v2 egress: default-allow mitmproxy gateway + account-level managed deploy keys + auth-token/provider reconcile

[kingsleydon]

Summary

CLI-side of the v2 hosted Invisible Gateway launch batch, plus the clean auth-token lifecycle and provider-projection reconcile. Pairs with the clawdi-hosted PR (invisible gateway image + single-key mint + launch alerting) — merge coordinated.

What's in it

• Invisible Gateway (transparent MITM) — invisible-gateway.ts (nftables meta skuid REDIRECT, default-DROP fail-closed, atomic nft -f, ct-mark matched redirect), transparent sidecar (mitm-sidecar/main.go: SO_ORIGINAL_DST, upstream TLS verified, secret by-ref, no key logging). Removes proxy-env from the hosted path (local clawdi run keeps its per-run forward proxy). Managed key is sidecar-only (agent env gets a placeholder; real key never in agent env).
• Clean auth-token lifecycle — single canonical <runRoot>/secrets/auth-token, env-first-then-file; watch unit bound to the manifest URL from controlPlane.manifestUrl. source.auth retained (tolerated) for CLI self-upgrade version-skew.
• Provider projection reconcile — switching provider now removes the stale (managed/BYOK) projected entry from OpenClaw/Hermes config; user-authored entries preserved.
• nft table name / UID centralized (no hardcoded 10001); net.isIP for address validation.

Validation

• bun run check (biome ci, 598 files): clean
• bun run typecheck (turbo, all packages): 4/4 pass
• bun test runtime + invisible-gateway + mitm-env + mitm-profiles + ai-provider + run: 201 pass / 0 fail
• Adversarial security review: found + fixed 1 critical (transparent-port bypass), 2 high (boot fail-open ordering, flush ruleset scope), 1 test-bug; re-validated on dev CVM (direct_leaks=0 across bypass / sidecar-restart / CLI-self-upgrade)
• Cleanliness review: 6 real items fixed (dead proxy path scoped, stale config, nft dedup, scrub list, exception convention, IP parsing)
• Gateway dev-CVM e2e (pre-integration): both runtimes, managed AI intercepted + billed, fail-closed, Hermes self-managed uv/python under /home/clawdi

In-flight (not blocking review)

Full integrated-code prod-shape e2e on dev CVM is running (BYOK rebind resolution + both-runtime function matrix + Telegram pairing). Recommend merge after that e2e is green.

Owner-decided: ONE deploy key per compute (single-key), aligns with the single canonical CLAWDI_AUTH_TOKEN.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clawdi	Skipped		Jul 9, 2026 6:40am

[kingsleydon]

Paired hosted PR: Clawdi-AI/clawdi-hosted#722 (invisible gateway image + single-key mint + launch alerting). Merge coordinated — deploy image + CLI together, after the integrated-code dev-CVM e2e is green.

[kingsleydon]

Self code-review (final integrated form) — no blocking findings

Reviewed the merged diff (not just sub-branches), risk-weighted on the security core:

invisible-gateway.ts — fail-closed verified: output_filter policy accept but a terminal meta skuid <agent> counter drop catches every non-allowed agent packet (transparentPort-direct, QUIC/UDP≠53, ICMP, arbitrary ports → dropped). Redirect matched by conntrack mark (ct mark) + oifname lo, so the old transparent-port bypass is closed. Same-table delete table + add table in one nft -f = atomic replace, no gap on re-converge. Full input validation (uid/port/nft-identifier/net.isIP).

egress boot (clawdi-runtime-egress-common) — early-drop guard and the full gateway use the SAME table name → the CLI's full apply atomically upgrades the boot drop-all-agent table into the full ruleset. No coexistence (no double-drop of redirected traffic), no window: fail-closed from t=0 through converge. UID derived from id -u, single source /etc/clawdi/invisible-gateway.env.

Prior review coverage (holds in final form): managed key sidecar-only (root:600, out of agent env — placeholder only), sidecar verifies upstream TLS + never logs the key, proxy-env removed from the hosted path (local clawdi run keeps its own), single deploy key per compute, no-data-no-patch-audit asserts agent can't read the MITM secret.

Verification: biome ci (598 files) clean; turbo typecheck 4/4; 201 CLI tests; adversarial security review (1 critical + 2 high fixed, direct_leaks=0 on dev CVM); cleanliness review (6 items fixed).

Residual (non-blocking): DNS→resolver is an accepted+documented exfil path (fast-follow allowlist for untrusted signup).

Verdict: approve — merge after the in-flight integrated-code dev-CVM e2e is green (BYOK rebind + both-runtime matrix + Telegram pairing), coordinated with clawdi-hosted#722.

[kingsleydon]

Reworked: fail-closed invisible gateway → default-allow mitmproxy (validated end-to-end)

The egress interception was over-engineered (nftables fail-closed default-DROP + hand-rolled Go MITM sidecar). Owner redesigned it to default-allow + profile-driven transparent MITM via runtime-fetched mitmproxy, plus a corrected deploy-key model.

What changed here (clawdi = CLI + cloud-api):

• Deleted the Go MITM sidecar + fail-closed nftables. New: generic Python mitmproxy addon (default-allow; provider host-match Authorization overwrite; http channel placeholder→rewrite+inject; passthrough unmatched), minimal nft redirect (no drop), runtime-fetched pinned+SHA256-verified mitmdump from downloads.mitmproxy.org (NOT baked in image), single-source config.
• cloud-api: managed platform API keys — the deploy/cloud-sync key is now account-level (environment_id=None) + managed=true: hidden from user GET /keys, user DELETE → 403, admin-only revoke. Manifest/managed-AI resolves by account (user_id) + manifest environment_id query, not key env-binding.
• Retained: clean auth-token lifecycle, provider projection reconcile.

Validated (full live e2e, correct harness — local cloud-api + cloudflared tunnel, dev CVM runs only the agent pod, managed AI → faraday TEST): managed AI OpenClaw+Hermes (Faraday usage 301/303), channels {OpenClaw,Hermes}×{Telegram,Discord} + Telegram+Discord concurrent, Discord WSS passthrough, default-allow (real upstream cert), BYOK passthrough, security (secrets absent from agent env; sidecar secret+CA unreadable by clawdi; logs redacted), degraded (kill mitmdump → default-allow, no billing bypass), restart resume, CLI self-upgrade reconcile, account-level managed key (managed=true env_id=NULL; user can't list/revoke; admin can), perf ~50MB/s. All PASS.
Full test suites: CLI 596 + cloud-api 120 + hosted 91 + addon 9, biome/typecheck/ruff green.

🤖 Generated with Claude Code