Summary

Fix inverted auth resolution logic in maybeProbeGateway that caused clawdbot security audit --deep to fail with "unauthorized" when connecting to a local gateway.

The Bug

In src/security/audit.ts, the auth selection condition was inverted:

// BEFORE (broken)
const auth = remoteUrlMissing ? resolveAuth("local") : resolveAuth("remote");

For local mode (gateway.mode undefined or "local"):

• isRemoteMode = false
• remoteUrlMissing = false (since isRemoteMode && !remoteUrlRaw)
• This incorrectly called resolveAuth("remote") which returns undefined token

The Fix

// AFTER (fixed)
const auth = !isRemoteMode || remoteUrlMissing ? resolveAuth("local") : resolveAuth("remote");

Testing

• pnpm lint - 0 warnings, 0 errors
• pnpm test src/security/audit.test.ts - 20 tests pass
• clawdbot security audit --deep - works without "unauthorized" error
• Added 4 new tests covering auth selection logic

AI-Assisted PR 🤖

• Built with Claude Code
• Fully tested locally
• I understand what the code does