Generate gateway token during onboard

cmd/clawgo/cmd_onboard.go

@@ -44,6 +44,9 @@ func ensureConfigOnboard(configPath string, defaults *config.Config) (string, er
 	if defaults == nil {
 		return "", fmt.Errorf("defaults is nil")
 	}
+	if defaults.Gateway.Token == "" {
+		defaults.Gateway.Token = config.DefaultConfig().Gateway.Token
+	}
 
 	exists := true
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {

cmd/clawgo/cmd_onboard_test.go

@@ -0,0 +1,31 @@
+package main
+
+import (
+	"testing"
+
+	"clawgo/pkg/config"
+)
+
+func TestEnsureConfigOnboardGeneratesGatewayToken(t *testing.T) {
+	t.Parallel()
+
+	configPath := t.TempDir() + "/config.json"
+	cfg := config.DefaultConfig()
+	cfg.Gateway.Token = ""
+
+	state, err := ensureConfigOnboard(configPath, cfg)
+	if err != nil {
+		t.Fatalf("ensureConfigOnboard failed: %v", err)
+	}
+	if state != "created" {
+		t.Fatalf("unexpected state: %s", state)
+	}
+
+	loaded, err := config.LoadConfig(configPath)
+	if err != nil {
+		t.Fatalf("load config failed: %v", err)
+	}
+	if loaded.Gateway.Token == "" {
+		t.Fatalf("expected gateway token to be generated")
+	}
+}

pkg/config/config.go

@@ -2,6 +2,8 @@ package config
 
 import (
 	"bytes"
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -510,7 +512,7 @@ func DefaultConfig() *Config {
 		Gateway: GatewayConfig{
 			Host:  "0.0.0.0",
 			Port:  18790,
-			Token: "",
+			Token: generateGatewayToken(),
 		},
 		Cron: CronConfig{
 			MinSleepSec:                  1,
@@ -568,6 +570,14 @@ func DefaultConfig() *Config {
 	}
 }
 
+func generateGatewayToken() string {
+	var buf [16]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		return ""
+	}
+	return "cg_" + hex.EncodeToString(buf[:])
+}
+
 func LoadConfig(path string) (*Config, error) {
 	cfg := DefaultConfig()
 

pkg/config/validate_test.go

@@ -2,6 +2,15 @@ package config
 
 import "testing"
 
+func TestDefaultConfigGeneratesGatewayToken(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	if cfg.Gateway.Token == "" {
+		t.Fatalf("expected default gateway token")
+	}
+}
+
 func TestValidateSubagentsAllowsKnownPeers(t *testing.T) {
 	t.Parallel()