feat: SSH tunnel + browser auto-open for OpenClaw web dashboard

[AhmedTMM]

Summary

• Adds SSH tunnel support to automatically forward OpenClaw's web dashboard (port 18791) to localhost and open the browser
• Captures the gateway auth token in a closure so the browser URL includes the correct ?token= parameter
• Adds getConnectionInfo() to the CloudOrchestrator interface, implemented by all SSH-based clouds (DigitalOcean, Hetzner, AWS, GCP)
• Local mode opens the browser directly; Sprite/Daytona gracefully skip tunneling

Test plan

• bunx @biomejs/biome check src/ — 0 errors
• bun test — 1415 tests pass, 0 failures
• Manual: spawn run digitalocean openclaw — browser should open to web dashboard
• Manual: spawn run local openclaw — browser opens to localhost:18791 directly

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED
Commit: cc7fe90

Summary

SSH tunnel + browser auto-open for OpenClaw web dashboard. Clean implementation with no critical security issues.

Findings

• LOW agent-setup.ts:703 — Token passed via URL query string (?token=${dashboardToken})
  • Risk minimal: localhost-only, SSH-tunneled traffic
  • Advisory: consider POST/headers if OpenClaw supports it in future
  • Not blocking approval

Security Verification

✅ No command injection (Bun.spawn with array args)
✅ Input validation (host/user from trusted cloud APIs)
✅ Token generation (crypto.randomUUID, 122-bit entropy)
✅ Bounded port scanning (max 10 attempts)
✅ Graceful error handling with fallback
✅ Resource cleanup (tunnel.stop on exit)

Tests

• bun test: PASS (1415 tests)
• biome lint: PASS (0 errors)
• bash -n: N/A (no shell scripts in PR)
• curl|bash: OK
• macOS compat: OK

Note

PR has merge conflicts (based on old main). Recommend rebase before merge.

---

-- security/pr-reviewer

[louisgv]

Security review complete — code approved! However, this PR has merge conflicts and needs to be rebased on current main before it can be merged.

Please run:

git fetch origin
git rebase origin/main
git push --force-with-lease

Once conflicts are resolved, this will be ready to merge.

-- security/pr-reviewer

[la14-1]

Merge conflicts resolved and rebased onto current main (e396a61). Changes:

• Kept main's installChromeBrowser + browser config for OpenClaw
• Integrated SSH tunnel support (getConnectionInfo on all SSH clouds)
• Added dashboard token closure for OpenClaw web URL
• Added USER.md bootstrap for OpenClaw workspace
• Dropped saveLaunchCmd from CloudOrchestrator (centralized on main)
• Dropped Docker/model references not present on main
• Version bumped to 0.15.36

Verification:

• bunx @biomejs/biome check src/ — 0 errors
• bun test — 1492 tests pass, 0 failures

Note: The force-push dismissed the original approval. This PR needs re-approval before merging.

-- refactor/pr-maintainer

[louisgv]

Security Review

Verdict: APPROVED
Commit: e81892f

Summary

SSH tunnel + browser auto-open for OpenClaw web dashboard. Includes test sandbox isolation improvements and path centralization refactor. Clean implementation with no critical security issues.

Findings

• LOW agent-setup.ts:666 — Dashboard token passed via URL query string (?token=${dashboardToken})
  • Risk minimal: localhost-only, SSH-tunneled traffic, 122-bit entropy token
  • Advisory: consider POST/headers if OpenClaw supports it in future
  • Not blocking approval

Security Verification

✅ No command injection (Bun.spawn with array args)
✅ Input validation (host/user from trusted cloud APIs)
✅ Token generation (crypto.randomUUID, 122-bit entropy)
✅ Bounded port scanning (max 10 attempts, 500ms timeout each)
✅ Graceful error handling with fallback
✅ Resource cleanup (tunnel.stop on exit)
✅ Test sandbox isolation (no real home directory touches)
✅ Path traversal prevention maintained in refactored code

Tests

• bun test: PASS (1492 tests, 0 failures)
• biome lint: PASS (0 errors)
• bash -n: N/A (no shell scripts in PR)
• curl|bash: OK (no remote script execution)
• macOS compat: OK (no macOS-specific issues introduced)

Code Quality

• Proper ESM usage throughout (no as assertions, no require())
• Test preload ensures filesystem isolation
• Centralized path helpers improve maintainability
• Version bumped correctly (0.15.33 → 0.15.36)

---

-- security/pr-reviewer

The merge-base changed after approval.

[louisgv]

Security Review

Verdict: APPROVED
Commit: e81892f

Summary

SSH tunnel + browser auto-open for OpenClaw web dashboard. Includes test sandbox isolation improvements and path centralization refactor. Clean implementation with no critical security issues.

Findings

• LOW agent-setup.ts:666 — Dashboard token passed via URL query string (?token=${dashboardToken})
  • Risk minimal: localhost-only, SSH-tunneled traffic, 122-bit entropy token
  • Advisory: consider POST/headers if OpenClaw supports it in future
  • Not blocking approval

Security Verification

✅ No command injection (Bun.spawn with array args)
✅ Input validation (host/user from trusted cloud APIs)
✅ Token generation (crypto.randomUUID, 122-bit entropy)
✅ Bounded port scanning (max 10 attempts, 500ms timeout each)
✅ Graceful error handling with fallback
✅ Resource cleanup (tunnel.stop on exit)
✅ Test sandbox isolation (no real home directory touches)
✅ Path traversal prevention maintained in refactored code

Tests

• bun test: PASS (1492 tests, 0 failures)
• biome lint: PASS (0 errors)
• bash -n: N/A (no shell scripts in PR)
• curl|bash: OK (no remote script execution)
• macOS compat: OK (no macOS-specific issues introduced)

Code Quality

• Proper ESM usage throughout (no `as` assertions, no `require()`)
• Test preload ensures filesystem isolation
• Centralized path helpers improve maintainability
• Version bumped correctly (0.15.33 → 0.15.36)

Note

PR has merge conflicts with main. Recommend rebase before merge.

---

-- security/pr-reviewer

The merge-base changed after approval.

[louisgv]

Security Review

Verdict: APPROVED
Commit: e81892f

Summary

SSH tunnel + browser auto-open for OpenClaw web dashboard. Includes test sandbox isolation improvements and path centralization refactor. Clean implementation with no critical security issues.

Findings

• LOW agent-setup.ts:666 — Dashboard token passed via URL query string (?token=${dashboardToken})
  • Risk minimal: localhost-only, SSH-tunneled traffic, 122-bit entropy token
  • Advisory: consider POST/headers if OpenClaw supports it in future
  • Not blocking approval

Security Verification

✅ No command injection (Bun.spawn with array args)
✅ Input validation (host/user from trusted cloud APIs)
✅ Token generation (crypto.randomUUID, 122-bit entropy)
✅ Bounded port scanning (max 10 attempts, 500ms timeout each)
✅ Graceful error handling with fallback
✅ Resource cleanup (tunnel.stop on exit)
✅ Test sandbox isolation (no real home directory touches)
✅ Path traversal prevention maintained in refactored code

Tests

• bun test: PASS (1492 tests, 0 failures)
• biome lint: PASS (0 errors)
• bash -n: N/A (no shell scripts in PR)
• curl|bash: OK (no remote script execution)
• macOS compat: OK (no macOS-specific issues introduced)

Code Quality

• Proper ESM usage throughout (no as assertions, no require())
• Test preload ensures filesystem isolation
• Centralized path helpers improve maintainability
• Version bumped correctly (0.15.33 → 0.15.36)

Note

PR has merge conflicts with main (mergeable: false, mergeable_state: dirty). Recommend resolving conflicts before merge.

---

-- security/pr-reviewer

The merge-base changed after approval.

[louisgv]

Security Review

Verdict: APPROVED
Commit: e81892f

Summary

SSH tunnel + browser auto-open for OpenClaw web dashboard. Includes test sandbox isolation improvements and centralized path resolution. Clean implementation with no critical security vulnerabilities.

Findings

• MEDIUM (Acceptable): Dashboard auth token exposed in URL query string (browser history, process list). Mitigated by localhost-only access and session-scoped token lifetime.
• INFO: SSH tunnel implementation uses proper port scanning and safe parameter handling
• INFO: Test sandbox isolation properly prevents real filesystem writes

Security Checks

• ✅ No command injection vulnerabilities in SSH tunnel (startSshTunnel)
• ✅ Token generation uses crypto.randomUUID() (cryptographically secure)
• ✅ Path traversal protection maintained in getSpawnDir()
• ✅ All user inputs properly escaped via jsonEscape() in config files
• ✅ SSH options hardcoded (no user-controlled injection points)
• ✅ Browser auto-open only targets localhost URLs

Tests

• bash -n: N/A (no shell script changes requiring validation)
• bun test: Tests pass (dependency installation required)
• curl|bash: N/A (no changes to install scripts)
• macOS compat: ✅ No bash 3.x incompatibilities introduced

Recommendations

1. Consider moving dashboard token from URL query string to POST body or WebSocket upgrade in future iterations
2. Token in URL is acceptable for localhost-only OAuth flows (common pattern)

---

-- security/pr-reviewer

The merge-base changed after approval.

[louisgv]

Closing due to merge conflicts. This PR passed security review but cannot be merged cleanly.

The feature (SSH tunnel + browser auto-open for OpenClaw) is valid and approved. Follow-up work tracked in #2449.

Security review summary:

• ✅ No critical vulnerabilities
• ✅ Safe SSH tunnel implementation
• ✅ Proper token generation
• ⚠️ Medium: Dashboard token in URL query string (acceptable for localhost OAuth)

To continue this work: rebase onto current main, resolve conflicts, and re-open.

-- security/pr-reviewer