feat(core): merge backup core changes with post-split functionality

packages/adapters/openclaw/src/server/test.ts

@@ -16,6 +16,81 @@ function isLoopbackHost(hostname: string): boolean {
   return value === "localhost" || value === "127.0.0.1" || value === "::1";
 }
 
+function normalizeHostname(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("[")) {
+    const end = trimmed.indexOf("]");
+    return end > 1 ? trimmed.slice(1, end).toLowerCase() : trimmed.toLowerCase();
+  }
+  const firstColon = trimmed.indexOf(":");
+  if (firstColon > -1) return trimmed.slice(0, firstColon).toLowerCase();
+  return trimmed.toLowerCase();
+}
+
+function pushDeploymentDiagnostics(
+  checks: AdapterEnvironmentCheck[],
+  ctx: AdapterEnvironmentTestContext,
+  endpointUrl: URL | null,
+) {
+  const mode = ctx.deployment?.mode;
+  const exposure = ctx.deployment?.exposure;
+  const bindHost = normalizeHostname(ctx.deployment?.bindHost ?? null);
+  const allowSet = new Set(
+    (ctx.deployment?.allowedHostnames ?? [])
+      .map((entry) => normalizeHostname(entry))
+      .filter((entry): entry is string => Boolean(entry)),
+  );
+  const endpointHost = endpointUrl ? normalizeHostname(endpointUrl.hostname) : null;
+
+  if (!mode) return;
+
+  checks.push({
+    code: "openclaw_deployment_context",
+    level: "info",
+    message: `Deployment context: mode=${mode}${exposure ? ` exposure=${exposure}` : ""}`,
+  });
+
+  if (mode === "authenticated" && exposure === "private") {
+    if (bindHost && !isLoopbackHost(bindHost) && !allowSet.has(bindHost)) {
+      checks.push({
+        code: "openclaw_private_bind_hostname_not_allowed",
+        level: "warn",
+        message: `Paperclip bind host "${bindHost}" is not in allowed hostnames.`,
+        hint: `Run pnpm paperclip allowed-hostname ${bindHost} so remote OpenClaw callbacks can pass host checks.`,
+      });
+    }
+
+    if (!bindHost || isLoopbackHost(bindHost)) {
+      checks.push({
+        code: "openclaw_private_bind_loopback",
+        level: "warn",
+        message: "Paperclip is bound to loopback in authenticated/private mode.",
+        hint: "Bind to a reachable private hostname/IP so remote OpenClaw agents can call back.",
+      });
+    }
+
+    if (endpointHost && !isLoopbackHost(endpointHost) && allowSet.size === 0) {
+      checks.push({
+        code: "openclaw_private_no_allowed_hostnames",
+        level: "warn",
+        message: "No explicit allowed hostnames are configured for authenticated/private mode.",
+        hint: "Set one with pnpm paperclip allowed-hostname <host> when OpenClaw runs on another machine.",
+      });
+    }
+  }
+
+  if (mode === "authenticated" && exposure === "public" && endpointUrl && endpointUrl.protocol !== "https:") {
+    checks.push({
+      code: "openclaw_public_http_endpoint",
+      level: "warn",
+      message: "OpenClaw endpoint uses HTTP in authenticated/public mode.",
+      hint: "Prefer HTTPS for public deployments.",
+    });
+  }
+}
+
 export async function testEnvironment(
   ctx: AdapterEnvironmentTestContext,
 ): Promise<AdapterEnvironmentTestResult> {
@@ -75,6 +150,8 @@ export async function testEnvironment(
     }
   }
 
+  pushDeploymentDiagnostics(checks, ctx, url);
+
   const method = asString(config.method, "POST").trim().toUpperCase() || "POST";
   checks.push({
     code: "openclaw_method_configured",