Claude-coauthored code created an embedded control server with no authentication. Anyone who could reach it could invoke non-health command routes.

+ * This is NOT a separate process. It runs inside the plugin (or standalone)+ * and provides HTTP endpoints for the CLI to connect to.+ *+ * Users never need to configure or manage this — it just works.+ */++import * as http from 'node:http';+import { SessionManager } from './session-manager.js';+import type { EffortLevel } from './types.js';

++  constructor(manager: SessionManager, port?: number) {+    this.manager = manager;+    this.port = port || DEFAULT_PORT;+  }

+          // Port already in use — another instance running, skip+          console.log(`[embedded-server] Port ${this.port} in use, skipping (another instance running)`);+          this.server = null;+          resolve(0);+        } else {+          reject(err);+        }+      });++      this.server.listen(this.port, '127.0.0.1', () => {+        console.log(`[embedded-server] Listening on http://127.0.0.1:${this.port}`);+        resolve(this.port);+      });+    });+  }++  async stop(): Promise<void> {+    if (!this.server) return;+    return new Promise(resolve => {+      this.server!.close(() => resolve());+    });+  }++  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {+    // CORS+    res.setHeader('Access-Control-Allow-Origin', '*');+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type');+    if (req.method === 'OPTIONS') { res.writeHead(200); res.end(); return; }++    const url = new URL(req.url || '/', `http://localhost:${this.port}`);+    const path = url.pathname;++    // Read body for POST+    if (req.method === 'POST') {+      let body = '';+      req.on('data', chunk => { body += chunk; });+      req.on('end', () => {+        let parsed: Record<string, unknown> = {};+        try { parsed = JSON.parse(body || '{}'); } catch {}+        this.route(path, parsed, url.searchParams, res);+      });+    } else {+      this.route(path, {}, url.searchParams, res);+    }+  }++  private async route(+    path: string, body: Record<string, unknown>,+    query: URLSearchParams, res: http.ServerResponse,+  ): Promise<void> {+    try {+      const json = (status: number, data: unknown) => {+        res.writeHead(status, { 'Content-Type': 'application/json' });+        res.end(JSON.stringify(data));+      };++      // ─── Session Routes ──────────────────────────────────────────

+import * as crypto from 'node:crypto'; import { SessionManager } from './session-manager.js'; import { sanitizeCwd, validateRegex } from './validation.js'; import type { EffortLevel } from './types.js';@@ -51,23 +52,45 @@ export class EmbeddedServer {     return recent.length <= this._rateLimit;   } +  private _writeTokenFile(token: string): void {

   async start(): Promise<number> {-    // Auth token: opt-in via OPENCLAW_SERVER_TOKEN env var.-    // When set, all requests (except /health) must include Authorization: Bearer <token>.-    // Default: no auth (localhost-only is the primary security boundary).

+    //   OPENCLAW_SERVER_TOKEN=<v>  → use the explicit token (legacy behaviour).+    //   OPENCLAW_SERVER_TOKEN=disabled → opt out of auth entirely. Only safe on+    //                                  a single-user host; loud warning at start.+    //+    // The file is mode 0600 (owner-read-only). Same-user CLI + dashboard read it;+    // other users on the same box cannot. Browsers reach /dashboard via the+    // `?token=<v>` query once; the server replies with a Set-Cookie so subsequent+    // requests authenticate via the cookie.     const envToken = process.env.OPENCLAW_SERVER_TOKEN;-    if (envToken) {+    if (envToken === 'disabled') {+      this.authToken = null;+      console.warn(+        '[embedded-server] OPENCLAW_SERVER_TOKEN=disabled — authentication is OFF. ' ++          'All endpoints are reachable to any process that can connect. Only safe on a trusted single-user host.',+      );+    } else if (envToken) {       this.authToken = envToken;-      // Write token to file for CLI to read

     this._rateLimitCleanupTimer = setInterval(() => {@@ -95,9 +118,15 @@ export class EmbeddedServer {       });        this.server.listen(this.port, this.host, () => {-        console.log(-          `[embedded-server] Listening on http://${this.host}:${this.port}${this.authToken ? ' (auth enabled)' : ''}`,

+        } else {+          console.log(`[embedded-server] Listening on http://${this.host}:${this.port} (AUTH DISABLED)`);+        }         resolve(this.port);       });     });@@ -143,14 +172,36 @@ export class EmbeddedServer {     const url = new URL(req.url || '/', `http://localhost:${this.port}`);     const path = url.pathname; 

+import * as fs from 'node:fs';+import * as path from 'node:path';+import * as os from 'node:os';  function getBaseUrl(): string {   return process.env.CLAWO_API_URL || process.env.CLAUDE_CODE_API_URL || 'http://127.0.0.1:18796'; } +/**+ * Locate the auth token the embedded server requires (3.5.6+):

+function getAuthToken(): string | null {

+    return null;+  }+}+ function getCliVersion(): string {   try {     const _require = createRequire(import.meta.url);@@ -29,10 +53,10 @@ function getCliVersion(): string { // ─── HTTP Client ─────────────────────────────────────────────────────────────  async function api(path: string, method = 'GET', body?: unknown): Promise<Record<string, unknown>> {-  const opts: RequestInit = {-    method,-    headers: { 'Content-Type': 'application/json' },-  };+  const headers: Record<string, string> = { 'Content-Type': 'application/json' };+  const token = getAuthToken();+  if (token) headers.Authorization = `Bearer ${token}`;+  const opts: RequestInit = { method, headers };   if (body) opts.body = JSON.stringify(body);   try {     const base = getBaseUrl();