From 61c46fd710acc7ee42892d586c74970243c23219 Mon Sep 17 00:00:00 2001
From: lpf <lipengfei886@qq.com>
Date: Fri, 6 Mar 2026 17:53:01 +0800
Subject: [PATCH] Generate gateway token during onboard

---
 cmd/clawgo/cmd_onboard.go      |  3 +++
 cmd/clawgo/cmd_onboard_test.go | 31 +++++++++++++++++++++++++++++++
 pkg/config/config.go           | 12 +++++++++++-
 pkg/config/validate_test.go    |  9 +++++++++
 4 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 cmd/clawgo/cmd_onboard_test.go

diff --git a/cmd/clawgo/cmd_onboard.go b/cmd/clawgo/cmd_onboard.go
index 881e215..5053592 100644
--- a/cmd/clawgo/cmd_onboard.go
+++ b/cmd/clawgo/cmd_onboard.go
@@ -44,6 +44,9 @@ func ensureConfigOnboard(configPath string, defaults *config.Config) (string, er
 	if defaults == nil {
 		return "", fmt.Errorf("defaults is nil")
 	}
+	if defaults.Gateway.Token == "" {
+		defaults.Gateway.Token = config.DefaultConfig().Gateway.Token
+	}
 
 	exists := true
 	if _, err := os.Stat(configPath); os.IsNotExist(err) {
diff --git a/cmd/clawgo/cmd_onboard_test.go b/cmd/clawgo/cmd_onboard_test.go
new file mode 100644
index 0000000..80e9b4c
--- /dev/null
+++ b/cmd/clawgo/cmd_onboard_test.go
@@ -0,0 +1,31 @@
+package main
+
+import (
+	"testing"
+
+	"clawgo/pkg/config"
+)
+
+func TestEnsureConfigOnboardGeneratesGatewayToken(t *testing.T) {
+	t.Parallel()
+
+	configPath := t.TempDir() + "/config.json"
+	cfg := config.DefaultConfig()
+	cfg.Gateway.Token = ""
+
+	state, err := ensureConfigOnboard(configPath, cfg)
+	if err != nil {
+		t.Fatalf("ensureConfigOnboard failed: %v", err)
+	}
+	if state != "created" {
+		t.Fatalf("unexpected state: %s", state)
+	}
+
+	loaded, err := config.LoadConfig(configPath)
+	if err != nil {
+		t.Fatalf("load config failed: %v", err)
+	}
+	if loaded.Gateway.Token == "" {
+		t.Fatalf("expected gateway token to be generated")
+	}
+}
diff --git a/pkg/config/config.go b/pkg/config/config.go
index dc63903..67d7884 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -2,6 +2,8 @@ package config
 
 import (
 	"bytes"
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -510,7 +512,7 @@ func DefaultConfig() *Config {
 		Gateway: GatewayConfig{
 			Host:  "0.0.0.0",
 			Port:  18790,
-			Token: "",
+			Token: generateGatewayToken(),
 		},
 		Cron: CronConfig{
 			MinSleepSec:                  1,
@@ -568,6 +570,14 @@ func DefaultConfig() *Config {
 	}
 }
 
+func generateGatewayToken() string {
+	var buf [16]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		return ""
+	}
+	return "cg_" + hex.EncodeToString(buf[:])
+}
+
 func LoadConfig(path string) (*Config, error) {
 	cfg := DefaultConfig()
 
diff --git a/pkg/config/validate_test.go b/pkg/config/validate_test.go
index 53885df..910e7f7 100644
--- a/pkg/config/validate_test.go
+++ b/pkg/config/validate_test.go
@@ -2,6 +2,15 @@ package config
 
 import "testing"
 
+func TestDefaultConfigGeneratesGatewayToken(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	if cfg.Gateway.Token == "" {
+		t.Fatalf("expected default gateway token")
+	}
+}
+
 func TestValidateSubagentsAllowsKnownPeers(t *testing.T) {
 	t.Parallel()