What

Adds a new HTTP endpoint POST /tools/invoke that can execute a Clawdbot agent tool (core or plugin) on behalf of a caller. This unblocks Lobster’s clawd.invoke bridge (tool/action/args) without needing to go through the OpenAI-compatible chat endpoints.

Request body:

{
  "tool": "sessions_list",
  "action": "json",
  "args": {
    "limit": 10
  },
  "sessionKey": "main"
}

Response:

{
  "ok": true,
  "result": { "...": "tool result" }
}

Policy & security

• Uses existing gateway auth (Authorization: Bearer …) via authorizeGatewayConnect.
• Enforces tool allow/deny policies derived from config + per-agent policies and group policy inheritance (when caller supplies channel/account headers).
• Only merges the top-level action into tool args when the tool’s schema actually declares an action property (avoids breaking tools like llm-task that don’t use actions).

Threat model

• Risk: Adds a direct tool execution surface; if exposed without auth, could allow arbitrary tool invocation (including filesystem or messaging).
• Mitigations: Endpoint is gated by the same gateway auth mechanism as other HTTP surfaces. Tool execution is restricted by tool policy (global + agent + provider + group).
• Residual risk: Operators who set gateway.auth.mode=none and bind publicly could still be vulnerable (same as other HTTP endpoints); recommend loopback bind or token auth.

Tests

• src/gateway/tools-invoke-http.test.ts covers success path, auth rejection, and policy-based tool unavailability.