fix: gate node p2p behind explicit config

pkg/config/config.go

@@ -288,9 +288,19 @@ type ProviderResponsesConfig struct {
 }
 
 type GatewayConfig struct {
-	Host  string `json:"host" env:"CLAWGO_GATEWAY_HOST"`
-	Port  int    `json:"port" env:"CLAWGO_GATEWAY_PORT"`
-	Token string `json:"token" env:"CLAWGO_GATEWAY_TOKEN"`
+	Host  string             `json:"host" env:"CLAWGO_GATEWAY_HOST"`
+	Port  int                `json:"port" env:"CLAWGO_GATEWAY_PORT"`
+	Token string             `json:"token" env:"CLAWGO_GATEWAY_TOKEN"`
+	Nodes GatewayNodesConfig `json:"nodes,omitempty"`
+}
+
+type GatewayNodesConfig struct {
+	P2P GatewayNodesP2PConfig `json:"p2p,omitempty"`
+}
+
+type GatewayNodesP2PConfig struct {
+	Enabled   bool   `json:"enabled"`
+	Transport string `json:"transport,omitempty"`
 }
 
 type CronConfig struct {
@@ -534,6 +544,12 @@ func DefaultConfig() *Config {
 			Host:  "0.0.0.0",
 			Port:  18790,
 			Token: generateGatewayToken(),
+			Nodes: GatewayNodesConfig{
+				P2P: GatewayNodesP2PConfig{
+					Enabled:   false,
+					Transport: "websocket_tunnel",
+				},
+			},
 		},
 		Cron: CronConfig{
 			MinSleepSec:                  1,

pkg/config/validate.go

@@ -119,6 +119,11 @@ func Validate(cfg *Config) []error {
 	if cfg.Gateway.Port <= 0 || cfg.Gateway.Port > 65535 {
 		errs = append(errs, fmt.Errorf("gateway.port must be in 1..65535"))
 	}
+	switch strings.ToLower(strings.TrimSpace(cfg.Gateway.Nodes.P2P.Transport)) {
+	case "", "websocket_tunnel", "webrtc":
+	default:
+		errs = append(errs, fmt.Errorf("gateway.nodes.p2p.transport must be one of: websocket_tunnel, webrtc"))
+	}
 	if cfg.Cron.MinSleepSec <= 0 {
 		errs = append(errs, fmt.Errorf("cron.min_sleep_sec must be > 0"))
 	}

pkg/config/validate_test.go

@@ -128,3 +128,26 @@ func TestValidateSubagentsRejectsInvalidNotifyMainPolicy(t *testing.T) {
 		t.Fatalf("expected validation errors")
 	}
 }
+
+func TestDefaultConfigDisablesGatewayNodeP2P(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	if cfg.Gateway.Nodes.P2P.Enabled {
+		t.Fatalf("expected gateway node p2p to be disabled by default")
+	}
+	if cfg.Gateway.Nodes.P2P.Transport != "websocket_tunnel" {
+		t.Fatalf("unexpected default gateway node p2p transport: %s", cfg.Gateway.Nodes.P2P.Transport)
+	}
+}
+
+func TestValidateRejectsUnknownGatewayNodeP2PTransport(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.Gateway.Nodes.P2P.Transport = "udp"
+
+	if errs := Validate(cfg); len(errs) == 0 {
+		t.Fatalf("expected validation errors")
+	}
+}