server.mjs

import http from 'node:http'
import crypto from 'node:crypto'
import { spawn } from 'node:child_process'
import { existsSync, readFileSync } from 'node:fs'
import net from 'node:net'
import tls from 'node:tls'
import next from 'next'
import { WebSocketServer, WebSocket } from 'ws'

function loadLocalEnvFile(pathname) {
  if (!existsSync(pathname)) return
  const lines = readFileSync(pathname, 'utf8').split(/\r?\n/)
  for (const line of lines) {
    const trimmed = line.trim()
    if (!trimmed || trimmed.startsWith('#')) continue
    const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/)
    if (!match || process.env[match[1]]) continue
    process.env[match[1]] = match[2].replace(/^['"]|['"]$/g, '')
  }
}

loadLocalEnvFile('.env.local')

function parseOptionalPort(value, name) {
  const raw = typeof value === 'string' ? value.trim() : ''
  if (!raw) return null
  const parsed = Number(raw)
  if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
    throw new Error(`${name} must be a TCP port between 1 and 65535`)
  }
  return parsed
}

const dev = process.env.NODE_ENV !== 'production'
const hostname = process.env.HOSTNAME || process.env.HOST || '0.0.0.0'
const port = Number(process.env.PORT || process.env.NEXT_PUBLIC_DASHBOARD_PORT || 3000)
const dashboardWsProxyPort = parseOptionalPort(process.env.OPENCLAW_DASHBOARD_WS_PROXY_PORT, 'OPENCLAW_DASHBOARD_WS_PROXY_PORT')
const terminalServerUrl = new URL(process.env.TERMINAL_SERVER_URL || 'http://127.0.0.1:3011')
const terminalWsProtocol = terminalServerUrl.protocol === 'https:' ? 'wss:' : 'ws:'
const terminalProxyPath = '/api/openshell/terminal/live/ws'
const legacyDashboardProxyPrefix = '/api/openshell/dashboard/proxy'
const instancesProxyPrefix = '/api/openshell/instances/'
const dashboardProxySuffix = '/dashboard/proxy'
const defaultDashboardUrl = process.env.OPENCLAW_DASHBOARD_URL || 'http://127.0.0.1:18789/'
const defaultInstanceId = 'default'
const sandboxDashboardPortBase = Number.parseInt(process.env.OPENCLAW_SANDBOX_DASHBOARD_PORT_BASE || '19000', 10)
const sandboxDashboardPortRange = 2000
const authCookieName = 'openshell_control_session'
const openClawDashboardTokenCookieName = 'openclaw_dashboard_token'

function now() {
  return new Date().toISOString()
}

function logBridge(event, fields = {}) {
  const payload = Object.entries(fields)
    .filter(([, value]) => value !== undefined && value !== null && value !== '')
    .map(([key, value]) => `${key}=${JSON.stringify(value)}`)
    .join(' ')
  console.log(`[terminal-bridge] ts=${now()} event=${event}${payload ? ` ${payload}` : ''}`)
}

const managedChildren = new Set()
let managedChildShutdownHandlersInstalled = false

function stopManagedChildren() {
  for (const child of managedChildren) {
    if (!child.killed) child.kill('SIGTERM')
  }
}

function installManagedChildShutdownHandlers() {
  if (managedChildShutdownHandlersInstalled) return
  managedChildShutdownHandlersInstalled = true
  process.once('exit', stopManagedChildren)
  process.once('SIGINT', () => {
    stopManagedChildren()
    process.exit(130)
  })
  process.once('SIGTERM', () => {
    stopManagedChildren()
    process.exit(143)
  })
}

function registerManagedChild(child) {
  managedChildren.add(child)
  installManagedChildShutdownHandlers()
  child.once('exit', () => {
    managedChildren.delete(child)
  })
}

function isAuthDisabled() {
  return /^(1|true|yes|on)$/i.test(process.env.OPENSHELL_CONTROL_AUTH_DISABLED || '')
}

function getAuthSecret() {
  return process.env.OPENSHELL_CONTROL_AUTH_SECRET || process.env.OPENSHELL_CONTROL_PASSWORD || ''
}

function base64UrlDecode(value) {
  const normalized = value.replace(/-/g, '+').replace(/_/g, '/')
  return Buffer.from(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '='), 'base64').toString('utf8')
}

function hmac(payload) {
  return crypto.createHmac('sha256', getAuthSecret()).update(payload).digest('base64url')
}

function safeEqual(left, right) {
  const leftBuffer = Buffer.from(left || '')
  const rightBuffer = Buffer.from(right || '')
  return leftBuffer.length === rightBuffer.length && crypto.timingSafeEqual(leftBuffer, rightBuffer)
}

function filterCookieHeader(value) {
  return String(value || '')
    .split(';')
    .map((part) => part.trim())
    .filter((part) => part && !part.startsWith(`${authCookieName}=`) && !part.startsWith(`${openClawDashboardTokenCookieName}=`))
    .join('; ')
}

function readCookieValue(value, name) {
  for (const part of String(value || '').split(';')) {
    const trimmed = part.trim()
    if (!trimmed.startsWith(`${name}=`)) continue
    try {
      return decodeURIComponent(trimmed.slice(name.length + 1))
    } catch {
      return trimmed.slice(name.length + 1)
    }
  }
  return null
}

function parseCookies(req) {
  return String(req.headers.cookie || '')
    .split(';')
    .reduce((cookies, part) => {
      const [rawName, ...rawValue] = part.trim().split('=')
      if (!rawName) return cookies
      cookies[rawName] = decodeURIComponent(rawValue.join('=') || '')
      return cookies
    }, {})
}

function isAuthenticatedUpgrade(req) {
  if (isAuthDisabled()) return true
  if (!process.env.OPENSHELL_CONTROL_PASSWORD) return false
  const value = parseCookies(req)[authCookieName]
  if (!value) return false
  const [payload, signature] = value.split('.')
  if (!payload || !signature || !safeEqual(signature, hmac(payload))) return false
  try {
    const parsed = JSON.parse(base64UrlDecode(payload))
    return typeof parsed.exp === 'number' && parsed.exp > Math.floor(Date.now() / 1000)
  } catch {
    return false
  }
}

function rejectUnauthorizedUpgrade(req, socket, path) {
  logBridge('upgrade-auth-rejected', {
    path,
    remoteAddress: req.socket.remoteAddress || 'unknown',
  })
  socket.end('HTTP/1.1 401 Unauthorized\r\nConnection: close\r\nContent-Length: 0\r\n\r\n')
}

function buildTerminalUpstreamUrl(req) {
  const incoming = new URL(req.url || '/', `http://${req.headers.host || `${hostname}:${port}`}`)
  const upstream = new URL('/ws', `${terminalWsProtocol}//${terminalServerUrl.host}`)
  incoming.searchParams.forEach((value, key) => upstream.searchParams.append(key, value))
  return upstream
}

function copyHeaders(req) {
  const headers = {}
  for (const [key, value] of Object.entries(req.headers)) {
    if (typeof value === 'undefined') continue
    const lowerKey = key.toLowerCase()
    if (
      ['connection', 'host', 'upgrade'].includes(lowerKey) ||
      lowerKey.startsWith('sec-websocket-')
    ) {
      continue
    }
    headers[key] = Array.isArray(value) ? value.join(', ') : value
  }
  return headers
}

function parseBoolean(value, fallback) {
  if (typeof value !== 'string') return fallback
  const normalized = value.trim().toLowerCase()
  if (!normalized) return fallback
  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true
  if (['0', 'false', 'no', 'off'].includes(normalized)) return false
  return fallback
}

function defaultOpenClawInstance() {
  return {
    id: defaultInstanceId,
    label: 'Default local OpenClaw',
    dashboardUrl: defaultDashboardUrl,
    controlUiOrigin: null,
    terminalServerUrl: process.env.TERMINAL_SERVER_URL || 'http://127.0.0.1:3011',
    loopbackOnly: true,
    default: true,
  }
}

function parseOpenClawInstanceRegistry() {
  const fallback = [defaultOpenClawInstance()]
  const raw = process.env.OPENCLAW_INSTANCE_REGISTRY_JSON?.trim()
  if (!raw) return fallback

  try {
    const parsed = JSON.parse(raw)
    if (!Array.isArray(parsed)) return fallback

    const normalized = parsed
      .map((entry) => {
        if (!entry || typeof entry !== 'object') return null
        const id = typeof entry.id === 'string' && entry.id.trim() ? entry.id.trim() : null
        const dashboardUrl = typeof entry.dashboardUrl === 'string' && entry.dashboardUrl.trim() ? entry.dashboardUrl.trim() : null
        if (!id || !dashboardUrl) return null

        return {
          id,
          label: typeof entry.label === 'string' && entry.label.trim() ? entry.label.trim() : id,
          dashboardUrl,
          controlUiOrigin: typeof entry.controlUiOrigin === 'string' && entry.controlUiOrigin.trim() ? entry.controlUiOrigin.trim() : null,
          terminalServerUrl: typeof entry.terminalServerUrl === 'string' && entry.terminalServerUrl.trim()
            ? entry.terminalServerUrl.trim()
            : process.env.TERMINAL_SERVER_URL || 'http://127.0.0.1:3011',
          loopbackOnly: parseBoolean(typeof entry.loopbackOnly === 'string' ? entry.loopbackOnly : undefined, entry.loopbackOnly ?? true),
          default: Boolean(entry.default),
        }
      })
      .filter(Boolean)

    if (normalized.length === 0) return fallback
    if (!normalized.some((entry) => entry.id === defaultInstanceId)) {
      normalized.unshift({ ...defaultOpenClawInstance(), default: normalized.some((entry) => entry.default) ? false : true })
    }
    return normalized
  } catch {
    return fallback
  }
}

function parseSandboxInstanceMap() {
  const defaultMap = process.env.MY_ASSISTANT_OPENCLAW_INSTANCE_ID?.trim()
    ? { 'my-assistant': process.env.MY_ASSISTANT_OPENCLAW_INSTANCE_ID.trim() }
    : {}
  const raw = process.env.OPENCLAW_SANDBOX_INSTANCE_MAP_JSON?.trim()
  if (!raw) return defaultMap

  try {
    const parsed = JSON.parse(raw)
    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return defaultMap
    const normalized = Object.entries(parsed).reduce((acc, [sandboxId, instanceId]) => {
      const normalizedSandboxId = typeof sandboxId === 'string' ? sandboxId.trim() : ''
      const normalizedInstanceId = typeof instanceId === 'string' ? instanceId.trim() : ''
      if (normalizedSandboxId && normalizedInstanceId) acc[normalizedSandboxId] = normalizedInstanceId
      return acc
    }, {})
    return Object.keys(normalized).length > 0 ? { ...defaultMap, ...normalized } : defaultMap
  } catch {
    return defaultMap
  }
}

const openClawInstances = parseOpenClawInstanceRegistry()
const openClawSandboxInstanceMap = parseSandboxInstanceMap()

function getDefaultOpenClawInstance() {
  return openClawInstances.find((entry) => entry.default) || openClawInstances[0] || defaultOpenClawInstance()
}

function resolveOpenClawInstance(instanceId) {
  const requested = typeof instanceId === 'string' ? instanceId.trim() : ''
  if (!requested) return getDefaultOpenClawInstance()
  const sandboxInstance = resolveSandboxOpenClawInstance(requested)
  if (sandboxInstance) return sandboxInstance
  return openClawInstances.find((entry) => entry.id === requested) || getDefaultOpenClawInstance()
}

function getMappedOpenClawInstanceId(sandboxId) {
  const requested = typeof sandboxId === 'string' ? sandboxId.trim() : ''
  return requested ? openClawSandboxInstanceMap[requested] || buildSandboxOpenClawInstanceId(requested) : null
}

function hashSandboxId(value) {
  let hash = 0
  for (let index = 0; index < value.length; index += 1) {
    hash = ((hash << 5) - hash + value.charCodeAt(index)) | 0
  }
  return Math.abs(hash)
}

function getSandboxOpenClawPort(sandboxId) {
  return sandboxDashboardPortBase + (hashSandboxId(sandboxId) % sandboxDashboardPortRange)
}

function buildSandboxOpenClawInstanceId(sandboxId) {
  return `sandbox-${getSandboxOpenClawPort(sandboxId)}-${sandboxId}`
}

function resolveSandboxOpenClawInstance(instanceId) {
  const requested = typeof instanceId === 'string' ? instanceId.trim() : ''
  const match = requested.match(/^sandbox-(\d+)-(.+)$/)
  if (!match) return null
  const port = Number.parseInt(match[1], 10)
  if (!Number.isFinite(port)) return null
  return {
    id: requested,
    label: `OpenClaw for ${match[2]}`,
    dashboardUrl: `http://127.0.0.1:${port}/`,
    controlUiOrigin: process.env.OPENCLAW_SANDBOX_CONTROL_UI_ORIGIN || 'http://127.0.0.1:18789',
    terminalServerUrl: process.env.TERMINAL_SERVER_URL || 'http://127.0.0.1:3011',
    loopbackOnly: true,
    default: false,
  }
}

function resolveDashboardUpstream(req) {
  const incoming = new URL(req.url || '/', `http://${req.headers.host || `${hostname}:${port}`}`)
  const { pathname, searchParams } = incoming

  let requestedInstanceId = null
  let proxyPrefix = legacyDashboardProxyPrefix

  if (pathname.startsWith(instancesProxyPrefix)) {
    const suffixIndex = pathname.indexOf(dashboardProxySuffix, instancesProxyPrefix.length)
    if (suffixIndex !== -1) {
      requestedInstanceId = decodeURIComponent(pathname.slice(instancesProxyPrefix.length, suffixIndex))
      proxyPrefix = `/api/openshell/instances/${encodeURIComponent(requestedInstanceId)}/dashboard/proxy`
    }
  }

  const sandboxId = searchParams.get('sandboxId')
  const mappedInstanceId = getMappedOpenClawInstanceId(sandboxId)
  const resolvedInstance = resolveOpenClawInstance(requestedInstanceId || mappedInstanceId)
  const upstreamHttpUrl = new URL(pathname.startsWith(proxyPrefix) ? pathname.slice(proxyPrefix.length) || '/' : '/', resolvedInstance.dashboardUrl)
  incoming.searchParams.forEach((value, key) => {
    if (key !== 'path' && key !== 'bootstrapUrl') upstreamHttpUrl.searchParams.append(key, value)
  })
  const upstreamWsUrl = new URL(upstreamHttpUrl.toString())
  upstreamWsUrl.protocol = upstreamWsUrl.protocol === 'https:' ? 'wss:' : 'ws:'

  return {
    proxyPrefix,
    upstreamWsUrl,
    controlUiOrigin: resolvedInstance.controlUiOrigin || new URL(resolvedInstance.dashboardUrl).origin,
    instanceId: resolvedInstance.id,
  }
}

function normalizeCloseCode(code) {
  return typeof code === 'number' && Number.isInteger(code) && code >= 1000 && code <= 4999 && code !== 1005 && code !== 1006 && code !== 1015
    ? code
    : 1000
}

function redactSensitiveUrl(value) {
  try {
    const url = new URL(value.toString())
    for (const key of ['token', 'authToken', 'access_token']) {
      if (url.searchParams.has(key)) url.searchParams.set(key, '<redacted>')
    }
    return url.toString()
  } catch {
    return String(value || '')
  }
}

function withDashboardTokenQuery(upstreamWsUrl, token) {
  const url = new URL(upstreamWsUrl.toString())
  if (token && !url.searchParams.has('token') && !url.searchParams.has('authToken')) {
    url.searchParams.set('token', token)
  }
  return url
}

function shouldAutoStartTerminalServer() {
  if (/^(0|false|no|off)$/i.test(process.env.TERMINAL_SERVER_AUTOSTART || '')) return false
  if (terminalServerUrl.protocol !== 'http:') return false
  return ['127.0.0.1', 'localhost', '[::1]', '::1'].includes(terminalServerUrl.hostname)
}

async function isTerminalServerReachable() {
  try {
    const response = await fetch(new URL('/healthz', terminalServerUrl), { cache: 'no-store' })
    return response.ok
  } catch {
    return false
  }
}

async function waitForTerminalServer(timeoutMs = 3000) {
  const deadline = Date.now() + timeoutMs
  while (Date.now() < deadline) {
    if (await isTerminalServerReachable()) return true
    await new Promise((resolve) => setTimeout(resolve, 150))
  }
  return false
}

async function startLocalTerminalServerIfNeeded() {
  if (!shouldAutoStartTerminalServer()) {
    logBridge('terminal-server-autostart-skipped', {
      terminalServerUrl: terminalServerUrl.toString(),
      reason: 'disabled-or-nonlocal',
    })
    return null
  }

  if (await isTerminalServerReachable()) {
    logBridge('terminal-server-existing', { terminalServerUrl: terminalServerUrl.toString() })
    return null
  }

  const child = spawn(process.execPath, ['terminal-server.mjs'], {
    cwd: process.cwd(),
    env: {
      ...process.env,
      TERMINAL_SERVER_HOST: terminalServerUrl.hostname === 'localhost' ? '127.0.0.1' : terminalServerUrl.hostname.replace(/^\[|\]$/g, ''),
      TERMINAL_SERVER_PORT: terminalServerUrl.port || '3011',
    },
    stdio: ['ignore', 'inherit', 'inherit'],
  })

  logBridge('terminal-server-autostarted', {
    pid: child.pid,
    terminalServerUrl: terminalServerUrl.toString(),
  })
  registerManagedChild(child)

  child.once('exit', (code, signal) => {
    logBridge('terminal-server-exited', { code, signal })
  })

  if (!await waitForTerminalServer()) {
    logBridge('terminal-server-autostart-not-ready', {
      terminalServerUrl: terminalServerUrl.toString(),
    })
  }

  return child
}

function shouldAutoStartInterSandboxChatSidecar() {
  return !/^(0|false|no|off)$/i.test(process.env.INTER_SANDBOX_CHAT_SIDECAR_AUTOSTART || '')
}

function startInterSandboxChatSidecar() {
  if (!shouldAutoStartInterSandboxChatSidecar()) {
    logBridge('inter-sandbox-chat-sidecar-autostart-skipped', {
      reason: 'disabled',
    })
    return null
  }

  const child = spawn(process.execPath, ['scripts/inter-sandbox-chat-sidecar.mjs'], {
    cwd: process.cwd(),
    env: process.env,
    stdio: ['ignore', 'inherit', 'inherit'],
  })

  logBridge('inter-sandbox-chat-sidecar-autostarted', {
    pid: child.pid,
  })
  registerManagedChild(child)

  child.once('error', (error) => {
    logBridge('inter-sandbox-chat-sidecar-error', {
      reason: error instanceof Error ? error.message : 'spawn failed',
    })
  })
  child.once('exit', (code, signal) => {
    logBridge('inter-sandbox-chat-sidecar-exited', { code, signal })
  })

  return child
}

const app = next({ dev, hostname, port })
const handle = app.getRequestHandler()

await startLocalTerminalServerIfNeeded()
startInterSandboxChatSidecar()
await app.prepare()
const handleUpgrade = typeof app.getUpgradeHandler === 'function'
  ? app.getUpgradeHandler()
  : null

const server = http.createServer((req, res) => handle(req, res))
const dashboardWsProxyServer = dashboardWsProxyPort
  ? http.createServer((_, res) => {
      res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' })
      res.end('OpenClaw dashboard websocket proxy only')
    })
  : null
const clientWss = new WebSocketServer({ noServer: true })
const dashboardWss = new WebSocketServer({ noServer: true })

function copyDashboardWebSocketHeaders(req, controlUiOrigin) {
  const headers = copyHeaders(req)
  const cookie = filterCookieHeader(req.headers.cookie)
  const dashboardToken = readCookieValue(req.headers.cookie, openClawDashboardTokenCookieName)
  if (cookie) headers.cookie = cookie
  else delete headers.cookie
  headers.origin = controlUiOrigin
  headers.referer = `${controlUiOrigin}/`
  if (dashboardToken && !headers.authorization) headers.authorization = `Bearer ${dashboardToken}`
  return headers
}

function handleDashboardProxyUpgrade(req, socket, head, logEvent) {
  const { upstreamWsUrl, instanceId, controlUiOrigin } = resolveDashboardUpstream(req)
  logBridge(logEvent, {
    path: req.url || '/',
    upstreamUrl: upstreamWsUrl.toString(),
    instanceId,
    remoteAddress: req.socket.remoteAddress || 'unknown',
  })
  dashboardWss.handleUpgrade(req, socket, head, (ws) => {
    dashboardWss.emit('connection', ws, req, { upstreamWsUrl, instanceId, controlUiOrigin })
  })
}

dashboardWss.on('connection', (client, req, context) => {
  const bridgeId = crypto.randomUUID()
  const dashboardToken = readCookieValue(req.headers.cookie, openClawDashboardTokenCookieName)
  const upstreamUrl = withDashboardTokenQuery(context.upstreamWsUrl, dashboardToken)
  const redactedUpstreamUrl = redactSensitiveUrl(upstreamUrl)
  const upstreamHeaders = copyDashboardWebSocketHeaders(req, context.controlUiOrigin)
  const upstream = new WebSocket(upstreamUrl.toString(), {
    headers: upstreamHeaders,
  })
  const pendingClientFrames = []
  let closing = false
  let clientFramesIn = 0
  let upstreamFramesOut = 0
  let upstreamFramesIn = 0
  let clientFramesOut = 0

  logBridge('dashboard-ws-client-connected', {
    bridgeId,
    path: req.url || '/',
    upstreamUrl: redactedUpstreamUrl,
    instanceId: context.instanceId,
    remoteAddress: req.socket.remoteAddress || 'unknown',
    upstreamHeaderKeys: Object.keys(upstreamHeaders).sort().join(','),
    dashboardTokenPresent: Boolean(dashboardToken),
  })

  const flushPendingFrames = () => {
    while (pendingClientFrames.length && upstream.readyState === WebSocket.OPEN) {
      const frame = pendingClientFrames.shift()
      upstreamFramesOut += 1
      upstream.send(frame.data, { binary: frame.isBinary })
    }
    logBridge('dashboard-ws-upstream-open', {
      bridgeId,
      bufferedFramesFlushed: upstreamFramesOut,
      pendingFrames: pendingClientFrames.length,
    })
  }

  const closeClient = (code = 1000, reason) => {
    const safeCode = normalizeCloseCode(code)
    if (client.readyState === WebSocket.OPEN) client.close(safeCode, reason)
    else if (client.readyState === WebSocket.CONNECTING) client.terminate()
  }

  const closeUpstream = (code = 1000, reason) => {
    const safeCode = normalizeCloseCode(code)
    if (upstream.readyState === WebSocket.OPEN) upstream.close(safeCode, reason)
    else if (upstream.readyState === WebSocket.CONNECTING) upstream.terminate()
  }

  const closeBoth = (code = 1000, reason, source = 'unknown') => {
    if (closing) return
    closing = true
    logBridge('dashboard-ws-closing', {
      bridgeId,
      source,
      code,
      reason,
      clientFramesIn,
      upstreamFramesOut,
      upstreamFramesIn,
      clientFramesOut,
      pendingFrames: pendingClientFrames.length,
    })
    closeClient(code, reason)
    closeUpstream(code, reason)
  }

  client.on('message', (data, isBinary) => {
    clientFramesIn += 1
    if (upstream.readyState === WebSocket.OPEN) {
      upstreamFramesOut += 1
      upstream.send(data, { binary: isBinary })
      return
    }

    if (upstream.readyState === WebSocket.CONNECTING) {
      pendingClientFrames.push({ data, isBinary })
      return
    }

    closeBoth(1011, 'upstream unavailable', 'dashboard-client-message-no-upstream')
  })

  client.on('close', (code, reasonBuffer) => {
    const reason = Buffer.isBuffer(reasonBuffer) ? reasonBuffer.toString() : String(reasonBuffer || '')
    closeBoth(code || 1000, reason || undefined, 'dashboard-client-close')
  })
  client.on('error', (error) => closeBoth(1011, error instanceof Error ? error.message : 'dashboard client error', 'dashboard-client-error'))

  upstream.on('open', () => {
    logBridge('dashboard-ws-upstream-connected', {
      bridgeId,
      upstreamUrl: redactedUpstreamUrl,
      instanceId: context.instanceId,
    })
    flushPendingFrames()
  })

  upstream.on('message', (data, isBinary) => {
    upstreamFramesIn += 1
    if (client.readyState === WebSocket.OPEN) {
      clientFramesOut += 1
      client.send(data, { binary: isBinary })
    }
  })

  upstream.on('close', (code, reasonBuffer) => {
    const reason = Buffer.isBuffer(reasonBuffer) ? reasonBuffer.toString() : String(reasonBuffer || '')
    closeBoth(code || 1000, reason || undefined, 'dashboard-upstream-close')
  })

  upstream.on('error', (error) => {
    logBridge('dashboard-ws-upstream-error', {
      bridgeId,
      upstreamUrl: redactedUpstreamUrl,
      instanceId: context.instanceId,
      reason: error instanceof Error ? error.message : 'dashboard upstream error',
    })
    closeBoth(1011, error instanceof Error ? error.message : 'dashboard upstream error', 'dashboard-upstream-error')
  })
})

function buildRawDashboardUpgradeHeaders(req, upstreamWsUrl, controlUiOrigin) {
  const headers = []
  const dashboardToken = readCookieValue(req.headers.cookie, openClawDashboardTokenCookieName)
  const rawHeaders = new Map()

  for (let i = 0; i < req.rawHeaders.length; i += 2) {
    const name = req.rawHeaders[i]
    const value = req.rawHeaders[i + 1]
    const lowerName = name.toLowerCase()
    if (!rawHeaders.has(lowerName)) rawHeaders.set(lowerName, [])
    rawHeaders.get(lowerName).push({ name, value })
  }

  const firstValue = (name) => rawHeaders.get(name)?.[0]?.value
  const pushRaw = (name) => {
    for (const header of rawHeaders.get(name) || []) {
      headers.push(`${header.name}: ${header.value}`)
    }
  }

  headers.push(`Host: ${upstreamWsUrl.host}`)
  headers.push(`Upgrade: ${firstValue('upgrade') || 'websocket'}`)
  headers.push(`Connection: ${firstValue('connection') || 'Upgrade'}`)
  if (firstValue('sec-websocket-key')) pushRaw('sec-websocket-key')
  if (firstValue('sec-websocket-version')) pushRaw('sec-websocket-version')
  pushRaw('sec-websocket-protocol')
  pushRaw('sec-websocket-extensions')
  headers.push(`Origin: ${controlUiOrigin}`)

  for (const header of rawHeaders.get('cookie') || []) {
    const filteredCookie = filterCookieHeader(header.value)
    if (filteredCookie) headers.push(`Cookie: ${filteredCookie}`)
  }

  if (rawHeaders.has('authorization')) {
    pushRaw('authorization')
  } else if (dashboardToken) {
    headers.push(`Authorization: Bearer ${dashboardToken}`)
  }

  return headers
}

function tunnelDashboardUpgrade(req, socket, head, upstreamWsUrl, instanceId, controlUiOrigin) {
  socket.pause()
  const dashboardToken = readCookieValue(req.headers.cookie, openClawDashboardTokenCookieName)
  const upstreamUrlWithToken = withDashboardTokenQuery(upstreamWsUrl, dashboardToken)
  const redactedUpstreamUrl = redactSensitiveUrl(upstreamUrlWithToken)
  const isSecure = upstreamUrlWithToken.protocol === 'wss:'
  const port = Number(upstreamUrlWithToken.port || (isSecure ? 443 : 80))
  const upstreamSocket = isSecure
    ? tls.connect({ host: upstreamUrlWithToken.hostname, port, servername: upstreamUrlWithToken.hostname })
    : net.connect({ host: upstreamUrlWithToken.hostname, port })
  const upstreamPath = `${upstreamUrlWithToken.pathname || '/'}${upstreamUrlWithToken.search || ''}`
  const requestHead = [
    `GET ${upstreamPath} HTTP/1.1`,
    ...buildRawDashboardUpgradeHeaders(req, upstreamUrlWithToken, controlUiOrigin),
    '',
    '',
  ].join('\r\n')
  let opened = false
  let upstreamBytes = 0
  let clientBytes = 0

  upstreamSocket.once(isSecure ? 'secureConnect' : 'connect', () => {
    opened = true
    upstreamSocket.write(requestHead)
    if (head?.length) upstreamSocket.write(head)
    socket.pipe(upstreamSocket, { end: false })
    upstreamSocket.pipe(socket, { end: false })
    upstreamSocket.resume()
    socket.resume()
    logBridge('dashboard-tunnel-open', {
      path: req.url || '/',
      upstreamUrl: redactedUpstreamUrl,
      instanceId,
      remoteAddress: req.socket.remoteAddress || 'unknown',
      dashboardTokenPresent: Boolean(dashboardToken),
    })
  })

  upstreamSocket.on('data', (chunk) => {
    upstreamBytes += chunk.length
  })

  socket.on('data', (chunk) => {
    clientBytes += chunk.length
  })

  upstreamSocket.on('error', (error) => {
    logBridge('dashboard-tunnel-error', {
      path: req.url || '/',
      upstreamUrl: redactedUpstreamUrl,
      instanceId,
      reason: error instanceof Error ? error.message : 'upstream error',
    })
    if (!opened && !socket.destroyed) {
      socket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\nContent-Length: 0\r\n\r\n')
    } else {
      socket.destroy()
    }
  })

  upstreamSocket.on('close', (hadError) => {
    logBridge('dashboard-tunnel-upstream-close', {
      path: req.url || '/',
      upstreamUrl: redactedUpstreamUrl,
      instanceId,
      hadError,
      upstreamBytes,
      clientBytes,
    })
  })

  socket.on('error', () => upstreamSocket.destroy())
  socket.on('close', (hadError) => {
    logBridge('dashboard-tunnel-client-close', {
      path: req.url || '/',
      upstreamUrl: redactedUpstreamUrl,
      instanceId,
      hadError,
      upstreamBytes,
      clientBytes,
    })
    upstreamSocket.destroy()
  })
}

clientWss.on('connection', (client, req) => {
  const bridgeId = crypto.randomUUID()
  const upstreamUrl = buildTerminalUpstreamUrl(req)
  const upstream = new WebSocket(upstreamUrl, { headers: copyHeaders(req) })
  const pendingClientFrames = []
  let closing = false
  let clientFramesIn = 0
  let upstreamFramesOut = 0
  let upstreamFramesIn = 0
  let clientFramesOut = 0

  logBridge('client-connected', {
    bridgeId,
    path: req.url || '/',
    upstreamUrl: upstreamUrl.toString(),
    remoteAddress: req.socket.remoteAddress || 'unknown',
  })

  const flushPendingFrames = () => {
    while (pendingClientFrames.length && upstream.readyState === WebSocket.OPEN) {
      const frame = pendingClientFrames.shift()
      upstreamFramesOut += 1
      upstream.send(frame.data, { binary: frame.isBinary })
    }
    logBridge('upstream-open', {
      bridgeId,
      bufferedFramesFlushed: upstreamFramesOut,
      pendingFrames: pendingClientFrames.length,
    })
  }

  const closeClient = (code = 1000, reason) => {
    const safeCode = normalizeCloseCode(code)
    if (client.readyState === WebSocket.OPEN) client.close(safeCode, reason)
    else if (client.readyState === WebSocket.CONNECTING) client.terminate()
  }

  const closeUpstream = (code = 1000, reason) => {
    const safeCode = normalizeCloseCode(code)
    if (upstream.readyState === WebSocket.OPEN) upstream.close(safeCode, reason)
    else if (upstream.readyState === WebSocket.CONNECTING) upstream.terminate()
  }

  const closeBoth = (code = 1000, reason, source = 'unknown') => {
    if (closing) return
    closing = true
    logBridge('bridge-closing', {
      bridgeId,
      source,
      code,
      reason,
      clientFramesIn,
      upstreamFramesOut,
      upstreamFramesIn,
      clientFramesOut,
      pendingFrames: pendingClientFrames.length,
    })
    closeClient(code, reason)
    closeUpstream(code, reason)
  }

  client.on('message', (data, isBinary) => {
    clientFramesIn += 1
    if (upstream.readyState === WebSocket.OPEN) {
      upstreamFramesOut += 1
      upstream.send(data, { binary: isBinary })
      return
    }

    if (upstream.readyState === WebSocket.CONNECTING) {
      pendingClientFrames.push({ data, isBinary })
      return
    }

    closeBoth(1011, 'upstream unavailable', 'client-message-no-upstream')
  })

  client.on('close', (code, reasonBuffer) => {
    const reason = Buffer.isBuffer(reasonBuffer) ? reasonBuffer.toString() : String(reasonBuffer || '')
    closeBoth(code || 1000, reason || undefined, 'client-close')
  })
  client.on('error', (error) => closeBoth(1011, error instanceof Error ? error.message : 'client error', 'client-error'))

  upstream.on('open', () => {
    flushPendingFrames()
  })

  upstream.on('message', (data, isBinary) => {
    upstreamFramesIn += 1
    if (client.readyState === WebSocket.OPEN) {
      clientFramesOut += 1
      client.send(data, { binary: isBinary })
    }
  })

  upstream.on('close', (code, reasonBuffer) => {
    const reason = Buffer.isBuffer(reasonBuffer) ? reasonBuffer.toString() : String(reasonBuffer || '')
    closeBoth(code || 1000, reason || undefined, 'upstream-close')
  })

  upstream.on('error', (error) => {
    closeBoth(1011, error instanceof Error ? error.message : 'upstream error', 'upstream-error')
  })
})

server.on('upgrade', (req, socket, head) => {
  if ((req.url || '').startsWith(terminalProxyPath)) {
    if (!isAuthenticatedUpgrade(req)) {
      rejectUnauthorizedUpgrade(req, socket, req.url || '/')
      return
    }
    logBridge('upgrade-accepted', {
      path: req.url || '/',
      remoteAddress: req.socket.remoteAddress || 'unknown',
    })
    clientWss.handleUpgrade(req, socket, head, (ws) => {
      clientWss.emit('connection', ws, req)
    })
    return
  }

  if (
    (req.url || '').startsWith(legacyDashboardProxyPrefix) ||
    (req.url || '').startsWith(instancesProxyPrefix)
  ) {
    if (!isAuthenticatedUpgrade(req)) {
      rejectUnauthorizedUpgrade(req, socket, req.url || '/')
      return
    }
    handleDashboardProxyUpgrade(req, socket, head, 'dashboard-upgrade-accepted')
    return
  }

  logBridge('upgrade-rejected', {
    path: req.url || '/',
    remoteAddress: req.socket.remoteAddress || 'unknown',
  })
  if (handleUpgrade) {
    handleUpgrade(req, socket, head)
    return
  }
  socket.destroy()
})

if (dashboardWsProxyServer) {
  dashboardWsProxyServer.on('upgrade', (req, socket, head) => {
    if ((req.url || '').startsWith(terminalProxyPath)) {
      if (!isAuthenticatedUpgrade(req)) {
        rejectUnauthorizedUpgrade(req, socket, req.url || '/')
        return
      }
      logBridge('terminal-sidecar-upgrade-accepted', {
        path: req.url || '/',
        remoteAddress: req.socket.remoteAddress || 'unknown',
      })
      clientWss.handleUpgrade(req, socket, head, (ws) => {
        clientWss.emit('connection', ws, req)
      })
      return
    }

    if (
      (req.url || '').startsWith(legacyDashboardProxyPrefix) ||
      (req.url || '').startsWith(instancesProxyPrefix)
    ) {
      if (!isAuthenticatedUpgrade(req)) {
        rejectUnauthorizedUpgrade(req, socket, req.url || '/')
        return
      }
      handleDashboardProxyUpgrade(req, socket, head, 'dashboard-sidecar-upgrade-accepted')
      return
    }

    logBridge('dashboard-sidecar-upgrade-rejected', {
      path: req.url || '/',
      remoteAddress: req.socket.remoteAddress || 'unknown',
    })
    socket.destroy()
  })
}

server.listen(port, hostname, () => {
  console.log(`dashboard server listening on http://${hostname}:${port}`)
  logBridge('server-listening', {
    hostname,
    port,
    terminalServerUrl: terminalServerUrl.toString(),
    soleOwnerPath: terminalProxyPath,
    dashboardWebSocketPath: legacyDashboardProxyPrefix,
    dashboardSidecarPort: dashboardWsProxyPort,
  })
})

if (dashboardWsProxyServer) {
  dashboardWsProxyServer.listen(dashboardWsProxyPort, hostname, () => {
    logBridge('dashboard-sidecar-listening', {
      hostname,
      port: dashboardWsProxyPort,
    })
  })
}