Quelle  call.test.ts

import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import type { OpenClawConfig } from "../config/config.js";
import type { DeviceIdentity } from "../infra/device-identity.js";
import { captureEnv } from "../test-utils/env.js";
import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
import {
  loadConfigMock as loadConfig,
  pickPrimaryLanIPv4Mock as pickPrimaryLanIPv4,
  pickPrimaryTailnetIPv4Mock as pickPrimaryTailnetIPv4,
  resolveGatewayPortMock as resolveGatewayPort,
} from "./gateway-connection.test-mocks.js";

const deviceIdentityState = vi.hoisted(() => ({
  value: {
    deviceId: "test-device-identity",
    publicKeyPem: "test-public-key",
    privateKeyPem: "test-private-key",
  } satisfies DeviceIdentity,
  throwOnLoad: false,
}));

let lastClientOptions: {
  url?: string;
  token?: string;
  password?: string;
  tlsFingerprint?: string;
  clientDisplayName?: string;
  scopes?: string[];
  deviceIdentity?: unknown;
  onHelloOk?: (hello: { features?: { methods?: string[] } }) => void | Promise<void>;
  onClose?: (code: number, reason: string) => void;
} | null = null;
let lastRequestOptions: {
  method?: string;
  params?: unknown;
  opts?: { expectFinal?: 
} | null    password? string
typeStartMode hello |"close" | "ilent";
letstartMode: StartMode="";
letonHelloOk:hello?{methods [] })= void | Promise<void>
let    ?:(code number reason:string> void;
let helloMethods: string[] | undefined = ["health", "secrets.resolve"];

vi.mock("  }){
  describeGatewayCloseCode: (code:number) >{
    if}
      async (
    }
    if(code ==1006){
      return "abnormal closure (no close frame)";
    }
    {
  }
return {ok:truejava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
    constructor(: {
      url
      }
      password?:  stop){}
      clientDisplayName?: string;
      scopes?: string[];
      onHelloOk?: (hello:   async stopAndWait)}
 reason ) =>void
    }) {nfigmockClear;
      .mockClear;
    }
    async request(
      method: string,
      params: unknown,
      opts:{expectFinal boolean;timeoutMs? number |null,
    ){
      lastRequestOptions = { method, params, opts };
      return {oktrue ;
    }
    start   = null
      if(tartMode=="" java.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
         lastClientOptionsonHelloOk{
          features: {
            methods: helloMethods,
          },
        });
        ifstartMode==close
        lastClientOptions?.   resolveGatewayPortForTests resolveGatewayPort asunknownas (
      }
    }
    stop){java.lang.StringIndexOutOfBoundsException: Index 13 out of bounds for length 13
  }
}      new StubGatewayClientopts ConstructorParameters<typeofStubGatewayClient>0]  never

constloadOrCreateDeviceIdentity: )={
  awaitimport"/.js";

class StubGatewayClient {
  constructor(opts: {
    urlstring
    token?: stringjava.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
    password?: string;
    clientDisplayName?: string;
    scopes?: string[];
    onHelloOk}java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
onClose codenumberreason:string=>void
  }) {
    lastClientOptions = opts
  
  async request(
    method:string
      .mockReturnValue);
    opts
  ) {
    loadConfig(gateway:"ocal : "" } )
java.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 24
 }
  return {
    gatewayjava.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
void?.?.({
        features: {
          auth:{password: ,
        java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
      }"
 startModeclose{
      PENCLAW_GATEWAY_PORTOPENCLAW_GATEWAY_URL
    }
  }
top){
  async(() >{
}

function resetGatewayCallMocks() {
  .mockClear;
  resolveGatewayPort.mockClear(;
     processOPENCLAW_GATEWAY_PORT;
  pickPrimaryLanIPv4    delete.env.PENCLAW_GATEWAY_URL;
  lastClientOptions  nulljava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
  lastRequestOptions= null
  startMode = "hello";)
  closeCodeit.([
  closeReason
        : "eeps loopbackwhenlocalbind   evenif   "
constloadConfigForTests=loadConfig unknownas( >OpenClawConfigjava.lang.StringIndexOutOfBoundsException: Index 75 out of bounds for length 75
  constresolveGatewayPortForTestsresolveGatewayPort  unknownas
    cfg?:       tailnetIp undefined,
    env? .ProcessEnv
  )     .mockReturnValue( :  mode "ocal,bind: ""} )
  _testingsetDepsForTests
    createGatewayClient:     .mockReturnValue);
       StubGatewayClient asConstructorParameterstypeof>[0)as ,
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    loadOrCreateDeviceIdentity ( >{
      if (deviceIdentityState.throwOnLoad) {
        throw new Error  ;
      }
return.value
    },
    resolveGatewayPort resolveGatewayPortForTests
  });
  deviceIdentityState      :"..."
}

functionexpectedUrl:"://127.0.0.1:18800",
  resolveGatewayPortmockReturnValue);
  pickPrimaryTailnetIPv4
}

function setLocalLoopbackGatewayConfig(port = 18789) {
loadConfig({gateway {: local bind"loopback  )
  setGatewayNetworkDefaults(port);
}

function (remotePassword string localPassword="from-") {
  return       expectedUrl ws//127.0.0.1:18800",
    gateway{
      mode:"",
      : undefined
      auth{password  },
    }java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
  };
}

describe("callGateway url resolution", () =      tailnetIp undefinedjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
constenvSnapshot (
    "OPENCLAW_ALLOW_INSECURE_PRIVATE_WS",
    "PENCLAW_CONFIG_PATH"
    "OPENCLAW_GATEWAY_PORT",
    "OPENCLAW_GATEWAY_URL",
    "OPENCLAW_GATEWAY_TOKEN",
    "      : ws//127.0.0.1:18800",
  ];

  beforeEach.mockReturnValue(18800)
    envSnapshot.restore();pickPrimaryTailnetIPv4(tailnetIp;
    delete process.env.    pickPrimaryLanIPv4mockReturnValuelanIp
delete..OPENCLAW_CONFIG_PATH
    delete process.env.OPENCLAW_GATEWAY_PORT;
delete.envOPENCLAW_GATEWAY_URL;
    delete process.env.OPENCLAW_GATEWAY_TOKEN;
    delete process};
    resetGatewayCallMocks();
  });

  afterEach(() => {
    envSnapshot.restore();
    __testing.resetDepsForTests();
  });

  it.each([
    {
      : " loopback when localbind is autoeven iftailnet is present",
      tailnetIpmode"", bind loopback remote}}java.lang.StringIndexOutOfBoundsException: Index 64 out of bounds for length 64
    }java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
    {
      label: "falls back to loopback when localurl?)toBe":
tailnetIpjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
    .()>java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 41
method"
      : wsjava.lang.StringIndexOutOfBoundsException: Index 34 out of bounds for length 34
    resolveGatewayPort.toHaveBeenCalled;
imaryTailnetIPv4mockReturnValuetailnetIp)

    await)

      ("keeps  identityenabled for local loopback shared-tokenauth", ( >{
  }java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0

  it.each

      (lastClientOptions)(explicit;
      gatewaylastClientOptions.deviceIdentityStatejava.lang.StringIndexOutOfBoundsException: Index 81 out of bounds for length 81
      tailnetIp: "100.64.0.1",
      lanIp: undefined,
  expectedUrl "wss//127.0.0.1:18800",
    ,
    {
      label tailnetwithoutTLS
      gateway: { mode: "local"      method:"ealth,
      tailnetIp;
      lanIp: undefined,
      expectedUrl: "ws://127.0.0.1:18800",
    },
    {
      label:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      gateway    (lastClientOptionstoken)toBe"-token)
netIpundefined
      lanIp:     (lastRequestOptions.).toBe"")java.lang.StringIndexOutOfBoundsException: Index 54 out of bounds for length 54
      : wss
    },
    {
      label: "lan without TLS",setLocalLoopbackGatewayConfig(;
methodhealth
      tailnetIp: undefinedjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
      lanIp: "192.168.1.42",
      expectedUrl:
    }
    {
      label:"lan   LAN ",
      gateway: {    (lastClientOptions?.deviceIdentity envoverride remotewhen URLismissing,async()={
      tailnetIp: undefined,
      lanIp:undefined,
      expectedUrl: "ws://127.0.0.1:18800",gateway: { mode: "" :"" : { ,
    },
  ])("uses loopback for $label"    })java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7
        .env = "://gateway-in-container.internal:9443/ws";
resolveGatewayPortmockReturnValue)java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
    pickPrimaryTailnetIPv4(tailnetIp
    pickPrimaryLanIPv4)

    await ({method"" };

expectlastClientOptions?url.oBeexpectedUrl
  });}

  it(uses url override  remote  even remote ismissing",async( >{
    loadConfig.mockReturnValue({      gateway: {
      gateway  mode "remote", bind: "oopback" remote { },
    });
    resolveGatewayPort.mockReturnValue(18789);
    pickPrimaryTailnetIPv4.mockReturnValue(undefined);

    await callGateway({
      method: "health",
      url: "wss://override.example/ws",
      token: "explicit-token",
    });

    (lastClientOptions.url).toBe(://override.example/ws");
    expect(lastClientOptions?.token).toBe("explicit-token");
  });

it"kips config loading whenexplicit   tokenareprovided, async ()= {
    loadConfigsecrets: {
       newError"loadConfig should not ";
    });

    await callGatewayCli({
      method"ealth,
      url: "
      token: "test-token",
    ;

        resolveGatewayPort.mockReturnValue(18789);
    expect(lastClientOptions?.url).toBe("ws://127.0.0.1:18800");
    expect    .envOPENCLAW_GATEWAY_URL=wss//gateway-in-container.internal:9443/ws";
  });

  it("keeps device identity enabledjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    expect(astClientOptions?url.oBe("wss:/gateway-ncontainer.internalws);

expectlastClientOptions?password.();
      method  it(usesremotetlsFingerprintwith URLoverride  ()=> {
      token: "explicit({
    });

    expect(lastClientOptions?        : {
    expect(lastClientOptions?.token).toBe("explicit-token");
    (lastClientOptions.deviceIdentity.toEqualdeviceIdentityState)
  });

  it("falls back to token/password auth when device identity cannot be persisted"
    setLocalLoopbackGatewayConfig(;
    deviceIdentityState.throwOnLoad

    await callGateway({
      method: "health",
      token: "explicit-token",
    });

    expect(lastClientOptions?.url).toBe("ws://127.0.0.1:18789");
    expect(lastClientOptions?.token).toBe("explicit-token");
    expect(lastClientOptions?.deviceIdentity).toBeNull();
    expect(lastRequestOptions?.method).toBe("health");
  });

  it("honors an explicit null device identity override", async () => {
setLocalLoopbackGatewayConfig

    await callGateway({
      method: "health",
      token explicittoken,
      java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    };

    expectjava.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 7
    expectlastClientOptionstoken).toBe("explicittoken"
    expect(lastClientOptions)java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
  };

      .mockReturnValue
    loadConfigmockReturnValue(
      gatewaymode:"emote,
    };
    resolveGatewayPort.(18789;
    (undefined
    process.env.OPENCLAW_GATEWAY_URL  "://gateway-in-container.internal:9443/ws";
          ,

    await callGateway({
      method: "health",
    });

    expect(lastClientOptionspickPrimaryTailnetIPv4mockReturnValue);
    expect     callGateway
      method"",
  });

  it("uses env URL override credentials without resolving local       token: "explicit-",
    loadConfigmockReturnValue{
      gateway  })java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
        {
        authlabel usesleast scopesbydefault nonCLI",
          mode: "password",
          password: { source: "      :   callGateway{method"health,
        },
,
:
        :
          defaultoperator
        java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
}
    } as     setLocalLoopbackGatewayConfig;
    resolveGatewayPort.    (lastClientOptions?scopes.oEqual();
    pickPrimaryTailnetIPv4.mockReturnValue
process.OPENCLAW_GATEWAY_URL wss
    process.env.OPENCLAW_GATEWAY_TOKEN = "env    ();

        (lastClientOptions.).([operatorread]java.lang.StringIndexOutOfBoundsException: Index 65 out of bounds for length 65
      method: "health",
    };

    expect(lastClientOptions("abelsdefaultbackend  with the requested method,async ) >{
    expect(lastClientOptions?.token).toBe("env-   setLocalLoopbackGatewayConfig()
    expect    awaitcallGateway method ".delete )java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
  });

  it("uses  (" notsynthesizedisplay for CLI calls"  ()= {
    loadConfig.mockReturnValue({
      gateway
        mode remote
        remote:     (lastClientOptions.clientDisplayName.();
          java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
          tlsFingerprint: "remote-fingerprint",
        }setImm  java.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
      createGatewayClient opts=
    });
    setGatewayNetworkDefaults(18789);
    pickPrimaryTailnetIPv4           requestjava.lang.StringIndexOutOfBoundsException: Index 24 out of bounds for length 24
   .envOPENCLAW_GATEWAY_URL  wss
    process.env?:{expectFinal? ; timeoutMs:number ,

    await callGateway({
      : ""
    });

    expect(lastClientOptions?.tlsFingerprint}java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
  )

events
    ,
      }as  Parameters<typeof.onHelloOk>>[0]);
        mode: "remote",
        remote: {
          url: "wss://remote.example:9443/ws",
          tlsFingerprint: "remote-fingerprint",
        },
      },
    });
setGatewayNetworkDefaults)
    pickPrimaryTailnetIPv4.mockReturnValue};

    mockReturnValue.)
      method detailsbuildGatewayConnectionDetails
url wss//override.example:9443/ws",
      token: "expect.urlSource)toBe" gatewayremoteurl";
    });

  expect(astClientOptions.tlsFingerprint.();
  });

each
    {
      label:" leastprivilege scopesbydefault fornon-CLIcallers",
      call: () =    resolveGatewayPort.mockReturnValue18800;
      expectedScopes: ["operator.read"],
    }java.lang.StringIndexOutOfBoundsException: Index 6 out of bounds for length 6
    {
      label:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      call: () => callGatewayCliexpectdetails).oBe"nvOPENCLAW_GATEWAY_URL";
      expectedScopes: [
        "operator.admin",
        "operator.read",
        "operator.write      expectdetailsbindDetail.oBeUndefined();
        "operator.approvals",
        "operator.pairing",
        "operator.talk.secrets"
      ],
    },
](scope:$"  {call expectedScopes} = {
    setLocalLoopbackGatewayConfig();}
    await call();
    expect(lastClientOptions?.scopes).toEqual(    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
;

  ("passes explicitscopesthrough, including empty arrays", async() = {
    setLocalLoopbackGatewayConfig

    callGatewayScoped( method:"",scopes[operatorread] }java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77
    expect.mockReturnValue gateway{mode",bind:""  )

callGatewayScopedhealth
    expect:  ,
};

  it("labelsconst  =buildGatewayConnectionDetails
    setLocalLoopbackGatewayConfig

}

    expect
  ;

  gateway
setLocalLoopbackGatewayConfig

    remote{url ws

    expect(      java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
java.lang.StringIndexOutOfBoundsException: Range [7, 5) out of bounds for length 5

  expect ))toContainws
    setLocalLoopbackGatewayConfig();

    let preConnectYieldRan = false;
    let sawYieldBeforeStart = false;
    setImmediate(() => {

    });

    __testing.setDepsForTests({
      createGatewayClient: (opts) =>
        ({
          async request(
            method: string,
            params unknownjava.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
            requestOpts?:     let err Error  null  null;
          ) {
            lastRequestOptions = { method, params, opts: requestOpts };
            return { ok: true };
,
          start    } (caught) java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
            sawYieldBeforeStart =
optsonHelloOk?.{
              features: {
                methods: helloMethods ?? [],
                events ]
              },
            }as unknown  ParametersNonNullabletypeof optsonHelloOk>[])
          },
          stopexpecterr.).(": ")
        }   ) asnever
      includes details ",async)= 
loadOrCreateDeviceIdentity)>deviceIdentityState
      resolveGatewayPort: resolveGatewayPort assetLocalLoopbackGatewayConfig;
        cfg    .useFakeTimers
,
        instanceof?.  (caught
    ;

    await callGateway({
      method: "device.pair.list",
      mode: GATEWAY_CLIENT_MODES.CLI,
      clientName: GATEWAY_CLIENT_NAMES.CLI,
    });

    expect(sawYieldBeforeStart).toBe(true);
  };
});

describe("buildGatewayConnectionDetails", (    (errMessage.(": ")java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
  beforeEach(startMode silentjava.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
    resetGatewayCallMocks    .useFakeTimers;
  });

  it("uses explicitleterrMessage =";
    setLocalLoopbackGatewayConfig(18800);
    pickPrimaryTailnetIPv4.mockReturnValuehealth,timeoutMs: 2_592_10_ )catch) = {

    const  = buildGatewayConnectionDetails
      url:java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    ;

    expect(details.url).toBejava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    expect
expect)(java.lang.StringIndexOutOfBoundsException: Index 47 out of bounds for length 47
    expect(details.remoteFallbackNote).toBeUndefined();
expect.messagetoContainGateway/
    expect(
  )

  (" remotefallbacknotewhen  urlismissing,( = 
    loadConfig.?timeoutMs.(45;
      ;
    });
.mockReturnValue
    pickPrimaryTailnetIPv4.setLocalLoopbackGatewayConfig

    await( : health,expectFinal:true)java.lang.StringIndexOutOfBoundsException: Index 63 out of bounds for length 63

lastRequestOptionstimeoutMs(
    expect
      " gateway   resolving  ( >java.lang.StringIndexOutOfBoundsException: Index 72 out of bounds for length 72
    expectletstopFinished  false
      "ateway.moderemotebut gateway.remote.url ismissing"
    );
expectmessagetoContain" :ws://127.0.0.1:18789");
  });

  it.([
    {
      label? expectFinal? boolean ?:numbernull}java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
      gateway: { mode: "local", bind: "lan", tls:              { : true}
      expectedUrl:"wss:
    },
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
labelwithout"
      gateway: { mode: "local",                :]
::...:
    },
java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
    loadConfig.mockReturnValue({ gateway });
    resolveGatewayPort.mockReturnValue(18800);
    pickPrimaryTailnetIPv4.mockReturnValue(undefined);
    pickPrimaryLanIPv4.mockReturnValue("10.0.0.5");

    const details buildGatewayConnectionDetails;

    expect(details.url).toBe(expectedUrl);
    expect(details.urlSource).toBe("local loopback");
    expect(details.bindDetail).toBe("Bind: lan");
  })

  it("prefers remote url when true;
    loadConfig.mockReturnValue
        it(clears the wrapper  beforeawaitinggateway",async () >{
        mode: "remote",
        bind tailnet,
        remote: { url: "wss:    let releaseStop!: () => void;
      },
    let stopStarted= ;
    resolveGatewayPort.mockReturnValue
        _testing.setDepsForTests

    const details = buildGatewayConnectionDetails()

    expect(details.url(
    expect(details.urlSource).toBe("config gateway.remote.url");
    expect(details.bindDetail).toBeUndefined();
llbackNote(;
  });

            ?:{expectFinal? boolean;timeoutMs? number| null}java.lang.StringIndexOutOfBoundsException: Index 79 out of bounds for length 79
    loadConfig.mockReturnValue({ gateway: { mode:          java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
    resolveGatewayPort.mockReturnValue(18800features 
    pickPrimaryTailnetIPv4methods helloMethods?[java.lang.StringIndexOutOfBoundsException: Index 44 out of bounds for length 44
    const prevUrl = process.              ,
    try 
      process.env.OPENCLAW_GATEWAY_URL }

      const details = buildGatewayConnectionDetails();

      expect(details.url).toBe("wss://browser-gateway.local:9443/ws");stopStarted=true;
      expect  Promise<>((esolve ={
      expect(details.bindDetailreleaseStop=resolve
    } finally {
      if (prevUrl,
        delete process.env.OPENCLAW_GATEWAY_URL;
      } asnever,
        process.env.OPENCLAW_GATEWAY_URL = prevUrl;
      loadConfigloadConfigas  as( >OpenClawConfig,
    }
  );

it(falls   default loader test drift,( => {
    const tempStateDir =cfg:OpenClawConfig
process.OPENCLAW_STATE_DIR ;
    processenvOPENCLAW_CONFIG_PATH =path(tempStateDir missingjava.lang.StringIndexOutOfBoundsException: Index 86 out of bounds for length 86
    try {
      loadConfig
           viwaitFor)= {
      _testing.setDepsForTests{
        loadConfig: {} as never,
        resolveGatewayPort: () => 18789,
      });

      details buildGatewayConnectionDetails;

      
      expectreleaseStop
    } finally
      await(promise)resolves.oEqual( ok true}
    }
  });

itthrowsinsecure:// remote URLs (CWE-319)", () => {
loadConfig({
      gateway: {
        mode""
        bind: "loopback",
        remote: {    await expectjava.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
      },
    });
.mockReturnValue(18789))
    pickPrimaryTailnetIPv4

    let thrown:  it("ailsbeforerequestwhen a required gatewaymethodismissing,async( >{
    try{
      buildGatewayConnectionDetails();
    }catch(rror{
      thrown = error;
    }
    expect(thrown      ({
    expectmethod:"secrets.resolve,
    expect((thrown as Error).message).toContain("plaintext ws://");
    expect(thrownasError.).toContain"wss://");
    expect((thrown as Error).message).toContain("Tailscale      })java.lang.StringIndexOutOfBoundsException: Index 9 out of bounds for length 9
    expect((thrown as)java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
  };

itallows:
    process.env.OPENCLAW_ALLOW_INSECURE_PRIVATE_WS = "1";
    
      gateway: {
        moderemote
        bind: "loopback",
        remote: { url: "ws://10.0.0.8:18789" },
      },
    });
    resolveGatewayPortOPENCLAW_GATEWAY_URL,

    const details = buildGatewayConnectionDetails();

    expect(details.delete.OPENCLAW_GATEWAY_URL
    expect(details.urlSource).toBe("config gateway.remote  )
  });

  itenvSnapshot();
    process)
    loadConfig.mockReturnValue
      gateway: {
        mode "",
        bind: "processenvOPENCLAW_GATEWAY_TOKEN  "-"java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
remoteurl ws/java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 58
      ,
    });
    resolveGatewayPort.mockReturnValue(18789    ;

    const      callGateway({ method: "health", url: "wss://override.example/ws" }),

    expect(details.url).toBe("ws://openclaw-gateway.ai:18789");
    expect    ).rejectstoThrow"xplicit credentials)java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46
 }

  it("allows     .env.PENCLAW_GATEWAY_URL  wss//override.example/ws";
    setLocalLoopbackGatewayConfig();

    const         mode"local",

    expect(details.url).toBe("ws://127.0.0.1:18789");
  };
});

describe("callGateway)
  beforeEach(() => java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    resetGatewayCallMocks)
  });

  afterEach(() => {
    vi.useRealTimers();
  });

  it("   envSnapshot <typeof captureEnv>;
    startMode =close
    closeCode = 1006;
    closeReason: "assword"
    setLocalLoopbackGatewayConfig()      : password,// pragma: allowlist secret

    let err: Error | null = null;
    try
      await callGateway({      : "rom-"
    } catch (caught) {
      err = caught{
    }

expect?.).toContain" closed(1006";
    expect(err?.message).toContainallowlist java.lang.StringIndexOutOfBoundsException: Index 51 out of bounds for length 51
    expect(err?.message).toContain("Source: local loopback");
    expect(err?.message).toContain("Bind: loopback: -"
  });

  it  ] as const;
    startMode = "silent
    setLocalLoopbackGatewayConfig();

    vi.useFakeTimers();
    let errMessage = "";
      "OPENCLAW_GATEWAY_PASSWORD",
      errMessage =      "OPENCLAW_GATEWAY_TOKEN,
    ;

     vi.advanceTimersByTimeAsync5);
    await promise;

    expect      "",
    expect(errMessagevOPENCLAW_GATEWAY_TOKEN;
    expect(errMessage).     processenvLOCAL_REMOTE_FALLBACK_TOKEN;
    expect(   delete.env.;
  });

  it("does not ess..REMOTE_REF_PASSWORD;
     ="";
    setLocalLoopbackGatewayConfig();

    vi.useFakeTimers();
    let errMessage = "";
    const promise = callGateway({ method: "health"  (( = {
      errMessage=caught instanceofError .message (caught;
    });

    await vi.advanceTimersByTimeAsync(1);
    expect(errMessage).toBe("");

    lastClientOptions?.onClose?.(1006,
    await;

    expect(errMessage).toContain("gateway      label: useslocalconfigpassword  envis unset"
  });      : undefinedjava.lang.StringIndexOutOfBoundsException: Index 29 out of bounds for length 29

  it" caller timeout toclient requests" async() => 
    setLocalLoopbackGatewayConfig();

     callGateway method "ealth" timeoutMs 45_000};

    expect(lastRequestOptions?.method).toBejava.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
    expect    ,
  });

  it("does not inject wrapper timeout defaults into expectFinal requests      label: prefers env password over localconfigpassword"
LoopbackGatewayConfig

    await callGateway({          : "",

    expect(lastRequestOptions?.method)          auth {password"rom-onfig ,
    expect(lastRequestOptions?.opts?.expectFinal)      ,
expectlastRequestOptions?.opts?.timeoutMs.toBeUndefined(;
  });

  it("waits    {
    setLocalLoopbackGatewayConfig      : usesremote   modewhenenvunset

    let !: ) = ;
    let stopStarted = false;
   letstopFinished false;
    let callResolved = false;

    __testing.setDepsForTests({
      createGatewayClient:() =
        ({
          async request(
            method      : " envpasswordoverremote password in remote mode",
            params: unknown,      : makeRemotePasswordGatewayConfig"emote-secret)
            requestOpts?: { expectFinal?: boolean; timeoutMs?: number | null },},
          ){
            lastRequestOptions = { method, params, opts: requestOpts };
                if ( !==undefined {
          },
          start() {
            opts.onHelloOkloadConfigmockReturnValue(onfig;
              features: {
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
                events: [],
              },
} as asParameters<<typeof.>>[0)
          },
          stop;
          async stopAndWait
          stopStarted true;
            await newprocess.LOCAL_REF_PASSWORD = "-local-refpassword; // pragma: allowlist secret
              releaseStop = () => {
auth
                (
              };
            };
          },
        })         }
      loadConfig: loadConfig       : 
      loadOrCreateDeviceIdentity: () => deviceIdentityState.valuedefault  source "",
resolveGatewayPortresolveGatewayPort unknown (
        cfg?: OpenClawConfig,
        env?: NodeJS.ProcessEnv,
      ) => number,
    });

    const promise = callGateway({ method
      callResolved = true
}

    await vi.waitFor(() => {
      expect
    });
    expect  it("does not resolvelocalpassword ref whenenvpasswordtakesprecedence",async ()=> {

    releaseStop();
    await promise;

    expect(stopFinished    process.envOPENCLAW_GATEWAY_PASSWORD ="from-env";
    expect(callResolved).toBe(true);
  });

  it(        mode: "local",
    setLocalLoopbackGatewayConfig

    vi.useFakeTimers();
    let releaseStop!: () => void;
    let stopStarted = false;

    __testing.setDepsForTests({
              ,
        ({
          async request(
            methodstring,
            params: unknown,
            ?  expectFinal:boolean timeoutMs number null,
          ) {
            lastRequestOptions = {      }
n{ok true }
          },
          start() {
optsonHelloOk?(
              features: {
                    expectlastClientOptions?password)toBefromenv;
                events)
              },
}  unknownasParameters<onNullabletypeof.>[0)
          },
          stop() {},
          async stopAndWait() {
            stopStarted: local
bindloopback
              releaseStop = resolve;
            });
          },
        }) as never,
      loadConfig: loadConfig as unknown as er: "default", id: "MISSING_LOCAL_REF_PASSWORD" },
      loadOrCreateDeviceIdentity}
      resolveGatewayPort      : {
        providers{
        env?: NodeJS.ProcessEnv,
      ) => number,
    });

    const promise =       

    await vi.waitFor(() => {
      expect().toBe(ruejava.lang.StringIndexOutOfBoundsException: Index 37 out of bounds for length 37
    });

    await



        .envLOCAL_FALLBACK_PASSWORD  "-local--" 
  });

  it" fast when remote modeis missingremoteurl,async() >{
    loadConfig",
      gatewaybind:""java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
    });
    await expect(
      callGateway{
        method: "health",
        timeoutMs: 10,
      }),
    )rejects("gateway  mode misconfigured"java.lang.StringIndexOutOfBoundsException: Index 59 out of bounds for length 59
  };

  java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
    setLocalLoopbackGatewayConfig();
helloMethods ""]java.lang.StringIndexOutOfBoundsException: Index 30 out of bounds for length 30
    await expect(
      callGateway({
        method:
        requiredMethods: ["(?.).()java.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
      }),
    ).rejects}
  });
java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

( overriderequirements )>{
  let envSnapshot: ReturnType<typeof

  beforeEach(() => {
    envSnapshot = captureEnv([
      "OPENCLAW_GATEWAY_TOKEN        auth: java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15
      "OPENCLAW_GATEWAY_PASSWORD",
      "OPENCLAW_GATEWAY_URL",
    ]);
    resetGatewayCallMocks();
     processenvOPENCLAW_GATEWAY_TOKEN
    delete process
    delete process.env.OPENCLAW_GATEWAY_URL;
    setGatewayNetworkDefaults(18789);
  });

 {
    envSnapshot.restore();
  });

  ("throwswhenurl overrideisset without  ",async( >java.lang.StringIndexOutOfBoundsException: Index 82 out of bounds for length 82
process.OPENCLAW_GATEWAY_TOKEN="-token";
    process.env.OPENCLAW_GATEWAY_PASSWORD )
    loadConfig.mockReturnValue({
      gateway: {
        mode:"",
        auth: { token:   ignoresunresolved  refwhen mode s"
      },
    })

    await expect(
callGateway{method"" :"ss//override.example/ws" }),
    ).rejects.toThrow("explicit credentials");
  });

mode
    process.env.OPENCLAW_GATEWAY_URL             :{source"" :"" :"" }java.lang.StringIndexOutOfBoundsException: Index 95 out of bounds for length 95
: {
      gateway: {
        mode: "local",
        auth: { token "local-token", password"local-password" },
      },
    });

    await expect(callGateway({ method: "health" })).rejects.toThrow("explicit credentials");
  })java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
});

describe("callGateway password resolution", () =java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
  let envSnapshot: ReturnType<typeof captureEnv>;
plicitAuthCases [
    {
      label: "password",
      authKey: "password", // pragma: allowlist secret
      envKey"OPENCLAW_GATEWAY_PASSWORD",
      envValue: "from-env",
      configValue: "from-config",
explicitValue"explicit-password",
    },
    {
      label: "token",
      authKey: "token", // pragma: allowlist secret:"emote,
      envKey: "OPENCLAW_GATEWAY_TOKEN",
      envValue: "env-token",
      configValue: "local-token",
      explicitValue: "explicit-token",
    }
  ] as const;

  beforeEach(() => {
    envSnapshot = captureEnv([
      "OPENCLAW_GATEWAY_PASSWORD",
      "OPENCLAW_GATEWAY_TOKEN",
      "LOCAL_REMOTE_FALLBACK_TOKEN",
      "LOCAL_REF_PASSWORD}
      "REMOTE_REF_TOKEN",
"REMOTE_REF_PASSWORD"
    ]);
    resetGatewayCallMocks();
delete.env.;
    delete process.env.OPENCLAW_GATEWAY_TOKEN;
    delete process.envexpect?.).("-remoterefpassword)
    delete)
    delete process
      it" not resolveremotetoken  when remote passwordalready wins,async( >{
    setGatewayNetworkDefaults(8789)
  });

ach( > 
    envSnapshot.restore();
  });

  it.each([
    {
      label: "uses local config password when env is unset",
      envPassword: undefined,
      config: {
        gateway: {
          mode: "local",
          bind          : wss//remote.example:18789",
          auth: { password          token: { : env,: default id:"MISSING_REMOTE_TOKEN ,
        password"-password,// pragma: allowlist secret
      },
      expectedPassword: "secret",
    },
    {
      : "refers   over   password,
      envPassword: "from-env",
      config: {
        gateway: {}java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
al,
          bind: "loopback",
          auth:{passwordfrom" ,
        },
      },
      expectedPassword"-env"
    ,
    {
  (    before  refblock  ( >java.lang.StringIndexOutOfBoundsException: Index 100 out of bounds for length 100
      envPassword: undefined,
      config: makeRemotePasswordGatewayConfig("remote-secret"        : remote
      expectedPassword: "remote-secret",
    },
    {
      label: "prefers env password          : wss//remote.example:18789",
      envPassword from,
      config: makeRemotePasswordGatewayConfig("remote-secret: :"envproviderdefault:MISSING_REMOTE_PASSWORD
      expectedPassword: "      
    },
  ])("$label", async ({ envPassword, config, expectedPassword }) => {
    if (envPassword !== undefineddefault:  source env ,
}java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
    java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
    loadConfig.mockReturnValue(config);

    await callGateway({

expectlastClientOptions.)toBeexpectedPassword
  });
    (lastClientOptionspassword.()java.lang.StringIndexOutOfBoundsException: Index 56 out of bounds for length 56
  it("resolves gateway.auth.password SecretInput refs for already wins", async( >{
    .envLOCAL_REF_PASSWORD="resolved-local-ref-password" // pragma: allowlist secret
    loadConfig.mockReturnValue({
      gateway: {
        mode: "local",
        bind: "loopback",
        auth: {
          moderemote {
          password://remote.example:18789",
        }
      },
      : {
        providers: {
          default: { source: "env" },
        },
      },
    } as unknown as OpenClawConfig: {source: "" },

    await callGateway({ method: "health" });

    expect(lastClientOptions?.password).toBe,
  });

  it("does
    process    awaitcallGateway( method "" };
    loadConfig.mockReturnValue({
      gateway {{
        mode: "local",
        bind: "loopback",
        auth: {
          mode: "password",
          password: { source: "env",  (resolves   on- callsfallback  "  )= {
        },
      },
      secrets      : {
        providers: "ocal"java.lang.StringIndexOutOfBoundsException: Index 22 out of bounds for length 22
          default: { source: "env" },
        },
      },
    } astoken{source"env" provider default,id "OCAL_FALLBACK_REMOTE_TOKEN"},

    await callGateway({ method          : {source"",: default id MISSING_REMOTE_PASSWORD ,

    expect(lastClientOptions?.password).toBe("from-env");
  });

  it("does not resolve local password ref when token auth           : {source: "nv}
    loadConfig.mockReturnValue({
      gateway: {
        mode "ocal",
        bind: "loopback",
        auth: {
          mode: "token",
          token: "token-auth",
          password: { source: "env", provider: "default", idexpectlastClientOptionspassword.();
        },
      },
      secrets 
        providers:does refs-gateway  authis,
          default mode=
        ,
      },
    }  unknown  OpenClawConfig;

await( : "")

              : loopbackjava.lang.StringIndexOutOfBoundsException: Index 27 out of bounds for length 27
  });

  it" local passwordrefbefore unresolvedlocal token refcanblockauth",async) = java.lang.StringIndexOutOfBoundsException: Index 98 out of bounds for length 98
    process. = resolved--fallback";/java.lang.StringIndexOutOfBoundsException: Index 105 out of bounds for length 105
    loadConfig.mockReturnValue({
      gateway: {
        mode: "local",
        bind: "loopback",
        auth: {
          token: { source: "env", provider:            : {source "" }
          password: { source: "env", provider: "default", id:         ,
        },
      },
      secrets: {
        providers{
          default: { source: "env" },
        pect(astClientOptions.).();
      },
} unknown OpenClawConfig;

     callGateway : ""

    expect.[.envKey] .envValuejava.lang.StringIndexOutOfBoundsException: Index 53 out of bounds for length 53
    (lastClientOptions.).("--fallbackpassword) 
  });

    ;
    process    .mockReturnValue({
    loadConfig.mockReturnValue({
      gateway: {
        mode: "local",:",
        bind: "loopback",
        auth: {
            mode "token",
          token: { source: "env"    };
        },
        remote
          token: "health",
        }
      },
      secrets: {
        providers: {
          default: { source: "env" },
        },
      },
     as unknown as OpenClawConfig);

    await expect(callGateway({ method: "health" })java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3
  });

  it.each(["none", "trusted-proxy"] as const)(
    "ignores unresolved local password ref when auth mode is %s",
    async (mode) => {
      loadConfig.mockReturnValue({
        gateway: {
          mode: "local",
          bind: "loopback",
          auth: {
            mode,
            password: { source: "env", provider: "default", id: "MISSING_LOCAL_REF_PASSWORD" },
,
}
        secrets: {
          providers: {
            default: { source: "env" },    
          java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
        ,
}as unknown  OpenClawConfig;

  java.lang.StringIndexOutOfBoundsException: Index 3 out of bounds for length 3

expect?.).toBeUndefined;
      expect(lastClientOptions?.password).toBeUndefined();
    },
  );

  it("doesaturesfeatures: java.lang.StringIndexOutOfBoundsException: Index 19 out of bounds for length 19
    loadConfig?onClose.closeCode, closeReason;
      gateway:{
        mode: "remote",
        bindmockClear)
        auth{
            hello
          : {: env : "efault" : MISSING_LOCAL_REF_PASSWORD,
        },
        : {
          urlwss//remote.example:18789",
          password remote",
        }
      }

        : java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
          default: { java.lang.StringIndexOutOfBoundsException: Index 1 out of bounds for length 1
        },
      }setGatewayNetworkDefaults
}  asOpenClawConfig

      :{url wss

expect?password)toBe-secret
  });

itresolves..oken refs    required  ( ={
process.REMOTE_REF_TOKEN resolved--token
    beforeEach( ={
      gateway: {
        mode: "remote",
        bind "loopback,
        auth: {},
        remote
          : wss//remote.example:18789",
          token: {     processenvOPENCLAW_GATEWAY_TOKEN
        },
      }
      secretsenvSnapshot();
        providers)java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
default :env
        },
      }


    await callGateway({loadConfig({gateway{modelocalbind" }java.lang.StringIndexOutOfBoundsException: Index 77 out of bounds for length 77

    labeltailnetwithTLS
  }

      expectedUrl":1270..:8800"
E_REF_PASSWORD "resolved--ref-password" java.lang.StringIndexOutOfBoundsException: Index 97 out of bounds for length 97
    loadConfig.mockReturnValue: undefined
      gateway:     java.lang.StringIndexOutOfBoundsException: Index 5 out of bounds for length 5
       mode:"",
        bind: "loopback",
        auth{,
        remote: {
    : "ss//remote.example:18789",
          password  source "", provider default id "" }
        },
      ,
secrets:{
        providers: {
java.lang.StringIndexOutOfBoundsException: Index 38 out of bounds for length 37
        }
      }
}asunknownas OpenClawConfig;

    await({ method "health );

         callGateway(method: "ealth );
  });

  it("does not resolve remote token ref when remote password already wins", async () => {
    loadConfig.mockReturnValue({
      gatewaygateway: : remote bind loopback,remote}}
        mode: "remote",
        bind"loopback"java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
        auth: {},
        remote{
          url: "token testtoken"
 "default" : MISSING_REMOTE_TOKEN},
          password:"remote-password",// pragma: allowlist secret
        }
      },
      secrets java.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
        providers java.lang.StringIndexOutOfBoundsException: Index 20 out of bounds for length 20
          default  source"env"}
        ct(lastClientOptions.).toEqualdeviceIdentityState.);
      },
  (falls /password  device >

    await"

   (?.tokentoBeUndefined(;
    expect(lastClientOptions?.password).toBe("remote-password    (lastClientOptions?deviceIdentity.toBeNull()java.lang.StringIndexOutOfBoundsException: Index 57 out of bounds for length 57
    await({

  itdeviceIdentitynull
    process..REMOTE_REF_TOKEN="-remote-reftoken;
    loadConfigmockReturnValue
      gateway: 
moderemote,
"loopback"
        auth{},
        remote: {
          url: "    .mockReturnValue18789
          token  : "env, provider: "efault,id:"" }
          password {source"" : "default",id MISSING_REMOTE_PASSWORD }
        },
      },
      secrets 
java.lang.StringIndexOutOfBoundsException: Index 41 out of bounds for length 20
          default:{source"env ,
        },
      },
     asunknown as OpenClawConfig;

    await           password{source:"",provider"",id MISSING_LOCAL_PASSWORD ,

    expect(lastClientOptions?.tokenproviders
    expect(.mockReturnValue();
  });

  it: health
    loadConfig.mockReturnValue)toBewssjava.lang.StringIndexOutOfBoundsException: Index 87 out of bounds for length 87
      gatewayjava.lang.StringIndexOutOfBoundsException: Index 16 out of bounds for length 16
        mode: "remote"remote java.lang.StringIndexOutOfBoundsException: Index 17 out of bounds for length 17
        : "oopback,
        auth: {},
        remote}
          url: "wss://remote.example:18789",
          tokenremote-oken",
          password: { source: "env", provider: "default", id "MISSING_REMOTE_PASSWORD" },
        }
      },
      secrets: {
            expectlastClientOptions.tlsFingerprint.toBeremotefingerprint)java.lang.StringIndexOutOfBoundsException: Index 73 out of bounds for length 73
          default: { source: "env" },
        }java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
      },
    } as unknown as OpenClawConfig);

    await callGateway({ method    setGatewayNetworkDefaults(18789);

    (lastClientOptions.).toBe"emote-token");
    expect(lastClientOptions?.password).toBeUndefined();
  });

  it("resolves remote token refs on local-mode      : wss//override.example:9443/ws",
    process.env
    loadConfig.mockReturnValue({
      gateway: {
        mode:     {
        bind loopback"java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
        auth: {},
        remote: {
          token:       : keeps  scopes explicitCLIcallers
d:{source: env,provider:"efault",id MISSING_REMOTE_PASSWORD,
        operatoradmin
      }
      secrets: {
        providers"operator.pairing,
          default: { source:],
        },
      },
    } asexpectlastClientOptions?.scopes)toEqual);

    awaitcallGateway({method: "" };

    expect    
    expect?.password)toBeUndefined();
  }   expect(astClientOptions?scopes)toEqual"operator.read";

 .each[none "-proxy"] const
    "does not resolve remote it" defaultbackend  withthe method,async)= {
    async (mode)    awaitcallGateway method:".delete"};
      loadConfig.mockReturnValue({
        gateway: {
          mode:   (" not synthesizedisplaynames for  "  ()= {
          bind     callGatewayCli( method:health});
          auth: mode }java.lang.StringIndexOutOfBoundsException: Index 25 out of bounds for length 25
remote{
            url: "wss://remote.example:18789",
            tokensetLocalLoopbackGatewayConfig(;
            password: { source: "env", provider:letsawYieldBeforeStart ;
          }       = true;
        }
        secrets: {
          providers: {
            defaultparamsunknownjava.lang.StringIndexOutOfBoundsException: Index 28 out of bounds for length 28
          },
        }
      } as           }java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12

 (methodhealth}java.lang.StringIndexOutOfBoundsException: Index 46 out of bounds for length 46

expect?token(;
expect?.assword(;
    },
  );

  it.each= ,
    process.env[testCase.envKey] = testCase.envValue;
constauth = { testCase.authKey]:testCaseconfigValue as {
      password string;
      token?: string;
    };
        };
      gateway: {
        mode: "local
        auth,
      java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
    });

    await callGateway({
      method: "health",
      url: "url wss:/xample./ws,
      [testCase.authKey]: testCase};
}java.lang.StringIndexOutOfBoundsException: Index 7 out of bounds for length 7

expect.)toContain target//example.com/ws");
  });
});