dependabot[bot]
ec8d7dd21f
Bumps [ws](https://github.com/websockets/ws) from 8.21.1 to 8.21.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.21.3</h2> <h1>Bug fixes</h1> <ul> <li>The server now correctly rejects permessage-deflate offers if the incoming <code>client_max_window_bits</code> parameter value is smaller than its configured <code>clientMaxWindowBits</code> (e97a20ea).</li> </ul> <h2>8.21.2</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a test for <a href="https://github.com/nodejs/citgm">CITGM</a> (2eb3be0b).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/c791e707eab3c13dd9a261d2479c3cc4a49a6fed"><code>c791e70</code></a> [dist] 8.21.3</li> <li><a href="https://github.com/websockets/ws/commit/e97a20eaa6f2ad7969419eed732a506453251eb9"><code>e97a20e</code></a> [fix] Reject offers with <code>client_max_window_bits</code> below config</li> <li><a href="https://github.com/websockets/ws/commit/787ebf22ce3d091fb6f931d20b4c7e914ba7cf85"><code>787ebf2</code></a> [dist] 8.21.2</li> <li><a href="https://github.com/websockets/ws/commit/b4d62ebad40c3b925c84ff305a47975406015422"><code>b4d62eb</code></a> Revert "[ci] Trust Coveralls Homebrew tap"</li> <li><a href="https://github.com/websockets/ws/commit/e4bb883723a0c18452eea10a74139901ae33c61d"><code>e4bb883</code></a> [security] Use GitHub PVR as main reporting channel</li> <li><a href="https://github.com/websockets/ws/commit/2eb3be0bff2453e2654b1315c5872e8d5d424a50"><code>2eb3be0</code></a> [test] Skip test on Node.js versions where it does not apply</li> <li>See full diff in <a href="https://github.com/websockets/ws/compare/8.21.1...8.21.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
OpenClaw Gateway Adapter
This document describes how @paperclipai/adapter-openclaw-gateway invokes OpenClaw over the Gateway protocol.
Transport
This adapter always uses WebSocket gateway transport.
- URL must be
ws://orwss:// - Connect flow follows gateway protocol:
- receive
connect.challenge - send
req connect(protocol/client/auth/device payload) - send
req agent - wait for completion via
req agent.wait - stream
event agentframes into Paperclip logs/transcript parsing
Auth Modes
Gateway credentials can be provided in any of these ways:
authToken/tokenin adapter configheaders.x-openclaw-tokenheaders.x-openclaw-auth(legacy)password(shared password mode)
When a token is present and authorization header is missing, the adapter derives Authorization: Bearer <token>.
Device Auth
By default the adapter sends a signed device payload in connect params.
- set
disableDeviceAuth=trueto omit device signing - set
devicePrivateKeyPemto pin a stable signing key - without
devicePrivateKeyPem, the adapter generates an ephemeral Ed25519 keypair per run - when
autoPairOnFirstConnectis enabled (default), the adapter handles one initialpairing requiredby callingdevice.pair.list+device.pair.approveover shared auth, then retries once.
Session Strategy
The adapter supports the same session routing model as HTTP OpenClaw mode:
sessionKeyStrategy=issue|fixed|runsessionKeyis used when strategy isfixed
Resolved session key is sent as agent.sessionKey.
Payload Mapping
The agent request is built as:
- required fields:
message(wake text plus optionalpayloadTemplate.message/payloadTemplate.textprefix)idempotencyKey(PapercliprunId)sessionKey(resolved strategy)
- optional additions:
- all
payloadTemplatefields merged in agentIdfrom config if set and not already in template
- all
Timeouts
timeoutSeccontrols adapter-level request budgetwaitTimeoutMscontrolsagent.wait.timeoutMs
If agent.wait returns timeout, adapter returns openclaw_gateway_wait_timeout.
Log Format
Structured gateway event logs use:
[openclaw-gateway] ...for lifecycle/system logs[openclaw-gateway:event] run=<id> stream=<stream> data=<json>forevent agentframes
UI/CLI parsers consume these lines to render transcript updates.
No-remote-git contract
Like every Paperclip adapter, this one must treat the local execution-workspace
cwd as the only persistence boundary across runs — no git push from runtime
code, no assuming a git remote exists. The gateway transport here doesn't
touch the workspace directly, but if you extend the adapter to ship code to
the OpenClaw side, use the round-trip helpers in @paperclipai/adapter-utils
(prepareWorkspaceForSshExecution → restoreWorkspaceFromSshExecution)
rather than reaching for a git remote. See
packages/adapters/AUTHORING.md
for the full contract and the pinning test at
packages/adapter-utils/src/ssh-fixture.test.ts.