@agentvault/agentvault 0.14.12 → 0.14.14

package/dist/cli.js

@@ -45103,22 +45103,6 @@ var init_scan_engine = __esm({
         /\bghp_[a-zA-Z0-9]{36,}\b/g,
         /\bglpat-[a-zA-Z0-9_-]{20,}\b/g,
         /\bxoxb-[0-9]+-[0-9]+-[a-zA-Z0-9]+\b/g
-      ],
-      prompt_injection: [
-        /\bignore\s+(?:all\s+)?(?:previous|above|prior)\s+instructions\b/gi,
-        /\byou\s+are\s+now\s+(?:a|an)\s+/gi,
-        /\bsystem\s*:\s*you\b/gi,
-        /\bDAN\s+mode\b/gi,
-        /\bdo\s+anything\s+now\b/gi,
-        /\bdo\s+not\s+follow\s+any\s+(?:other\s+)?rules\b/gi,
-        /\bjailbreak\b/gi
-      ],
-      shell_injection: [
-        /\bcurl\s+.*\|\s*(?:sh|bash|zsh)\b/gi,
-        /\beval\s*\(/gi,
-        /\bexec\s*\(/gi,
-        /\bchmod\s+\+x\b/gi,
-        /\brm\s+-rf\s+\//gi
       ]
     };
     ScanEngine = class {
@@ -45230,24 +45214,6 @@ var init_scan_engine = __esm({
           }
           return false;
         }
-        if (builtinId === "prompt_injection") {
-          const patterns = BUILTIN_PATTERNS.prompt_injection;
-          for (const p2 of patterns) {
-            const regex = new RegExp(p2.source, p2.flags);
-            if (regex.test(text))
-              return true;
-          }
-          return false;
-        }
-        if (builtinId === "shell_injection") {
-          const patterns = BUILTIN_PATTERNS.shell_injection;
-          for (const p2 of patterns) {
-            const regex = new RegExp(p2.source, p2.flags);
-            if (regex.test(text))
-              return true;
-          }
-          return false;
-        }
         return false;
       }
       _buildMatchSummary(rule) {
@@ -45267,48 +45233,6 @@ var init_scan_engine = __esm({
       _escapeRegex(str) {
         return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       }
-      /**
-       * Scan a workspace file (e.g. SOUL.md) against all builtin patterns.
-       * Runs api_keys, pii_*, prompt_injection, and shell_injection checks
-       * regardless of rule direction.
-       */
-      static scanWorkspaceFile(content) {
-        const violations = [];
-        let blocked = false;
-        let flagged = false;
-        const checks = [
-          { id: "api_keys", action: "block" },
-          { id: "prompt_injection", action: "block" },
-          { id: "shell_injection", action: "block" },
-          { id: "pii_ssn", action: "flag" },
-          { id: "pii_credit_card", action: "flag" },
-          { id: "pii_email", action: "flag" }
-        ];
-        for (const check of checks) {
-          const patterns = BUILTIN_PATTERNS[check.id];
-          if (!patterns)
-            continue;
-          for (const p2 of patterns) {
-            const regex = new RegExp(p2.source, p2.flags);
-            if (regex.test(content)) {
-              violations.push({
-                rule_id: `workspace_${check.id}`,
-                rule_name: check.id,
-                action: check.action,
-                scanner_type: "builtin",
-                match_summary: `builtin:${check.id}`
-              });
-              if (check.action === "block")
-                blocked = true;
-              if (check.action === "flag")
-                flagged = true;
-              break;
-            }
-          }
-        }
-        const status = blocked ? "blocked" : flagged ? "flagged" : "clean";
-        return { status, violations };
-      }
     };
   }
 });
@@ -47740,6 +47664,14 @@ var init_channel = __esm({
                 await this._persistState();
               }
               this.emit("a2a_channel_approved", channelData);
+              if (this.config.onA2AChannelReady && convId) {
+                this.config.onA2AChannelReady({
+                  channelId,
+                  peerHubAddress: peerHub,
+                  role,
+                  conversationId: convId
+                });
+              }
             }
             if (data.event === "a2a_channel_activated") {
               const actData = data.data || data;
@@ -49260,187 +49192,860 @@ var init_index = __esm({
   }
 });
 
-// src/setup.ts
-var setup_exports = {};
-__export(setup_exports, {
-  configurePm2: () => configurePm2,
-  installPlugin: () => installPlugin,
-  runSetupCommand: () => runSetupCommand
+// src/create-agent.ts
+var create_agent_exports = {};
+__export(create_agent_exports, {
+  findNextPort: () => findNextPort,
+  generateWorkspaceFiles: () => generateWorkspaceFiles,
+  openclawHome: () => openclawHome,
+  readOpenClawConfig: () => readOpenClawConfig,
+  runCreateCommand: () => runCreateCommand
 });
-import { execSync, spawnSync } from "node:child_process";
-import * as readline from "node:readline";
-import { resolve } from "node:path";
-async function runSetupCommand(options) {
-  const { token: token2, name: name2, apiUrl: apiUrl2 } = options;
-  const dataDir2 = resolve(options.dataDir.replace(/^~/, process.env.HOME ?? "~"));
-  const alreadyEnrolled = await isStateValid(dataDir2);
-  if (alreadyEnrolled && !options.force) {
-    console.log(`
-  Already enrolled (state in ${dataDir2}).
-  Re-enroll with --force, or update plugin with: openclaw plugins update agentvault
-`);
-    return;
-  }
-  console.log(`
-\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
-\u2551         AgentVault \u2014 First-Time Setup        \u2551
-\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
-
-  Agent name : ${name2}${options.accountId ? `
-  Account ID : ${options.accountId}` : ""}
-  Data dir   : ${dataDir2}
-  API        : ${apiUrl2}
-`);
-  let enrollDone = false;
-  const channel2 = new SecureChannel({
-    inviteToken: token2,
-    dataDir: dataDir2,
-    apiUrl: apiUrl2,
-    agentName: name2,
-    onMessage: () => {
-    },
-    // Not handling messages during setup
-    onStateChange: (state) => {
-      switch (state) {
-        case "enrolling":
-          console.log("  Enrolling with AgentVault server...");
-          break;
-        case "polling":
-          console.log("  Waiting for approval in your AgentVault dashboard...");
-          if (channel2.fingerprint) {
-            console.log(`
-  Fingerprint: ${channel2.fingerprint}`);
-            console.log("  Verify this fingerprint matches the one shown in your dashboard");
-            console.log("  before clicking Approve.\n");
-          }
-          break;
-        case "activating":
-          console.log("  Approved! Setting up encryption...");
-          break;
-        case "ready":
-          enrollDone = true;
-          console.log("  \u2705 Enrollment complete! Secure channel established.\n");
-          break;
-        case "error":
-          console.error("  \u274C Setup encountered an error.");
-          break;
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from "node:fs";
+import { join as join4 } from "node:path";
+function openclawHome() {
+  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
+  return join4(home, ".openclaw");
+}
+function readOpenClawConfig(home) {
+  const configPath = join4(home, "openclaw.json");
+  const raw = readFileSync(configPath, "utf-8");
+  return JSON.parse(raw);
+}
+function writeOpenClawConfig(home, config, backupSuffix) {
+  const configPath = join4(home, "openclaw.json");
+  const backupPath = `${configPath}.bak.pre-${backupSuffix}`;
+  copyFileSync(configPath, backupPath);
+  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+function collectPorts(config) {
+  const ports = [];
+  const accounts = config?.channels?.agentvault?.accounts;
+  if (accounts && typeof accounts === "object") {
+    for (const acct of Object.values(accounts)) {
+      if (typeof acct.httpPort === "number") {
+        ports.push(acct.httpPort);
       }
     }
-  });
-  channel2.on("error", (err) => {
-    console.error(`
-  \u274C Setup failed: ${err.message}
-`);
-    process.exit(1);
-  });
-  await new Promise((res, rej) => {
-    const check = setInterval(() => {
-      if (enrollDone) {
-        clearInterval(check);
-        res();
-      }
-    }, 500);
-    channel2.start().catch((err) => {
-      clearInterval(check);
-      rej(err);
-    });
-  });
-  await channel2.stop();
-  console.log("  Installing AgentVault plugin in OpenClaw...\n");
-  const home = process.env.HOME ?? "";
-  const extraPaths = [
-    `${home}/.local/bin`,
-    `${home}/.pnpm/bin`,
-    `${home}/Library/pnpm/bin`,
-    "/usr/local/bin",
-    "/opt/homebrew/bin"
-  ].join(":");
-  const env = { ...process.env, PATH: `${extraPaths}:${process.env.PATH ?? ""}` };
-  const pluginInstalled = installPlugin(env);
-  if (!pluginInstalled) {
-    if (options.accountId) {
-      console.log(`
-  \u26A0\uFE0F  Could not auto-configure OpenClaw (is 'openclaw' in your PATH?).
+  }
+  return ports;
+}
+function findNextPort(config, startPort = 18800) {
+  const ports = collectPorts(config);
+  if (ports.length === 0) return startPort;
+  return Math.max(...ports, startPort - 1) + 1;
+}
+function isPortInUse(config, port) {
+  return collectPorts(config).includes(port);
+}
+function generateWorkspaceFiles(name2) {
+  const displayName = name2.charAt(0).toUpperCase() + name2.slice(1).toLowerCase();
+  return {
+    "IDENTITY.md": `# IDENTITY.md - Who Am I?
 
-  1. Install the plugin:
-     openclaw plugins install @agentvault/agentvault
+- **Name:** ${displayName}
+- **Creature:** AI assistant \u2014 a capable peer agent in the AgentVault network
+- **Vibe:** Direct, competent, focused on their specialty domain
+- **Emoji:** (placeholder \u2014 update to something fitting)
+- **Avatar:** _(none set yet)_
 
-  2. Register the plugin in the allow list:
-     openclaw config set plugins.allow '["agentvault"]'
+> TODO: Customize this file to give ${name2} a distinct identity.
+`,
+    "SOUL.md": `# SOUL.md - Who You Are
 
-  3. Add this to your OpenClaw config (openclaw.yaml or openclaw.json):
-     channels:
-       agentvault:
-         apiUrl: "${apiUrl2}"
-         accounts:
-           ${options.accountId}:
-             dataDir: "${dataDir2}"
-             agentName: "${name2}"
+> TODO: Define ${name2}'s personality, tone, and behavioral rules.
+> Copy and adapt from ~/.openclaw/workspace/SOUL.md as a starting point.
 
-  4. (Recommended) Install pm2 for auto-restart and crash recovery:
-     npm install -g pm2
-     pm2 start "openclaw gateway start" --name openclaw-gateway
-     pm2 startup
-     pm2 save
+## Core Truths
 
-  5. Restart the gateway:
-     openclaw gateway restart
-`);
-    } else {
-      console.log(`
-  \u26A0\uFE0F  Could not auto-configure OpenClaw (is 'openclaw' in your PATH?).
+- Be genuinely helpful, not performatively helpful.
+- Have opinions. Be resourceful before asking.
+- Earn trust through competence.
 
-  1. Install the plugin:
-     openclaw plugins install @agentvault/agentvault
+## Channel Reply Rules
 
-  2. Register the plugin in the allow list:
-     openclaw config set plugins.allow '["agentvault"]'
+- Never include reasoning or internal logic in visible replies.
+- No narrating your approach before or after tool calls.
+- Just deliver the answer \u2014 clean and direct.
 
-  3. Add this to your OpenClaw config (openclaw.yaml or openclaw.json):
-     channels:
-       agentvault:
-         dataDir: "${dataDir2}"
-         apiUrl: "${apiUrl2}"
-         agentName: "${name2}"
+## Vibe
 
-  4. (Recommended) Install pm2 for auto-restart and crash recovery:
-     npm install -g pm2
-     pm2 start "openclaw gateway start" --name openclaw-gateway
-     pm2 startup
-     pm2 save
+_(Define ${name2}'s specific personality here.)_
+`,
+    "HEARTBEAT.md": `# Heartbeat
 
-  5. Restart the gateway:
-     openclaw gateway restart
-`);
-    }
-    return;
-  }
-  console.log("\n  Registering AgentVault channel in OpenClaw config...\n");
-  const configPrefix = options.accountId ? `channels.agentvault.accounts.${options.accountId}` : "channels.agentvault";
-  const patchCommands = [
-    // When using multi-agent, set shared apiUrl at top level too
-    ...options.accountId ? [`openclaw config set channels.agentvault.apiUrl "${apiUrl2}"`] : [],
-    `openclaw config set ${configPrefix}.dataDir "${dataDir2}"`,
-    `openclaw config set ${configPrefix}.apiUrl "${apiUrl2}"`,
-    `openclaw config set ${configPrefix}.agentName "${name2}"`,
-    `openclaw config set plugins.allow '["agentvault"]'`
-  ];
-  let configPatched = false;
+- Stay available. If nothing needs attention, reply HEARTBEAT_OK.
+- **Heartbeat replies are INTERNAL ONLY.** Reply with ONLY \`HEARTBEAT_OK\` when nothing needs attention.
+- If something genuinely urgent needs attention, send it proactively FIRST, THEN reply HEARTBEAT_OK.
+`,
+    "MEMORY.md": `# MEMORY.md - Long-Term Memory
+
+_(Empty \u2014 ${name2} starts with a clean memory. Update as the agent learns.)_
+`
+  };
+}
+async function runCreateCommand(options) {
+  const { name: name2, token: token2, apiUrl: apiUrl2, force } = options;
+  const home = openclawHome();
+  const configPath = join4(home, "openclaw.json");
+  const workspaceDir = join4(home, `workspace-${name2}`);
+  const dataDir2 = join4(home, "agents", name2, "agentvault-data");
+  const templateDir = join4(home, "workspace");
+  console.log(`
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551       AgentVault \u2014 Create New Agent          \u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`);
+  console.log("  Step 1/7 \u2014 Preflight checks...");
+  try {
+    execSync("openclaw --version", { stdio: "pipe" });
+  } catch {
+    console.error("  Error: 'openclaw' not found in PATH. Is OpenClaw installed?");
+    process.exit(1);
+  }
+  if (!existsSync(configPath)) {
+    console.error(`  Error: openclaw.json not found at ${configPath}`);
+    process.exit(1);
+  }
+  console.log("  Preflight passed.\n");
+  console.log("  Step 2/7 \u2014 Detecting port...");
+  const config = readOpenClawConfig(home);
+  let port;
+  if (options.port != null) {
+    port = options.port;
+    if (isPortInUse(config, port)) {
+      console.error(`  Error: Port ${port} is already in use in openclaw.json.`);
+      process.exit(1);
+    }
+    console.log(`  Using explicit port ${port}.
+`);
+  } else {
+    port = findNextPort(config);
+    console.log(`  Auto-assigned port ${port}.
+`);
+  }
+  console.log("  Step 3/7 \u2014 Creating agent with OpenClaw...");
+  try {
+    execSync(`openclaw agents add -- ${name2}`, { stdio: "pipe" });
+    console.log(`  Agent '${name2}' created.
+`);
+  } catch {
+    console.log(`  Warning: 'openclaw agents add' failed \u2014 agent may already exist. Continuing.
+`);
+  }
+  console.log("  Step 4/7 \u2014 Creating directories...");
+  mkdirSync(workspaceDir, { recursive: true });
+  mkdirSync(dataDir2, { recursive: true });
+  console.log(`  Workspace: ${workspaceDir}`);
+  console.log(`  DataDir:   ${dataDir2}
+`);
+  console.log("  Step 5/7 \u2014 Writing workspace files...");
+  const files = generateWorkspaceFiles(name2);
+  for (const [filename, content] of Object.entries(files)) {
+    writeFileSync(join4(workspaceDir, filename), content, "utf-8");
+  }
+  for (const copyFile of ["AGENTS.md", "USER.md"]) {
+    const src = join4(templateDir, copyFile);
+    if (existsSync(src)) {
+      copyFileSync(src, join4(workspaceDir, copyFile));
+      console.log(`  Copied ${copyFile} from template workspace.`);
+    }
+  }
+  console.log("  Workspace files written.\n");
+  console.log("  Step 6/7 \u2014 Enrolling with AgentVault...\n");
+  await runSetupCommand({
+    token: token2,
+    name: name2,
+    apiUrl: apiUrl2,
+    dataDir: dataDir2,
+    accountId: name2,
+    force
+  });
+  console.log("\n  Step 7/7 \u2014 Patching openclaw.json...");
+  try {
+    const freshConfig = readOpenClawConfig(home);
+    let patched = false;
+    const avChannel = freshConfig?.channels?.agentvault;
+    if (avChannel?.accounts) {
+      const acct = avChannel.accounts[name2];
+      if (acct) {
+        acct.httpPort = port;
+        patched = true;
+      }
+    }
+    if (avChannel) {
+      const bindings = avChannel.bindings;
+      const hasWildcard = bindings?.some(
+        (b2) => b2.match?.accountId === "*"
+      );
+      if (!hasWildcard) {
+        avChannel.bindings = [{ match: { accountId: "*" } }, ...bindings ?? []];
+        console.log(`  Added wildcard binding (accountId: "*").`);
+      }
+    }
+    if (patched) {
+      writeOpenClawConfig(home, freshConfig, name2);
+      console.log(`  httpPort set to ${port}.
+`);
+    } else {
+      console.log(`  Warning: Could not find account '${name2}' in channels.agentvault.accounts.`);
+      console.log(`  You may need to manually set httpPort: ${port} in openclaw.json.
+`);
+    }
+  } catch (err) {
+    console.log(`  Warning: Failed to patch openclaw.json: ${err.message}
+`);
+  }
+  console.log("  Verifying agent...");
+  try {
+    const http = await import("node:http");
+    await new Promise((resolve4) => {
+      const req = http.get(`http://127.0.0.1:${port}/status`, { timeout: 3e3 }, (res) => {
+        console.log(`  Port ${port} responded (HTTP ${res.statusCode}).`);
+        res.resume();
+        resolve4();
+      });
+      req.on("error", () => {
+        console.log(`  Port ${port} not yet responding \u2014 gateway may need a moment.`);
+        resolve4();
+      });
+      req.on("timeout", () => {
+        req.destroy();
+        console.log(`  Port ${port} timed out \u2014 check gateway logs.`);
+        resolve4();
+      });
+    });
+  } catch {
+    console.log("  Verification skipped.");
+  }
+  if (process.platform === "darwin") {
+    const { validatePlist: validatePlist2 } = await init_doctor().then(() => doctor_exports);
+    const plistResult = validatePlist2();
+    if (plistResult.status === "stale") {
+      console.log(`
+  \u26A0\uFE0F  macOS LaunchAgent plist has stale paths.
+  Run to diagnose and fix: npx @agentvault/agentvault doctor
+`);
+    }
+  }
+  console.log(`
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+  Agent '${name2}' created successfully!
+\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
+
+  Workspace:  ${workspaceDir}
+  DataDir:    ${dataDir2}
+  HTTP Port:  ${port}
+
+  Next steps:
+  1. Edit ${workspaceDir}/SOUL.md \u2014 give ${name2} a personality
+  2. Edit ${workspaceDir}/IDENTITY.md \u2014 set name, emoji, vibe
+  3. Approve the agent in the AgentVault app
+`);
+}
+var init_create_agent = __esm({
+  async "src/create-agent.ts"() {
+    "use strict";
+    await init_setup();
+  }
+});
+
+// src/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  applyPlistFix: () => applyPlistFix,
+  checkAgentDataDirs: () => checkAgentDataDirs,
+  checkAgentVaultChannel: () => checkAgentVaultChannel,
+  checkConfigExists: () => checkConfigExists,
+  checkGatewayPort: () => checkGatewayPort,
+  checkOpenClawInstalled: () => checkOpenClawInstalled,
+  checkPlist: () => checkPlist,
+  checkPluginsAllow: () => checkPluginsAllow,
+  checkPm2Status: () => checkPm2Status,
+  parsePlist: () => parsePlist,
+  plistPath: () => plistPath,
+  runDoctorCommand: () => runDoctorCommand,
+  validatePlist: () => validatePlist
+});
+import { execSync as execSync2 } from "node:child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, chmodSync } from "node:fs";
+import { join as join5 } from "node:path";
+import { createInterface } from "node:readline";
+function checkOpenClawInstalled() {
+  try {
+    const out = execSync2("openclaw --version", { stdio: "pipe", timeout: 1e4 });
+    const version = out.toString().trim();
+    return { name: "OpenClaw installed", status: "pass", message: version };
+  } catch {
+    return {
+      name: "OpenClaw installed",
+      status: "fail",
+      message: "'openclaw' not found in PATH"
+    };
+  }
+}
+function checkConfigExists(home) {
+  const configPath = join5(home, "openclaw.json");
+  if (!existsSync2(configPath)) {
+    return {
+      name: "Config exists",
+      status: "fail",
+      message: `Not found: ${configPath}`
+    };
+  }
+  try {
+    JSON.parse(readFileSync2(configPath, "utf-8"));
+    return { name: "Config exists", status: "pass", message: configPath };
+  } catch {
+    return {
+      name: "Config exists",
+      status: "fail",
+      message: `Invalid JSON: ${configPath}`
+    };
+  }
+}
+function checkAgentVaultChannel(config) {
+  if (!config) {
+    return {
+      name: "AgentVault channel",
+      status: "fail",
+      message: "Config is null"
+    };
+  }
+  if (config.channels?.agentvault) {
+    return { name: "AgentVault channel", status: "pass", message: "channels.agentvault present" };
+  }
+  return {
+    name: "AgentVault channel",
+    status: "fail",
+    message: "channels.agentvault not found in config"
+  };
+}
+function checkPluginsAllow(config) {
+  if (!config) {
+    return { name: "Plugin allow-listed", status: "warn", message: "Config is null" };
+  }
+  const allow = config.plugins?.allow;
+  if (!Array.isArray(allow)) {
+    return {
+      name: "Plugin allow-listed",
+      status: "warn",
+      message: "plugins.allow not defined"
+    };
+  }
+  if (allow.includes("agentvault")) {
+    return { name: "Plugin allow-listed", status: "pass", message: "agentvault in plugins.allow" };
+  }
+  return {
+    name: "Plugin allow-listed",
+    status: "warn",
+    message: "'agentvault' not in plugins.allow list"
+  };
+}
+function checkPlist() {
+  if (process.platform !== "darwin") {
+    return { name: "macOS LaunchAgent plist", status: "skip", message: "Not macOS" };
+  }
+  const result = validatePlist();
+  switch (result.status) {
+    case "ok":
+      return { name: "macOS LaunchAgent plist", status: "pass", message: "Plist paths valid" };
+    case "already-fixed":
+      return { name: "macOS LaunchAgent plist", status: "pass", message: "Wrapper script already configured" };
+    case "stale":
+      return {
+        name: "macOS LaunchAgent plist",
+        status: "fail",
+        message: `Stale path: ${result.stalePaths?.[0] ?? "unknown"}`
+      };
+    case "missing":
+      return {
+        name: "macOS LaunchAgent plist",
+        status: "warn",
+        message: `Plist not found: ${result.plistPath ?? PLIST_FILENAME}`
+      };
+    default:
+      return { name: "macOS LaunchAgent plist", status: "skip", message: "Skipped" };
+  }
+}
+function checkGatewayPort() {
+  try {
+    execSync2("curl -sf --max-time 3 http://127.0.0.1:18789/", { stdio: "pipe" });
+    return { name: "Gateway port (18789)", status: "pass", message: "Responding" };
+  } catch {
+    return {
+      name: "Gateway port (18789)",
+      status: "fail",
+      message: "No response on 127.0.0.1:18789"
+    };
+  }
+}
+function checkAgentDataDirs(config) {
+  if (!config) {
+    return { name: "Agent data dirs", status: "warn", message: "Config is null" };
+  }
+  const home = process.env.HOME ?? "";
+  const warnings = [];
+  const av = config.channels?.agentvault;
+  if (!av) {
+    return { name: "Agent data dirs", status: "warn", message: "No agentvault channel" };
+  }
+  const checkDir = (label, dataDir2) => {
+    const resolved = dataDir2.replace(/^~/, home);
+    if (!existsSync2(resolved)) {
+      warnings.push(`${label}: dir missing (${resolved})`);
+      return;
+    }
+    const statePath2 = join5(resolved, "agentvault.json");
+    if (!existsSync2(statePath2)) {
+      warnings.push(`${label}: no agentvault.json`);
+    }
+  };
+  if (av.accounts && typeof av.accounts === "object") {
+    for (const [id, acct] of Object.entries(av.accounts)) {
+      if (acct.dataDir) checkDir(id, acct.dataDir);
+    }
+  } else if (av.dataDir) {
+    checkDir("default", av.dataDir);
+  }
+  if (warnings.length > 0) {
+    return { name: "Agent data dirs", status: "warn", message: warnings.join("; ") };
+  }
+  return { name: "Agent data dirs", status: "pass", message: "All data dirs valid" };
+}
+function checkPm2Status() {
+  try {
+    execSync2("pm2 --version", { stdio: "pipe", timeout: 5e3 });
+  } catch {
+    return { name: "pm2 status", status: "skip", message: "pm2 not installed" };
+  }
+  try {
+    const info = execSync2("pm2 describe openclaw-gateway", { stdio: "pipe", timeout: 5e3 });
+    const out = info.toString();
+    if (out.includes("online")) {
+      return { name: "pm2 status", status: "pass", message: "openclaw-gateway: online" };
+    }
+    if (out.includes("stopped")) {
+      return { name: "pm2 status", status: "warn", message: "openclaw-gateway: stopped" };
+    }
+    return { name: "pm2 status", status: "warn", message: "openclaw-gateway: unknown state" };
+  } catch {
+    return { name: "pm2 status", status: "warn", message: "openclaw-gateway not registered in pm2" };
+  }
+}
+function plistPath() {
+  const home = process.env.HOME ?? "";
+  return join5(home, "Library", "LaunchAgents", PLIST_FILENAME);
+}
+function parsePlist(plistFile) {
+  if (!existsSync2(plistFile)) return null;
+  try {
+    const json = execSync2(`plutil -convert json -o - "${plistFile}"`, {
+      stdio: "pipe",
+      timeout: 5e3
+    }).toString();
+    const parsed = JSON.parse(json);
+    const programArgs = parsed.ProgramArguments ?? [];
+    const stalePaths = [];
+    const wrapperPath = join5(process.env.HOME ?? "", ".openclaw", WRAPPER_SCRIPT_NAME);
+    for (const arg of programArgs) {
+      if (arg.startsWith("/") && arg !== "/bin/bash" && arg !== wrapperPath) {
+        if (!existsSync2(arg)) {
+          stalePaths.push(arg);
+        }
+      }
+    }
+    return { plistPath: plistFile, programArgs, stalePaths };
+  } catch {
+    return null;
+  }
+}
+function validatePlist() {
+  if (process.platform !== "darwin") {
+    return { status: "skip" };
+  }
+  const path = plistPath();
+  if (!existsSync2(path)) {
+    return { status: "missing", plistPath: path };
+  }
+  const info = parsePlist(path);
+  if (!info) {
+    return { status: "missing", plistPath: path };
+  }
+  const home = process.env.HOME ?? "";
+  const wrapperPath = join5(home, ".openclaw", WRAPPER_SCRIPT_NAME);
+  if (info.programArgs.includes(wrapperPath)) {
+    return { status: "already-fixed", plistPath: path };
+  }
+  if (info.stalePaths.length > 0) {
+    return { status: "stale", plistPath: path, stalePaths: info.stalePaths };
+  }
+  return { status: "ok", plistPath: path };
+}
+function applyPlistFix(info) {
+  const home = process.env.HOME ?? "";
+  const openclawDir = join5(home, ".openclaw");
+  const wrapperPath = join5(openclawDir, WRAPPER_SCRIPT_NAME);
+  const wrapperContent = `#!/bin/bash
+exec "$(which openclaw)" gateway start "$@"
+`;
+  try {
+    writeFileSync2(wrapperPath, wrapperContent, "utf-8");
+    chmodSync(wrapperPath, 493);
+    console.log(`  Created wrapper: ${wrapperPath}`);
+  } catch (err) {
+    console.error(`  Failed to create wrapper script: ${err.message}`);
+    return false;
+  }
+  const plistBuddy = "/usr/libexec/PlistBuddy";
+  const plist = info.plistPath;
+  try {
+    execSync2(`${plistBuddy} -c "Set :ProgramArguments:0 /bin/bash" "${plist}"`, { stdio: "pipe" });
+    try {
+      execSync2(`${plistBuddy} -c "Set :ProgramArguments:1 ${wrapperPath}" "${plist}"`, { stdio: "pipe" });
+    } catch {
+      execSync2(`${plistBuddy} -c "Add :ProgramArguments:1 string ${wrapperPath}" "${plist}"`, { stdio: "pipe" });
+    }
+    let argCount = info.programArgs.length;
+    for (let i2 = argCount - 1; i2 >= 2; i2--) {
+      try {
+        execSync2(`${plistBuddy} -c "Delete :ProgramArguments:${i2}" "${plist}"`, { stdio: "pipe" });
+      } catch {
+      }
+    }
+    console.log("  Updated plist ProgramArguments.");
+  } catch (err) {
+    console.error(`  Failed to update plist: ${err.message}`);
+    return false;
+  }
+  try {
+    execSync2(`launchctl unload "${plist}"`, { stdio: "pipe" });
+  } catch {
+  }
+  try {
+    execSync2(`launchctl load "${plist}"`, { stdio: "pipe" });
+    console.log("  Reloaded LaunchAgent.");
+  } catch (err) {
+    console.error(`  Failed to reload LaunchAgent: ${err.message}`);
+    console.log(`  Try manually: launchctl load "${plist}"`);
+    return false;
+  }
+  return true;
+}
+async function runDoctorCommand(options) {
+  const home = openclawHome();
+  console.log(`
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551       AgentVault \u2014 Doctor Diagnostics        \u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+`);
+  const results = [];
+  results.push(checkOpenClawInstalled());
+  results.push(checkConfigExists(home));
+  let config = null;
+  try {
+    config = readOpenClawConfig(home);
+  } catch {
+  }
+  results.push(checkAgentVaultChannel(config));
+  results.push(checkPluginsAllow(config));
+  results.push(checkPlist());
+  results.push(checkGatewayPort());
+  results.push(checkAgentDataDirs(config));
+  results.push(checkPm2Status());
+  const statusLabels = {
+    pass: "pass",
+    warn: "WARN",
+    fail: "FAIL",
+    skip: "skip"
+  };
+  for (const r2 of results) {
+    const label = `[${statusLabels[r2.status]}]`;
+    console.log(`  ${label.padEnd(6)} ${r2.name} \u2014 ${r2.message}`);
+  }
+  const passed = results.filter((r2) => r2.status === "pass").length;
+  const warnings = results.filter((r2) => r2.status === "warn").length;
+  const failed = results.filter((r2) => r2.status === "fail").length;
+  console.log(`
+  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  ${passed} passed  ${warnings} warnings  ${failed} failed
+  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+`);
+  if (failed > 0) {
+    process.exitCode = 1;
+  }
+  const plistResult = validatePlist();
+  if (plistResult.status === "stale") {
+    const plistInfo = parsePlist(plistResult.plistPath);
+    if (!plistInfo) return;
+    if (options?.fix) {
+      console.log("  Applying plist fix (--fix)...\n");
+      const ok = applyPlistFix(plistInfo);
+      if (ok) {
+        console.log("\n  \u2705 Plist fixed. Gateway should start cleanly now.\n");
+      } else {
+        console.log("\n  \u274C Plist fix failed. See errors above.\n");
+      }
+    } else {
+      const answer = await ask("  Stale plist detected. Apply wrapper script fix? [y/N] ");
+      if (answer.trim().toLowerCase() === "y") {
+        console.log("");
+        const ok = applyPlistFix(plistInfo);
+        if (ok) {
+          console.log("\n  \u2705 Plist fixed. Gateway should start cleanly now.\n");
+        } else {
+          console.log("\n  \u274C Plist fix failed. See errors above.\n");
+        }
+      } else {
+        console.log(`
+  To fix later, run:
+    npx @agentvault/agentvault doctor --fix
+`);
+      }
+    }
+  }
+}
+function ask(question) {
+  return new Promise((resolve4) => {
+    const rl2 = createInterface({
+      input: process.stdin,
+      output: process.stdout,
+      terminal: true
+    });
+    rl2.question(question, (answer) => {
+      rl2.close();
+      resolve4(answer);
+    });
+  });
+}
+var PLIST_FILENAME, WRAPPER_SCRIPT_NAME;
+var init_doctor = __esm({
+  async "src/doctor.ts"() {
+    "use strict";
+    await init_create_agent();
+    PLIST_FILENAME = "ai.openclaw.gateway.plist";
+    WRAPPER_SCRIPT_NAME = "start-gateway.sh";
+  }
+});
+
+// src/setup.ts
+var setup_exports = {};
+__export(setup_exports, {
+  configurePm2: () => configurePm2,
+  installPlugin: () => installPlugin,
+  runSetupCommand: () => runSetupCommand
+});
+import { execSync as execSync3, spawnSync } from "node:child_process";
+import * as readline from "node:readline";
+import { resolve } from "node:path";
+async function runSetupCommand(options) {
+  const { token: token2, name: name2, apiUrl: apiUrl2 } = options;
+  const dataDir2 = resolve(options.dataDir.replace(/^~/, process.env.HOME ?? "~"));
+  const alreadyEnrolled = await isStateValid(dataDir2);
+  if (alreadyEnrolled && !options.force) {
+    console.log(`
+  Already enrolled (state in ${dataDir2}).
+  Re-enroll with --force, or update plugin with: openclaw plugins update agentvault
+`);
+    return;
+  }
+  console.log(`
+\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+\u2551         AgentVault \u2014 First-Time Setup        \u2551
+\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+
+  Agent name : ${name2}${options.accountId ? `
+  Account ID : ${options.accountId}` : ""}
+  Data dir   : ${dataDir2}
+  API        : ${apiUrl2}
+`);
+  let enrollDone = false;
+  const channel2 = new SecureChannel({
+    inviteToken: token2,
+    dataDir: dataDir2,
+    apiUrl: apiUrl2,
+    agentName: name2,
+    onMessage: () => {
+    },
+    // Not handling messages during setup
+    onStateChange: (state) => {
+      switch (state) {
+        case "enrolling":
+          console.log("  Enrolling with AgentVault server...");
+          break;
+        case "polling":
+          console.log("  Waiting for approval in your AgentVault dashboard...");
+          if (channel2.fingerprint) {
+            console.log(`
+  Fingerprint: ${channel2.fingerprint}`);
+            console.log("  Verify this fingerprint matches the one shown in your dashboard");
+            console.log("  before clicking Approve.\n");
+          }
+          break;
+        case "activating":
+          console.log("  Approved! Setting up encryption...");
+          break;
+        case "ready":
+          enrollDone = true;
+          console.log("  \u2705 Enrollment complete! Secure channel established.\n");
+          break;
+        case "error":
+          console.error("  \u274C Setup encountered an error.");
+          break;
+      }
+    }
+  });
+  channel2.on("error", (err) => {
+    console.error(`
+  \u274C Setup failed: ${err.message}
+`);
+    process.exit(1);
+  });
+  await new Promise((res, rej) => {
+    const check = setInterval(() => {
+      if (enrollDone) {
+        clearInterval(check);
+        res();
+      }
+    }, 500);
+    channel2.start().catch((err) => {
+      clearInterval(check);
+      rej(err);
+    });
+  });
+  await channel2.stop();
+  console.log("  Installing AgentVault plugin in OpenClaw...\n");
+  const home = process.env.HOME ?? "";
+  const extraPaths = [
+    `${home}/.local/bin`,
+    `${home}/.pnpm/bin`,
+    `${home}/Library/pnpm/bin`,
+    "/usr/local/bin",
+    "/opt/homebrew/bin"
+  ].join(":");
+  const env = { ...process.env, PATH: `${extraPaths}:${process.env.PATH ?? ""}` };
+  const pluginInstalled = installPlugin(env);
+  if (!pluginInstalled) {
+    if (options.accountId) {
+      console.log(`
+  \u26A0\uFE0F  Could not auto-configure OpenClaw (is 'openclaw' in your PATH?).
+
+  1. Install the plugin:
+     openclaw plugins install @agentvault/agentvault
+
+  2. Register the plugin in the allow list:
+     openclaw config set plugins.allow '["agentvault"]'
+
+  3. Add this to your OpenClaw config (openclaw.yaml or openclaw.json):
+     channels:
+       agentvault:
+         apiUrl: "${apiUrl2}"
+         bindings:
+           - match:
+               accountId: "*"
+         accounts:
+           ${options.accountId}:
+             dataDir: "${dataDir2}"
+             agentName: "${name2}"
+
+  4. (Recommended) Install pm2 for auto-restart and crash recovery:
+     npm install -g pm2
+     pm2 start "openclaw gateway start" --name openclaw-gateway
+     pm2 startup
+     pm2 save
+
+  5. Restart the gateway:
+     openclaw gateway restart
+`);
+    } else {
+      console.log(`
+  \u26A0\uFE0F  Could not auto-configure OpenClaw (is 'openclaw' in your PATH?).
+
+  1. Install the plugin:
+     openclaw plugins install @agentvault/agentvault
+
+  2. Register the plugin in the allow list:
+     openclaw config set plugins.allow '["agentvault"]'
+
+  3. Add this to your OpenClaw config (openclaw.yaml or openclaw.json):
+     channels:
+       agentvault:
+         dataDir: "${dataDir2}"
+         apiUrl: "${apiUrl2}"
+         agentName: "${name2}"
+
+  4. (Recommended) Install pm2 for auto-restart and crash recovery:
+     npm install -g pm2
+     pm2 start "openclaw gateway start" --name openclaw-gateway
+     pm2 startup
+     pm2 save
+
+  5. Restart the gateway:
+     openclaw gateway restart
+`);
+    }
+    return;
+  }
+  console.log("\n  Registering AgentVault channel in OpenClaw config...\n");
+  const configPrefix = options.accountId ? `channels.agentvault.accounts.${options.accountId}` : "channels.agentvault";
+  const patchCommands = [
+    // When using multi-agent, set shared apiUrl at top level too
+    ...options.accountId ? [`openclaw config set channels.agentvault.apiUrl "${apiUrl2}"`] : [],
+    `openclaw config set ${configPrefix}.dataDir "${dataDir2}"`,
+    `openclaw config set ${configPrefix}.apiUrl "${apiUrl2}"`,
+    `openclaw config set ${configPrefix}.agentName "${name2}"`,
+    `openclaw config set plugins.allow '["agentvault"]'`
+  ];
+  let configPatched = false;
   for (const cmd of patchCommands) {
     try {
-      execSync(cmd, { stdio: "pipe", env });
+      execSync3(cmd, { stdio: "pipe", env });
       configPatched = true;
     } catch {
       configPatched = false;
       break;
     }
   }
+  if (configPatched) {
+    try {
+      const raw = execSync3("openclaw config get channels.agentvault.bindings", {
+        stdio: "pipe",
+        env
+      }).toString().trim();
+      const hasWildcard = raw.includes('"*"') || raw.includes("'*'");
+      if (!hasWildcard) {
+        execSync3(
+          `openclaw config set channels.agentvault.bindings '[{"match":{"accountId":"*"}}]'`,
+          { stdio: "pipe", env }
+        );
+      }
+    } catch {
+      try {
+        execSync3(
+          `openclaw config set channels.agentvault.bindings '[{"match":{"accountId":"*"}}]'`,
+          { stdio: "pipe", env }
+        );
+      } catch {
+      }
+    }
+  }
   if (configPatched) {
     console.log(`  \u2705 Channel registered in OpenClaw config.
 `);
     console.log("  Configuring pm2 process management...\n");
     configurePm2(env);
     await promptAndRestart(env);
+    if (process.platform === "darwin") {
+      const { validatePlist: validatePlist2 } = await init_doctor().then(() => doctor_exports);
+      const plistResult = validatePlist2();
+      if (plistResult.status === "stale") {
+        console.log(`
+  \u26A0\uFE0F  macOS LaunchAgent plist has stale paths.
+  Run to diagnose and fix: npx @agentvault/agentvault doctor
+`);
+      }
+    }
   } else {
     if (options.accountId) {
       console.log(`  \u26A0\uFE0F  Could not auto-configure OpenClaw channel.
@@ -49475,7 +50080,7 @@ async function runSetupCommand(options) {
 }
 function installPlugin(env) {
   try {
-    const info = execSync("openclaw plugins info agentvault", {
+    const info = execSync3("openclaw plugins info agentvault", {
       stdio: "pipe",
       env
     });
@@ -49485,7 +50090,7 @@ function installPlugin(env) {
     if (installedVersion && installedVersion !== VERSION) {
       console.log(`  Updating plugin ${installedVersion} \u2192 ${VERSION}...`);
       try {
-        execSync("openclaw plugins update agentvault", { stdio: "pipe", env });
+        execSync3("openclaw plugins update agentvault", { stdio: "pipe", env });
         console.log("  Plugin updated.");
       } catch {
         console.log(`  \u26A0\uFE0F  Update failed \u2014 v${installedVersion} will be used.`);
@@ -49497,7 +50102,7 @@ function installPlugin(env) {
   } catch {
   }
   try {
-    execSync("openclaw plugins install @agentvault/agentvault", {
+    execSync3("openclaw plugins install @agentvault/agentvault", {
       stdio: "pipe",
       env
     });
@@ -49510,7 +50115,7 @@ function installPlugin(env) {
 }
 function configurePm2(env) {
   try {
-    execSync("pm2 --version", { stdio: "pipe", env });
+    execSync3("pm2 --version", { stdio: "pipe", env });
   } catch {
     console.log(`
   \u2139\uFE0F  pm2 not found. For best reliability, install pm2:
@@ -49524,7 +50129,7 @@ function configurePm2(env) {
     return false;
   }
   try {
-    const info = execSync("pm2 describe openclaw-gateway", { stdio: "pipe", env });
+    const info = execSync3("pm2 describe openclaw-gateway", { stdio: "pipe", env });
     const infoStr = info.toString();
     if (infoStr.includes("online") || infoStr.includes("stopped")) {
       console.log("  pm2 process 'openclaw-gateway' already exists.");
@@ -49535,20 +50140,20 @@ function configurePm2(env) {
   const isMac = process.platform === "darwin";
   const startCmd = isMac ? "caffeinate -i openclaw gateway start" : "openclaw gateway start";
   try {
-    execSync(`pm2 start "${startCmd}" --name openclaw-gateway`, { stdio: "pipe", env });
+    execSync3(`pm2 start "${startCmd}" --name openclaw-gateway`, { stdio: "pipe", env });
     console.log("  \u2705 Gateway registered with pm2.");
   } catch (err) {
     console.log(`  \u26A0\uFE0F  Failed to register with pm2: ${err}`);
     return false;
   }
   try {
-    execSync("pm2 startup", { stdio: "pipe", env });
+    execSync3("pm2 startup", { stdio: "pipe", env });
     console.log("  \u2705 pm2 startup configured (auto-start on boot).");
   } catch {
     console.log("  \u26A0\uFE0F  pm2 startup failed \u2014 you may need to run 'pm2 startup' manually with sudo.");
   }
   try {
-    execSync("pm2 save", { stdio: "pipe", env });
+    execSync3("pm2 save", { stdio: "pipe", env });
     console.log("  \u2705 pm2 process list saved.");
   } catch {
     console.log("  \u26A0\uFE0F  pm2 save failed.");
@@ -49556,7 +50161,7 @@ function configurePm2(env) {
   return true;
 }
 async function promptAndRestart(env) {
-  const answer = await ask(
+  const answer = await ask2(
     "  \u26A0\uFE0F  OpenClaw gateway will restart, briefly interrupting any active conversations.\n  Restart now? [y/N] "
   );
   if (answer.trim().toLowerCase() === "y") {
@@ -49592,7 +50197,7 @@ async function promptAndRestart(env) {
 `);
   }
 }
-function ask(question) {
+function ask2(question) {
   return new Promise((resolve4) => {
     const rl2 = readline.createInterface({
       input: process.stdin,
@@ -49614,255 +50219,12 @@ var init_setup = __esm({
   }
 });
 
-// src/create-agent.ts
-var create_agent_exports = {};
-__export(create_agent_exports, {
-  findNextPort: () => findNextPort,
-  generateWorkspaceFiles: () => generateWorkspaceFiles,
-  openclawHome: () => openclawHome,
-  readOpenClawConfig: () => readOpenClawConfig,
-  runCreateCommand: () => runCreateCommand
-});
-import { execSync as execSync2 } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from "node:fs";
-import { join as join4 } from "node:path";
-function openclawHome() {
-  const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return join4(home, ".openclaw");
-}
-function readOpenClawConfig(home) {
-  const configPath = join4(home, "openclaw.json");
-  const raw = readFileSync(configPath, "utf-8");
-  return JSON.parse(raw);
-}
-function writeOpenClawConfig(home, config, backupSuffix) {
-  const configPath = join4(home, "openclaw.json");
-  const backupPath = `${configPath}.bak.pre-${backupSuffix}`;
-  copyFileSync(configPath, backupPath);
-  writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
-}
-function collectPorts(config) {
-  const ports = [];
-  const accounts = config?.channels?.agentvault?.accounts;
-  if (accounts && typeof accounts === "object") {
-    for (const acct of Object.values(accounts)) {
-      if (typeof acct.httpPort === "number") {
-        ports.push(acct.httpPort);
-      }
-    }
-  }
-  return ports;
-}
-function findNextPort(config, startPort = 18800) {
-  const ports = collectPorts(config);
-  if (ports.length === 0) return startPort;
-  return Math.max(...ports, startPort - 1) + 1;
-}
-function isPortInUse(config, port) {
-  return collectPorts(config).includes(port);
-}
-function generateWorkspaceFiles(name2) {
-  const displayName = name2.charAt(0).toUpperCase() + name2.slice(1).toLowerCase();
-  return {
-    "IDENTITY.md": `# IDENTITY.md - Who Am I?
-
-- **Name:** ${displayName}
-- **Creature:** AI assistant \u2014 a capable peer agent in the AgentVault network
-- **Vibe:** Direct, competent, focused on their specialty domain
-- **Emoji:** (placeholder \u2014 update to something fitting)
-- **Avatar:** _(none set yet)_
-
-> TODO: Customize this file to give ${name2} a distinct identity.
-`,
-    "SOUL.md": `# SOUL.md - Who You Are
-
-> TODO: Define ${name2}'s personality, tone, and behavioral rules.
-> Copy and adapt from ~/.openclaw/workspace/SOUL.md as a starting point.
-
-## Core Truths
-
-- Be genuinely helpful, not performatively helpful.
-- Have opinions. Be resourceful before asking.
-- Earn trust through competence.
-
-## Channel Reply Rules
-
-- Never include reasoning or internal logic in visible replies.
-- No narrating your approach before or after tool calls.
-- Just deliver the answer \u2014 clean and direct.
-
-## Vibe
-
-_(Define ${name2}'s specific personality here.)_
-`,
-    "HEARTBEAT.md": `# Heartbeat
-
-- Stay available. If nothing needs attention, reply HEARTBEAT_OK.
-- **Heartbeat replies are INTERNAL ONLY.** Reply with ONLY \`HEARTBEAT_OK\` when nothing needs attention.
-- If something genuinely urgent needs attention, send it proactively FIRST, THEN reply HEARTBEAT_OK.
-`,
-    "MEMORY.md": `# MEMORY.md - Long-Term Memory
-
-_(Empty \u2014 ${name2} starts with a clean memory. Update as the agent learns.)_
-`
-  };
-}
-async function runCreateCommand(options) {
-  const { name: name2, token: token2, apiUrl: apiUrl2, force } = options;
-  const home = openclawHome();
-  const configPath = join4(home, "openclaw.json");
-  const workspaceDir = join4(home, `workspace-${name2}`);
-  const dataDir2 = join4(home, "agents", name2, "agentvault-data");
-  const templateDir = join4(home, "workspace");
-  console.log(`
-\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
-\u2551       AgentVault \u2014 Create New Agent          \u2551
-\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
-`);
-  console.log("  Step 1/7 \u2014 Preflight checks...");
-  try {
-    execSync2("openclaw --version", { stdio: "pipe" });
-  } catch {
-    console.error("  Error: 'openclaw' not found in PATH. Is OpenClaw installed?");
-    process.exit(1);
-  }
-  if (!existsSync(configPath)) {
-    console.error(`  Error: openclaw.json not found at ${configPath}`);
-    process.exit(1);
-  }
-  console.log("  Preflight passed.\n");
-  console.log("  Step 2/7 \u2014 Detecting port...");
-  const config = readOpenClawConfig(home);
-  let port;
-  if (options.port != null) {
-    port = options.port;
-    if (isPortInUse(config, port)) {
-      console.error(`  Error: Port ${port} is already in use in openclaw.json.`);
-      process.exit(1);
-    }
-    console.log(`  Using explicit port ${port}.
-`);
-  } else {
-    port = findNextPort(config);
-    console.log(`  Auto-assigned port ${port}.
-`);
-  }
-  console.log("  Step 3/7 \u2014 Creating agent with OpenClaw...");
-  try {
-    execSync2(`openclaw agents add -- ${name2}`, { stdio: "pipe" });
-    console.log(`  Agent '${name2}' created.
-`);
-  } catch {
-    console.log(`  Warning: 'openclaw agents add' failed \u2014 agent may already exist. Continuing.
-`);
-  }
-  console.log("  Step 4/7 \u2014 Creating directories...");
-  mkdirSync(workspaceDir, { recursive: true });
-  mkdirSync(dataDir2, { recursive: true });
-  console.log(`  Workspace: ${workspaceDir}`);
-  console.log(`  DataDir:   ${dataDir2}
-`);
-  console.log("  Step 5/7 \u2014 Writing workspace files...");
-  const files = generateWorkspaceFiles(name2);
-  for (const [filename, content] of Object.entries(files)) {
-    writeFileSync(join4(workspaceDir, filename), content, "utf-8");
-  }
-  for (const copyFile of ["AGENTS.md", "USER.md"]) {
-    const src = join4(templateDir, copyFile);
-    if (existsSync(src)) {
-      copyFileSync(src, join4(workspaceDir, copyFile));
-      console.log(`  Copied ${copyFile} from template workspace.`);
-    }
-  }
-  console.log("  Workspace files written.\n");
-  console.log("  Step 6/7 \u2014 Enrolling with AgentVault...\n");
-  await runSetupCommand({
-    token: token2,
-    name: name2,
-    apiUrl: apiUrl2,
-    dataDir: dataDir2,
-    accountId: name2,
-    force
-  });
-  console.log("\n  Step 7/7 \u2014 Patching openclaw.json...");
-  try {
-    const freshConfig = readOpenClawConfig(home);
-    let patched = false;
-    const avChannel = freshConfig?.channels?.agentvault;
-    if (avChannel?.accounts) {
-      const acct = avChannel.accounts[name2];
-      if (acct) {
-        acct.httpPort = port;
-        patched = true;
-      }
-    }
-    if (avChannel && !avChannel.bindings) {
-      avChannel.bindings = [{ match: { accountId: "*" } }];
-      console.log(`  Added wildcard binding (accountId: "*").`);
-    }
-    if (patched) {
-      writeOpenClawConfig(home, freshConfig, name2);
-      console.log(`  httpPort set to ${port}.
-`);
-    } else {
-      console.log(`  Warning: Could not find account '${name2}' in channels.agentvault.accounts.`);
-      console.log(`  You may need to manually set httpPort: ${port} in openclaw.json.
-`);
-    }
-  } catch (err) {
-    console.log(`  Warning: Failed to patch openclaw.json: ${err.message}
-`);
-  }
-  console.log("  Verifying agent...");
-  try {
-    const http = await import("node:http");
-    await new Promise((resolve4) => {
-      const req = http.get(`http://127.0.0.1:${port}/status`, { timeout: 3e3 }, (res) => {
-        console.log(`  Port ${port} responded (HTTP ${res.statusCode}).`);
-        res.resume();
-        resolve4();
-      });
-      req.on("error", () => {
-        console.log(`  Port ${port} not yet responding \u2014 gateway may need a moment.`);
-        resolve4();
-      });
-      req.on("timeout", () => {
-        req.destroy();
-        console.log(`  Port ${port} timed out \u2014 check gateway logs.`);
-        resolve4();
-      });
-    });
-  } catch {
-    console.log("  Verification skipped.");
-  }
-  console.log(`
-\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-  Agent '${name2}' created successfully!
-\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550
-
-  Workspace:  ${workspaceDir}
-  DataDir:    ${dataDir2}
-  HTTP Port:  ${port}
-
-  Next steps:
-  1. Edit ${workspaceDir}/SOUL.md \u2014 give ${name2} a personality
-  2. Edit ${workspaceDir}/IDENTITY.md \u2014 set name, emoji, vibe
-  3. Approve the agent in the AgentVault app
-`);
-}
-var init_create_agent = __esm({
-  async "src/create-agent.ts"() {
-    "use strict";
-    await init_setup();
-  }
-});
-
 // src/skills-publish.ts
 var skills_publish_exports = {};
 __export(skills_publish_exports, {
   publishSkills: () => publishSkills
 });
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 async function publishSkills(opts) {
   if (!opts.manifest) {
@@ -49876,7 +50238,7 @@ async function publishSkills(opts) {
   const manifestPath = resolve2(opts.manifest);
   let raw;
   try {
-    raw = readFileSync2(manifestPath, "utf-8");
+    raw = readFileSync3(manifestPath, "utf-8");
   } catch {
     console.error(`Error: Cannot read manifest file: ${manifestPath}`);
     process.exit(1);
@@ -49955,8 +50317,8 @@ var init_skills_publish = __esm({
 await init_channel();
 await init_setup();
 import { resolve as resolve3 } from "node:path";
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { createInterface as createInterface2 } from "node:readline";
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { createInterface as createInterface3 } from "node:readline";
 import { createRequire } from "node:module";
 var _require = createRequire(import.meta.url);
 var PKG_VERSION = (() => {
@@ -50128,6 +50490,11 @@ if (subcommand === "skills") {
   console.error(`Usage: agentvault skills publish --manifest=./skill-manifest.json`);
   process.exit(1);
 }
+if (subcommand === "doctor") {
+  const { runDoctorCommand: runDoctorCommand2 } = await init_doctor().then(() => doctor_exports);
+  await runDoctorCommand2({ fix: flags["fix"] === "true" });
+  process.exit(0);
+}
 if (!token) {
   console.error(`
 AgentVault Secure Channel CLI
@@ -50139,6 +50506,7 @@ Usage:
   npx @agentvault/agentvault send "message"         # Send a message to the owner
   npx @agentvault/agentvault status                 # Check gateway status
   npx @agentvault/agentvault skills publish --manifest=FILE  # Publish skills from manifest
+  npx @agentvault/agentvault doctor              # Diagnose and fix gateway issues
   npx @agentvault/agentvault --token=TOKEN          # Standalone interactive CLI
 
 Options:
@@ -50151,6 +50519,7 @@ Options:
   --webhook-url=URL      URL for HTTP webhook notifications on new messages
   --no-notifications     Disable OS desktop notifications
   --port=PORT            Gateway port for send/status (default: 18790)
+  --fix                  Apply fixes automatically (used with doctor)
 
 Environment variables:
   AGENTVAULT_INVITE_TOKEN       Same as --token
@@ -50230,9 +50599,9 @@ channel.on("error", (err) => {
 var resolvedDataDir = resolve3(dataDir);
 var statePath = resolve3(resolvedDataDir, "agentvault.json");
 var existingDeviceId = null;
-if (existsSync2(statePath)) {
+if (existsSync3(statePath)) {
   try {
-    const state = JSON.parse(readFileSync3(statePath, "utf-8"));
+    const state = JSON.parse(readFileSync4(statePath, "utf-8"));
     existingDeviceId = state.deviceId ?? null;
   } catch {
   }
@@ -50255,7 +50624,7 @@ if (existingDeviceId) {
 `);
 }
 await channel.start();
-var rl = createInterface2({
+var rl = createInterface3({
   input: process.stdin,
   output: process.stdout,
   prompt: "> "