What does invalid handshake code 1008 mean

The Gateway is a WebSocket server, and it expects the very first message to be a connect frame. If it receives anything else, it closes the connection with code 1008 (policy violation).
Common causes:
You opened the HTTP URL in a browser (http://...) instead of a WS client.
You used the wrong port or path.
A proxy or tunnel stripped auth headers or sent a non‑Gateway request.
Quick fixes:
Use the WS URL: ws://<host>:18789 (or wss://... if HTTPS).
Don’t open the WS port in a normal browser tab.
If auth is on, include the token/password in the connect frame.
If you’re using the CLI or TUI, the URL should look like:
openclaw tui --url ws://<host>:18789 --token <token>
Protocol details: Gateway protocol.