OpenClaw Main Adds a Public Worker Ingress Route: What Changes for Cloud Workers and What to Lock Down

On August 12, OpenClaw merged PR #122578, which gives node-hosted session workers something they never had before: a way to reach the Gateway over its public endpoint instead of an SSH reverse tunnel to loopback.

The change in one paragraph

The Gateway now reserves one WebSocket route, /__openclaw__/worker, on its main listener. A worker holding a valid dispatch credential completes the closed worker handshake there directly; route-owned socket metadata selects the worker protocol before plugin routing or frame parsing ever runs. Before this merge, the closed worker protocol was reachable only through a loopback listener plus an SSH reverse tunnel, and pointing a worker at the main listener dumped it into the general client path where the handshake simply failed.

Why the old design was also the safe design

Until now, worker traffic stayed private by construction: loopback plus tunnel meant nothing was publicly dialable, so exposure was bounded by who held SSH access. Publishing a route changes that equation. The PR is explicit about the new risks it introduces and how they are contained:

• Detailed admission failures collapse to admission-rejected on the public wire — the response does not reveal whether a credential belongs to another environment.
• Internal reasons remain visible only in trusted diagnostics.
• Public workers share the main client-IP pre-auth connection budget and get a dedicated scope on the existing auth rate limiter, bounding invalid attempts.
• The loopback listener, SSH reverse tunnel, admission store, placement claims, owner epochs, transcript protocol, and per-RPC authority validation are all unchanged.

That last point matters most for operators running cloud workers today: this is additive. Existing SSH-provisioned workers keep using private loopback ingress with no behavior change, and no migration is required or implied.

Operator impact

If you run cloud workers over SSH tunnels: nothing breaks and nothing changes until you choose to move. When you do evaluate the public route, treat it as a network-exposure decision, not a convenience upgrade: confirm your Gateway’s public endpoint sits behind the same TLS termination, IP filtering, and logging posture you apply to client traffic, because worker handshakes will now arrive from outside.

If you provision workers headlessly: the route removes the tunnel step from automation, which is genuinely simpler — but the dispatch credential becomes the entire gate. It should live in SecretRef-backed storage (see our August 21 coverage of the onboarding plaintext fixes), never in worker images or user-data scripts that outlive provisioning.

For everyone else: if you do not use node-hosted session workers, this merge does not affect your install. The route exists but serves only the worker handshake; ordinary clients, channels, and Control UI traffic are unaffected.

What to verify when you adopt it

1. Confirm invalid handshake attempts against /__openclaw__/worker are rate-limited and return the generic admission-rejected outcome rather than detailed errors.
2. Check that trusted diagnostics still capture internal failure reasons somewhere private, so debugging does not depend on the public wire’s terse responses.
3. Review whether your edge (reverse proxy, firewall, Cloudflare config) applies the same connection budgets to the worker route as to client routes.
4. Keep the dispatch credential rotation story ready before the first public worker connects — the credential is now the only thing between the internet and worker admission.

Status

This is merged main functionality as of August 12, part of the runners milestone series (“revision-2 runners milestone 5” per the PR). The current beta package line, 2026.8.1-beta.2, was published August 15 — after this merge — so the change may be present in that build, but we have not verified its release notes name it; check per release before relying on packaged availability. Until then, evaluation means building from source.