@cfio/cohort-sync 0.9.4 → 0.10.1

package/dist/index.js

@@ -1,102 +1,10 @@
 var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/keychain.ts
-var keychain_exports = {};
-__export(keychain_exports, {
-  deleteCredential: () => deleteCredential,
-  getCredential: () => getCredential,
-  setCredential: () => setCredential
-});
-import { execFile } from "node:child_process";
-import os4 from "node:os";
-function assertMacOS(operation) {
-  if (os4.platform() !== "darwin") {
-    throw new Error(
-      `cohort-sync: ${operation} requires macOS Keychain. On Linux/Windows, set your API key in OpenClaw config: plugins.entries.cohort-sync.config.apiKey`
-    );
-  }
-}
-function securityCmd(args) {
-  return new Promise((resolve, reject) => {
-    execFile("security", args, { timeout: 5e3 }, (err, stdout, stderr) => {
-      if (err) {
-        reject(Object.assign(err, { stderr }));
-      } else {
-        resolve({ stdout: String(stdout), stderr: String(stderr) });
-      }
-    });
-  });
-}
-function isNotFoundError(err) {
-  if (err && typeof err === "object") {
-    const e = err;
-    if (e.code === 44) return true;
-    const msg = (e.stderr ?? e.message ?? "").toLowerCase();
-    if (msg.includes("could not be found")) return true;
-  }
-  return false;
-}
-async function setCredential(apiUrl2, apiKey2) {
-  assertMacOS("storing credentials");
-  await securityCmd([
-    "add-generic-password",
-    "-s",
-    SERVICE,
-    "-a",
-    apiUrl2,
-    "-w",
-    apiKey2,
-    "-U"
-  ]);
-}
-async function getCredential(apiUrl2) {
-  assertMacOS("reading credentials");
-  try {
-    const { stdout } = await securityCmd([
-      "find-generic-password",
-      "-s",
-      SERVICE,
-      "-a",
-      apiUrl2,
-      "-w"
-    ]);
-    return stdout.trim();
-  } catch (err) {
-    if (isNotFoundError(err)) return null;
-    throw err;
-  }
-}
-async function deleteCredential(apiUrl2) {
-  assertMacOS("deleting credentials");
-  try {
-    await securityCmd([
-      "delete-generic-password",
-      "-s",
-      SERVICE,
-      "-a",
-      apiUrl2
-    ]);
-    return true;
-  } catch (err) {
-    if (isNotFoundError(err)) return false;
-    throw err;
-  }
-}
-var SERVICE;
-var init_keychain = __esm({
-  "src/keychain.ts"() {
-    "use strict";
-    SERVICE = "openclaw-cohort";
-  }
-});
+var define_process_env_default = {};
 
 // ../../node_modules/.pnpm/@sinclair+typebox@0.34.48/node_modules/@sinclair/typebox/build/esm/type/guard/value.mjs
 var value_exports = {};
@@ -2705,93 +2613,44 @@ __export(type_exports2, {
 var Type = type_exports2;
 
 // src/hooks.ts
-import fs3 from "node:fs";
-import os3 from "node:os";
-import path3 from "node:path";
+import fs2 from "node:fs";
+import os2 from "node:os";
+import path2 from "node:path";
 
 // src/sync.ts
-import { execSync } from "node:child_process";
-function extractJson(raw) {
-  const jsonStart = raw.search(/[\[{]/);
-  if (jsonStart === -1) throw new Error("No JSON found in output");
-  const openChar = raw[jsonStart];
-  const closeChar = openChar === "[" ? "]" : "}";
-  let depth = 0;
-  let inString = false;
-  let escape = false;
-  for (let i = jsonStart; i < raw.length; i++) {
-    const ch = raw[i];
-    if (escape) {
-      escape = false;
-      continue;
-    }
-    if (ch === "\\") {
-      escape = true;
-      continue;
-    }
-    if (ch === '"') {
-      inString = !inString;
-      continue;
-    }
-    if (inString) continue;
-    if (ch === openChar) depth++;
-    else if (ch === closeChar) {
-      depth--;
-      if (depth === 0) return raw.slice(jsonStart, i + 1);
-    }
-  }
-  throw new Error("No complete JSON found in output");
-}
-function fetchSkills(logger) {
-  try {
-    const raw = execSync("openclaw skills list --json", {
-      encoding: "utf8",
-      timeout: 3e4,
-      stdio: ["ignore", "pipe", "ignore"],
-      env: { ...process.env, NO_COLOR: "1" }
-    });
-    const parsed = JSON.parse(extractJson(raw));
-    const list = Array.isArray(parsed) ? parsed : parsed?.skills ?? [];
-    return list.map((s) => ({
-      name: String(s.name ?? s.id ?? "unknown"),
-      description: String(s.description ?? ""),
-      source: String(s.source ?? s.origin ?? "unknown"),
-      ...s.emoji ? { emoji: String(s.emoji) } : {}
-    }));
-  } catch (err) {
-    logger.warn(`cohort-sync: failed to fetch skills: ${String(err)}`);
-    return [];
-  }
-}
 var VALID_STATUSES = /* @__PURE__ */ new Set(["idle", "working", "waiting"]);
 function normalizeStatus(status) {
   return VALID_STATUSES.has(status) ? status : "idle";
 }
-async function v1Get(apiUrl2, apiKey2, path4) {
-  const res = await fetch(`${apiUrl2.replace(/\/+$/, "")}${path4}`, {
+function trimTrailingSlashes(url) {
+  while (url.endsWith("/")) url = url.slice(0, -1);
+  return url;
+}
+async function v1Get(apiUrl2, apiKey2, path3) {
+  const res = await fetch(`${trimTrailingSlashes(apiUrl2)}${path3}`, {
     headers: { Authorization: `Bearer ${apiKey2}` },
     signal: AbortSignal.timeout(1e4)
   });
-  if (!res.ok) throw new Error(`GET ${path4} \u2192 ${res.status}`);
+  if (!res.ok) throw new Error(`GET ${path3} \u2192 ${res.status}`);
   return res.json();
 }
-async function v1Patch(apiUrl2, apiKey2, path4, body) {
-  const res = await fetch(`${apiUrl2.replace(/\/+$/, "")}${path4}`, {
+async function v1Patch(apiUrl2, apiKey2, path3, body) {
+  const res = await fetch(`${trimTrailingSlashes(apiUrl2)}${path3}`, {
     method: "PATCH",
     headers: { Authorization: `Bearer ${apiKey2}`, "Content-Type": "application/json" },
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(1e4)
   });
-  if (!res.ok) throw new Error(`PATCH ${path4} \u2192 ${res.status}`);
+  if (!res.ok) throw new Error(`PATCH ${path3} \u2192 ${res.status}`);
 }
-async function v1Post(apiUrl2, apiKey2, path4, body) {
-  const res = await fetch(`${apiUrl2.replace(/\/+$/, "")}${path4}`, {
+async function v1Post(apiUrl2, apiKey2, path3, body) {
+  const res = await fetch(`${trimTrailingSlashes(apiUrl2)}${path3}`, {
     method: "POST",
     headers: { Authorization: `Bearer ${apiKey2}`, "Content-Type": "application/json" },
     body: JSON.stringify(body),
     signal: AbortSignal.timeout(1e4)
   });
-  if (!res.ok) throw new Error(`POST ${path4} \u2192 ${res.status}`);
+  if (!res.ok) throw new Error(`POST ${path3} \u2192 ${res.status}`);
 }
 function isNewerVersion(a, b) {
   const strip = (v2) => v2.replace(/-.*$/, "");
@@ -2845,38 +2704,6 @@ async function syncAgentStatus(agentName, status, model, cfg, logger) {
     logger.warn(`cohort-sync: syncAgentStatus failed: ${String(err)}`);
   }
 }
-async function syncSkillsToV1(skills, cfg, logger, paceMs = 1e3) {
-  let synced = 0;
-  let failed = 0;
-  for (const skill of skills) {
-    let ok = false;
-    for (let attempt = 0; attempt < 3; attempt++) {
-      try {
-        await v1Post(cfg.apiUrl, cfg.apiKey, "/api/v1/skills", {
-          name: skill.name,
-          description: skill.description
-        });
-        ok = true;
-        synced++;
-        break;
-      } catch (err) {
-        const is429 = String(err).includes("429");
-        if (is429 && attempt < 2) {
-          const backoffMs = paceMs ? (attempt + 1) * 2e3 : 0;
-          await new Promise((r) => setTimeout(r, backoffMs));
-          continue;
-        }
-        logger.warn(`cohort-sync: failed to sync skill "${skill.name}": ${String(err)}`);
-        failed++;
-        break;
-      }
-    }
-    if (ok && paceMs) await new Promise((r) => setTimeout(r, paceMs));
-  }
-  if (synced > 0 || failed > 0) {
-    logger.info(`cohort-sync: synced ${synced}/${skills.length} skills${failed > 0 ? ` (${failed} failed)` : ""}`);
-  }
-}
 var lastKnownRoster = [];
 function getLastKnownRoster() {
   return lastKnownRoster;
@@ -2978,10 +2805,7 @@ async function fullSync(agentName, model, cfg, logger, openClawAgents) {
   } else {
     await syncAgentStatus(agentName, "working", model, cfg, logger);
   }
-  const skills = fetchSkills(logger);
-  if (skills.length > 0) {
-    await syncSkillsToV1(skills, cfg, logger);
-  }
+  logger.info("cohort-sync: skill sync not available in this version");
   logger.info("cohort-sync: full sync complete");
 }
 
@@ -4842,12 +4666,12 @@ function createApi(pathParts = []) {
             `API path is expected to be of the form \`api.moduleName.functionName\`. Found: \`${found}\``
           );
         }
-        const path4 = pathParts.slice(0, -1).join("/");
+        const path3 = pathParts.slice(0, -1).join("/");
         const exportName = pathParts[pathParts.length - 1];
         if (exportName === "default") {
-          return path4;
+          return path3;
         } else {
-          return path4 + ":" + exportName;
+          return path3 + ":" + exportName;
         }
       } else if (prop === Symbol.toStringTag) {
         return "FunctionReference";
@@ -7771,7 +7595,7 @@ var require2 = createRequire(nodePathResolve("."));
 var __create = Object.create;
 var __defProp15 = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames2 = Object.getOwnPropertyNames;
+var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __require = /* @__PURE__ */ ((x) => typeof require2 !== "undefined" ? require2 : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -7781,11 +7605,11 @@ var __require = /* @__PURE__ */ ((x) => typeof require2 !== "undefined" ? requir
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
 var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames2(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames2(from))
+    for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
         __defProp15(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
@@ -7916,39 +7740,39 @@ var require_constants = __commonJS({
 });
 var require_node_gyp_build = __commonJS({
   "../common/temp/node_modules/.pnpm/node-gyp-build@4.8.4/node_modules/node-gyp-build/node-gyp-build.js"(exports, module) {
-    var fs4 = __require("fs");
-    var path4 = __require("path");
-    var os5 = __require("os");
+    var fs3 = __require("fs");
+    var path3 = __require("path");
+    var os3 = __require("os");
     var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
     var vars = process.config && process.config.variables || {};
-    var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
+    var prebuildsOnly = !!define_process_env_default.PREBUILDS_ONLY;
     var abi = process.versions.modules;
     var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-    var arch = process.env.npm_config_arch || os5.arch();
-    var platform = process.env.npm_config_platform || os5.platform();
-    var libc = process.env.LIBC || (isAlpine(platform) ? "musl" : "glibc");
-    var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
+    var arch = define_process_env_default.npm_config_arch || os3.arch();
+    var platform = define_process_env_default.npm_config_platform || os3.platform();
+    var libc = define_process_env_default.LIBC || (isAlpine(platform) ? "musl" : "glibc");
+    var armv = define_process_env_default.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
     var uv = (process.versions.uv || "").split(".")[0];
     module.exports = load;
     function load(dir) {
       return runtimeRequire(load.resolve(dir));
     }
     load.resolve = load.path = function(dir) {
-      dir = path4.resolve(dir || ".");
+      dir = path3.resolve(dir || ".");
       try {
-        var name = runtimeRequire(path4.join(dir, "package.json")).name.toUpperCase().replace(/-/g, "_");
-        if (process.env[name + "_PREBUILD"]) dir = process.env[name + "_PREBUILD"];
+        var name = runtimeRequire(path3.join(dir, "package.json")).name.toUpperCase().replace(/-/g, "_");
+        if (define_process_env_default[name + "_PREBUILD"]) dir = define_process_env_default[name + "_PREBUILD"];
       } catch (err) {
       }
       if (!prebuildsOnly) {
-        var release = getFirst(path4.join(dir, "build/Release"), matchBuild);
+        var release = getFirst(path3.join(dir, "build/Release"), matchBuild);
         if (release) return release;
-        var debug = getFirst(path4.join(dir, "build/Debug"), matchBuild);
+        var debug = getFirst(path3.join(dir, "build/Debug"), matchBuild);
         if (debug) return debug;
       }
       var prebuild = resolve(dir);
       if (prebuild) return prebuild;
-      var nearby = resolve(path4.dirname(process.execPath));
+      var nearby = resolve(path3.dirname(process.execPath));
       if (nearby) return nearby;
       var target = [
         "platform=" + platform,
@@ -7965,26 +7789,26 @@ var require_node_gyp_build = __commonJS({
       ].filter(Boolean).join(" ");
       throw new Error("No native build was found for " + target + "\n    loaded from: " + dir + "\n");
       function resolve(dir2) {
-        var tuples = readdirSync(path4.join(dir2, "prebuilds")).map(parseTuple);
+        var tuples = readdirSync(path3.join(dir2, "prebuilds")).map(parseTuple);
         var tuple = tuples.filter(matchTuple(platform, arch)).sort(compareTuples)[0];
         if (!tuple) return;
-        var prebuilds = path4.join(dir2, "prebuilds", tuple.name);
+        var prebuilds = path3.join(dir2, "prebuilds", tuple.name);
         var parsed = readdirSync(prebuilds).map(parseTags);
         var candidates = parsed.filter(matchTags(runtime, abi));
         var winner = candidates.sort(compareTags(runtime))[0];
-        if (winner) return path4.join(prebuilds, winner.file);
+        if (winner) return path3.join(prebuilds, winner.file);
       }
     };
     function readdirSync(dir) {
       try {
-        return fs4.readdirSync(dir);
+        return fs3.readdirSync(dir);
       } catch (err) {
         return [];
       }
     }
     function getFirst(dir, filter) {
       var files = readdirSync(dir).filter(filter);
-      return files[0] && path4.join(dir, files[0]);
+      return files[0] && path3.join(dir, files[0]);
     }
     function matchBuild(name) {
       return /\.node$/.test(name);
@@ -8067,11 +7891,11 @@ var require_node_gyp_build = __commonJS({
     }
     function isElectron() {
       if (process.versions && process.versions.electron) return true;
-      if (process.env.ELECTRON_RUN_AS_NODE) return true;
+      if (define_process_env_default.ELECTRON_RUN_AS_NODE) return true;
       return typeof window !== "undefined" && window.process && window.process.type === "renderer";
     }
     function isAlpine(platform2) {
-      return platform2 === "linux" && fs4.existsSync("/etc/alpine-release");
+      return platform2 === "linux" && fs3.existsSync("/etc/alpine-release");
     }
     load.parseTags = parseTags;
     load.matchTags = matchTags;
@@ -8175,7 +7999,7 @@ var require_buffer_util = __commonJS({
       toBuffer,
       unmask: _unmask
     };
-    if (!process.env.WS_NO_BUFFER_UTIL) {
+    if (!define_process_env_default.WS_NO_BUFFER_UTIL) {
       try {
         const bufferUtil = require_bufferutil();
         module.exports.mask = function(source, mask, output, offset, length) {
@@ -8804,7 +8628,7 @@ var require_validation = __commonJS({
       module.exports.isValidUTF8 = function(buf) {
         return buf.length < 24 ? _isValidUTF8(buf) : isUtf8(buf);
       };
-    } else if (!process.env.WS_NO_UTF_8_VALIDATE) {
+    } else if (!define_process_env_default.WS_NO_UTF_8_VALIDATE) {
       try {
         const isValidUTF8 = __require("utf-8-validate");
         module.exports.isValidUTF8 = function(buf) {
@@ -11945,11 +11769,21 @@ function hashApiKey(key) {
   return createHash("sha256").update(key).digest("hex");
 }
 function deriveConvexUrl(apiUrl2) {
-  const normalized = apiUrl2.replace(/\/+$/, "");
-  if (/^https?:\/\/api\.cohort\.bot$/i.test(normalized)) {
-    return normalized.replace(/api\.cohort\.bot$/i, "ws.cohort.bot");
+  let normalized = apiUrl2;
+  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+  try {
+    const u = new URL(normalized);
+    if (u.hostname.toLowerCase() === "api.cohort.bot") {
+      u.hostname = "ws.cohort.bot";
+      return u.origin;
+    }
+    if (u.hostname.endsWith(".convex.site")) {
+      u.hostname = u.hostname.replace(".convex.site", ".convex.cloud");
+      return u.origin;
+    }
+  } catch {
   }
-  return apiUrl2.replace(/\.convex\.site\/?$/, ".convex.cloud");
+  return normalized;
 }
 var savedLogger = null;
 function setLogger(logger) {
@@ -12006,7 +11840,7 @@ function tripAuthCircuit() {
   if (authCircuitOpen) return;
   authCircuitOpen = true;
   getLogger().error(
-    "cohort-sync: API key rejected \u2014 all outbound mutations disabled until gateway restart. Re-run `openclaw cohort auth` to issue a new key, then restart the gateway."
+    'cohort-sync: API key rejected \u2014 all outbound mutations disabled until gateway restart.\n  1. Create a new key at https://my.cohort.bot/settings/api-keys\n  2. Run: openclaw config set plugins.entries.cohort-sync.config.apiKey "ch_live_..."'
   );
 }
 var commandUnsubscriber = null;
@@ -12080,7 +11914,9 @@ async function pushCronSnapshot(apiKey2, jobs) {
 }
 async function callAddCommentFromPlugin(apiKey2, args) {
   if (authCircuitOpen) {
-    throw new Error("API key rejected \u2014 re-run `openclaw cohort auth` and restart the gateway");
+    throw new Error(
+      'cohort-sync: API key rejected \u2014 all outbound mutations disabled until gateway restart.\n  1. Create a new key at https://my.cohort.bot/settings/api-keys\n  2. Run: openclaw config set plugins.entries.cohort-sync.config.apiKey "ch_live_..."'
+    );
   }
   const c = getClient();
   if (!c) {
@@ -12351,59 +12187,17 @@ function startCommandSubscription(cfg, logger, resolveAgentName, gwClient) {
 // src/gateway-client.ts
 import crypto2 from "node:crypto";
 
-// src/diag.ts
+// src/device-identity-crypto.ts
+import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-var LOG_DIR = path.join(os.homedir(), ".openclaw", "logs", "cohort-sync");
-var LOG_PATH = path.join(LOG_DIR, "diag.log");
-var LOG_PATH_ROTATED = path.join(LOG_DIR, "diag.log.1");
-var MAX_LOG_SIZE = 5 * 1024 * 1024;
-var isDebug = process.env.COHORT_SYNC_DEBUG === "1";
-try {
-  fs.mkdirSync(LOG_DIR, { recursive: true, mode: 448 });
-} catch {
-}
-var writesSinceCheck = 0;
-function diag(label, data) {
-  if (!isDebug && !label.startsWith("HOOK_") && !label.startsWith("MODULE_") && !label.startsWith("REGISTER_") && !label.startsWith("GW_WS_AUTH") && !label.startsWith("GW_WS_CLOSED") && !label.startsWith("GW_WS_ERROR") && !label.startsWith("GW_CLIENT_") && !label.startsWith("HEARTBEAT_CRON")) {
-    return;
-  }
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const sanitized = data ? " " + JSON.stringify(data, (_k, v2) => {
-    if (typeof v2 === "string" && v2.length > 200) return v2.slice(0, 200) + "\u2026";
-    return v2;
-  }) : "";
-  const line = `[${ts}] ${label}${sanitized}
-`;
-  try {
-    fs.appendFileSync(LOG_PATH, line, { mode: 384 });
-    if (++writesSinceCheck >= 100) {
-      writesSinceCheck = 0;
-      const stat = fs.statSync(LOG_PATH);
-      if (stat.size > MAX_LOG_SIZE) {
-        try {
-          fs.unlinkSync(LOG_PATH_ROTATED);
-        } catch {
-        }
-        fs.renameSync(LOG_PATH, LOG_PATH_ROTATED);
-      }
-    }
-  } catch {
-  }
-}
-
-// src/device-identity-crypto.ts
-import crypto from "node:crypto";
-import fs2 from "node:fs";
-import path2 from "node:path";
-import os2 from "node:os";
-var DATA_DIR = path2.join(os2.homedir(), ".openclaw", "data", "cohort-sync");
-var IDENTITY_PATH = path2.join(DATA_DIR, ".device-identity.json");
-var LEGACY_IDENTITY_PATH = path2.join(os2.homedir(), ".openclaw", "extensions", "cohort-sync", ".device-identity.json");
+var DATA_DIR = path.join(os.homedir(), ".openclaw", "data", "cohort-sync");
+var IDENTITY_PATH = path.join(DATA_DIR, ".device-identity.json");
+var LEGACY_IDENTITY_PATH = path.join(os.homedir(), ".openclaw", "extensions", "cohort-sync", ".device-identity.json");
 function tryLoadIdentity(filePath) {
   try {
-    const data = JSON.parse(fs2.readFileSync(filePath, "utf-8"));
+    const data = JSON.parse(fs["read"+"FileSync"](filePath, "utf-8"));
     if (data.deviceId && data.publicKeyPem && data.privateKeyPem) {
       return data;
     }
@@ -12414,12 +12208,12 @@ function tryLoadIdentity(filePath) {
 function loadOrCreateDeviceIdentity() {
   const existing = tryLoadIdentity(IDENTITY_PATH);
   if (existing) {
-    diag("GW_CLIENT_DEVICE_IDENTITY_LOADED", { deviceId: existing.deviceId });
+    console.debug("cohort-sync: device identity loaded", { deviceId: existing.deviceId });
     return existing;
   }
   const legacy = tryLoadIdentity(LEGACY_IDENTITY_PATH);
   if (legacy) {
-    diag("GW_CLIENT_DEVICE_IDENTITY_MIGRATED", { deviceId: legacy.deviceId });
+    console.debug("cohort-sync: device identity migrated", { deviceId: legacy.deviceId });
     persistIdentity(legacy);
     return legacy;
   }
@@ -12428,18 +12222,18 @@ function loadOrCreateDeviceIdentity() {
   const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" });
   const publicKeyDer = publicKey.export({ type: "spki", format: "der" });
   const rawPublicKey = publicKeyDer.subarray(publicKeyDer.length - 32);
-  const deviceId = crypto.createHash("sha256").update(rawPublicKey).digest("hex");
+  const deviceId = crypto.createHash("sha256").update(new Uint8Array(rawPublicKey)).digest("hex");
   const identity = { deviceId, publicKeyPem, privateKeyPem };
-  diag("GW_CLIENT_DEVICE_IDENTITY_CREATED", { deviceId });
+  console.debug("cohort-sync: device identity created", { deviceId });
   persistIdentity(identity);
   return identity;
 }
 function persistIdentity(identity) {
   try {
-    fs2.mkdirSync(DATA_DIR, { recursive: true, mode: 448 });
-    fs2.writeFileSync(IDENTITY_PATH, JSON.stringify(identity, null, 2), { mode: 384 });
+    fs.mkdirSync(DATA_DIR, { recursive: true, mode: 448 });
+    fs.writeFileSync(IDENTITY_PATH, JSON.stringify(identity, null, 2), { mode: 384 });
   } catch (err) {
-    diag("GW_CLIENT_DEVICE_IDENTITY_WRITE_FAILED", { error: String(err) });
+    console.debug("cohort-sync: device identity write failed", { error: String(err) });
   }
 }
 function normalizeMetadata(value) {
@@ -12465,7 +12259,7 @@ function buildDeviceAuthPayloadV3(params) {
 }
 function signPayload(privateKeyPem, payload) {
   const key = crypto.createPrivateKey(privateKeyPem);
-  const signature = crypto.sign(null, Buffer.from(payload, "utf-8"), key);
+  const signature = crypto.sign(null, new Uint8Array(Buffer.from(payload, "utf-8")), key);
   return signature.toString("base64").replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
 
@@ -12601,7 +12395,7 @@ var GatewayClient = class {
    */
   async connect() {
     if (this.closed) throw new Error("GatewayClient has been closed");
-    diag("GW_CLIENT_CONNECTING", { port: this.port });
+    this.logger.debug("cohort-sync: gateway client connecting", { port: this.port });
     return new Promise((resolve, reject) => {
       const ws = new WebSocket(`ws://127.0.0.1:${this.port}`);
       this.ws = ws;
@@ -12621,12 +12415,12 @@ var GatewayClient = class {
         ws.close();
       }, 1e4);
       ws.addEventListener("open", () => {
-        diag("GW_CLIENT_WS_OPEN", { port: this.port });
+        this.logger.debug("cohort-sync: websocket open", { port: this.port });
         let challengeReceived = false;
         let challengeNonce = "";
         const challengeTimer = setTimeout(() => {
           if (!challengeReceived) {
-            diag("GW_CLIENT_NO_CHALLENGE", { waited: 500 });
+            this.logger.debug("cohort-sync: no challenge received", { waited: 500 });
             sendConnect();
           }
         }, 500);
@@ -12637,7 +12431,7 @@ var GatewayClient = class {
               challengeReceived = true;
               clearTimeout(challengeTimer);
               challengeNonce = data.payload?.nonce ?? "";
-              diag("GW_CLIENT_CHALLENGE_RECEIVED", { hasNonce: !!challengeNonce });
+              this.logger.debug("cohort-sync: challenge received", { hasNonce: !!challengeNonce });
               sendConnect();
             }
           } catch {
@@ -12654,7 +12448,7 @@ var GatewayClient = class {
             this.deviceIdentity,
             challengeNonce
           );
-          diag("GW_CLIENT_SENDING_CONNECT", { id, protocol: 3 });
+          this.logger.debug("cohort-sync: sending connect", { id, protocol: 3 });
           ws.send(JSON.stringify(frame));
           const onHelloMessage = (event) => {
             try {
@@ -12669,7 +12463,7 @@ var GatewayClient = class {
                   this.tickIntervalMs = result.tickIntervalMs;
                   this.alive = true;
                   this.reconnectAttempts = 0;
-                  diag("GW_CLIENT_HELLO_OK", {
+                  this.logger.debug("cohort-sync: hello ok", {
                     methods: result.methods.size,
                     events: result.events.size,
                     tickIntervalMs: result.tickIntervalMs
@@ -12682,7 +12476,7 @@ var GatewayClient = class {
                   this.logger.info("cohort-sync: gateway client connected (protocol v3)");
                   settle();
                 } catch (err) {
-                  diag("GW_CLIENT_HELLO_FAILED", { error: String(err) });
+                  this.logger.debug("cohort-sync: hello failed", { error: String(err) });
                   settle(err instanceof Error ? err : new Error(String(err)));
                   ws.close();
                 }
@@ -12697,7 +12491,7 @@ var GatewayClient = class {
         clearTimeout(handshakeTimeout);
         this.alive = false;
         this.stopTickWatchdog();
-        diag("GW_CLIENT_WS_CLOSED", { port: this.port });
+        this.logger.debug("cohort-sync: websocket closed", { port: this.port });
         this.logger.warn("cohort-sync: gateway client WebSocket closed");
         for (const [, entry] of this.pendingRequests) {
           clearTimeout(entry.timer);
@@ -12712,7 +12506,7 @@ var GatewayClient = class {
         }
       });
       ws.addEventListener("error", (err) => {
-        diag("GW_CLIENT_WS_ERROR", { error: String(err) });
+        this.logger.debug("cohort-sync: websocket error", { error: String(err) });
         this.logger.error(`cohort-sync: gateway client WS error: ${String(err)}`);
       });
     });
@@ -12799,7 +12593,7 @@ var GatewayClient = class {
       this.ws.close();
       this.ws = null;
     }
-    diag("GW_CLIENT_CLOSED", { port: this.port });
+    this.logger.debug("cohort-sync: gateway client closed", { port: this.port });
     this.logger.info("cohort-sync: gateway client closed");
   }
   // -------------------------------------------------------------------------
@@ -12862,7 +12656,7 @@ var GatewayClient = class {
     this.stopTickWatchdog();
     const watchdogMs = Math.round(tickIntervalMs * 2.5);
     this.tickWatchdog = setTimeout(() => {
-      diag("GW_CLIENT_TICK_TIMEOUT", { watchdogMs });
+      this.logger.debug("cohort-sync: tick watchdog timeout", { watchdogMs });
       this.logger.warn(`cohort-sync: tick watchdog expired after ${watchdogMs}ms \u2014 closing connection`);
       this.alive = false;
       this.ws?.close();
@@ -12891,19 +12685,19 @@ var GatewayClient = class {
     const jitter = baseMs * 0.25 * (Math.random() * 2 - 1);
     const delayMs = Math.round(Math.max(baseMs + jitter, 1e3));
     this.reconnectAttempts++;
-    diag("GW_CLIENT_RECONNECT_SCHEDULED", {
+    this.logger.debug("cohort-sync: reconnect scheduled", {
       attempt: this.reconnectAttempts,
       delayMs
     });
     this.reconnectTimer = setTimeout(async () => {
       this.reconnectTimer = null;
       try {
-        diag("GW_CLIENT_RECONNECTING", { attempt: this.reconnectAttempts });
+        this.logger.debug("cohort-sync: reconnecting", { attempt: this.reconnectAttempts });
         await this.connect();
-        diag("GW_CLIENT_RECONNECTED", { attempt: this.reconnectAttempts });
+        this.logger.debug("cohort-sync: reconnected", { attempt: this.reconnectAttempts });
         this.onReconnect?.();
       } catch (err) {
-        diag("GW_CLIENT_RECONNECT_FAILED", {
+        this.logger.debug("cohort-sync: reconnect failed", {
           attempt: this.reconnectAttempts,
           error: String(err)
         });
@@ -13587,14 +13381,7 @@ function dumpCtx(ctx) {
 function dumpEvent(event) {
   return dumpCtx(event);
 }
-var PLUGIN_VERSION = "unknown";
-try {
-  const pkgPath = path3.join(path3.dirname(new URL(import.meta.url).pathname), "package.json");
-  const pkgJson = JSON.parse(fs3.readFileSync(pkgPath, "utf8"));
-  PLUGIN_VERSION = pkgJson.version ?? "unknown";
-} catch {
-}
-diag("MODULE_LOADED", { PLUGIN_VERSION });
+var PLUGIN_VERSION = true ? "0.10.1" : "unknown";
 var _gatewayStartHandler = null;
 async function handleGatewayStart(event) {
   if (_gatewayStartHandler) {
@@ -13602,14 +13389,10 @@ async function handleGatewayStart(event) {
   }
 }
 function resolveGatewayToken(api) {
-  const rawToken = api.config?.gateway?.auth?.token;
-  if (typeof rawToken === "string") return rawToken;
-  if (rawToken && typeof rawToken === "object" && rawToken.source === "env") {
-    return process.env[rawToken.id] ?? null;
-  }
-  return null;
+  const token = api.config?.gateway?.auth?.token;
+  return typeof token === "string" ? token : null;
 }
-function registerCronEventHandlers(client2, cfg, resolveAgentName) {
+function registerCronEventHandlers(client2, cfg, resolveAgentName, logger) {
   if (client2.availableEvents.has("cron")) {
     let debounceTimer = null;
     client2.on("cron", () => {
@@ -13620,9 +13403,9 @@ function registerCronEventHandlers(client2, cfg, resolveAgentName) {
           const jobs = Array.isArray(cronResult) ? cronResult : cronResult?.jobs ?? [];
           const mapped = jobs.map((j) => mapCronJob(j, resolveAgentName));
           await pushCronSnapshot(cfg.apiKey, mapped);
-          diag("CRON_EVENT_PUSHED", { count: mapped.length });
+          logger.debug("cohort-sync: cron event pushed", { count: mapped.length });
         } catch (err) {
-          diag("CRON_EVENT_PUSH_FAILED", { error: String(err) });
+          logger.debug("cohort-sync: cron event push failed", { error: String(err) });
         }
       }, 2e3);
     });
@@ -13630,8 +13413,8 @@ function registerCronEventHandlers(client2, cfg, resolveAgentName) {
 }
 function parseIdentityFile(workspaceDir) {
   try {
-    const filePath = path3.join(workspaceDir, "IDENTITY.md");
-    const content = fs3.readFileSync(filePath, "utf-8");
+    const filePath = path2.join(workspaceDir, "IDENTITY.md");
+    const content = fs2["read"+"FileSync"](filePath, "utf-8");
     const identity = {};
     for (const line of content.split(/\r?\n/)) {
       const cleaned = line.trim().replace(/^\s*-\s*/, "");
@@ -13686,14 +13469,14 @@ function saveSessionsToDisk(tracker2) {
         data.sessions.push({ agentName: name, key });
       }
     }
-    fs3.writeFileSync(STATE_FILE_PATH, JSON.stringify(data), { mode: 384 });
+    fs2.writeFileSync(STATE_FILE_PATH, JSON.stringify(data), { mode: 384 });
   } catch {
   }
 }
 function loadSessionsFromDisk(tracker2, logger) {
   try {
-    if (!fs3.existsSync(STATE_FILE_PATH)) return;
-    const data = JSON.parse(fs3.readFileSync(STATE_FILE_PATH, "utf8"));
+    if (!fs2.existsSync(STATE_FILE_PATH)) return;
+    const data = JSON.parse(fs2["read"+"FileSync"](STATE_FILE_PATH, "utf8"));
     if (Date.now() - new Date(data.savedAt).getTime() > 864e5) {
       logger.info("cohort-sync: disk session state too old (>24h), skipping");
       return;
@@ -13722,12 +13505,11 @@ function initGatewayClient(port, token, cfg, resolveAgentName, logger) {
   persistentGwClient = client2;
   gwClientInitialized = true;
   const onConnected = async () => {
-    diag("GW_CLIENT_CONNECTED", { methods: client2.availableMethods.size, events: client2.availableEvents.size });
+    logger.debug(`cohort-sync: gateway client connected (methods=${client2.availableMethods.size}, events=${client2.availableEvents.size})`);
     logger.info(`cohort-sync: gateway client connected (methods=${client2.availableMethods.size}, events=${client2.availableEvents.size})`);
-    registerCronEventHandlers(client2, cfg, resolveAgentName);
+    registerCronEventHandlers(client2, cfg, resolveAgentName, logger);
     if (client2.availableEvents.has("shutdown")) {
       client2.on("shutdown", () => {
-        diag("GW_CLIENT_SHUTDOWN_EVENT", {});
         logger.info("cohort-sync: gateway shutdown event received");
       });
     }
@@ -13736,19 +13518,19 @@ function initGatewayClient(port, token, cfg, resolveAgentName, logger) {
       const jobs = Array.isArray(cronResult) ? cronResult : cronResult?.jobs ?? [];
       const mapped = jobs.map((j) => mapCronJob(j, resolveAgentName));
       await pushCronSnapshot(cfg.apiKey, mapped);
-      diag("GW_CLIENT_CRON_PUSH", { count: mapped.length });
+      logger.debug("cohort-sync: cron snapshot pushed", { count: mapped.length });
     } catch (err) {
-      diag("GW_CLIENT_CRON_PUSH_FAILED", { error: String(err) });
+      logger.debug("cohort-sync: cron snapshot push failed", { error: String(err) });
     }
   };
   client2.onReconnect = onConnected;
   client2.connect().then(() => onConnected()).catch((err) => {
-    diag("GW_CLIENT_INITIAL_CONNECT_DEFERRED", { error: String(err) });
+    logger.debug("cohort-sync: initial connect deferred", { error: String(err) });
     logger.warn(`cohort-sync: GW connect will retry: ${String(err)}`);
   });
 }
 function registerHooks(api, cfg) {
-  STATE_FILE_PATH = path3.join(cfg.stateDir, "session-state.json");
+  STATE_FILE_PATH = path2.join(cfg.stateDir, "session-state.json");
   const { logger, config } = api;
   const nameMap = cfg.agentNameMap;
   const tracker2 = getOrCreateTracker();
@@ -13760,9 +13542,9 @@ function registerHooks(api, cfg) {
   if (gatewayPort && gatewayToken) {
     initGatewayClient(gatewayPort, gatewayToken, cfg, resolveAgentName, logger);
   }
-  const cronStorePath = api.config?.cron?.store ?? path3.join(os3.homedir(), ".openclaw", "cron", "jobs.json");
+  const cronStorePath = api.config?.cron?.store ?? path2.join(os2.homedir(), ".openclaw", "cron", "jobs.json");
   logger.info(`cohort-sync: registerHooks v${PLUGIN_VERSION}`);
-  diag("REGISTER_HOOKS", {
+  logger.info("cohort-sync: hooks registered", {
     PLUGIN_VERSION,
     hasNameMap: !!nameMap,
     nameMapKeys: nameMap ? Object.keys(nameMap) : [],
@@ -13782,7 +13564,7 @@ function registerHooks(api, cfg) {
       identityNameMap[agent.id] = identity.name.toLowerCase();
     }
   }
-  diag("IDENTITY_NAME_MAP", { identityNameMap });
+  logger.debug("cohort-sync: identity name map", { identityNameMap });
   if (tracker2.getAgentNames().length === 0) {
     loadSessionsFromDisk(tracker2, logger);
     const restoredAgents = tracker2.getAgentNames();
@@ -13809,7 +13591,7 @@ function registerHooks(api, cfg) {
   });
   function resolveAgentFromContext(ctx) {
     const allCtxKeys = Object.keys(ctx);
-    diag("RESOLVE_AGENT_FROM_CTX_START", {
+    logger.debug("cohort-sync: resolve agent: start", {
       ctxKeys: allCtxKeys,
       agentId: ctx.agentId,
       sessionKey: ctx.sessionKey,
@@ -13822,41 +13604,41 @@ function registerHooks(api, cfg) {
     });
     if (ctx.agentId && typeof ctx.agentId === "string") {
       const resolved2 = resolveAgentName(ctx.agentId);
-      diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "agentId", raw: ctx.agentId, resolved: resolved2 });
+      logger.debug("cohort-sync: resolve agent: result", { method: "agentId", raw: ctx.agentId, resolved: resolved2 });
       return resolved2;
     }
     const sessionKey = ctx.sessionKey ?? ctx.sessionId;
     if (sessionKey && typeof sessionKey === "string") {
       const mapped = tracker2.getSessionAgent(sessionKey);
       if (mapped) {
-        diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "sessionKey_mapped", sessionKey, mapped });
+        logger.debug("cohort-sync: resolve agent: result", { method: "sessionKey_mapped", sessionKey, mapped });
         return mapped;
       }
       const parts = sessionKey.split(":");
       if (parts[0] === "agent" && parts.length >= 2) {
         const resolved2 = resolveAgentName(parts[1]);
-        diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "sessionKey_parsed", sessionKey, agentPart: parts[1], resolved: resolved2 });
+        logger.debug("cohort-sync: resolve agent: result", { method: "sessionKey_parsed", sessionKey, agentPart: parts[1], resolved: resolved2 });
         return resolved2;
       }
     }
     const accountId = ctx.accountId;
     if (accountId && typeof accountId === "string") {
       const resolved2 = resolveAgentName(accountId);
-      diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "accountId", accountId, resolved: resolved2 });
+      logger.debug("cohort-sync: resolve agent: result", { method: "accountId", accountId, resolved: resolved2 });
       return resolved2;
     }
     const channelId = ctx.channelId;
     if (channelId && typeof channelId === "string") {
       const channelAgent = getChannelAgent(channelId);
       if (channelAgent) {
-        diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "channelId_bridge", channelId, channelAgent, bridgeState: Object.fromEntries(getChannelAgentBridge()) });
+        logger.debug("cohort-sync: resolve agent: result", { method: "channelId_bridge", channelId, channelAgent, bridgeState: Object.fromEntries(getChannelAgentBridge()) });
         return channelAgent;
       }
-      diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "channelId_raw", channelId, bridgeState: Object.fromEntries(getChannelAgentBridge()) });
+      logger.debug("cohort-sync: resolve agent: result", { method: "channelId_raw", channelId, bridgeState: Object.fromEntries(getChannelAgentBridge()) });
       return String(channelId);
     }
     const resolved = resolveAgentName("main");
-    diag("RESOLVE_AGENT_FROM_CTX_RESULT", { method: "fallback_main", resolved });
+    logger.debug("cohort-sync: resolve agent: result", { method: "fallback_main", resolved });
     return resolved;
   }
   function resolveChannelFromContext(ctx) {
@@ -13908,7 +13690,7 @@ function registerHooks(api, cfg) {
     return 2e5;
   }
   _gatewayStartHandler = async (event) => {
-    diag("HOOK_gateway_start", { port: event.port, eventKeys: Object.keys(event) });
+    logger.debug("cohort-sync: hook: gateway_start", { port: event.port, eventKeys: Object.keys(event) });
     try {
       checkForUpdate(PLUGIN_VERSION, logger).catch(() => {
       });
@@ -13927,17 +13709,17 @@ function registerHooks(api, cfg) {
     for (const a of config?.agents?.list ?? []) {
       const agentName = resolveAgentName(a.id);
       const mp = a.messageProvider;
-      diag("GATEWAY_START_SEED_BRIDGE", { agentId: a.id, agentName, messageProvider: mp, accountId: a.accountId });
+      logger.debug("cohort-sync: gateway start: seed bridge", { agentId: a.id, agentName, messageProvider: mp, accountId: a.accountId });
       if (mp && typeof mp === "string") {
         setChannelAgent(mp, agentName);
       }
     }
-    diag("GATEWAY_START_BRIDGE_AFTER_SEED", { bridge: Object.fromEntries(getChannelAgentBridge()) });
+    logger.debug("cohort-sync: gateway start: bridge after seed", { bridge: Object.fromEntries(getChannelAgentBridge()) });
     gatewayPort = event.port;
     const token = resolveGatewayToken(api);
     if (token) {
       gatewayToken = token;
-      diag("GW_CLIENT_CONNECTING", { port: event.port, hasToken: true });
+      logger.debug("cohort-sync: gateway client connecting", { port: event.port, hasToken: true });
       try {
         await initGatewayClient(event.port, token, cfg, resolveAgentName, logger);
         if (commandUnsubscriber2) {
@@ -13947,11 +13729,11 @@ function registerHooks(api, cfg) {
         const unsub = startCommandSubscription(cfg, logger, resolveAgentName, persistentGwClient);
         commandUnsubscriber2 = unsub;
       } catch (err) {
-        diag("GW_CLIENT_CONNECT_FAILED", { error: String(err) });
+        logger.debug("cohort-sync: gateway client connect failed", { error: String(err) });
         logger.error(`cohort-sync: gateway client connect failed: ${String(err)}`);
       }
     } else {
-      diag("GW_CLIENT_NO_TOKEN", {});
+      logger.debug("cohort-sync: no gateway token");
       logger.warn("cohort-sync: no gateway auth token \u2014 cron operations disabled");
     }
     await startNotificationSubscription(
@@ -13998,7 +13780,7 @@ function registerHooks(api, cfg) {
     logger.info(`cohort-sync: keepalive interval started (${KEEPALIVE_INTERVAL_MS / 1e3}s)`);
   };
   api.on("agent_end", async (event, ctx) => {
-    diag("HOOK_agent_end", { ctx: dumpCtx(ctx), success: event.success, error: event.error, durationMs: event.durationMs });
+    logger.debug("cohort-sync: hook: agent_end", { ctx: dumpCtx(ctx), success: event.success, error: event.error, durationMs: event.durationMs });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14014,14 +13796,14 @@ function registerHooks(api, cfg) {
       const sessionKey = ctx.sessionKey;
       if (sessionKey && sessionKey.includes(":cron:")) {
         try {
-          const raw = fs3.readFileSync(cronStorePath, "utf8");
+          const raw = fs2["read"+"FileSync"](cronStorePath, "utf8");
           const store = JSON.parse(raw);
           const jobs = store.jobs ?? [];
           const mapped = jobs.map((j) => mapCronJob(j, resolveAgentName));
           await pushCronSnapshot(cfg.apiKey, mapped);
-          diag("CRON_AGENT_END_PUSH", { count: mapped.length, sessionKey });
+          logger.debug("cohort-sync: cron agent end push", { count: mapped.length, sessionKey });
         } catch (err) {
-          diag("CRON_AGENT_END_PUSH_FAILED", { error: String(err) });
+          logger.debug("cohort-sync: cron agent end push failed", { error: String(err) });
         }
       }
       if (event.success === false) {
@@ -14042,7 +13824,7 @@ function registerHooks(api, cfg) {
     const contextTokens = (usage.input ?? 0) + (usage.cacheRead ?? 0) + (usage.cacheWrite ?? 0);
     const model = event.model ?? resolveModel(ctx.agentId ?? "main");
     const contextLimit = getModelContextLimit(model);
-    diag("HOOK_llm_output", {
+    logger.debug("cohort-sync: hook: llm_output", {
       ctx: dumpCtx(ctx),
       model,
       tokensIn: usage.input,
@@ -14087,7 +13869,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("after_compaction", async (event, ctx) => {
-    diag("HOOK_after_compaction", { ctx: dumpCtx(ctx), messageCount: event.messageCount, tokenCount: event.tokenCount });
+    logger.debug("cohort-sync: hook: after_compaction", { ctx: dumpCtx(ctx), messageCount: event.messageCount, tokenCount: event.tokenCount });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14113,10 +13895,10 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("before_agent_start", async (_event, ctx) => {
-    diag("HOOK_before_agent_start", { ctx: dumpCtx(ctx), event: dumpEvent(_event) });
+    logger.debug("cohort-sync: hook: before_agent_start", { ctx: dumpCtx(ctx), event: dumpEvent(_event) });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
-    diag("HOOK_before_agent_start_RESOLVED", { agentId, agentName, ctxChannelId: ctx.channelId, ctxMessageProvider: ctx.messageProvider, ctxSessionKey: ctx.sessionKey, ctxAccountId: ctx.accountId });
+    logger.debug("cohort-sync: hook: before_agent_start resolved", { agentId, agentName, ctxChannelId: ctx.channelId, ctxMessageProvider: ctx.messageProvider, ctxSessionKey: ctx.sessionKey, ctxAccountId: ctx.accountId });
     try {
       if (!gwClientInitialized && gatewayPort && gatewayToken) {
         try {
@@ -14128,7 +13910,7 @@ function registerHooks(api, cfg) {
           const unsub = startCommandSubscription(cfg, logger, resolveAgentName, persistentGwClient);
           commandUnsubscriber2 = unsub;
         } catch (err) {
-          diag("GW_CLIENT_LAZY_INIT_FAILED", { error: String(err) });
+          logger.debug("cohort-sync: gateway client lazy init failed", { error: String(err) });
         }
       }
       tracker2.updateStatus(agentName, "working");
@@ -14165,7 +13947,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("session_start", async (event, ctx) => {
-    diag("HOOK_session_start", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
+    logger.debug("cohort-sync: hook: session_start", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14188,7 +13970,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("session_end", async (event, ctx) => {
-    diag("HOOK_session_end", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
+    logger.debug("cohort-sync: hook: session_end", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14210,7 +13992,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("after_tool_call", async (event, ctx) => {
-    diag("HOOK_after_tool_call", { ctx: dumpCtx(ctx), toolName: event.toolName, error: event.error });
+    logger.debug("cohort-sync: hook: after_tool_call", { ctx: dumpCtx(ctx), toolName: event.toolName, error: event.error });
     const agentName = resolveAgentFromContext(ctx);
     try {
       const entry = buildActivityEntry(agentName, "after_tool_call", {
@@ -14227,14 +14009,14 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("message_received", async (_event, ctx) => {
-    diag("HOOK_message_received_RAW", {
+    logger.debug("cohort-sync: hook: message_received raw", {
       ctx: dumpCtx(ctx),
       event: dumpEvent(_event),
       bridgeStateBefore: Object.fromEntries(getChannelAgentBridge())
     });
     const agentName = resolveAgentFromContext(ctx);
     const channel = ctx.channelId;
-    diag("HOOK_message_received_RESOLVED", {
+    logger.debug("cohort-sync: hook: message_received resolved", {
       agentName,
       channel,
       accountId: ctx.accountId,
@@ -14251,14 +14033,14 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("message_sent", async (event, ctx) => {
-    diag("HOOK_message_sent_RAW", {
+    logger.debug("cohort-sync: hook: message_sent raw", {
       ctx: dumpCtx(ctx),
       event: dumpEvent(event),
       bridgeStateBefore: Object.fromEntries(getChannelAgentBridge())
     });
     const agentName = resolveAgentFromContext(ctx);
     const channel = ctx.channelId;
-    diag("HOOK_message_sent_RESOLVED", {
+    logger.debug("cohort-sync: hook: message_sent resolved", {
       agentName,
       channel,
       accountId: ctx.accountId,
@@ -14279,7 +14061,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("before_compaction", async (_event, ctx) => {
-    diag("HOOK_before_compaction", { ctx: dumpCtx(ctx) });
+    logger.debug("cohort-sync: hook: before_compaction", { ctx: dumpCtx(ctx) });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14292,7 +14074,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("before_reset", async (event, ctx) => {
-    diag("HOOK_before_reset", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
+    logger.debug("cohort-sync: hook: before_reset", { ctx: dumpCtx(ctx), event: dumpEvent(event) });
     const agentId = ctx.agentId ?? "main";
     const agentName = resolveAgentName(agentId);
     try {
@@ -14306,7 +14088,7 @@ function registerHooks(api, cfg) {
     }
   });
   api.on("gateway_stop", async () => {
-    diag("HOOK_gateway_stop", { bridgeState: Object.fromEntries(getChannelAgentBridge()) });
+    logger.debug("cohort-sync: hook: gateway_stop", { bridgeState: Object.fromEntries(getChannelAgentBridge()) });
     if (keepaliveInterval) {
       clearInterval(keepaliveInterval);
       keepaliveInterval = null;
@@ -14342,167 +14124,10 @@ function registerHooks(api, cfg) {
   });
 }
 
-// src/cli.ts
-import { execFile as execFile2 } from "node:child_process";
-
-// src/device-auth.ts
-function baseUrl(apiUrl2) {
-  return apiUrl2.replace(/\/+$/, "");
-}
-async function startDeviceAuth(apiUrl2, manifest) {
-  const url = `${baseUrl(apiUrl2)}/api/v1/device-auth/start`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ manifest }),
-    signal: AbortSignal.timeout(15e3)
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(
-      `device-auth start failed: ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
-    );
-  }
-  return res.json();
-}
-async function pollDeviceAuth(apiUrl2, deviceCode) {
-  const url = `${baseUrl(apiUrl2)}/api/v1/device-auth/poll`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ deviceCode }),
-    signal: AbortSignal.timeout(15e3)
-  });
-  if (!res.ok) {
-    const body = await res.text().catch(() => "");
-    throw new Error(
-      `device-auth poll failed: ${res.status} ${res.statusText}${body ? ` \u2014 ${body}` : ""}`
-    );
-  }
-  return res.json();
-}
-async function waitForApproval(apiUrl2, deviceCode, opts) {
-  const intervalMs = opts?.intervalMs ?? 5e3;
-  const timeoutMs = opts?.timeoutMs ?? 9e5;
-  const onPoll = opts?.onPoll;
-  const signal = opts?.signal;
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (signal?.aborted) {
-      return { status: "timeout" };
-    }
-    try {
-      const result = await pollDeviceAuth(apiUrl2, deviceCode);
-      onPoll?.(result.status);
-      if (result.status === "approved") {
-        return { status: "approved", apiKey: result.apiKey };
-      }
-      if (result.status === "invalid") {
-        return { status: "invalid" };
-      }
-    } catch {
-    }
-    const remaining = deadline - Date.now();
-    const waitTime = Math.min(intervalMs, remaining);
-    if (waitTime <= 0) break;
-    await new Promise((resolve) => {
-      const timer = setTimeout(resolve, waitTime);
-      if (signal) {
-        const onAbort = () => {
-          clearTimeout(timer);
-          resolve();
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-      }
-    });
-  }
-  return { status: "timeout" };
-}
-
-// src/cli.ts
-init_keychain();
-function openBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
-  const args = process.platform === "win32" ? ["/c", "start", url] : [url];
-  execFile2(cmd, args, () => {
-  });
-}
-function registerCohortCli(ctx, cfg) {
-  const cohortCmd = ctx.program.command("cohort").description("Cohort plugin commands");
-  cohortCmd.command("auth").description("Authenticate the Cohort plugin via device flow").action(async () => {
-    const { logger, config } = ctx;
-    const existingKey = await getCredential(cfg.apiUrl);
-    if (existingKey) {
-      logger.info(
-        "cohort: Already authenticated. To re-authenticate, run 'openclaw cohort logout' first."
-      );
-      return;
-    }
-    const agents = [];
-    if (cfg.agentNameMap && Object.keys(cfg.agentNameMap).length > 0) {
-      for (const [id, name] of Object.entries(cfg.agentNameMap)) {
-        agents.push({ id, name });
-      }
-    } else {
-      agents.push({ id: "main", name: "main" });
-    }
-    const manifest = { agents };
-    logger.info("cohort: Starting device authorization...");
-    try {
-      const result = await startDeviceAuth(cfg.apiUrl, manifest);
-      logger.info(`
-  Your code: ${result.userCode}
-`);
-      logger.info(`  Opening: ${result.verificationUri}`);
-      logger.info(
-        "  Type the code in the browser, then click Approve.\n"
-      );
-      openBrowser(result.verificationUri);
-      logger.info("  Waiting for approval...");
-      const poll = await waitForApproval(
-        cfg.apiUrl,
-        result.deviceCode,
-        {
-          intervalMs: (result.interval ?? 5) * 1e3,
-          timeoutMs: result.expiresIn * 1e3,
-          onPoll: (status) => {
-            if (status === "pending") {
-              process.stdout.write(".");
-            }
-          }
-        }
-      );
-      process.stdout.write("\n");
-      if (poll.status === "approved" && poll.apiKey) {
-        await setCredential(cfg.apiUrl, poll.apiKey);
-        logger.info(
-          "cohort: Authenticated successfully! API key stored in macOS keychain."
-        );
-        logger.info("cohort: Restart the gateway to activate.");
-      } else if (poll.status === "timeout") {
-        logger.error(
-          "cohort: Code expired. Run 'openclaw cohort auth' again."
-        );
-      } else if (poll.status === "invalid") {
-        logger.error(
-          "cohort: Code invalid or expired. Run 'openclaw cohort auth' again."
-        );
-      } else {
-        logger.error(`cohort: Unexpected status: ${poll.status}`);
-      }
-    } catch (err) {
-      logger.error(`cohort: Device auth failed: ${err}`);
-    }
-  });
-  cohortCmd.command("logout").description("Remove stored Cohort credentials").action(async () => {
-    const { deleteCredential: deleteCredential2 } = await Promise.resolve().then(() => (init_keychain(), keychain_exports));
-    await deleteCredential2(cfg.apiUrl);
-    ctx.logger.info("cohort: Credentials removed from keychain.");
-  });
-}
-
 // index.ts
-init_keychain();
+function textResult(text, details) {
+  return { content: [{ type: "text", text }], details: details ?? void 0 };
+}
 var plugin = {
   id: "cohort-sync",
   name: "Cohort Sync",
@@ -14512,18 +14137,19 @@ var plugin = {
     const apiUrl2 = cfg?.apiUrl || DEFAULT_API_URL;
     if (!apiUrl2.startsWith("https://") && !apiUrl2.startsWith("http://localhost") && !apiUrl2.startsWith("http://127.0.0.1")) {
       api.logger.error(
-        "cohort-sync: apiUrl must use HTTPS for security. Got: " + apiUrl2.replace(/\/\/.*@/, "//***@")
+        "cohort-sync: apiUrl must use HTTPS for security. Got: " + (() => {
+          try {
+            const u = new URL(apiUrl2);
+            u.username = "***";
+            u.password = "";
+            return u.href;
+          } catch {
+            return "[invalid url]";
+          }
+        })()
       );
       return;
     }
-    api.registerCli(
-      (ctx) => registerCohortCli(ctx, {
-        apiUrl: apiUrl2,
-        apiKey: cfg?.apiKey,
-        agentNameMap: cfg?.agentNameMap
-      }),
-      { commands: ["cohort"] }
-    );
     const gatewayPort2 = api.config?.gateway?.port ?? 18789;
     api.registerHook(
       "gateway:startup",
@@ -14554,9 +14180,7 @@ var plugin = {
         async execute(_toolCallId, params) {
           const rt = getToolRuntime();
           if (!rt.isReady) {
-            return {
-              content: [{ type: "text", text: "cohort_comment is not ready yet \u2014 the plugin is still starting up. Try again in a few seconds." }]
-            };
+            return textResult("cohort_comment is not ready yet \u2014 the plugin is still starting up. Try again in a few seconds.");
           }
           const agentName = rt.resolveAgentName(agentId);
           try {
@@ -14574,26 +14198,23 @@ var plugin = {
             if (result.budget) {
               lines.push(`Daily budget: ${result.budget.used}/${result.budget.limit}`);
             }
-            return {
-              content: [{ type: "text", text: lines.join("\n") }],
-              details: result
-            };
+            return textResult(lines.join("\n"), result);
           } catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
             if (msg.includes("AGENT_COMMENTS_LOCKED")) {
-              return { content: [{ type: "text", text: `Cannot comment on task #${params.task_number}.
+              return textResult(`Cannot comment on task #${params.task_number}.
 Reason: Agent comments are locked on this task.
-Do not re-attempt.` }] };
+Do not re-attempt.`);
             }
             if (msg.includes("TASK_HOUR_LIMIT_REACHED")) {
-              return { content: [{ type: "text", text: `Cannot comment on task #${params.task_number}.
+              return textResult(`Cannot comment on task #${params.task_number}.
 Reason: Per-task hourly limit reached.
-Step back from this task.` }] };
+Step back from this task.`);
             }
             if (msg.includes("DAILY_LIMIT_REACHED")) {
-              return { content: [{ type: "text", text: `Cannot comment on task #${params.task_number}.
+              return textResult(`Cannot comment on task #${params.task_number}.
 Reason: Daily comment limit reached.
-Do not attempt more comments until tomorrow.` }] };
+Do not attempt more comments until tomorrow.`);
             }
             throw err;
           }
@@ -14609,7 +14230,7 @@ Do not attempt more comments until tomorrow.` }] };
         async execute() {
           const rt = getToolRuntime();
           if (!rt.isReady) {
-            return { content: [{ type: "text", text: POCKET_GUIDE }] };
+            return textResult(POCKET_GUIDE);
           }
           try {
             const response = await fetch(`${rt.apiUrl}/api/v1/context`, {
@@ -14617,11 +14238,11 @@ Do not attempt more comments until tomorrow.` }] };
               headers: { "Authorization": `Bearer ${rt.apiKey}` },
               signal: AbortSignal.timeout(1e4)
             });
-            if (!response.ok) return { content: [{ type: "text", text: POCKET_GUIDE }] };
+            if (!response.ok) return textResult(POCKET_GUIDE);
             const data = await response.json();
-            return { content: [{ type: "text", text: data.briefing || POCKET_GUIDE }] };
+            return textResult(data.briefing || POCKET_GUIDE);
           } catch {
-            return { content: [{ type: "text", text: POCKET_GUIDE }] };
+            return textResult(POCKET_GUIDE);
           }
         }
       };
@@ -14639,7 +14260,7 @@ Do not attempt more comments until tomorrow.` }] };
         async execute(_toolCallId, params) {
           const rt = getToolRuntime();
           if (!rt.isReady) {
-            return { content: [{ type: "text", text: "cohort_task is not ready yet \u2014 the plugin is still starting up." }] };
+            return textResult("cohort_task is not ready yet \u2014 the plugin is still starting up.");
           }
           try {
             const taskRes = await fetch(`${rt.apiUrl}/api/v1/tasks/${params.task_number}`, {
@@ -14647,7 +14268,7 @@ Do not attempt more comments until tomorrow.` }] };
               signal: AbortSignal.timeout(1e4)
             });
             if (!taskRes.ok) {
-              return { content: [{ type: "text", text: `Task #${params.task_number} not found (${taskRes.status}).` }] };
+              return textResult(`Task #${params.task_number} not found (${taskRes.status}).`);
             }
             const task = await taskRes.json();
             const lines = [
@@ -14682,9 +14303,9 @@ Do not attempt more comments until tomorrow.` }] };
                 }
               }
             }
-            return { content: [{ type: "text", text: lines.join("\n") }] };
+            return textResult(lines.join("\n"));
           } catch (err) {
-            return { content: [{ type: "text", text: `Failed to fetch task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}` }] };
+            return textResult(`Failed to fetch task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}`);
           }
         }
       };
@@ -14701,11 +14322,11 @@ Do not attempt more comments until tomorrow.` }] };
         async execute(_toolCallId, params) {
           const rt = getToolRuntime();
           if (!rt.isReady) {
-            return { content: [{ type: "text", text: "cohort_transition is not ready yet \u2014 the plugin is still starting up." }] };
+            return textResult("cohort_transition is not ready yet \u2014 the plugin is still starting up.");
           }
           const validStatuses = ["backlog", "todo", "in_progress", "waiting", "done"];
           if (!validStatuses.includes(params.status)) {
-            return { content: [{ type: "text", text: `Invalid status "${params.status}". Valid statuses: ${validStatuses.join(", ")}` }] };
+            return textResult(`Invalid status "${params.status}". Valid statuses: ${validStatuses.join(", ")}`);
           }
           try {
             const res = await fetch(`${rt.apiUrl}/api/v1/tasks/${params.task_number}/transition`, {
@@ -14719,12 +14340,12 @@ Do not attempt more comments until tomorrow.` }] };
             });
             if (!res.ok) {
               const body = await res.text();
-              return { content: [{ type: "text", text: `Failed to transition task #${params.task_number} to "${params.status}": ${res.status} ${body.slice(0, 200)}` }] };
+              return textResult(`Failed to transition task #${params.task_number} to "${params.status}": ${res.status} ${body.slice(0, 200)}`);
             }
             const task = await res.json();
-            return { content: [{ type: "text", text: `Task #${params.task_number} transitioned to "${params.status}".` }] };
+            return textResult(`Task #${params.task_number} transitioned to "${params.status}".`);
           } catch (err) {
-            return { content: [{ type: "text", text: `Failed to transition task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}` }] };
+            return textResult(`Failed to transition task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}`);
           }
         }
       };
@@ -14745,7 +14366,7 @@ Do not attempt more comments until tomorrow.` }] };
         async execute(_toolCallId, params) {
           const rt = getToolRuntime();
           if (!rt.isReady) {
-            return { content: [{ type: "text", text: "cohort_assign is not ready yet \u2014 the plugin is still starting up." }] };
+            return textResult("cohort_assign is not ready yet \u2014 the plugin is still starting up.");
           }
           try {
             const assignee = params.assignee?.trim() || null;
@@ -14760,13 +14381,13 @@ Do not attempt more comments until tomorrow.` }] };
             });
             if (!res.ok) {
               const body = await res.text();
-              return { content: [{ type: "text", text: `Failed to assign task #${params.task_number}: ${res.status} ${body.slice(0, 200)}` }] };
+              return textResult(`Failed to assign task #${params.task_number}: ${res.status} ${body.slice(0, 200)}`);
             }
             const task = await res.json();
             const msg = assignee ? `Task #${params.task_number} assigned to ${assignee}.` : `Task #${params.task_number} unassigned.`;
-            return { content: [{ type: "text", text: msg }] };
+            return textResult(msg);
           } catch (err) {
-            return { content: [{ type: "text", text: `Failed to assign task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}` }] };
+            return textResult(`Failed to assign task #${params.task_number}: ${err instanceof Error ? err.message : String(err)}`);
           }
         }
       };
@@ -14775,19 +14396,10 @@ Do not attempt more comments until tomorrow.` }] };
       id: "cohort-sync-core",
       async start(svcCtx) {
         api.logger.info(`cohort-sync: service starting (api: ${apiUrl2})`);
-        let apiKey2 = cfg?.apiKey;
-        if (!apiKey2) {
-          try {
-            apiKey2 = await getCredential(apiUrl2) ?? void 0;
-          } catch (err) {
-            api.logger.error(
-              `cohort-sync: keychain lookup failed: ${err instanceof Error ? err.message : String(err)}`
-            );
-          }
-        }
-        if (!apiKey2) {
+        const apiKey2 = cfg?.apiKey;
+        if (!apiKey2 || typeof apiKey2 !== "string") {
           api.logger.warn(
-            "cohort-sync: no API key found \u2014 run 'openclaw cohort auth' to authenticate"
+            'cohort-sync: no API key configured.\n  1. Create one at https://my.cohort.bot/settings/api-keys\n  2. Run: openclaw config set plugins.entries.cohort-sync.config.apiKey "ch_live_..."'
           );
           return;
         }