feat: auto-fill gateway token via URL redirect

Add token-redirect.cjs preload script that redirects "/" to
"/?token=GATEWAY_TOKEN". The Control UI reads token from URL params
and auto-fills it, so users don't need to manually enter the token.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/entrypoint.sh

@@ -26,6 +26,9 @@ export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/scripts
 # Enable Telegram API proxy (redirects fetch() to working mirror if needed)
 export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/scripts/telegram-proxy.cjs"
 
+# Auto-fill gateway token in Control UI (redirects "/" to "/?token=GATEWAY_TOKEN")
+export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/scripts/token-redirect.cjs"
+
 # ── Extensions symlink ──────────────────────────────────────────────────────
 SYMLINK_START=$(date +%s)
 if [ ! -L /home/node/.openclaw/extensions ]; then

scripts/token-redirect.cjs

@@ -0,0 +1,37 @@
+/**
+ * token-redirect.cjs — Node.js preload script
+ *
+ * Intercepts HTTP requests to the root URL "/" and redirects to
+ * "/?token=GATEWAY_TOKEN" so the Control UI auto-fills the gateway token.
+ *
+ * Loaded via NODE_OPTIONS --require before OpenClaw starts.
+ */
+'use strict';
+
+const http = require('http');
+
+const GATEWAY_TOKEN = process.env.GATEWAY_TOKEN || 'huggingclaw';
+const origEmit = http.Server.prototype.emit;
+
+http.Server.prototype.emit = function (event, ...args) {
+  if (event === 'request') {
+    const [req, res] = args;
+    // Only redirect normal GET to "/" without token — skip WebSocket upgrades
+    if (req.method === 'GET' && !req.headers.upgrade) {
+      try {
+        const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+        if (url.pathname === '/' && !url.searchParams.has('token')) {
+          url.searchParams.set('token', GATEWAY_TOKEN);
+          res.writeHead(302, { Location: url.pathname + url.search });
+          res.end();
+          return true;
+        }
+      } catch (_) {
+        // URL parse error — pass through
+      }
+    }
+  }
+  return origEmit.apply(this, [event, ...args]);
+};
+
+console.log('[token-redirect] Gateway token redirect active');