feat(gateway): add LAN mode toggle in add-on config

Add gateway_lan_mode option to control gateway bind mode:
- false (default): bind to loopback only (secure, local access)
- true: bind to LAN (accessible from local network)

Non-destructive config patching: only modifies gateway.bind,
preserves auth token and all other settings.

Author: root

openclaw_assistant_dev/config.yaml

@@ -47,6 +47,12 @@ options:
   clean_session_locks_on_start: true
   clean_session_locks_on_exit: true
 
+  # Gateway network bind mode:
+  # - true: bind to LAN (accessible from local network, e.g., 0.0.0.0 or LAN IP)
+  # - false: bind to loopback only (127.0.0.1, local access only)
+  # Default is false for security. Toggle this on if you need external access.
+  gateway_lan_mode: false
+
 
 schema:
   timezone: str
@@ -60,4 +66,5 @@ schema:
 
   clean_session_locks_on_start: bool?
   clean_session_locks_on_exit: bool?
+  gateway_lan_mode: bool?
 

openclaw_assistant_dev/run.sh

@@ -27,6 +27,9 @@ ROUTER_KEY=$(jq -r '.router_ssh_key_path // "/data/keys/router_ssh"' "$OPTIONS_F
 CLEAN_LOCKS_ON_START=$(jq -r '.clean_session_locks_on_start // true' "$OPTIONS_FILE")
 CLEAN_LOCKS_ON_EXIT=$(jq -r '.clean_session_locks_on_exit // true' "$OPTIONS_FILE")
 
+# Gateway LAN mode toggle (default false for security)
+GATEWAY_LAN_MODE=$(jq -r '.gateway_lan_mode // false' "$OPTIONS_FILE")
+
 export TZ="$TZNAME"
 
 # Reduce risk of secrets ending up in logs
@@ -182,6 +185,45 @@ print("INFO: Wrote minimal OpenClaw config (gateway.mode=local, auth.token gener
 PY
 fi
 
+# ------------------------------------------------------------------------------
+# Apply gateway LAN mode setting safely (non-destructive config patch)
+# This updates gateway.bind without touching other settings (auth token, etc.)
+# ------------------------------------------------------------------------------
+LAN_MODE="${GATEWAY_LAN_MODE}"
+if [ -f "$OPENCLAW_CONFIG_PATH" ]; then
+  python3 - <<PY
+import json
+from pathlib import Path
+import os
+
+cfg_path = Path(os.environ['OPENCLAW_CONFIG_PATH'])
+lan_mode = os.environ.get('GATEWAY_LAN_MODE', 'false').lower() == 'true'
+
+# Read existing config (preserve formatting as much as possible)
+text = cfg_path.read_text(encoding='utf-8')
+cfg = json.loads(text)
+
+# Determine desired bind value
+desired_bind = "lan" if lan_mode else "loopback"
+
+current_bind = cfg.get("gateway", {}).get("bind", "")
+
+if current_bind != desired_bind:
+    # Ensure gateway section exists
+    if "gateway" not in cfg:
+        cfg["gateway"] = {}
+    cfg["gateway"]["bind"] = desired_bind
+    
+    # Write back with nice formatting
+    cfg_path.write_text(json.dumps(cfg, indent=2) + "\n", encoding='utf-8')
+    print(f"INFO: Updated gateway.bind to '{desired_bind}' (gateway_lan_mode={lan_mode})")
+else:
+    print(f"INFO: gateway.bind already '{desired_bind}', no change needed")
+PY
+else
+  echo "WARN: OpenClaw config not found at $OPENCLAW_CONFIG_PATH, cannot apply gateway_lan_mode"
+fi
+
 echo "Starting OpenClaw Assistant gateway (openclaw)..."
 openclaw gateway run &
 GW_PID=$!