fix(behavior): Respect DEV/E2E modes when mapping gateway token

src/gateway/env.test.ts

@@ -91,6 +91,18 @@ describe('buildEnvVars', () => {
     expect(result.CLAWDBOT_GATEWAY_TOKEN).toBe('my-token');
   });
 
+  it('skips gateway token when DEV_MODE is true', () => {
+    const env = createMockEnv({ DEV_MODE: 'true', MOLTBOT_GATEWAY_TOKEN: 'my-token' });
+    const result = buildEnvVars(env);
+    expect(result.CLAWDBOT_GATEWAY_TOKEN).toBeUndefined();
+  });
+
+  it('skips gateway token when E2E_TEST_MODE is true', () => {
+    const env = createMockEnv({ E2E_TEST_MODE: 'true', MOLTBOT_GATEWAY_TOKEN: 'my-token' });
+    const result = buildEnvVars(env);
+    expect(result.CLAWDBOT_GATEWAY_TOKEN).toBeUndefined();
+  });
+
   it('includes all channel tokens when set', () => {
     const env = createMockEnv({
       TELEGRAM_BOT_TOKEN: 'tg-token',

src/gateway/env.ts

@@ -44,7 +44,10 @@ export function buildEnvVars(env: MoltbotEnv): Record<string, string> {
     envVars.ANTHROPIC_BASE_URL = env.ANTHROPIC_BASE_URL;
   }
   // Map MOLTBOT_GATEWAY_TOKEN to CLAWDBOT_GATEWAY_TOKEN (container expects this name)
-  if (env.MOLTBOT_GATEWAY_TOKEN) envVars.CLAWDBOT_GATEWAY_TOKEN = env.MOLTBOT_GATEWAY_TOKEN;
+  // Skip in DEV_MODE so local dev uses device pairing / insecure auth flow.
+  if (env.MOLTBOT_GATEWAY_TOKEN && env.DEV_MODE !== 'true' && env.E2E_TEST_MODE !== 'true') {
+    envVars.CLAWDBOT_GATEWAY_TOKEN = env.MOLTBOT_GATEWAY_TOKEN;
+  }
   if (env.DEV_MODE) envVars.CLAWDBOT_DEV_MODE = env.DEV_MODE; // Pass DEV_MODE as CLAWDBOT_DEV_MODE to container
   if (env.CLAWDBOT_BIND_MODE) envVars.CLAWDBOT_BIND_MODE = env.CLAWDBOT_BIND_MODE;
   if (env.TELEGRAM_BOT_TOKEN) envVars.TELEGRAM_BOT_TOKEN = env.TELEGRAM_BOT_TOKEN;

src/index.ts

@@ -57,7 +57,8 @@ function validateRequiredEnv(env: MoltbotEnv): string[] {
   const missing: string[] = [];
   const isTestMode = env.DEV_MODE === 'true' || env.E2E_TEST_MODE === 'true';
 
-  if (!env.MOLTBOT_GATEWAY_TOKEN) {
+  // Environment aware validation check
+  if (!env.DEV_MODE && !env.MOLTBOT_GATEWAY_TOKEN) {
     missing.push('MOLTBOT_GATEWAY_TOKEN');
   }