From bf91e00d36cc94db57d23fd15a6a3c2aaa10f7ab Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sun, 23 Aug 2026 09:21:05 -0700
Subject: [PATCH] fix(macos): reject invalid gateway ports before tunnel setup
 (#128260)

---
 .../Sources/OpenClaw/GatewayEnvironment.swift     |  6 +++---
 .../GatewayEnvironmentTests.swift                 | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/apps/macos/Sources/OpenClaw/GatewayEnvironment.swift b/apps/macos/Sources/OpenClaw/GatewayEnvironment.swift
index 7f2aaace30a0..666f120ecf7d 100644
--- a/apps/macos/Sources/OpenClaw/GatewayEnvironment.swift
+++ b/apps/macos/Sources/OpenClaw/GatewayEnvironment.swift
@@ -122,12 +122,12 @@ enum GatewayEnvironment {
     {
         if let raw = environment["OPENCLAW_GATEWAY_PORT"] {
             let trimmed = raw.trimmingCharacters(in: .whitespacesAndNewlines)
-            if let parsed = Int(trimmed), parsed > 0 { return parsed }
+            if let parsed = Int(trimmed), (1...65535).contains(parsed) { return parsed }
         }
-        if let configPort, configPort > 0 {
+        if let configPort, (1...65535).contains(configPort) {
             return configPort
         }
-        return storedPort > 0 ? storedPort : profile.defaultGatewayPort
+        return (1...65535).contains(storedPort) ? storedPort : profile.defaultGatewayPort
     }
 
     static func expectedGatewayVersion() -> Semver? {
diff --git a/apps/macos/Tests/OpenClawIPCTests/GatewayEnvironmentTests.swift b/apps/macos/Tests/OpenClawIPCTests/GatewayEnvironmentTests.swift
index db4e89ca8e50..445208f718d5 100644
--- a/apps/macos/Tests/OpenClawIPCTests/GatewayEnvironmentTests.swift
+++ b/apps/macos/Tests/OpenClawIPCTests/GatewayEnvironmentTests.swift
@@ -124,6 +124,21 @@ struct GatewayEnvironmentTests {
             configPort: nil,
             storedPort: 23001,
             profile: work) == 23001)
+        #expect(GatewayEnvironment.resolvedGatewayPort(
+            environment: ["OPENCLAW_GATEWAY_PORT": "65536"],
+            configPort: 22001,
+            storedPort: 23001,
+            profile: work) == 22001)
+        #expect(GatewayEnvironment.resolvedGatewayPort(
+            environment: [:],
+            configPort: 65536,
+            storedPort: 23001,
+            profile: work) == 23001)
+        #expect(GatewayEnvironment.resolvedGatewayPort(
+            environment: [:],
+            configPort: nil,
+            storedPort: 65536,
+            profile: work) == work.defaultGatewayPort)
         #expect(AppProfile(environment: [:]).defaultGatewayPort == 18789)
     }