fix: add LRU eviction and expired-entry cleanup to web_fetch cache

.env.example

@@ -15,8 +15,9 @@
 # Gateway auth + paths
 # -----------------------------------------------------------------------------
 # Recommended if the gateway binds beyond loopback.
-OPENCLAW_GATEWAY_TOKEN=change-me-to-a-long-random-token
-# Example generator: openssl rand -hex 32
+# Generate a secure random token:  openssl rand -hex 32
+# Docker/Podman setup scripts auto-generate this if left empty.
+OPENCLAW_GATEWAY_TOKEN=
 
 # Optional alternative auth mode (use token OR password).
 # OPENCLAW_GATEWAY_PASSWORD=change-me-to-a-strong-password

src/agents/tools/web-shared.ts

@@ -35,6 +35,9 @@ export function readCache<T>(
     cache.delete(key);
     return null;
   }
+  // Promote to most-recent position for LRU eviction.
+  cache.delete(key);
+  cache.set(key, entry);
   return { value: entry.value, cached: true };
 }
 
@@ -47,16 +50,33 @@ export function writeCache<T>(
   if (ttlMs <= 0) {
     return;
   }
+  // Remove existing entry so .set() moves it to the end (LRU order).
+  cache.delete(key);
   if (cache.size >= DEFAULT_CACHE_MAX_ENTRIES) {
-    const oldest = cache.keys().next();
-    if (!oldest.done) {
-      cache.delete(oldest.value);
+    // Evict expired entries first, then fall back to LRU (oldest insertion order).
+    const now = Date.now();
+    let evicted = false;
+    for (const [k, v] of cache) {
+      if (now > v.expiresAt) {
+        cache.delete(k);
+        evicted = true;
+        if (cache.size < DEFAULT_CACHE_MAX_ENTRIES) {
+          break;
+        }
+      }
+    }
+    if (!evicted || cache.size >= DEFAULT_CACHE_MAX_ENTRIES) {
+      const oldest = cache.keys().next();
+      if (!oldest.done) {
+        cache.delete(oldest.value);
+      }
     }
   }
+  const now = Date.now();
   cache.set(key, {
     value,
-    expiresAt: Date.now() + ttlMs,
-    insertedAt: Date.now(),
+    expiresAt: now + ttlMs,
+    insertedAt: now,
   });
 }