Resolve PR #395 conflicts and integrate pr-365-merge fixes (#424)

* Add OpenClaw gateway auth and device token persistence

- Add gateway client handshake with signed device identity
- Persist encrypted gateway config, device keys, and tokens
- Thread OpenClaw auth state through server and UI

* Wire in Openclaw gateway config and drop Solar Witch theme

- Add `OpenclawGatewayConfigLive` to the server runtime layer
- Remove the Solar Witch theme definitions from the web styles

* Apply reviewer feedback: fix connect handshake, config error handling, Solar Witch theme, and legacy import banner gating

Agent-Logs-Url: https://github.com/OpenKnots/okcode/sessions/9615af9c-7cb2-409b-93c1-541b906a4a67

Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>

* Add nonce validation in test handshake for clearer error reporting

Agent-Logs-Url: https://github.com/OpenKnots/okcode/sessions/9615af9c-7cb2-409b-93c1-541b906a4a67

Co-authored-by: BunsDev <68980965+BunsDev@users.noreply.github.com>

* Update DESIGN.md

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update apps/web/src/themes.css

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Route Claude chats through provider runtime

- Remove Anthropic env-based chat handling
- Validate Claude against provider health and new provider options
- Update migrations and theme docs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: 3 people

apps/server/src/index.ts

@@ -10,11 +10,45 @@ import { version } from "../package.json" with { type: "json" };
 import { ServerLive } from "./wsServer";
 import { NetService } from "@okcode/shared/Net";
 import { FetchHttpClient } from "effect/unstable/http";
+import { OpenclawGatewayConfig } from "./persistence/Services/OpenclawGatewayConfig";
 
 const RuntimeLayer = Layer.empty.pipe(
   Layer.provideMerge(CliConfig.layer),
   Layer.provideMerge(ServerLive),
   Layer.provideMerge(OpenLive),
+  Layer.provideMerge(
+    Layer.succeed(OpenclawGatewayConfig, {
+      getSummary: () =>
+        Effect.succeed({
+          gatewayUrl: null,
+          hasSharedSecret: false,
+          deviceId: null,
+          devicePublicKey: null,
+          deviceFingerprint: null,
+          hasDeviceToken: false,
+          deviceTokenRole: null,
+          deviceTokenScopes: [],
+          updatedAt: null,
+        }),
+      getStored: () => Effect.succeed(null),
+      save: () => Effect.die("unexpected openclaw save"),
+      resolveForConnect: () => Effect.succeed(null),
+      saveDeviceToken: () => Effect.void,
+      clearDeviceToken: () => Effect.void,
+      resetDeviceState: () =>
+        Effect.succeed({
+          gatewayUrl: null,
+          hasSharedSecret: false,
+          deviceId: null,
+          devicePublicKey: null,
+          deviceFingerprint: null,
+          hasDeviceToken: false,
+          deviceTokenRole: null,
+          deviceTokenScopes: [],
+          updatedAt: null,
+        }),
+    }),
+  ),
   Layer.provideMerge(NetService.layer),
   Layer.provideMerge(NodeServices.layer),
   Layer.provideMerge(FetchHttpClient.layer),

apps/server/src/main.test.ts

@@ -15,6 +15,7 @@ import { NetService } from "@okcode/shared/Net";
 import { CliConfig, okcodeCli, type CliConfigShape } from "./main";
 import { ServerConfig, type ServerConfigShape } from "./config";
 import { Open, type OpenShape } from "./open";
+import { OpenclawGatewayConfig } from "./persistence/Services/OpenclawGatewayConfig";
 import { Server, type ServerShape } from "./wsServer";
 
 const start = vi.fn(() => undefined);
@@ -54,6 +55,37 @@ const testLayer = Layer.mergeAll(
     start: serverStart,
     stopSignal: Effect.void,
   } satisfies ServerShape),
+  Layer.succeed(OpenclawGatewayConfig, {
+    getSummary: () =>
+      Effect.succeed({
+        gatewayUrl: null,
+        hasSharedSecret: false,
+        deviceId: null,
+        devicePublicKey: null,
+        deviceFingerprint: null,
+        hasDeviceToken: false,
+        deviceTokenRole: null,
+        deviceTokenScopes: [],
+        updatedAt: null,
+      }),
+    getStored: () => Effect.succeed(null),
+    save: () => Effect.die("unexpected openclaw save"),
+    resolveForConnect: () => Effect.succeed(null),
+    saveDeviceToken: () => Effect.void,
+    clearDeviceToken: () => Effect.void,
+    resetDeviceState: () =>
+      Effect.succeed({
+        gatewayUrl: null,
+        hasSharedSecret: false,
+        deviceId: null,
+        devicePublicKey: null,
+        deviceFingerprint: null,
+        hasDeviceToken: false,
+        deviceTokenRole: null,
+        deviceTokenScopes: [],
+        updatedAt: null,
+      }),
+  }),
   Layer.succeed(Open, {
     openBrowser: (_target: string) => Effect.void,
     openInEditor: () => Effect.void,

apps/server/src/main.ts

@@ -20,6 +20,7 @@ import {
 import { fixPath, resolveBaseDir } from "./os-jank";
 import { Open } from "./open";
 import * as SqlitePersistence from "./persistence/Layers/Sqlite";
+import { OpenclawGatewayConfigLive } from "./persistence/Layers/OpenclawGatewayConfig";
 import { makeServerProviderLayer, makeServerRuntimeServicesLayer } from "./serverLayers";
 import { ProviderHealthLive } from "./provider/Layers/ProviderHealth";
 import { Server } from "./wsServer";
@@ -194,6 +195,7 @@ const LayerLive = (input: CliInput) =>
   Layer.empty.pipe(
     Layer.provideMerge(makeServerRuntimeServicesLayer()),
     Layer.provideMerge(makeServerProviderLayer()),
+    Layer.provideMerge(OpenclawGatewayConfigLive),
     Layer.provideMerge(ProviderHealthLive),
     Layer.provideMerge(SqlitePersistence.layerConfig),
     Layer.provideMerge(ServerLoggerLive),