fix(ios): require explicit gateway log target

scripts/dev/ios-pull-gateway-log.sh

@@ -1,9 +1,24 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-DEVICE_UDID="${1:-00008130-000630CE0146001C}"
-BUNDLE_ID="${2:-ai.openclaw.ios.dev.mariano.test}"
-DEST="${3:-/tmp/openclaw-gateway.log}"
+usage() {
+  echo "Usage: $0 <device-udid> <bundle-id> [dest]" >&2
+  echo "       OPENCLAW_IOS_DEVICE_UDID=... OPENCLAW_IOS_BUNDLE_ID=... $0" >&2
+}
+
+DEVICE_UDID="${1:-${OPENCLAW_IOS_DEVICE_UDID:-}}"
+BUNDLE_ID="${2:-${OPENCLAW_IOS_BUNDLE_ID:-}}"
+DEST="${3:-${OPENCLAW_IOS_GATEWAY_LOG_DEST:-}}"
+
+if [[ -z "$DEVICE_UDID" || -z "$BUNDLE_ID" ]]; then
+  usage
+  exit 2
+fi
+
+if [[ -z "$DEST" ]]; then
+  dest_dir="$(mktemp -d "${TMPDIR:-/tmp}/openclaw-ios-gateway.XXXXXX")"
+  DEST="$dest_dir/openclaw-gateway.log"
+fi
 
 xcrun devicectl device copy from \
   --device "$DEVICE_UDID" \
@@ -14,4 +29,3 @@ xcrun devicectl device copy from \
 
 echo "Pulled to: $DEST"
 tail -n 200 "$DEST"
-

test/scripts/ios-pull-gateway-log.test.ts

@@ -0,0 +1,19 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+const scriptPath = "scripts/dev/ios-pull-gateway-log.sh";
+
+describe("scripts/dev/ios-pull-gateway-log.sh", () => {
+  it("does not bake local device or bundle identifiers into the log pull helper", () => {
+    const script = readFileSync(scriptPath, "utf8");
+
+    expect(script).toContain('DEVICE_UDID="${1:-${OPENCLAW_IOS_DEVICE_UDID:-}}"');
+    expect(script).toContain('BUNDLE_ID="${2:-${OPENCLAW_IOS_BUNDLE_ID:-}}"');
+    expect(script).toContain('DEST="${3:-${OPENCLAW_IOS_GATEWAY_LOG_DEST:-}}"');
+    expect(script).toContain('mktemp -d "${TMPDIR:-/tmp}/openclaw-ios-gateway.XXXXXX"');
+    expect(script).toContain('exit 2');
+    expect(script).not.toMatch(/DEVICE_UDID="\$\{1:-[0-9A-F-]+/u);
+    expect(script).not.toMatch(/BUNDLE_ID="\$\{2:-ai\.openclaw\.ios\.dev\.[^}]+/u);
+    expect(script).not.toContain("/tmp/openclaw-gateway.log");
+  });
+});