openclaw-navigator 5.2.2 → 5.3.1

package/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * openclaw-navigator v5.2.0
+ * openclaw-navigator v5.3.1
  *
  * One-command bridge + tunnel for the Navigator browser.
  * Starts a local bridge, creates a Cloudflare tunnel automatically,
@@ -62,6 +62,10 @@ const validTokens = new Set();
 // OC Web UI reverse proxy target (configurable via --ui-port or env)
 let ocUIPort = parseInt(process.env.OPENCLAW_UI_PORT ?? "4000", 10);
 
+// OC Web UI directory — the pre-installed Next.js app
+const OC_UI_DIR = process.env.OPENCLAW_UI_DIR ?? join(homedir(), "openclaw-ui");
+let uiProcess = null;
+
 // OC Gateway port — where sessions API + WebSocket live (separate from web UI)
 let ocGatewayPort = parseInt(process.env.OPENCLAW_GATEWAY_PORT ?? "18789", 10);
 
@@ -144,6 +148,77 @@ function writeJSON(filePath, data) {
   writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
 }
 
+// ── OC Web UI lifecycle ───────────────────────────────────────────────────
+
+/** Kill any process listening on a port (best-effort, macOS/Linux) */
+async function killPort(port) {
+  const { execSync } = await import("node:child_process");
+  try {
+    // macOS: lsof -ti :PORT gives PIDs
+    const pids = execSync(`lsof -ti :${port} 2>/dev/null`, { encoding: "utf8" }).trim();
+    if (pids) {
+      for (const pid of pids.split("\n")) {
+        try {
+          execSync(`kill -9 ${pid.trim()} 2>/dev/null`);
+          info(`  Killed process ${pid.trim()} on port ${port}`);
+        } catch {}
+      }
+      // Wait a beat for the port to free up
+      await new Promise((r) => setTimeout(r, 500));
+    }
+  } catch {
+    // No process on that port, or lsof not available — that's fine
+  }
+}
+
+/** Start the OC Web UI (Next.js) as a child process */
+function startWebUI() {
+  if (!existsSync(join(OC_UI_DIR, "package.json"))) {
+    warn(`OC Web UI not found at ${OC_UI_DIR} — /ui/ proxy will return 502`);
+    info(`  Set OPENCLAW_UI_DIR to the correct path, or install openclaw-ui there`);
+    return;
+  }
+
+  if (uiProcess) {
+    uiProcess.kill();
+    uiProcess = null;
+  }
+
+  uiProcess = spawn("npx", ["next", "start", "-p", String(ocUIPort)], {
+    cwd: OC_UI_DIR,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, PORT: String(ocUIPort), NODE_ENV: "production" },
+  });
+
+  uiProcess.stdout.on("data", (data) => {
+    const line = data.toString().trim();
+    if (line) {
+      info(`  [ui] ${line}`);
+    }
+  });
+
+  uiProcess.stderr.on("data", (data) => {
+    const line = data.toString().trim();
+    if (line && !line.includes("ExperimentalWarning")) {
+      info(`  [ui] ${line}`);
+    }
+  });
+
+  uiProcess.on("error", (err) => {
+    warn(`OC Web UI failed to start: ${err.message}`);
+    uiProcess = null;
+  });
+
+  uiProcess.on("exit", (code) => {
+    if (code !== null && code !== 0) {
+      warn(`OC Web UI exited with code ${code}`);
+    }
+    uiProcess = null;
+  });
+
+  ok(`OC Web UI starting on port ${ocUIPort} (PID ${uiProcess.pid}) from ${OC_UI_DIR}`);
+}
+
 // Pairing code state
 let pairingCode = null;
 let pairingData = null;
@@ -891,11 +966,13 @@ function handleRequest(req, res) {
     return;
   }
 
-  // ── Fallback: proxy unmatched paths → OC Web UI (for static assets) ──
-  // The web UI at localhost:4000 may serve assets at /_next/*, /static/*, etc.
-  // These don't start with /ui/ but still need to reach the web UI server.
+  // ── Fallback: proxy unmatched paths → OC Web UI ──────────────────────
+  // Catches /login, /_next/*, /static/*, /favicon.ico, etc.
+  // MUST apply the same cookie/redirect/forwarded-header treatment as /ui/*
+  // or login won't work (session cookies get lost through the tunnel).
   {
     const targetURL = `${path}${url.search}`;
+    const incomingHost = req.headers.host || "localhost";
 
     const proxyOpts = {
       hostname: "127.0.0.1",
@@ -905,14 +982,38 @@ function handleRequest(req, res) {
       headers: {
         ...req.headers,
         host: `127.0.0.1:${ocUIPort}`,
+        "x-forwarded-host": incomingHost,
+        "x-forwarded-proto": activeTunnelURL ? "https" : "http",
+        "x-forwarded-for": req.socket.remoteAddress || "127.0.0.1",
       },
     };
 
     const proxyReq = httpRequest(proxyOpts, (proxyRes) => {
       const headers = { ...proxyRes.headers };
+
+      // CORS
       headers["access-control-allow-origin"] = "*";
       headers["access-control-allow-methods"] = "GET, POST, PUT, DELETE, OPTIONS";
-      headers["access-control-allow-headers"] = "Content-Type, Authorization";
+      headers["access-control-allow-headers"] = "Content-Type, Authorization, Cookie";
+      headers["access-control-allow-credentials"] = "true";
+
+      // Fix redirects — strip localhost prefix so browser stays on tunnel URL
+      if (headers.location) {
+        headers.location = headers.location
+          .replace(`http://127.0.0.1:${ocUIPort}`, "")
+          .replace(`http://localhost:${ocUIPort}`, "");
+      }
+
+      // Fix cookies — remove domain restriction + secure flag for tunnel access
+      if (headers["set-cookie"]) {
+        const cookies = Array.isArray(headers["set-cookie"])
+          ? headers["set-cookie"]
+          : [headers["set-cookie"]];
+        headers["set-cookie"] = cookies.map((c) =>
+          c.replace(/;\s*domain=[^;]*/gi, "").replace(/;\s*secure/gi, ""),
+        );
+      }
+
       res.writeHead(proxyRes.statusCode ?? 502, headers);
       proxyRes.pipe(res, { end: true });
     });
@@ -1173,7 +1274,7 @@ module.exports = {
     });
 
     gwSocket.on("error", (err) => {
-      console.log(`  ${DIM}WS proxy: gateway unreachable — ${err.message}${RESET}`);
+      warn(`WS proxy: gateway on port ${ocGatewayPort} unreachable — ${err.message}`);
       socket.destroy();
     });
 
@@ -1204,6 +1305,11 @@ module.exports = {
 
   ok(`Bridge server running on ${bindHost}:${port}`);
 
+  // ── Step 1.5: Start OC Web UI ──────────────────────────────────────
+  // Kill anything on the UI port, then start the Next.js app as a child process.
+  await killPort(ocUIPort);
+  startWebUI();
+
   // ── Step 2: Persistent identity ─────────────────────────────────────
   // Reuse the same pairing code + token across restarts so Navigator
   // doesn't need to re-pair. The code resolves to the NEW tunnel URL
@@ -1907,6 +2013,10 @@ module.exports = {
   // ── Graceful shutdown ─────────────────────────────────────────────────
   const shutdown = () => {
     console.log(`\n${DIM}Shutting down bridge...${RESET}`);
+    if (uiProcess) {
+      uiProcess.kill();
+      uiProcess = null;
+    }
     if (mcpProcess) {
       mcpProcess.kill();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-navigator",
-  "version": "5.2.2",
+  "version": "5.3.1",
   "description": "One-command bridge + tunnel for the Navigator browser — works on any machine, any OS",
   "keywords": [
     "browser",