replace(/frame-ancestors\s+[^;]*/i, "frame-ancestors 'self'");
+                    reply.header("content-security-policy", rewritten === csp ? `${csp}; frame-ancestors 'self'` : rewritten);
+                    continue;
+                }
+                reply.header(k, Array.isArray(v) ? v.join(", ") : v);
+            }
+            const respCt = upstreamRes.headers["content-type"] || "";
+            if (suffix === "__openclaw/control-ui-config.json" && respCt.includes("application/json")) {
+                const chunks = [];
+                for await (const chunk of upstreamRes)
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                try {
+                    const config = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+                    config.basePath = `/api/instances/${id}/gateway`;
+                    const buf = Buffer.from(JSON.stringify(config));
+                    reply.header("content-length", buf.length);
+                    reply.removeHeader("content-encoding");
+                    return reply.send(buf);
+                }
+                catch {
+                    /* fall through to stream */
+                }
+            }
+            if (respCt.includes("text/html")) {
+                const chunks = [];
+                for await (const chunk of upstreamRes)
+                    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+                let html = Buffer.concat(chunks).toString("utf-8");
+                const basePath = `/api/instances/${id}/gateway`;
+                const injectScript = [
+                    `window.__OPENCLAW_CONTROL_UI_BASE_PATH__=${JSON.stringify(basePath)};`,
+                    `(()=>{`,
+                    `  try {`,
+                    `    const settingsKey='openclaw.control.settings.v1';`,
+                    `    const tokenStoragePrefix='openclaw.control.token.v1:';`,
+                    `    const normalizeGatewayScope=(gatewayUrl)=>{`,
+                    `      const raw=(gatewayUrl||'').trim();`,
+                    `      if(!raw) return 'default';`,
+                    `      try {`,
+                    `        const base=\`\${window.location.protocol}//\${window.location.host}\${window.location.pathname||'/'}\`;`,
+                    `        const parsed=new URL(raw, base);`,
+                    `        const pathname=parsed.pathname==='/'?'':(parsed.pathname.replace(/\\/+$/,'')||parsed.pathname);`,
+                    `        return \`\${parsed.protocol}//\${parsed.host}\${pathname}\`;`,
+                    `      } catch {`,
+                    `        return raw;`,
+                    `      }`,
+                    `    };`,
+                    `    const proto=window.location.protocol==='https:'?'wss':'ws';`,
+                    `    const gatewayUrl=\`\${proto}://\${window.location.host}${basePath}\`;`,
+                    `    const tokenSessionKey=\`\${tokenStoragePrefix}\${normalizeGatewayScope(gatewayUrl)}\`;`,
+                    `    const raw=window.localStorage.getItem(settingsKey);`,
+                    `    let next={};`,
+                    `    try { next=raw ? JSON.parse(raw) : {}; } catch { next={}; }`,
+                    `    next.gatewayUrl=gatewayUrl;`,
+                    `    if('token' in next) delete next.token;`,
+                    `    const hashParams=new URLSearchParams(window.location.hash.startsWith('#')?window.location.hash.slice(1):window.location.hash);`,
+                    `    const searchParams=new URLSearchParams(window.location.search);`,
+                    `    const launchToken=(hashParams.get('token')||searchParams.get('token')||'').trim();`,
+                    `    if(launchToken){`,
+                    `      window.sessionStorage.setItem(tokenSessionKey, launchToken);`,
+                    `    }`,
+                    `    window.localStorage.setItem(settingsKey, JSON.stringify(next));`,
+                    `    const autoConnect=()=>{`,
+                    `      const attempt=()=>{`,
+                    `        const app=document.querySelector('openclaw-app');`,
+                    `        if(!app||typeof app.connect!=='function'||typeof app.applySettings!=='function'||!app.settings||typeof app.settings!=='object') return false;`,
+                    `        const sessionToken=(window.sessionStorage.getItem(tokenSessionKey)||'').trim();`,
+                    `        const token=(sessionToken||launchToken||app.settings.token||'').trim();`,
+                    `        if(!token) return false;`,
+                    `        const nextSettings={...app.settings, gatewayUrl, token};`,
+                    `        if(nextSettings.gatewayUrl!==app.settings.gatewayUrl||nextSettings.token!==app.settings.token){`,
+                    `          app.applySettings(nextSettings);`,
+                    `        }`,
+                    `        if(app.connected) return true;`,
+                    `        const wsState=app.client&&app.client.ws?app.client.ws.readyState:null;`,
+                    `        const connecting=wsState===0||wsState===1;`,
+                    `        if(!connecting){`,
+                    `          window.setTimeout(()=>{`,
+                    `            try { if(!app.connected) app.connect(); } catch {}`,
+                    `          }, 0);`,
+                    `        }`,
+                    `        return false;`,
+                    `      };`,
+                    `      const start=()=>{`,
+                    `        let tries=0;`,
+                    `        let timer=0;`,
+                    `        const tick=()=>{`,
+                    `          tries+=1;`,
+                    `          if(attempt()||tries>=120){`,
+                    `            window.clearInterval(timer);`,
+                    `          }`,
+                    `        };`,
+                    `        tick();`,
+                    `        timer=window.setInterval(()=>{`,
+                    `          tick();`,
+                    `        },500);`,
+                    `      };`,
+                    `      if(window.customElements&&typeof window.customElements.whenDefined==='function'){`,
+                    `        window.customElements.whenDefined('openclaw-app').then(start).catch(()=>{});`,
+                    `      }else{`,
+                    `        start();`,
+                    `      }`,
+                    `    };`,
+                    `    autoConnect();`,
+                    `  } catch {}`,
+                    `})();`,
+                ].join("");
+                const inject = `<script>${injectScript}</script>`;
+                const injectCmdScript = [
+                    `(function(){`,
+                    `  var _jishuInject=function(cmd,send){`,
+                    `    var app=document.querySelector('openclaw-app');`,
+                    `    if(!app)return false;`,
+                    `    if(send){`,
+                    `      if(!app.connected)return false;`,
+                    `      try{app.handleSendChat(cmd);return true;}catch(e){}`,
+                    `      return false;`,
+                    `    }else{`,
+                    `      try{app.chatMessage=cmd;return true;}catch(e){}`,
+                    `      return false;`,
+                    `    }`,
+                    `  };`,
+                    `  window.addEventListener('message',function(e){`,
+                    `    if(!e.data||e.data.type!=='jishu:inject-cmd')return;`,
+                    `    var cmd=e.data.cmd,send=!!e.data.send,tries=0;`,
+                    `    var poll=function(){if(_jishuInject(cmd,send)||++tries>=50)return;setTimeout(poll,200);};`,
+                    `    poll();`,
+                    `  },false);`,
+                    `})();`,
+                ].join("");
+                const injectCmdScriptHash = createHash("sha256").update(injectCmdScript, "utf8").digest("base64");
+                const fullHtmlInject = `${inject}<script>${injectCmdScript}</script>`;
+                html = html.replace(/<head\b[^>]*>/i, (match) => `${match}${fullHtmlInject}`);
+                const inlineScriptHash = createHash("sha256").update(injectScript, "utf8").digest("base64");
+                const cspHeader = reply.getHeader("content-security-policy");
+                if (typeof cspHeader === "string" && cspHeader) {
+                    const hashToken = `'sha256-${inlineScriptHash}'`;
+                    const hashToken2 = `'sha256-${injectCmdScriptHash}'`;
+                    const addHashes = (src) => {
+                        let s = src;
+                        if (!s.includes(hashToken))
+                            s = s + ` ${hashToken}`;
+                        if (!s.includes(hashToken2))
+                            s = s + ` ${hashToken2}`;
+                        return s;
+                    };
+                    const nextCsp = /\bscript-src\b/i.test(cspHeader)
+                        ? cspHeader.replace(/\bscript-src\b([^;]*)/i, (_m, value) => `script-src${addHashes(value)}`)
+                        : `${cspHeader}; script-src 'self' ${hashToken} ${hashToken2}`;
+                    reply.header("content-security-policy", nextCsp);
+                }
+                const buf = Buffer.from(html, "utf-8");
+                reply.header("cache-control", "no-store");
+                reply.header("content-length", buf.length);
+                reply.removeHeader("content-encoding");
+                return reply.send(buf);
+            }
+            return reply.send(upstreamRes);
+        }
+        catch (err) {
+            console.error(`[gateway-proxy] ${id}:`, err.message || err);
+            return reply.status(502).send({ detail: "Cannot reach OpenClaw gateway" });
+        }
+    };
+    app.all("/api/instances/:id/gateway/*", gatewayProxy);
+    app.all("/api/instances/:id/gateway", gatewayProxy);
+}
+//# sourceMappingURL=openclaw-routes.js.map