openclaw-navigator 5.7.3 → 5.7.4

package/cli.mjs

@@ -1703,6 +1703,23 @@ async function registerWithRelay(code, url, token, name) {
     });
     clearTimeout(timeout);
     const data = await res.json();
+
+    // Also register with token as the lookup key — so Navigator can
+    // resolve by saved token even after the pairing code rotates.
+    // Uses first 8 chars of token as a "token code" (avoids relay key limits).
+    const tokenCode = `T${token.substring(0, 7)}`;
+    try {
+      const c2 = new AbortController();
+      const t2 = setTimeout(() => c2.abort(), 5000);
+      await fetch(`${RELAY_URL}/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code: tokenCode, url, token, name }),
+        signal: c2.signal,
+      });
+      clearTimeout(t2);
+    } catch { /* non-critical */ }
+
     return data.ok === true;
   } catch {
     return false;
@@ -1927,25 +1944,30 @@ module.exports = {
   await killPort(ocUIPort);
   startWebUI();
 
-  // ── Step 2: Persistent identity ─────────────────────────────────────
-  // Reuse the same pairing code + token across restarts so Navigator
-  // doesn't need to re-pair. The code resolves to the NEW tunnel URL
-  // via the relay, so everything reconnects automatically.
+  // ── Step 2: Identity — persistent token, rotating code ──────────────
+  // Token is persistent: Navigator stores it after first pairing and uses
+  // it for all future requests. This is the real auth credential.
+  // Pairing code rotates every startup: it's a one-time handshake to
+  // exchange the token. A new code every time means nobody can reuse
+  // an old code to hijack the connection.
   const displayName = hostname().replace(/\.local$/, "");
   let token;
 
   const savedIdentity = freshIdentity ? null : loadBridgeIdentity();
   if (savedIdentity) {
-    pairingCode = savedIdentity.pairingCode;
+    // Keep the token (Navigator already has it) but rotate the code
     token = savedIdentity.token;
     validTokens.add(token);
-    ok(`Restored pairing code: ${BOLD}${GREEN}${pairingCode}${RESET} (same as last session)`);
+    pairingCode = generatePairingCode(); // fresh code every startup
+    saveBridgeIdentity(pairingCode, token, displayName);
+    ok(`Token restored (Navigator will auto-reconnect)`);
+    ok(`New pairing code: ${BOLD}${GREEN}${pairingCode}${RESET} (rotated for security)`);
   } else {
     token = randomUUID().replace(/-/g, "");
     validTokens.add(token);
     pairingCode = generatePairingCode();
     saveBridgeIdentity(pairingCode, token, displayName);
-    ok(`New pairing code generated: ${BOLD}${GREEN}${pairingCode}${RESET}`);
+    ok(`New pairing code: ${BOLD}${GREEN}${pairingCode}${RESET}`);
   }
 
   let gatewayURL = `http://localhost:${port}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-navigator",
-  "version": "5.7.3",
+  "version": "5.7.4",
   "description": "One-command bridge + tunnel for the Navigator browser — works on any machine, any OS",
   "keywords": [
     "browser",