Add SSH server port for managed tunnels

[christineyan4]

Summary

• Adds a separate SSH daemon port (sshPort, default 22) for managed SSH tunnels instead of overloading the forwarded gateway remote port.
• Persists the port in gateway records and legacy settings, migrates older settings/records safely, and treats port changes as operator reconnects.
• Exposes the SSH port in the Add Gateway and diagnostics direct-connect UIs, including localized labels and validation.

Fixes #697

Validation

• dotnet test .\tests\OpenClaw.Shared.Tests\OpenClaw.Shared.Tests.csproj --no-restore --filter "FullyQualifiedName~SshTunnelCommandLineTests"
• dotnet test .\tests\OpenClaw.Connection.Tests\OpenClaw.Connection.Tests.csproj --no-restore
• dotnet test .\tests\OpenClaw.Tray.Tests\OpenClaw.Tray.Tests.csproj --no-restore
• .\build.ps1
• git diff --check

Manual proof

• Configured local OpenSSH Server to listen only on 127.0.0.1:2222.
• Verified ssh -p 2222 -l OpenClawSshRepro 127.0.0.1 hostname succeeds while port 22 fails.
• On master, the Add Gateway SSH UI has no SSH port field, so it cannot express 2222.
• On this branch, the fixed UI accepts SSH port = 2222; tray logs show the tunnel starts via OpenClawSshRepro@127.0.0.1:2222.

Review

• Ran Hanselman-style dual-model review (Opus + Codex).
• Fixed agreed/actionable findings around diagnostics port validation, diagnostics settings persistence, and invalid settings normalization.
• Remaining low-severity notes were accepted as non-blocking: snapshot does not expose active SSH port and upgrade may trigger a one-time tunnel restart due to the new spec identity.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed June 5, 2026, 5:14 PM ET / 21:14 UTC.

Summary
Review failed before ClawSweeper could summarize the requested change.

Reproducibility: unclear. The review failed before ClawSweeper could establish a reproduction path.

Review metrics: none identified.

Merge readiness
Overall: 🌊 off-meta tidepool
Proof: 🌊 off-meta tidepool
Patch quality: 🌊 off-meta tidepool
Result: rating does not apply to this item.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Risk before merge

• [P1] No close action taken because the review did not complete.

Maintainer options:

1. Decide the mitigation before merge
   Retry the Codex review after fixing the execution failure.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P1] Review did not complete, so no work-lane recommendation was made.

Review details

Best possible solution:

Retry the Codex review after fixing the execution failure.

Do we have a high-confidence way to reproduce the issue?

Unclear. The review failed before ClawSweeper could establish a reproduction path.

Is this the best way to solve the issue?

Unclear. Retry the review first so ClawSweeper can evaluate the actual issue and fix direction.

AGENTS.md: unclear because the file could not be read completely.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 077d44cc6cd2.

Label changes

Label changes:

• add rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.
• remove status: 📣 needs proof: Current PR status no longer selects a status label.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🌊 off-meta tidepool, so this older rating label is no longer current.

Label justifications:

• rating: 🌊 off-meta tidepool: Overall readiness is 🌊 off-meta tidepool; proof is 🌊 off-meta tidepool and patch quality is 🌊 off-meta tidepool.

Evidence reviewed

What I checked:

• failure reason: timeout.
• codex failure detail: Codex review failed for this PR: spawnSync codex ETIMEDOUT.
• codex stdout: Per-item Codex failure; continuing with the rest of the shard.

Likely related people:

• unknown: Codex failed before it could trace repository history. (role: review did not complete; confidence: low)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[christineyan4]

real-behavior proof: logs after the fix, showing the SSH tunnel has connected successfully

[christineyan4]

@clawsweeper re-review

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

• State: Failed
• Detail: The targeted re-review did not finish cleanly. Check the workflow run for details.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/27037129891
• Updated: 2026-06-05T20:01:13.091Z

[shanselman]

Merged after first-pass triage.

Follow-up found during adversarial review: BuildBrowserProxySshForwardHint should include -p <sshPort> when the managed tunnel uses a non-default SSH daemon port, otherwise the diagnostic copy/paste hint can point users back at port 22. Core tunnel command construction, migration, validation, persistence, and reconnect behavior looked safe.