fix: allow token auth without device identity (#1314) (thanks @dbhurley)

The device identity check was rejecting connections before token
authentication could be attempted. This broke the control-ui (web UI)
which uses token-based authentication via URL parameter.

Changes:
- Skip device identity requirement when a token is provided
- Guard device token verification to only run when device is present

Fixes control-ui showing "device identity required" error when
connecting with a valid token.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -29,6 +29,7 @@ Docs: https://docs.clawd.bot
 - Model catalog: avoid caching import failures, log transient discovery errors, and keep partial results. (#1332) — thanks @dougvk.
 - Doctor: clarify plugin auto-enable hint text in the startup banner.
 - Gateway: clarify unauthorized handshake responses with token/password mismatch guidance.
+- Gateway: allow token-auth Control UI connections without device identity. (#1314) — thanks @dbhurley.
 - Gateway: preserve restart wake routing + thread replies across restarts. (#1337) — thanks @John-Rood.
 - Gateway: reschedule per-agent heartbeats on config hot reload without restarting the runner.
 - Config: log invalid config issues once per run and keep invalid-config errors stackless.
@@ -39,7 +40,6 @@ Docs: https://docs.clawd.bot
 - TUI: keep thinking blocks ordered before content during streaming and isolate per-run assembly. (#1202) — thanks @aaronveklabs.
 - TUI: align custom editor initialization with the latest pi-tui API. (#1298) — thanks @sibbl.
 - CLI: avoid duplicating --profile/--dev flags when formatting commands.
-- CLI: make `clawdbot logs --follow` output stable, keep spinners, and surface closed pipes. (#1318) — thanks @sebslight.
 - Status: route native `/status` to the active agent so model selection reflects the correct profile. (#1301)
 - Exec: prefer bash when fish is default shell, falling back to sh if bash is missing. (#1297) — thanks @ysqander.
 - Exec: merge login-shell PATH for host=gateway exec while keeping daemon PATH minimal. (#1304)

src/cli/logs-cli.test.ts

@@ -1,85 +0,0 @@
-import { Command } from "commander";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-const callGatewayFromCli = vi.fn();
-
-vi.mock("./gateway-rpc.js", async () => {
-  const actual = await vi.importActual<typeof import("./gateway-rpc.js")>("./gateway-rpc.js");
-  return {
-    ...actual,
-    callGatewayFromCli: (...args: unknown[]) => callGatewayFromCli(...args),
-  };
-});
-
-describe("logs cli", () => {
-  afterEach(() => {
-    callGatewayFromCli.mockReset();
-  });
-
-  it("writes output directly to stdout/stderr", async () => {
-    callGatewayFromCli.mockResolvedValueOnce({
-      file: "/tmp/clawdbot.log",
-      cursor: 1,
-      size: 123,
-      lines: ["raw line"],
-      truncated: true,
-      reset: true,
-    });
-
-    const stdoutWrites: string[] = [];
-    const stderrWrites: string[] = [];
-    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation((chunk: unknown) => {
-      stdoutWrites.push(String(chunk));
-      return true;
-    });
-    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
-      stderrWrites.push(String(chunk));
-      return true;
-    });
-
-    const { registerLogsCli } = await import("./logs-cli.js");
-    const program = new Command();
-    program.exitOverride();
-    registerLogsCli(program);
-
-    await program.parseAsync(["logs"], { from: "user" });
-
-    stdoutSpy.mockRestore();
-    stderrSpy.mockRestore();
-
-    expect(stdoutWrites.join("")).toContain("Log file:");
-    expect(stdoutWrites.join("")).toContain("raw line");
-    expect(stderrWrites.join("")).toContain("Log tail truncated");
-    expect(stderrWrites.join("")).toContain("Log cursor reset");
-  });
-
-  it("warns when the output pipe closes", async () => {
-    callGatewayFromCli.mockResolvedValueOnce({
-      file: "/tmp/clawdbot.log",
-      lines: ["line one"],
-    });
-
-    const stderrWrites: string[] = [];
-    const stdoutSpy = vi.spyOn(process.stdout, "write").mockImplementation(() => {
-      const err = new Error("EPIPE") as NodeJS.ErrnoException;
-      err.code = "EPIPE";
-      throw err;
-    });
-    const stderrSpy = vi.spyOn(process.stderr, "write").mockImplementation((chunk: unknown) => {
-      stderrWrites.push(String(chunk));
-      return true;
-    });
-
-    const { registerLogsCli } = await import("./logs-cli.js");
-    const program = new Command();
-    program.exitOverride();
-    registerLogsCli(program);
-
-    await program.parseAsync(["logs"], { from: "user" });
-
-    stdoutSpy.mockRestore();
-    stderrSpy.mockRestore();
-
-    expect(stderrWrites.join("")).toContain("output stdout closed");
-  });
-});

src/cli/logs-cli.ts

@@ -2,8 +2,8 @@ import { setTimeout as delay } from "node:timers/promises";
 import type { Command } from "commander";
 import { buildGatewayConnectionDetails } from "../gateway/call.js";
 import { parseLogLine } from "../logging/parse-log-line.js";
+import { defaultRuntime } from "../runtime.js";
 import { formatDocsLink } from "../terminal/links.js";
-import { clearActiveProgressLine } from "../terminal/progress-line.js";
 import { colorize, isRich, theme } from "../terminal/theme.js";
 import { formatCliCommand } from "./command-format.js";
 import { addGatewayClientOptions, callGatewayFromCli } from "./gateway-rpc.js";
@@ -104,68 +104,10 @@ function formatLogLine(
   return [head, messageValue].filter(Boolean).join(" ").trim();
 }
 
-let outputClosed = false;
-let outputClosedNotice = false;
-
-function isBrokenPipeError(err: unknown): err is NodeJS.ErrnoException {
-  const code = (err as NodeJS.ErrnoException)?.code;
-  return code === "EPIPE" || code === "EIO";
-}
-
-function noteOutputClosed(err: NodeJS.ErrnoException, stream: NodeJS.WriteStream) {
-  if (outputClosedNotice) return;
-  outputClosedNotice = true;
-  const code = err.code ?? "EPIPE";
-  const target = stream === process.stdout ? "stdout" : "stderr";
-  const message = `clawdbot logs: output ${target} closed (${code}). Stopping tail.`;
-  try {
-    clearActiveProgressLine();
-    process.stderr.write(`${message}\n`);
-  } catch {
-    // ignore secondary failures while reporting the broken pipe
-  }
-}
-
-function handleWriteError(err: unknown, stream: NodeJS.WriteStream): boolean {
-  if (!isBrokenPipeError(err)) {
-    throw err;
-  }
-  outputClosed = true;
-  noteOutputClosed(err, stream);
-  return false;
-}
-
-function writeText(text: string, stream: NodeJS.WriteStream): boolean {
-  if (outputClosed) return false;
-  try {
-    clearActiveProgressLine();
-  } catch (err) {
-    if (!handleWriteError(err, process.stderr)) return false;
-  }
-  try {
-    stream.write(text);
-    return true;
-  } catch (err) {
-    return handleWriteError(err, stream);
-  }
-}
-
-function writeLine(text: string, stream: NodeJS.WriteStream): boolean {
-  // Avoid feeding CLI output back into the log file via console capture.
-  return writeText(`${text}\n`, stream);
-}
-
-function logLine(text: string): boolean {
-  return writeLine(text, process.stdout);
-}
-
-function errorLine(text: string): boolean {
-  return writeLine(text, process.stderr);
-}
-
-function emitJsonLine(payload: Record<string, unknown>, toStdErr = false): boolean {
+function emitJsonLine(payload: Record<string, unknown>, toStdErr = false) {
   const text = `${JSON.stringify(payload)}\n`;
-  return writeText(text, toStdErr ? process.stderr : process.stdout);
+  if (toStdErr) process.stderr.write(text);
+  else process.stdout.write(text);
 }
 
 function emitGatewayError(
@@ -180,26 +122,22 @@ function emitGatewayError(
   const errorText = err instanceof Error ? err.message : String(err);
 
   if (mode === "json") {
-    if (
-      !emitJsonLine(
-        {
-          type: "error",
-          message,
-          error: errorText,
-          details,
-          hint,
-        },
-        true,
-      )
-    ) {
-      return;
-    }
+    emitJsonLine(
+      {
+        type: "error",
+        message,
+        error: errorText,
+        details,
+        hint,
+      },
+      true,
+    );
     return;
   }
 
-  if (!errorLine(colorize(rich, theme.error, message))) return;
-  if (!errorLine(details.message)) return;
-  errorLine(colorize(rich, theme.muted, hint));
+  defaultRuntime.error(colorize(rich, theme.error, message));
+  defaultRuntime.error(details.message);
+  defaultRuntime.error(colorize(rich, theme.muted, hint));
 }
 
 export function registerLogsCli(program: Command) {
@@ -221,8 +159,6 @@ export function registerLogsCli(program: Command) {
   addGatewayClientOptions(logs);
 
   logs.action(async (opts: LogsCliOptions) => {
-    outputClosed = false;
-    outputClosedNotice = false;
     const interval = parsePositiveInt(opts.interval, 1000);
     let cursor: number | undefined;
     let first = true;
@@ -236,83 +172,57 @@ export function registerLogsCli(program: Command) {
         payload = await fetchLogs(opts, cursor);
       } catch (err) {
         emitGatewayError(err, opts, jsonMode ? "json" : "text", rich);
-        process.exit(1);
+        defaultRuntime.exit(1);
         return;
       }
       const lines = Array.isArray(payload.lines) ? payload.lines : [];
       if (jsonMode) {
         if (first) {
-          if (
-            !emitJsonLine({
-              type: "meta",
-              file: payload.file,
-              cursor: payload.cursor,
-              size: payload.size,
-            })
-          ) {
-            return;
-          }
+          emitJsonLine({
+            type: "meta",
+            file: payload.file,
+            cursor: payload.cursor,
+            size: payload.size,
+          });
         }
         for (const line of lines) {
           const parsed = parseLogLine(line);
           if (parsed) {
-            if (!emitJsonLine({ type: "log", ...parsed })) {
-              return;
-            }
+            emitJsonLine({ type: "log", ...parsed });
           } else {
-            if (!emitJsonLine({ type: "raw", raw: line })) {
-              return;
-            }
+            emitJsonLine({ type: "raw", raw: line });
           }
         }
         if (payload.truncated) {
-          if (
-            !emitJsonLine({
-              type: "notice",
-              message: "Log tail truncated (increase --max-bytes).",
-            })
-          ) {
-            return;
-          }
+          emitJsonLine({
+            type: "notice",
+            message: "Log tail truncated (increase --max-bytes).",
+          });
         }
         if (payload.reset) {
-          if (
-            !emitJsonLine({
-              type: "notice",
-              message: "Log cursor reset (file rotated).",
-            })
-          ) {
-            return;
-          }
+          emitJsonLine({
+            type: "notice",
+            message: "Log cursor reset (file rotated).",
+          });
         }
       } else {
         if (first && payload.file) {
           const prefix = pretty ? colorize(rich, theme.muted, "Log file:") : "Log file:";
-          if (!logLine(`${prefix} ${payload.file}`)) {
-            return;
-          }
+          defaultRuntime.log(`${prefix} ${payload.file}`);
         }
         for (const line of lines) {
-          if (
-            !logLine(
-              formatLogLine(line, {
-                pretty,
-                rich,
-              }),
-            )
-          ) {
-            return;
-          }
+          defaultRuntime.log(
+            formatLogLine(line, {
+              pretty,
+              rich,
+            }),
+          );
         }
         if (payload.truncated) {
-          if (!errorLine("Log tail truncated (increase --max-bytes).")) {
-            return;
-          }
+          defaultRuntime.error("Log tail truncated (increase --max-bytes).");
         }
         if (payload.reset) {
-          if (!errorLine("Log cursor reset (file rotated).")) {
-            return;
-          }
+          defaultRuntime.error("Log cursor reset (file rotated).");
         }
       }
       cursor =

src/gateway/server.auth.test.ts

@@ -102,6 +102,33 @@ describe("gateway server auth/connect", () => {
     }
   });
 
+  test("accepts token auth without device identity", async () => {
+    const { server, ws, prevToken } = await startServerWithClient("secret");
+    const res = await connectReq(ws, { token: "secret", device: null });
+    expect(res.ok).toBe(true);
+    ws.close();
+    await server.close();
+    if (prevToken === undefined) {
+      delete process.env.CLAWDBOT_GATEWAY_TOKEN;
+    } else {
+      process.env.CLAWDBOT_GATEWAY_TOKEN = prevToken;
+    }
+  });
+
+  test("requires device identity when auth mode is none", async () => {
+    const { server, ws, prevToken } = await startServerWithClient();
+    const res = await connectReq(ws, { device: null });
+    expect(res.ok).toBe(false);
+    expect(res.error?.message ?? "").toContain("device identity required");
+    ws.close();
+    await server.close();
+    if (prevToken === undefined) {
+      delete process.env.CLAWDBOT_GATEWAY_TOKEN;
+    } else {
+      process.env.CLAWDBOT_GATEWAY_TOKEN = prevToken;
+    }
+  });
+
   test("accepts password auth when configured", async () => {
     testState.gatewayAuth = { mode: "password", password: "secret" };
     const port = await getFreePort();

src/gateway/server/ws-connection/message-handler.ts

@@ -290,9 +290,18 @@ export function attachGatewayWsMessageHandler(params: {
         connectParams.role = role;
         connectParams.scopes = scopes;
 
+        const authResult = await authorizeGatewayConnect({
+          auth: resolvedAuth,
+          connectAuth: connectParams.auth,
+          req: upgradeReq,
+        });
+        let authOk = authResult.ok;
+        let authMethod = authResult.method ?? "none";
+        const allowsDeviceOptional = authOk && authMethod === "token";
+
         const device = connectParams.device;
         let devicePublicKey: string | null = null;
-        if (!device) {
+        if (!device && !allowsDeviceOptional) {
           setHandshakeState("failed");
           setCloseCause("device-required", {
             client: connectParams.client.id,
@@ -458,14 +467,7 @@ export function attachGatewayWsMessageHandler(params: {
           }
         }
 
-        const authResult = await authorizeGatewayConnect({
-          auth: resolvedAuth,
-          connectAuth: connectParams.auth,
-          req: upgradeReq,
-        });
-        let authOk = authResult.ok;
-        let authMethod = authResult.method ?? "none";
-        if (!authOk && connectParams.auth?.token) {
+        if (!authOk && connectParams.auth?.token && device) {
           const tokenCheck = await verifyDeviceToken({
             deviceId: device.id,
             token: connectParams.auth.token,

src/gateway/test-helpers.server.ts

@@ -280,7 +280,7 @@ export async function connectReq(
       signature: string;
       signedAt: number;
       nonce?: string;
-    };
+    } | null;
   },
 ): Promise<ConnectResponse> {
   const { randomUUID } = await import("node:crypto");
@@ -294,6 +294,7 @@ export async function connectReq(
   const role = opts?.role ?? "operator";
   const requestedScopes = Array.isArray(opts?.scopes) ? opts?.scopes : [];
   const device = (() => {
+    if (opts?.device === null) return undefined;
     if (opts?.device) return opts.device;
     const identity = loadOrCreateDeviceIdentity();
     const signedAtMs = Date.now();