fix: add ellipsis for config section titles (#1784) (thanks @robbyczgw-cla)

Fixes #1728

Config section header titles were being truncated without visual
indication. Added standard CSS truncation to BOTH title classes:
- .config-section-hero__title (main section headers)
- .config-section-card__title (card headers)

Properties added:
- white-space: nowrap
- overflow: hidden
- text-overflow: ellipsis

CHANGELOG.md

@@ -28,8 +28,8 @@ Docs: https://docs.clawd.bot
 - Diagnostics: add diagnostic flags for targeted debug logs (config + env override). https://docs.clawd.bot/diagnostics/flags
 
 ### Fixes
-- Gateway: allow Control UI token-only auth to skip device pairing even when device identity is present (`gateway.controlUi.allowInsecureAuth`). (#1679) Thanks @steipete.
 - Gateway: include inline config env vars in service install environments. (#1735) Thanks @Seredeep.
+- UI: add ellipsis to config section titles in the Control UI. (#1784) Thanks @robbyczgw-cla.
 - BlueBubbles: route phone-number targets to DMs, avoid leaking routing IDs, and auto-create missing DMs (Private API required). (#1751) Thanks @tyler6204. https://docs.clawd.bot/channels/bluebubbles
 - BlueBubbles: keep part-index GUIDs in reply tags when short IDs are missing.
 - Web UI: hide internal `message_id` hints in chat bubbles.
@@ -46,7 +46,6 @@ Docs: https://docs.clawd.bot
 - Agents: auto-compact on context overflow prompt errors before failing. (#1627) Thanks @rodrigouroz.
 - Agents: use the active auth profile for auto-compaction recovery.
 - Models: default missing custom provider fields so minimal configs are accepted.
-- Models/Heartbeat: normalize provider-less default model fallback and skip empty checklist items. (#1762) Thanks @senoldogann.
 - Media understanding: skip image understanding when the primary model already supports vision. (#1747) Thanks @tyler6204.
 - Gateway: skip Tailscale DNS probing when tailscale.mode is off. (#1671)
 - Gateway: reduce log noise for late invokes + remote node probes; debounce skills refresh. (#1607) Thanks @petter-b.

CONTRIBUTING.md

@@ -40,13 +40,3 @@ Please include in your PR:
 - [ ] Confirm you understand what the code does
 
 AI PRs are first-class citizens here. We just want transparency so reviewers know what to look for.
-
-## Current Focus & Roadmap 🗺
-
-We are currently prioritizing:
-- **Stability**: Fixing edge cases in channel connections (WhatsApp/Telegram).
-- **UX**: Improving the onboarding wizard and error messages.
-- **Skills**: ClawdHub-first (no new core/bundled skills).
-- **Performance**: Optimizing token usage and compaction logic.
-
-Check the [GitHub Issues](https://github.com/clawdbot/clawdbot/issues) for "good first issue" labels!

docs/gateway/configuration.md

@@ -2847,9 +2847,8 @@ Control UI base path:
 - `gateway.controlUi.basePath` sets the URL prefix where the Control UI is served.
 - Examples: `"/ui"`, `"/clawdbot"`, `"/apps/clawdbot"`.
 - Default: root (`/`) (unchanged).
-- `gateway.controlUi.allowInsecureAuth` allows token-only auth for the Control UI and skips
-  device identity + pairing (even on HTTPS). Default: `false`. Prefer HTTPS
-  (Tailscale Serve) or `127.0.0.1`.
+- `gateway.controlUi.allowInsecureAuth` allows token-only auth over **HTTP** (no device identity).
+  Default: `false`. Prefer HTTPS (Tailscale Serve) or `127.0.0.1`.
 
 Related docs:
 - [Control UI](/web/control-ui)

docs/gateway/security.md

@@ -58,7 +58,7 @@ When the audit prints findings, treat this as a priority order:
 
 The Control UI needs a **secure context** (HTTPS or localhost) to generate device
 identity. If you enable `gateway.controlUi.allowInsecureAuth`, the UI falls back
-to **token-only auth** and skips device pairing (even on HTTPS). This is a security
+to **token-only auth** on plain HTTP and skips device pairing. This is a security
 downgrade—prefer HTTPS (Tailscale Serve) or open the UI on `127.0.0.1`.
 
 `clawdbot security audit` warns when this setting is enabled.

docs/tools/creating-skills.md

@@ -1,41 +0,0 @@
-# Creating Custom Skills 🛠
-
-Clawdbot is designed to be easily extensible. "Skills" are the primary way to add new capabilities to your assistant.
-
-## What is a Skill?
-A skill is a directory containing a `SKILL.md` file (which provides instructions and tool definitions to the LLM) and optionally some scripts or resources.
-
-## Step-by-Step: Your First Skill
-
-### 1. Create the Directory
-Skills live in your workspace at `<workspace>/skills` (default: `~/clawd/skills`). Create a new folder for your skill:
-```bash
-mkdir -p ~/clawd/skills/hello-world
-```
-
-### 2. Define the `SKILL.md`
-Create a `SKILL.md` file in that directory. This file uses YAML frontmatter for metadata and Markdown for instructions.
-
-```markdown
----
-name: hello_world
-description: A simple skill that says hello.
----
-
-# Hello World Skill
-When the user asks for a greeting, use the `exec` tool to run `echo "Hello from your custom skill!"`.
-```
-
-### 3. Add Tools (Optional)
-You can define custom tools in the frontmatter or instruct the agent to use existing system tools (like `exec` or `web`).
-
-### 4. Refresh Clawdbot
-If the skills watcher is enabled (default), changes are picked up automatically. Otherwise restart the gateway or start a new session to refresh the skills snapshot.
-
-## Best Practices
-- **Be Concise**: Instruct the model on *what* to do, not how to be an AI.
-- **Safety First**: If your skill uses `exec`, ensure the prompts don't allow arbitrary command injection from untrusted user input.
-- **Test Locally**: Use `clawdbot agent --message "use my new skill"` to test.
-
-## Shared Skills
-You can also browse and contribute skills to [ClawdHub](https://clawdhub.com).

docs/web/control-ui.md

@@ -108,8 +108,8 @@ Clawdbot **blocks** Control UI connections without device identity.
 }
 ```
 
-This disables device identity + pairing for the Control UI (even on HTTPS). Use
-only if you trust the network.
+This disables device identity + pairing for the Control UI. Use only if you
+trust the network.
 
 See [Tailscale](/gateway/tailscale) for HTTPS setup guidance.
 

src/agents/model-selection.test.ts

@@ -1,139 +1,252 @@
-import { describe, it, expect, vi } from "vitest";
-import {
-  parseModelRef,
-  resolveModelRefFromString,
-  resolveConfiguredModelRef,
-  buildModelAliasIndex,
-  normalizeProviderId,
-  modelKey,
-} from "./model-selection.js";
+import { describe, expect, it } from "vitest";
+
 import type { ClawdbotConfig } from "../config/config.js";
+import { DEFAULT_PROVIDER } from "./defaults.js";
+import {
+  buildAllowedModelSet,
+  modelKey,
+  parseModelRef,
+  resolveAllowedModelRef,
+  resolveHooksGmailModel,
+} from "./model-selection.js";
 
-describe("model-selection", () => {
-  describe("normalizeProviderId", () => {
-    it("should normalize provider names", () => {
-      expect(normalizeProviderId("Anthropic")).toBe("anthropic");
-      expect(normalizeProviderId("Z.ai")).toBe("zai");
-      expect(normalizeProviderId("z-ai")).toBe("zai");
-      expect(normalizeProviderId("OpenCode-Zen")).toBe("opencode");
-      expect(normalizeProviderId("qwen")).toBe("qwen-portal");
-    });
-  });
+const catalog = [
+  {
+    provider: "openai",
+    id: "gpt-4",
+    name: "GPT-4",
+  },
+];
 
-  describe("parseModelRef", () => {
-    it("should parse full model refs", () => {
-      expect(parseModelRef("anthropic/claude-3-5-sonnet", "openai")).toEqual({
-        provider: "anthropic",
-        model: "claude-3-5-sonnet",
-      });
-    });
-
-    it("should use default provider if none specified", () => {
-      expect(parseModelRef("claude-3-5-sonnet", "anthropic")).toEqual({
-        provider: "anthropic",
-        model: "claude-3-5-sonnet",
-      });
-    });
-
-    it("should return null for empty strings", () => {
-      expect(parseModelRef("", "anthropic")).toBeNull();
-      expect(parseModelRef("  ", "anthropic")).toBeNull();
-    });
-
-    it("should handle invalid slash usage", () => {
-      expect(parseModelRef("/", "anthropic")).toBeNull();
-      expect(parseModelRef("anthropic/", "anthropic")).toBeNull();
-      expect(parseModelRef("/model", "anthropic")).toBeNull();
-    });
-  });
-
-  describe("buildModelAliasIndex", () => {
-    it("should build alias index from config", () => {
-      const cfg: Partial<ClawdbotConfig> = {
-        agents: {
-          defaults: {
-            models: {
-              "anthropic/claude-3-5-sonnet": { alias: "fast" },
-              "openai/gpt-4o": { alias: "smart" },
-            },
+describe("buildAllowedModelSet", () => {
+  it("always allows the configured default model", () => {
+    const cfg = {
+      agents: {
+        defaults: {
+          models: {
+            "openai/gpt-4": { alias: "gpt4" },
           },
         },
-      };
+      },
+    } as ClawdbotConfig;
 
-      const index = buildModelAliasIndex({
-        cfg: cfg as ClawdbotConfig,
-        defaultProvider: "anthropic",
-      });
-
-      expect(index.byAlias.get("fast")?.ref).toEqual({
-        provider: "anthropic",
-        model: "claude-3-5-sonnet",
-      });
-      expect(index.byAlias.get("smart")?.ref).toEqual({ provider: "openai", model: "gpt-4o" });
-      expect(index.byKey.get(modelKey("anthropic", "claude-3-5-sonnet"))).toEqual(["fast"]);
+    const allowed = buildAllowedModelSet({
+      cfg,
+      catalog,
+      defaultProvider: "claude-cli",
+      defaultModel: "opus-4.5",
     });
+
+    expect(allowed.allowAny).toBe(false);
+    expect(allowed.allowedKeys.has(modelKey("openai", "gpt-4"))).toBe(true);
+    expect(allowed.allowedKeys.has(modelKey("claude-cli", "opus-4.5"))).toBe(true);
   });
 
-  describe("resolveModelRefFromString", () => {
-    it("should resolve from string with alias", () => {
-      const index = {
-        byAlias: new Map([
-          ["fast", { alias: "fast", ref: { provider: "anthropic", model: "sonnet" } }],
-        ]),
-        byKey: new Map(),
-      };
+  it("includes the default model when no allowlist is set", () => {
+    const cfg = {
+      agents: { defaults: {} },
+    } as ClawdbotConfig;
 
-      const resolved = resolveModelRefFromString({
-        raw: "fast",
-        defaultProvider: "openai",
-        aliasIndex: index,
-      });
-
-      expect(resolved?.ref).toEqual({ provider: "anthropic", model: "sonnet" });
-      expect(resolved?.alias).toBe("fast");
+    const allowed = buildAllowedModelSet({
+      cfg,
+      catalog,
+      defaultProvider: "claude-cli",
+      defaultModel: "opus-4.5",
     });
 
-    it("should resolve direct ref if no alias match", () => {
-      const resolved = resolveModelRefFromString({
-        raw: "openai/gpt-4",
-        defaultProvider: "anthropic",
-      });
-      expect(resolved?.ref).toEqual({ provider: "openai", model: "gpt-4" });
-    });
+    expect(allowed.allowAny).toBe(true);
+    expect(allowed.allowedKeys.has(modelKey("openai", "gpt-4"))).toBe(true);
+    expect(allowed.allowedKeys.has(modelKey("claude-cli", "opus-4.5"))).toBe(true);
   });
 
-  describe("resolveConfiguredModelRef", () => {
-    it("should fall back to anthropic and warn if provider is missing for non-alias", () => {
-      const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-      const cfg: Partial<ClawdbotConfig> = {
-        agents: {
-          defaults: {
-            model: "claude-3-5-sonnet",
+  it("allows explicit custom providers from models.providers", () => {
+    const cfg = {
+      agents: {
+        defaults: {
+          models: {
+            "moonshot/kimi-k2-0905-preview": { alias: "kimi" },
           },
         },
-      };
+      },
+      models: {
+        mode: "merge",
+        providers: {
+          moonshot: {
+            baseUrl: "https://api.moonshot.ai/v1",
+            apiKey: "x",
+            api: "openai-completions",
+            models: [{ id: "kimi-k2-0905-preview", name: "Kimi" }],
+          },
+        },
+      },
+    } as ClawdbotConfig;
 
-      const result = resolveConfiguredModelRef({
-        cfg: cfg as ClawdbotConfig,
-        defaultProvider: "google",
-        defaultModel: "gemini-pro",
-      });
-
-      expect(result).toEqual({ provider: "anthropic", model: "claude-3-5-sonnet" });
-      expect(warnSpy).toHaveBeenCalledWith(
-        expect.stringContaining('Falling back to "anthropic/claude-3-5-sonnet"'),
-      );
-      warnSpy.mockRestore();
+    const allowed = buildAllowedModelSet({
+      cfg,
+      catalog: [],
+      defaultProvider: "anthropic",
+      defaultModel: "claude-opus-4-5",
     });
 
-    it("should use default provider/model if config is empty", () => {
-      const cfg: Partial<ClawdbotConfig> = {};
-      const result = resolveConfiguredModelRef({
-        cfg: cfg as ClawdbotConfig,
-        defaultProvider: "openai",
-        defaultModel: "gpt-4",
+    expect(allowed.allowAny).toBe(false);
+    expect(allowed.allowedKeys.has(modelKey("moonshot", "kimi-k2-0905-preview"))).toBe(true);
+  });
+});
+
+describe("parseModelRef", () => {
+  it("normalizes anthropic/opus-4.5 to claude-opus-4-5", () => {
+    const ref = parseModelRef("anthropic/opus-4.5", "anthropic");
+    expect(ref).toEqual({
+      provider: "anthropic",
+      model: "claude-opus-4-5",
+    });
+  });
+
+  it("normalizes google gemini 3 models to preview ids", () => {
+    expect(parseModelRef("google/gemini-3-pro", "anthropic")).toEqual({
+      provider: "google",
+      model: "gemini-3-pro-preview",
+    });
+    expect(parseModelRef("google/gemini-3-flash", "anthropic")).toEqual({
+      provider: "google",
+      model: "gemini-3-flash-preview",
+    });
+  });
+
+  it("normalizes default-provider google models", () => {
+    expect(parseModelRef("gemini-3-pro", "google")).toEqual({
+      provider: "google",
+      model: "gemini-3-pro-preview",
+    });
+  });
+});
+
+describe("resolveHooksGmailModel", () => {
+  it("returns null when hooks.gmail.model is not set", () => {
+    const cfg = {} satisfies ClawdbotConfig;
+    const result = resolveHooksGmailModel({
+      cfg,
+      defaultProvider: DEFAULT_PROVIDER,
+    });
+    expect(result).toBeNull();
+  });
+
+  it("returns null when hooks.gmail.model is empty", () => {
+    const cfg = {
+      hooks: { gmail: { model: "" } },
+    } satisfies ClawdbotConfig;
+    const result = resolveHooksGmailModel({
+      cfg,
+      defaultProvider: DEFAULT_PROVIDER,
+    });
+    expect(result).toBeNull();
+  });
+
+  it("parses provider/model from hooks.gmail.model", () => {
+    const cfg = {
+      hooks: { gmail: { model: "openrouter/meta-llama/llama-3.3-70b:free" } },
+    } satisfies ClawdbotConfig;
+    const result = resolveHooksGmailModel({
+      cfg,
+      defaultProvider: DEFAULT_PROVIDER,
+    });
+    expect(result).toEqual({
+      provider: "openrouter",
+      model: "meta-llama/llama-3.3-70b:free",
+    });
+  });
+
+  it("resolves alias from agent.models", () => {
+    const cfg = {
+      agents: {
+        defaults: {
+          models: {
+            "anthropic/claude-sonnet-4-1": { alias: "Sonnet" },
+          },
+        },
+      },
+      hooks: { gmail: { model: "Sonnet" } },
+    } satisfies ClawdbotConfig;
+    const result = resolveHooksGmailModel({
+      cfg,
+      defaultProvider: DEFAULT_PROVIDER,
+    });
+    expect(result).toEqual({
+      provider: "anthropic",
+      model: "claude-sonnet-4-1",
+    });
+  });
+
+  it("uses default provider when model omits provider", () => {
+    const cfg = {
+      hooks: { gmail: { model: "claude-haiku-3-5" } },
+    } satisfies ClawdbotConfig;
+    const result = resolveHooksGmailModel({
+      cfg,
+      defaultProvider: "anthropic",
+    });
+    expect(result).toEqual({
+      provider: "anthropic",
+      model: "claude-haiku-3-5",
+    });
+  });
+});
+
+describe("resolveAllowedModelRef", () => {
+  it("resolves aliases when allowed", () => {
+    const cfg = {
+      agents: {
+        defaults: {
+          models: {
+            "anthropic/claude-sonnet-4-1": { alias: "Sonnet" },
+          },
+        },
+      },
+    } satisfies ClawdbotConfig;
+    const resolved = resolveAllowedModelRef({
+      cfg,
+      catalog: [
+        {
+          provider: "anthropic",
+          id: "claude-sonnet-4-1",
+          name: "Sonnet",
+        },
+      ],
+      raw: "Sonnet",
+      defaultProvider: "anthropic",
+      defaultModel: "claude-opus-4-5",
+    });
+    expect("error" in resolved).toBe(false);
+    if ("ref" in resolved) {
+      expect(resolved.ref).toEqual({
+        provider: "anthropic",
+        model: "claude-sonnet-4-1",
       });
-      expect(result).toEqual({ provider: "openai", model: "gpt-4" });
+    }
+  });
+
+  it("rejects disallowed models", () => {
+    const cfg = {
+      agents: {
+        defaults: {
+          models: {
+            "openai/gpt-4": { alias: "GPT4" },
+          },
+        },
+      },
+    } satisfies ClawdbotConfig;
+    const resolved = resolveAllowedModelRef({
+      cfg,
+      catalog: [
+        { provider: "openai", id: "gpt-4", name: "GPT-4" },
+        { provider: "anthropic", id: "claude-sonnet-4-1", name: "Sonnet" },
+      ],
+      raw: "anthropic/claude-sonnet-4-1",
+      defaultProvider: "openai",
+      defaultModel: "gpt-4",
+    });
+    expect(resolved).toEqual({
+      error: "model not allowed: anthropic/claude-sonnet-4-1",
     });
   });
 });

src/agents/model-selection.ts

@@ -131,25 +131,14 @@ export function resolveConfiguredModelRef(params: {
       cfg: params.cfg,
       defaultProvider: params.defaultProvider,
     });
-    if (!trimmed.includes("/")) {
-      const aliasKey = normalizeAliasKey(trimmed);
-      const aliasMatch = aliasIndex.byAlias.get(aliasKey);
-      if (aliasMatch) return aliasMatch.ref;
-
-      // Default to anthropic if no provider is specified, but warn as this is deprecated.
-      const normalized = normalizeProviderModelId("anthropic", trimmed);
-      console.warn(
-        `[clawdbot] Model "${trimmed}" specified without provider. Falling back to "anthropic/${normalized}". Please use "anthropic/${normalized}" in your config.`,
-      );
-      return { provider: "anthropic", model: normalized };
-    }
-
     const resolved = resolveModelRefFromString({
       raw: trimmed,
       defaultProvider: params.defaultProvider,
       aliasIndex,
     });
     if (resolved) return resolved.ref;
+    // TODO(steipete): drop this fallback once provider-less agents.defaults.model is fully deprecated.
+    return { provider: "anthropic", model: trimmed };
   }
   return { provider: params.defaultProvider, model: params.defaultModel };
 }

src/auto-reply/heartbeat.test.ts

@@ -133,15 +133,6 @@ describe("isHeartbeatContentEffectivelyEmpty", () => {
     expect(isHeartbeatContentEffectivelyEmpty("# HEARTBEAT.md\n\n")).toBe(true);
   });
 
-  it("returns true for empty list items", () => {
-    expect(isHeartbeatContentEffectivelyEmpty("- ")).toBe(true);
-    expect(isHeartbeatContentEffectivelyEmpty("- [ ]")).toBe(true);
-    expect(isHeartbeatContentEffectivelyEmpty("- [x]")).toBe(true);
-    expect(isHeartbeatContentEffectivelyEmpty("* [ ]")).toBe(true);
-    expect(isHeartbeatContentEffectivelyEmpty("+ [ ]")).toBe(true);
-    expect(isHeartbeatContentEffectivelyEmpty("# HEARTBEAT.md\n- [ ]")).toBe(true);
-  });
-
   it("returns true for comments only", () => {
     expect(isHeartbeatContentEffectivelyEmpty("# Header\n# Another comment")).toBe(true);
     expect(isHeartbeatContentEffectivelyEmpty("## Subheader\n### Another")).toBe(true);

src/auto-reply/heartbeat.ts

@@ -32,8 +32,6 @@ export function isHeartbeatContentEffectivelyEmpty(content: string | undefined |
     // This intentionally does NOT skip lines like "#TODO" or "#hashtag" which might be content
     // (Those aren't valid markdown headers - ATX headers require space after #)
     if (/^#+(\s|$)/.test(trimmed)) continue;
-    // Skip empty markdown list items like "- [ ]" or "* [ ]" or just "- "
-    if (/^[-*+]\s*(\[[\sXx]?\]\s*)?$/.test(trimmed)) continue;
     // Found a non-empty, non-comment line - there's actionable content
     return false;
   }

src/gateway/server.auth.e2e.test.ts

@@ -2,7 +2,6 @@ import { afterAll, beforeAll, describe, expect, test, vi } from "vitest";
 import { WebSocket } from "ws";
 import { PROTOCOL_VERSION } from "./protocol/index.js";
 import { getHandshakeTimeoutMs } from "./server-constants.js";
-import { buildDeviceAuthPayload } from "./device-auth.js";
 import {
   connectReq,
   getFreePort,
@@ -287,70 +286,6 @@ describe("gateway server auth/connect", () => {
     }
   });
 
-  test("allows control ui with device identity when insecure auth is enabled", async () => {
-    testState.gatewayControlUi = { allowInsecureAuth: true };
-    const { writeConfigFile } = await import("../config/config.js");
-    await writeConfigFile({
-      gateway: {
-        trustedProxies: ["127.0.0.1"],
-      },
-    } as any);
-    const prevToken = process.env.CLAWDBOT_GATEWAY_TOKEN;
-    process.env.CLAWDBOT_GATEWAY_TOKEN = "secret";
-    const port = await getFreePort();
-    const server = await startGatewayServer(port);
-    const ws = new WebSocket(`ws://127.0.0.1:${port}`, {
-      headers: { "x-forwarded-for": "203.0.113.10" },
-    });
-    const challengePromise = onceMessage<{ payload?: unknown }>(
-      ws,
-      (o) => o.type === "event" && o.event === "connect.challenge",
-    );
-    await new Promise<void>((resolve) => ws.once("open", resolve));
-    const challenge = await challengePromise;
-    const nonce = (challenge.payload as { nonce?: unknown } | undefined)?.nonce;
-    expect(typeof nonce).toBe("string");
-    const { loadOrCreateDeviceIdentity, publicKeyRawBase64UrlFromPem, signDevicePayload } =
-      await import("../infra/device-identity.js");
-    const identity = loadOrCreateDeviceIdentity();
-    const signedAtMs = Date.now();
-    const payload = buildDeviceAuthPayload({
-      deviceId: identity.deviceId,
-      clientId: GATEWAY_CLIENT_NAMES.CONTROL_UI,
-      clientMode: GATEWAY_CLIENT_MODES.WEBCHAT,
-      role: "operator",
-      scopes: [],
-      signedAtMs,
-      token: "secret",
-      nonce: String(nonce),
-    });
-    const device = {
-      id: identity.deviceId,
-      publicKey: publicKeyRawBase64UrlFromPem(identity.publicKeyPem),
-      signature: signDevicePayload(identity.privateKeyPem, payload),
-      signedAt: signedAtMs,
-      nonce: String(nonce),
-    };
-    const res = await connectReq(ws, {
-      token: "secret",
-      device,
-      client: {
-        id: GATEWAY_CLIENT_NAMES.CONTROL_UI,
-        version: "1.0.0",
-        platform: "web",
-        mode: GATEWAY_CLIENT_MODES.WEBCHAT,
-      },
-    });
-    expect(res.ok).toBe(true);
-    ws.close();
-    await server.close();
-    if (prevToken === undefined) {
-      delete process.env.CLAWDBOT_GATEWAY_TOKEN;
-    } else {
-      process.env.CLAWDBOT_GATEWAY_TOKEN = prevToken;
-    }
-  });
-
   test("accepts device token auth for paired device", async () => {
     const { loadOrCreateDeviceIdentity } = await import("../infra/device-identity.js");
     const { approveDevicePairing, getPairedDevice, listDevicePairing } =

src/gateway/server/ws-connection/message-handler.ts

@@ -318,13 +318,13 @@ export function attachGatewayWsMessageHandler(params: {
         let devicePublicKey: string | null = null;
         const hasTokenAuth = Boolean(connectParams.auth?.token);
         const hasPasswordAuth = Boolean(connectParams.auth?.password);
-        const hasSharedAuth = hasTokenAuth || hasPasswordAuth;
         const isControlUi = connectParams.client.id === GATEWAY_CLIENT_IDS.CONTROL_UI;
-        const allowInsecureControlUi =
-          isControlUi && configSnapshot.gateway?.controlUi?.allowInsecureAuth === true;
 
         if (!device) {
-          const canSkipDevice = allowInsecureControlUi ? hasSharedAuth : hasTokenAuth;
+          const allowInsecureControlUi =
+            isControlUi && configSnapshot.gateway?.controlUi?.allowInsecureAuth === true;
+          const canSkipDevice =
+            isControlUi && allowInsecureControlUi ? hasTokenAuth || hasPasswordAuth : hasTokenAuth;
 
           if (isControlUi && !allowInsecureControlUi) {
             const errorMessage = "control ui requires HTTPS or localhost (secure context)";
@@ -569,8 +569,7 @@ export function attachGatewayWsMessageHandler(params: {
           return;
         }
 
-        const skipPairing = allowInsecureControlUi && hasSharedAuth;
-        if (device && devicePublicKey && !skipPairing) {
+        if (device && devicePublicKey) {
           const requirePairing = async (reason: string, _paired?: { deviceId: string }) => {
             const pairing = await requestDevicePairing({
               deviceId: device.id,