team-handoff

Team Handoff

Use when the user says "open a session on the team server for this", "hand this off to ", or "summarize this for a new agent and start it on ", and the target is a shared OpenClaw Gateway behind an identity-aware proxy (Cloudflare Access).

One Gateway request, as the operator's own identity. No browser automation, no SSH, no polling.

Script: scripts/team-handoff.sh

Setup (once per machine)

1. Operator config, outside any repo: ${XDG_CONFIG_HOME:-~/.config}/openclaw/team-handoff.env

   OPENCLAW_HANDOFF_URL=https://gateway.example      # the shared Gateway's public origin
   OPENCLAW_HANDOFF_AGENT=main                        # default agent id on that Gateway
   OPENCLAW_HANDOFF_PROJECT=example-project           # default projects.list id
   # optional:
   # OPENCLAW_HANDOFF_CLI=/path/to/openclaw           # installed OpenClaw CLI (default: openclaw on PATH)
   # OPENCLAW_HANDOFF_PROFILE_DIR=~/.openclaw/profiles/team
   # OPENCLAW_HANDOFF_SSH_HOST=gateway-host           # operator fallback only; see below
   

2. Isolated CLI profile so the local Gateway config is never touched. The script writes it on first probe when missing: OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH point at the profile dir, whose openclaw.json holds only gateway.mode: "remote", gateway.remote.url, and an exec secret provider that runs cloudflared access token -app=<url> for the Cf-Access-Token header (gateway.remote.edgeAuth, see the OpenClaw docs page "Remote access", section "Gateway behind an identity-aware proxy"). The provider command must be the real cloudflared binary, not a symlink.

3. The human logs in once per Access session lifetime (agents cannot):

   cloudflared access login https://gateway.example
   

   probe prints ok when the chain works. Exec provider "cloudflare-access" exited with code 1 or an HTTP 302 on upgrade means the login lapsed: ask the human to run it again; do not switch to the SSH fallback on your own.