Update server.js

server.js

@@ -4,30 +4,192 @@ import { spawn } from "child_process";
 const app = express();
 app.use(express.json());
 
-app.get("/", (_, res) => {
-  res.json({ status: "OpenClaw Space running" });
+/* ===============================
+   1. BASIC AUTH
+================================ */
+
+const GATE_KEY = process.env.OPENCLAW_GATE_KEY;
+
+app.use((req, res, next) => {
+  if (!GATE_KEY) return next();
+  if (req.headers["x-openclaw-key"] !== GATE_KEY) {
+    return res.status(401).json({ error: "Unauthorized" });
+  }
+  next();
 });
 
-app.post("/run", (req, res) => {
-  const proc = spawn(
-    "node",
-    ["src/index.js"],
-    {
-      cwd: "/app/openclaw",
-      env: process.env
-    }
-  );
+/* ===============================
+   2. RATE LIMITING (IP-based)
+================================ */
+
+const RATE_LIMIT = 30; // requests
+const WINDOW_MS = 60_000;
+const ipHits = new Map();
+
+app.use((req, res, next) => {
+  const ip = req.headers["x-forwarded-for"] || req.socket.remoteAddress;
+  const now = Date.now();
+
+  const record = ipHits.get(ip) || { count: 0, ts: now };
+  if (now - record.ts > WINDOW_MS) {
+    record.count = 0;
+    record.ts = now;
+  }
+
+  record.count++;
+  ipHits.set(ip, record);
+
+  if (record.count > RATE_LIMIT) {
+    return res.status(429).json({ error: "Rate limit exceeded" });
+  }
+  next();
+});
+
+/* ===============================
+   3. LOAD KEY POOLS
+================================ */
+
+function loadPool(prefix) {
+  return Object.keys(process.env)
+    .filter(k => k.startsWith(prefix))
+    .map(k => process.env[k])
+    .filter(Boolean);
+}
+
+const PROVIDERS = {
+  openai: loadPool("OPENAI_API_KEY_"),
+  deepseek: loadPool("DEEPSEEK_API_KEY_"),
+  gemini: loadPool("GEMINI_API_KEY_"),
+  openrouter: loadPool("OPENROUTER_API_KEY_"),
+  dashscope: loadPool("DASHSCOPE_API_KEY_")
+};
+
+function randomKey(pool) {
+  return pool[Math.floor(Math.random() * pool.length)];
+}
+
+/* ===============================
+   4. TASK ROUTING
+================================ */
+
+const TASKS = new Set([
+  "market_research",
+  "summarize",
+  "classify"
+]);
+
+/* ===============================
+   5. RUN AGENT
+================================ */
+app.use((req, res, next) => {
+  if (req.method === "POST" && !req.is("application/json")) {
+    return res.status(400).json({ error: "JSON body required" });
+  }
+  next();
+});
+
+app.post("/run", async (req, res) => {
+  const { task, provider, model, ...payload } = req.body;
+
+  if (!TASKS.has(task)) {
+    return res.status(400).json({ error: "Unknown task" });
+  }
 
-  let output = "";
+  const providersToTry = provider
+    ? [provider, ...Object.keys(PROVIDERS).filter(p => p !== provider)]
+    : Object.keys(PROVIDERS);
 
-  proc.stdout.on("data", d => output += d.toString());
-  proc.stderr.on("data", d => output += d.toString());
+  let lastError;
 
-  proc.on("close", code => {
-    res.json({ exitCode: code, output });
+  for (const p of providersToTry) {
+    const pool = PROVIDERS[p];
+    if (!pool || pool.length === 0) continue;
+
+    for (let i = 0; i < pool.length; i++) {
+      const apiKey = randomKey(pool);
+
+const env = {
+  ...process.env,
+  OPENCLAW_PROVIDER: p,
+  OPENCLAW_MODEL: model || "",
+  OPENCLAW_API_KEY: apiKey,
+  OPENCLAW_TASK: task
+};
+
+      try {
+        const result = await runOpenClaw(env, payload);
+        return res.json(result);
+      } catch (err) {
+        lastError = err;
+        if (!isRateLimit(err)) break;
+      }
+    }
+  }
+
+  res.status(500).json({
+    error: "All providers failed",
+    details: lastError?.message
   });
 });
 
+/* ===============================
+   6. EXECUTION + JSON PARSE
+================================ */
+
+function runOpenClaw(env, payload) {
+  return new Promise((resolve, reject) => {
+    const proc = spawn("node", ["src/index.js"], {
+      cwd: "/app/openclaw",
+      env
+    });
+
+    let out = "";
+    let err = "";
+
+    const timeout = setTimeout(() => {
+      proc.kill("SIGKILL");
+      reject(new Error("Agent timeout"));
+    }, 120000); // 2 minutes
+
+    proc.stdout.on("data", d => out += d.toString());
+    proc.stderr.on("data", d => err += d.toString());
+
+    proc.on("close", code => {
+      clearTimeout(timeout);
+
+      if (code !== 0) {
+        return reject(new Error(err || "Execution failed"));
+      }
+
+      try {
+        const json = JSON.parse(out);
+        resolve(json);
+      } catch {
+        reject(new Error("Invalid JSON output from agent"));
+      }
+    });
+
+    proc.stdin.write(JSON.stringify(payload));
+    proc.stdin.end();
+  });
+}
+
+
+function isRateLimit(err) {
+  const msg = err.message?.toLowerCase() || "";
+  return (
+    msg.includes("429") ||
+    msg.includes("rate") ||
+    msg.includes("quota") ||
+    msg.includes("limit")
+  );
+}
+
+
+/* ===============================
+   7. START
+================================ */
+
 app.listen(7860, () => {
-  console.log("🚀 OpenClaw wrapper listening on 7860");
+  console.log("🚀 OpenClaw Agent Gateway running");
 });