fix(openclaw): seed gateway.controlUi when no claw.cutos.ai URL in config

If openclaw.json has no https://*.claw.cutos.ai string, set controlUi
allowedOrigins (loopback + newOrigin), allowInsecureAuth, and
dangerouslyDisableDeviceAuth so factory images need no manual edit.
Otherwise keep replaceOriginStrings behavior.

Made-with: Cursor

lib/client.js

@@ -460,6 +460,7 @@ class ClawClient {
       const config = JSON.parse(raw);
       const newOrigin = `https://${targetId}.claw.cutos.ai`;
       const re = /https:\/\/[^"'\s]+\.claw\.cutos\.ai/g;
+      const hasAnyClawCutosAi = /https:\/\/[^"'\s]+\.claw\.cutos\.ai/.test(JSON.stringify(config));
 
       /** 与原 YAML 全文替换等价：遍历 JSON 内所有字符串并替换匹配的 origin */
       const replaceOriginStrings = (node) => {
@@ -500,7 +501,19 @@ class ClawClient {
         return false;
       };
 
-      if (!replaceOriginStrings(config)) {
+      let changed;
+      if (!hasAnyClawCutosAi) {
+        config.gateway.controlUi = config.gateway.controlUi || {};
+        const port = config.gateway.port ?? 18789;
+        config.gateway.controlUi.allowedOrigins = [`http://0.0.0.0:${port}`, newOrigin];
+        config.gateway.controlUi.allowInsecureAuth = true;
+        config.gateway.controlUi.dangerouslyDisableDeviceAuth = true;
+        changed = true;
+      } else {
+        changed = replaceOriginStrings(config);
+      }
+
+      if (!changed) {
         log.info('clawd', `openclaw origin 已是 ${newOrigin}，无需变更`);
         return;
       }