openclaw-navigator 5.2.0 → 5.2.2

package/cli.mjs

@@ -755,6 +755,7 @@ function handleRequest(req, res) {
   // Keep /ui prefix — Next.js basePath: "/ui" expects it
   if (path === "/ui" || path.startsWith("/ui/")) {
     const targetURL = `${path}${url.search}`;
+    const incomingHost = req.headers.host || "localhost";
 
     const proxyOpts = {
       hostname: "127.0.0.1",
@@ -764,15 +765,38 @@ function handleRequest(req, res) {
       headers: {
         ...req.headers,
         host: `127.0.0.1:${ocUIPort}`,
+        "x-forwarded-host": incomingHost,
+        "x-forwarded-proto": activeTunnelURL ? "https" : "http",
+        "x-forwarded-for": req.socket.remoteAddress || "127.0.0.1",
       },
     };
 
     const proxyReq = httpRequest(proxyOpts, (proxyRes) => {
-      // Forward status + headers (add CORS for cross-origin tunnel access)
       const headers = { ...proxyRes.headers };
+
+      // CORS for cross-origin tunnel access
       headers["access-control-allow-origin"] = "*";
       headers["access-control-allow-methods"] = "GET, POST, PUT, DELETE, OPTIONS";
-      headers["access-control-allow-headers"] = "Content-Type, Authorization";
+      headers["access-control-allow-headers"] = "Content-Type, Authorization, Cookie";
+      headers["access-control-allow-credentials"] = "true";
+
+      // Fix redirects — rewrite Location from localhost:4000 to tunnel URL
+      if (headers.location) {
+        headers.location = headers.location
+          .replace(`http://127.0.0.1:${ocUIPort}`, "")
+          .replace(`http://localhost:${ocUIPort}`, "");
+      }
+
+      // Fix cookies — remove domain restriction so they work through tunnel
+      if (headers["set-cookie"]) {
+        const cookies = Array.isArray(headers["set-cookie"])
+          ? headers["set-cookie"]
+          : [headers["set-cookie"]];
+        headers["set-cookie"] = cookies.map((c) =>
+          c.replace(/;\s*domain=[^;]*/gi, "").replace(/;\s*secure/gi, ""),
+        );
+      }
+
       res.writeHead(proxyRes.statusCode ?? 502, headers);
       proxyRes.pipe(res, { end: true });
     });
@@ -1119,13 +1143,14 @@ module.exports = {
   });
 
   // ── WebSocket proxy — forward /ws connections to OC gateway ─────────
-  // The bridge is a transparent relay: Navigator connects here, we pipe to
-  // the OC gateway WebSocket at ws://localhost:ocGatewayPort/ws.
+  // The bridge is a transparent relay: Navigator connects to /ws here,
+  // we pipe to the OC gateway WebSocket at ws://localhost:ocGatewayPort/
+  // (OC Core accepts WebSocket at root /, not /ws)
   server.on("upgrade", (req, socket, head) => {
     const reqUrl = new URL(req.url ?? "/", "http://localhost");
     const reqPath = reqUrl.pathname;
 
-    // Only handle /ws paths
+    // Only handle /ws paths (Navigator connects to /ws)
     if (reqPath !== "/ws" && !reqPath.startsWith("/ws/")) {
       socket.destroy();
       return;
@@ -1133,9 +1158,10 @@ module.exports = {
 
     // Connect to the gateway WebSocket
     const gwSocket = netConnect(ocGatewayPort, "127.0.0.1", () => {
-      // Forward the HTTP upgrade request to the gateway
+      // Rewrite path: Navigator uses /ws but OC Core expects / (root)
+      const gwPath = reqPath === "/ws" ? "/" : reqPath.replace(/^\/ws/, "");
       const upgradeHeaders = [
-        `${req.method} ${req.url} HTTP/${req.httpVersion}`,
+        `${req.method} ${gwPath || "/"} HTTP/${req.httpVersion}`,
         ...Object.entries(req.headers).map(([k, v]) => `${k}: ${v}`),
         "",
         "",

package/mcp.mjs

@@ -63,46 +63,66 @@ function authHeaders() {
 
 // ── HTTP helpers ──────────────────────────────────────────────────────────
 
-async function bridgeGet(path) {
-  const res = await fetch(`${BRIDGE_URL}${path}`, {
-    headers: authHeaders(),
-  });
-  if (!res.ok) {
-    // If 401, try reloading the token (bridge may have restarted with new identity)
-    if (res.status === 401 && !bridgeGet._retrying) {
-      bridgeGet._retrying = true;
-      bridgeToken = loadBridgeToken();
-      const retry = await bridgeGet(path);
-      bridgeGet._retrying = false;
-      return retry;
+const MAX_RETRIES = 3;
+const RETRY_DELAYS = [500, 1500, 3000]; // ms — escalating backoff
+
+/** Retry wrapper for bridge HTTP calls — handles ECONNREFUSED and 401 */
+async function withRetry(fn, label) {
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      const isConnErr =
+        err.cause?.code === "ECONNREFUSED" ||
+        err.message?.includes("ECONNREFUSED") ||
+        err.message?.includes("fetch failed");
+      const is401 = err.message?.includes("returned 401");
+
+      if (is401 && attempt === 0) {
+        // Auth mismatch — bridge may have restarted with new token
+        log(`${label}: 401 — reloading bridge token and retrying`);
+        bridgeToken = loadBridgeToken();
+        continue;
+      }
+
+      if (isConnErr && attempt < MAX_RETRIES) {
+        const delay = RETRY_DELAYS[attempt] || 3000;
+        log(`${label}: bridge unreachable — retry ${attempt + 1}/${MAX_RETRIES} in ${delay}ms`);
+        await new Promise((r) => setTimeout(r, delay));
+        // Also reload token in case bridge restarted with new identity
+        bridgeToken = loadBridgeToken();
+        continue;
+      }
+
+      throw err;
     }
-    bridgeGet._retrying = false;
-    throw new Error(`Bridge GET ${path} returned ${res.status}`);
   }
-  bridgeGet._retrying = false;
-  return res.json();
+}
+
+async function bridgeGet(path) {
+  return withRetry(async () => {
+    const res = await fetch(`${BRIDGE_URL}${path}`, {
+      headers: authHeaders(),
+    });
+    if (!res.ok) {
+      throw new Error(`Bridge GET ${path} returned ${res.status}`);
+    }
+    return res.json();
+  }, `GET ${path}`);
 }
 
 async function bridgePost(path, body) {
-  const res = await fetch(`${BRIDGE_URL}${path}`, {
-    method: "POST",
-    headers: authHeaders(),
-    body: JSON.stringify(body),
-  });
-  if (!res.ok) {
-    // If 401, try reloading the token (bridge may have restarted with new identity)
-    if (res.status === 401 && !bridgePost._retrying) {
-      bridgePost._retrying = true;
-      bridgeToken = loadBridgeToken();
-      const retry = await bridgePost(path, body);
-      bridgePost._retrying = false;
-      return retry;
+  return withRetry(async () => {
+    const res = await fetch(`${BRIDGE_URL}${path}`, {
+      method: "POST",
+      headers: authHeaders(),
+      body: JSON.stringify(body),
+    });
+    if (!res.ok) {
+      throw new Error(`Bridge POST ${path} returned ${res.status}`);
     }
-    bridgePost._retrying = false;
-    throw new Error(`Bridge POST ${path} returned ${res.status}`);
-  }
-  bridgePost._retrying = false;
-  return res.json();
+    return res.json();
+  }, `POST ${path}`);
 }
 
 // ── Event polling engine ──────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-navigator",
-  "version": "5.2.0",
+  "version": "5.2.2",
   "description": "One-command bridge + tunnel for the Navigator browser — works on any machine, any OS",
   "keywords": [
     "browser",