docs(changelog): expand #1053 note

CHANGELOG.md

@@ -61,6 +61,7 @@
 - Fix: refactor session store updates, add chat.inject, and harden subagent cleanup flow. (#944) — thanks @tyler6204.
 - Fix: clean up suspended CLI processes across backends. (#978) — thanks @Nachx639.
 - Fix: support MiniMax coding plan usage responses with `model_remains`/`current_interval_*` payloads.
+- Fix: honor message tool channel for duplicate suppression (prefer `NO_REPLY` after `message` tool sends). (#1053) — thanks @sashcatanzarite.
 - Fix: suppress WhatsApp pairing replies for historical catch-up DMs on initial link. (#904)
 - Browser: extension mode recovers when only one tab is attached (stale targetId fallback).
 - Browser: fix `tab not found` for extension relay snapshots/actions when Playwright blocks `newCDPSession` (use the single available Page).
@@ -71,9 +72,7 @@
 - Fix: allow local Tailscale Serve hostnames without treating tailnet clients as direct. (#885) — thanks @oswalpalash.
 - Fix: reset sessions after role-ordering conflicts to recover from consecutive user turns. (#998)
 - Fix: keep background exec aborts from killing backgrounded sessions while honoring timeouts.
-- Fix: use local auth for gateway security probe unless remote mode has a URL. (#1011) — thanks @ivanrvpereira.
 - Discord: truncate skill command descriptions for slash command limits. (#1018) — thanks @evalexpr.
-- macOS: resolve gateway token/password using config mode/remote URL, and warn when `launchctl setenv` overrides config. (#1022, #1021) — thanks @kkarimi.
 
 ## 2026.1.14-1
 

apps/macos/Sources/Clawdbot/AppState.swift

@@ -257,8 +257,30 @@ final class AppState {
 
         let configRoot = ClawdbotConfigFile.loadDict()
         let configGateway = configRoot["gateway"] as? [String: Any]
+        let configModeRaw = (configGateway?["mode"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines)
+        let configMode: ConnectionMode? = switch configModeRaw {
+        case "local":
+            .local
+        case "remote":
+            .remote
+        default:
+            nil
+        }
         let configRemoteUrl = (configGateway?["remote"] as? [String: Any])?["url"] as? String
-        let resolvedConnectionMode = ConnectionModeResolver.resolve(root: configRoot).mode
+        let configHasRemoteUrl = !(configRemoteUrl?
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+            .isEmpty ?? true)
+
+        let storedMode = UserDefaults.standard.string(forKey: connectionModeKey)
+        let resolvedConnectionMode: ConnectionMode = if let configMode {
+            configMode
+        } else if configHasRemoteUrl {
+            .remote
+        } else if let storedMode {
+            ConnectionMode(rawValue: storedMode) ?? .local
+        } else {
+            onboardingSeen ? .local : .unconfigured
+        }
         self.connectionMode = resolvedConnectionMode
 
         let storedRemoteTarget = UserDefaults.standard.string(forKey: remoteTargetKey) ?? ""

apps/macos/Sources/Clawdbot/CommandResolver.swift

@@ -385,8 +385,14 @@ enum CommandResolver {
     }
 
     static func connectionSettings(defaults: UserDefaults = .standard) -> RemoteSettings {
-        let root = ClawdbotConfigFile.loadDict()
-        let mode = ConnectionModeResolver.resolve(root: root, defaults: defaults).mode
+        let modeRaw = defaults.string(forKey: connectionModeKey)
+        let mode: AppState.ConnectionMode
+        if let modeRaw {
+            mode = AppState.ConnectionMode(rawValue: modeRaw) ?? .local
+        } else {
+            let seen = defaults.bool(forKey: "clawdbot.onboardingSeen")
+            mode = seen ? .local : .unconfigured
+        }
         let target = defaults.string(forKey: remoteTargetKey) ?? ""
         let identity = defaults.string(forKey: remoteIdentityKey) ?? ""
         let projectRoot = defaults.string(forKey: remoteProjectRootKey) ?? ""

apps/macos/Sources/Clawdbot/ConnectionModeResolver.swift

@@ -1,50 +0,0 @@
-import Foundation
-
-enum EffectiveConnectionModeSource: Sendable, Equatable {
-    case configMode
-    case configRemoteURL
-    case userDefaults
-    case onboarding
-}
-
-struct EffectiveConnectionMode: Sendable, Equatable {
-    let mode: AppState.ConnectionMode
-    let source: EffectiveConnectionModeSource
-}
-
-enum ConnectionModeResolver {
-    static func resolve(
-        root: [String: Any],
-        defaults: UserDefaults = .standard) -> EffectiveConnectionMode
-    {
-        let gateway = root["gateway"] as? [String: Any]
-        let configModeRaw = (gateway?["mode"] as? String) ?? ""
-        let configMode = configModeRaw
-            .trimmingCharacters(in: .whitespacesAndNewlines)
-            .lowercased()
-
-        switch configMode {
-        case "local":
-            return EffectiveConnectionMode(mode: .local, source: .configMode)
-        case "remote":
-            return EffectiveConnectionMode(mode: .remote, source: .configMode)
-        default:
-            break
-        }
-
-        let remoteURLRaw = ((gateway?["remote"] as? [String: Any])?["url"] as? String) ?? ""
-        let remoteURL = remoteURLRaw.trimmingCharacters(in: .whitespacesAndNewlines)
-        if !remoteURL.isEmpty {
-            return EffectiveConnectionMode(mode: .remote, source: .configRemoteURL)
-        }
-
-        if let storedModeRaw = defaults.string(forKey: connectionModeKey) {
-            let storedMode = AppState.ConnectionMode(rawValue: storedModeRaw) ?? .local
-            return EffectiveConnectionMode(mode: storedMode, source: .userDefaults)
-        }
-
-        let seen = defaults.bool(forKey: "clawdbot.onboardingSeen")
-        return EffectiveConnectionMode(mode: seen ? .local : .unconfigured, source: .onboarding)
-    }
-}
-

apps/macos/Sources/Clawdbot/GatewayEndpointStore.swift

@@ -1,4 +1,3 @@
-import ConcurrencyExtras
 import Foundation
 import OSLog
 
@@ -17,13 +16,6 @@ actor GatewayEndpointStore {
     static let shared = GatewayEndpointStore()
     private static let supportedBindModes: Set<String> = ["loopback", "tailnet", "lan", "auto"]
     private static let remoteConnectingDetail = "Connecting to remote gateway…"
-    private static let staticLogger = Logger(subsystem: "com.clawdbot", category: "gateway-endpoint")
-    private enum EnvOverrideWarningKind: Sendable {
-        case token
-        case password
-    }
-
-    private static let envOverrideWarnings = LockIsolated((token: false, password: false))
 
     struct Deps: Sendable {
         let mode: @Sendable () async -> AppState.ConnectionMode
@@ -38,18 +30,16 @@ actor GatewayEndpointStore {
             mode: { await MainActor.run { AppStateStore.shared.connectionMode } },
             token: {
                 let root = ClawdbotConfigFile.loadDict()
-                let isRemote = ConnectionModeResolver.resolve(root: root).mode == .remote
                 return GatewayEndpointStore.resolveGatewayToken(
-                    isRemote: isRemote,
+                    isRemote: CommandResolver.connectionModeIsRemote(),
                     root: root,
                     env: ProcessInfo.processInfo.environment,
                     launchdSnapshot: GatewayLaunchAgentManager.launchdConfigSnapshot())
             },
             password: {
                 let root = ClawdbotConfigFile.loadDict()
-                let isRemote = ConnectionModeResolver.resolve(root: root).mode == .remote
                 return GatewayEndpointStore.resolveGatewayPassword(
-                    isRemote: isRemote,
+                    isRemote: CommandResolver.connectionModeIsRemote(),
                     root: root,
                     env: ProcessInfo.processInfo.environment,
                     launchdSnapshot: GatewayLaunchAgentManager.launchdConfigSnapshot())
@@ -78,14 +68,6 @@ actor GatewayEndpointStore {
         let raw = env["CLAWDBOT_GATEWAY_PASSWORD"] ?? ""
         let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
         if !trimmed.isEmpty {
-            if let configPassword = self.resolveConfigPassword(isRemote: isRemote, root: root),
-               !configPassword.isEmpty
-            {
-                self.warnEnvOverrideOnce(
-                    kind: .password,
-                    envVar: "CLAWDBOT_GATEWAY_PASSWORD",
-                    configKey: isRemote ? "gateway.remote.password" : "gateway.auth.password")
-            }
             return trimmed
         }
         if isRemote {
@@ -117,26 +99,6 @@ actor GatewayEndpointStore {
         return nil
     }
 
-    private static func resolveConfigPassword(isRemote: Bool, root: [String: Any]) -> String? {
-        if isRemote {
-            if let gateway = root["gateway"] as? [String: Any],
-               let remote = gateway["remote"] as? [String: Any],
-               let password = remote["password"] as? String
-            {
-                return password.trimmingCharacters(in: .whitespacesAndNewlines)
-            }
-            return nil
-        }
-
-        if let gateway = root["gateway"] as? [String: Any],
-           let auth = gateway["auth"] as? [String: Any],
-           let password = auth["password"] as? String
-        {
-            return password.trimmingCharacters(in: .whitespacesAndNewlines)
-        }
-        return nil
-    }
-
     private static func resolveGatewayToken(
         isRemote: Bool,
         root: [String: Any],
@@ -146,14 +108,6 @@ actor GatewayEndpointStore {
         let raw = env["CLAWDBOT_GATEWAY_TOKEN"] ?? ""
         let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
         if !trimmed.isEmpty {
-            if let configToken = self.resolveConfigToken(isRemote: isRemote, root: root),
-               !configToken.isEmpty
-            {
-                self.warnEnvOverrideOnce(
-                    kind: .token,
-                    envVar: "CLAWDBOT_GATEWAY_TOKEN",
-                    configKey: isRemote ? "gateway.remote.token" : "gateway.auth.token")
-            }
             return trimmed
         }
         if isRemote {
@@ -185,49 +139,6 @@ actor GatewayEndpointStore {
         return nil
     }
 
-    private static func resolveConfigToken(isRemote: Bool, root: [String: Any]) -> String? {
-        if isRemote {
-            if let gateway = root["gateway"] as? [String: Any],
-               let remote = gateway["remote"] as? [String: Any],
-               let token = remote["token"] as? String
-            {
-                return token.trimmingCharacters(in: .whitespacesAndNewlines)
-            }
-            return nil
-        }
-
-        if let gateway = root["gateway"] as? [String: Any],
-           let auth = gateway["auth"] as? [String: Any],
-           let token = auth["token"] as? String
-        {
-            return token.trimmingCharacters(in: .whitespacesAndNewlines)
-        }
-        return nil
-    }
-
-    private static func warnEnvOverrideOnce(
-        kind: EnvOverrideWarningKind,
-        envVar: String,
-        configKey: String)
-    {
-        let shouldWarn = Self.envOverrideWarnings.withValue { state in
-            switch kind {
-            case .token:
-                guard !state.token else { return false }
-                state.token = true
-                return true
-            case .password:
-                guard !state.password else { return false }
-                state.password = true
-                return true
-            }
-        }
-        guard shouldWarn else { return }
-        Self.staticLogger.warning(
-            "\(envVar, privacy: .public) is set and overrides \(configKey, privacy: .public). " +
-                "If this is unintentional, clear it with: launchctl unsetenv \(envVar, privacy: .public)")
-    }
-
     private let deps: Deps
     private let logger = Logger(subsystem: "com.clawdbot", category: "gateway-endpoint")
 

apps/macos/Tests/ClawdbotIPCTests/GatewayEndpointStoreTests.swift

@@ -3,13 +3,6 @@ import Testing
 @testable import Clawdbot
 
 @Suite struct GatewayEndpointStoreTests {
-    private func makeDefaults() -> UserDefaults {
-        let suiteName = "GatewayEndpointStoreTests.\(UUID().uuidString)"
-        let defaults = UserDefaults(suiteName: suiteName)!
-        defaults.removePersistentDomain(forName: suiteName)
-        return defaults
-    }
-
     @Test func resolveGatewayTokenPrefersEnvAndFallsBackToLaunchd() {
         let snapshot = LaunchAgentPlistSnapshot(
             programArguments: [],
@@ -73,70 +66,4 @@ import Testing
             launchdSnapshot: snapshot)
         #expect(password == "launchd-pass")
     }
-
-    @Test func connectionModeResolverPrefersConfigModeOverDefaults() {
-        let defaults = self.makeDefaults()
-        defaults.set("remote", forKey: connectionModeKey)
-
-        let root: [String: Any] = [
-            "gateway": [
-                "mode": " local ",
-            ],
-        ]
-
-        let resolved = ConnectionModeResolver.resolve(root: root, defaults: defaults)
-        #expect(resolved.mode == .local)
-    }
-
-    @Test func connectionModeResolverTrimsConfigMode() {
-        let defaults = self.makeDefaults()
-        defaults.set("local", forKey: connectionModeKey)
-
-        let root: [String: Any] = [
-            "gateway": [
-                "mode": " remote ",
-            ],
-        ]
-
-        let resolved = ConnectionModeResolver.resolve(root: root, defaults: defaults)
-        #expect(resolved.mode == .remote)
-    }
-
-    @Test func connectionModeResolverFallsBackToDefaultsWhenMissingConfig() {
-        let defaults = self.makeDefaults()
-        defaults.set("remote", forKey: connectionModeKey)
-
-        let resolved = ConnectionModeResolver.resolve(root: [:], defaults: defaults)
-        #expect(resolved.mode == .remote)
-    }
-
-    @Test func connectionModeResolverFallsBackToDefaultsOnUnknownConfig() {
-        let defaults = self.makeDefaults()
-        defaults.set("local", forKey: connectionModeKey)
-
-        let root: [String: Any] = [
-            "gateway": [
-                "mode": "staging",
-            ],
-        ]
-
-        let resolved = ConnectionModeResolver.resolve(root: root, defaults: defaults)
-        #expect(resolved.mode == .local)
-    }
-
-    @Test func connectionModeResolverPrefersRemoteURLWhenModeMissing() {
-        let defaults = self.makeDefaults()
-        defaults.set("local", forKey: connectionModeKey)
-
-        let root: [String: Any] = [
-            "gateway": [
-                "remote": [
-                    "url": " ws://umbrel:18789 ",
-                ],
-            ],
-        ]
-
-        let resolved = ConnectionModeResolver.resolve(root: root, defaults: defaults)
-        #expect(resolved.mode == .remote)
-    }
 }

docs/cli/doctor.md

@@ -21,14 +21,3 @@ clawdbot doctor --repair
 clawdbot doctor --deep
 ```
 
-## macOS: `launchctl` env overrides
-
-If you previously ran `launchctl setenv CLAWDBOT_GATEWAY_TOKEN ...` (or `...PASSWORD`), that value overrides your config file and can cause persistent “unauthorized” errors.
-
-```bash
-launchctl getenv CLAWDBOT_GATEWAY_TOKEN
-launchctl getenv CLAWDBOT_GATEWAY_PASSWORD
-
-launchctl unsetenv CLAWDBOT_GATEWAY_TOKEN
-launchctl unsetenv CLAWDBOT_GATEWAY_PASSWORD
-```

docs/start/showcase.md

@@ -146,19 +146,6 @@ Full setup walkthrough (28m) by VelvetShark.
 
   14+ agents under one gateway with Opus 4.5 orchestrator delegating to Codex workers. Comprehensive [technical write-up](https://github.com/adam91holt/orchestrated-ai-articles) covering the Dream Team roster, model selection, sandboxing, webhooks, heartbeats, and delegation flows. [Clawdspace](https://github.com/adam91holt/clawdspace) for agent sandboxing. [Blog post](https://adams-ai-journey.ghost.io/2026-the-year-of-the-orchestrator/).
 </Card>
-
-<Card title="Linear CLI" icon="terminal" href="https://github.com/Finesssee/linear-cli">
-  **@NessZerra** • `devtools` `linear` `cli` `issues`
-
-  CLI for Linear that integrates with agentic workflows (Claude Code, Clawdbot). Manage issues, projects, and workflows from the terminal. First external PR merged!
-</Card>
-
-<Card title="Beeper CLI" icon="message" href="https://github.com/blqke/beepcli">
-  **@jules** • `messaging` `beeper` `cli` `automation`
-
-  Read, send, and archive messages via Beeper Desktop. Uses Beeper local MCP API so agents can manage all your chats (iMessage, WhatsApp, etc.) in one place.
-</Card>
-
 </CardGroup>
 
 ## 🤖 Automation & Workflows

src/agents/pi-embedded-subscribe.tools.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+
+import { extractMessagingToolSend } from "./pi-embedded-subscribe.tools.js";
+
+describe("extractMessagingToolSend", () => {
+  it("uses channel as provider for message tool", () => {
+    const result = extractMessagingToolSend("message", {
+      action: "send",
+      channel: "telegram",
+      to: "123",
+    });
+
+    expect(result?.tool).toBe("message");
+    expect(result?.provider).toBe("telegram");
+    expect(result?.to).toBe("telegram:123");
+  });
+
+  it("prefers provider when both provider and channel are set", () => {
+    const result = extractMessagingToolSend("message", {
+      action: "send",
+      provider: "slack",
+      channel: "telegram",
+      to: "channel:C1",
+    });
+
+    expect(result?.tool).toBe("message");
+    expect(result?.provider).toBe("slack");
+    expect(result?.to).toBe("channel:c1");
+  });
+});

src/agents/pi-embedded-subscribe.tools.ts

@@ -57,8 +57,10 @@ export function extractMessagingToolSend(
     const toRaw = typeof args.to === "string" ? args.to : undefined;
     if (!toRaw) return undefined;
     const providerRaw = typeof args.provider === "string" ? args.provider.trim() : "";
-    const providerId = providerRaw ? normalizeChannelId(providerRaw) : null;
-    const provider = providerId ?? (providerRaw ? providerRaw.toLowerCase() : "message");
+    const channelRaw = typeof args.channel === "string" ? args.channel.trim() : "";
+    const providerHint = providerRaw || channelRaw;
+    const providerId = providerHint ? normalizeChannelId(providerHint) : null;
+    const provider = providerId ?? (providerHint ? providerHint.toLowerCase() : "message");
     const to = normalizeTargetForProvider(provider, toRaw);
     return to ? { tool: toolName, provider, accountId, to } : undefined;
   }

src/agents/system-prompt.test.ts

@@ -216,6 +216,7 @@ describe("buildAgentSystemPrompt", () => {
 
     expect(prompt).toContain("message: Send messages and channel actions");
     expect(prompt).toContain("### message tool");
+    expect(prompt).toContain("respond with ONLY: NO_REPLY");
   });
 
   it("includes runtime provider capabilities when present", () => {

src/agents/system-prompt.ts

@@ -95,6 +95,7 @@ function buildMessagingSection(params: {
           "- Use `message` for proactive sends + channel actions (polls, reactions, etc.).",
           "- For `action=send`, include `to` and `message`.",
           `- If multiple channels are configured, pass \`channel\` (${params.messageChannelOptions}).`,
+          `- If you use \`message\` (\`action=send\`) to deliver your user-visible reply, respond with ONLY: ${SILENT_REPLY_TOKEN} (avoid duplicate replies).`,
           params.inlineButtonsEnabled
             ? "- Inline buttons supported. Use `action=send` with `buttons=[[{text,callback_data}]]` (callback_data routes back as a user message)."
             : params.runtimeChannel

src/commands/doctor-platform-notes.ts

@@ -1,14 +1,9 @@
-import { execFile } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { promisify } from "node:util";
 
-import type { ClawdbotConfig } from "../config/config.js";
 import { note } from "../terminal/note.js";
 
-const execFileAsync = promisify(execFile);
-
 function resolveHomeDir(): string {
   return process.env.HOME ?? os.homedir();
 }
@@ -26,47 +21,3 @@ export async function noteMacLaunchAgentOverrides() {
   ].filter((line): line is string => Boolean(line));
   note(lines.join("\n"), "Gateway (macOS)");
 }
-
-async function launchctlGetenv(name: string): Promise<string | undefined> {
-  try {
-    const result = await execFileAsync("/bin/launchctl", ["getenv", name], { encoding: "utf8" });
-    const value = String(result.stdout ?? "").trim();
-    return value.length > 0 ? value : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function hasConfigGatewayCreds(cfg: ClawdbotConfig): boolean {
-  const localToken =
-    typeof cfg.gateway?.auth?.token === "string" ? cfg.gateway?.auth?.token.trim() : "";
-  const localPassword =
-    typeof cfg.gateway?.auth?.password === "string" ? cfg.gateway?.auth?.password.trim() : "";
-  const remoteToken =
-    typeof cfg.gateway?.remote?.token === "string" ? cfg.gateway?.remote?.token.trim() : "";
-  const remotePassword =
-    typeof cfg.gateway?.remote?.password === "string" ? cfg.gateway?.remote?.password.trim() : "";
-  return Boolean(localToken || localPassword || remoteToken || remotePassword);
-}
-
-export async function noteMacLaunchctlGatewayEnvOverrides(cfg: ClawdbotConfig) {
-  if (process.platform !== "darwin") return;
-  if (!hasConfigGatewayCreds(cfg)) return;
-
-  const envToken = await launchctlGetenv("CLAWDBOT_GATEWAY_TOKEN");
-  const envPassword = await launchctlGetenv("CLAWDBOT_GATEWAY_PASSWORD");
-  if (!envToken && !envPassword) return;
-
-  const lines = [
-    "- launchctl environment overrides detected (can cause confusing unauthorized errors).",
-    envToken ? "- `CLAWDBOT_GATEWAY_TOKEN` is set; it overrides config tokens." : undefined,
-    envPassword
-      ? "- `CLAWDBOT_GATEWAY_PASSWORD` is set; it overrides config passwords."
-      : undefined,
-    "- Clear overrides and restart the app/gateway:",
-    envToken ? "  launchctl unsetenv CLAWDBOT_GATEWAY_TOKEN" : undefined,
-    envPassword ? "  launchctl unsetenv CLAWDBOT_GATEWAY_PASSWORD" : undefined,
-  ].filter((line): line is string => Boolean(line));
-
-  note(lines.join("\n"), "Gateway (macOS)");
-}

src/commands/doctor.ts

@@ -26,10 +26,7 @@ import {
   maybeScanExtraGatewayServices,
 } from "./doctor-gateway-services.js";
 import { noteSourceInstallIssues } from "./doctor-install.js";
-import {
-  noteMacLaunchAgentOverrides,
-  noteMacLaunchctlGatewayEnvOverrides,
-} from "./doctor-platform-notes.js";
+import { noteMacLaunchAgentOverrides } from "./doctor-platform-notes.js";
 import { createDoctorPrompter, type DoctorOptions } from "./doctor-prompter.js";
 import { maybeRepairSandboxImages, noteSandboxScopeWarnings } from "./doctor-sandbox.js";
 import { noteSecurityWarnings } from "./doctor-security.js";
@@ -163,7 +160,6 @@ export async function doctorCommand(
   await maybeScanExtraGatewayServices(options);
   await maybeRepairGatewayServiceConfig(cfg, resolveMode(cfg), runtime, prompter);
   await noteMacLaunchAgentOverrides();
-  await noteMacLaunchctlGatewayEnvOverrides(cfg);
 
   await noteSecurityWarnings(cfg);
 

src/security/audit.test.ts

@@ -401,148 +401,4 @@ describe("security audit", () => {
       ]),
     );
   });
-
-  describe("maybeProbeGateway auth selection", () => {
-    it("uses local auth when gateway.mode is local", async () => {
-      let capturedAuth: { token?: string; password?: string } | undefined;
-      const cfg: ClawdbotConfig = {
-        gateway: {
-          mode: "local",
-          auth: { token: "local-token-abc123" },
-        },
-      };
-
-      await runSecurityAudit({
-        config: cfg,
-        deep: true,
-        deepTimeoutMs: 50,
-        includeFilesystem: false,
-        includeChannelSecurity: false,
-        probeGatewayFn: async (opts) => {
-          capturedAuth = opts.auth;
-          return {
-            ok: true,
-            url: opts.url,
-            connectLatencyMs: 10,
-            error: null,
-            close: null,
-            health: null,
-            status: null,
-            presence: null,
-            configSnapshot: null,
-          };
-        },
-      });
-
-      expect(capturedAuth?.token).toBe("local-token-abc123");
-    });
-
-    it("uses local auth when gateway.mode is undefined (default)", async () => {
-      let capturedAuth: { token?: string; password?: string } | undefined;
-      const cfg: ClawdbotConfig = {
-        gateway: {
-          auth: { token: "default-local-token" },
-        },
-      };
-
-      await runSecurityAudit({
-        config: cfg,
-        deep: true,
-        deepTimeoutMs: 50,
-        includeFilesystem: false,
-        includeChannelSecurity: false,
-        probeGatewayFn: async (opts) => {
-          capturedAuth = opts.auth;
-          return {
-            ok: true,
-            url: opts.url,
-            connectLatencyMs: 10,
-            error: null,
-            close: null,
-            health: null,
-            status: null,
-            presence: null,
-            configSnapshot: null,
-          };
-        },
-      });
-
-      expect(capturedAuth?.token).toBe("default-local-token");
-    });
-
-    it("uses remote auth when gateway.mode is remote with URL", async () => {
-      let capturedAuth: { token?: string; password?: string } | undefined;
-      const cfg: ClawdbotConfig = {
-        gateway: {
-          mode: "remote",
-          auth: { token: "local-token-should-not-use" },
-          remote: {
-            url: "ws://remote.example.com:18789",
-            token: "remote-token-xyz789",
-          },
-        },
-      };
-
-      await runSecurityAudit({
-        config: cfg,
-        deep: true,
-        deepTimeoutMs: 50,
-        includeFilesystem: false,
-        includeChannelSecurity: false,
-        probeGatewayFn: async (opts) => {
-          capturedAuth = opts.auth;
-          return {
-            ok: true,
-            url: opts.url,
-            connectLatencyMs: 10,
-            error: null,
-            close: null,
-            health: null,
-            status: null,
-            presence: null,
-            configSnapshot: null,
-          };
-        },
-      });
-
-      expect(capturedAuth?.token).toBe("remote-token-xyz789");
-    });
-
-    it("falls back to local auth when gateway.mode is remote but URL is missing", async () => {
-      let capturedAuth: { token?: string; password?: string } | undefined;
-      const cfg: ClawdbotConfig = {
-        gateway: {
-          mode: "remote",
-          auth: { token: "fallback-local-token" },
-          remote: {
-            token: "remote-token-should-not-use",
-          },
-        },
-      };
-
-      await runSecurityAudit({
-        config: cfg,
-        deep: true,
-        deepTimeoutMs: 50,
-        includeFilesystem: false,
-        includeChannelSecurity: false,
-        probeGatewayFn: async (opts) => {
-          capturedAuth = opts.auth;
-          return {
-            ok: true,
-            url: opts.url,
-            connectLatencyMs: 10,
-            error: null,
-            close: null,
-            health: null,
-            status: null,
-            presence: null,
-            configSnapshot: null,
-          };
-        },
-      });
-
-      expect(capturedAuth?.token).toBe("fallback-local-token");
-    });
-  });
 });

src/security/audit.ts

@@ -538,7 +538,7 @@ async function maybeProbeGateway(params: {
     return { token, password };
   };
 
-  const auth = !isRemoteMode || remoteUrlMissing ? resolveAuth("local") : resolveAuth("remote");
+  const auth = remoteUrlMissing ? resolveAuth("local") : resolveAuth("remote");
   const res = await params.probe({ url, auth, timeoutMs: params.timeoutMs }).catch((err) => ({
     ok: false,
     url,