@clawchatsai/connector 0.0.12 → 0.0.14

package/dist/gateway-bridge.d.ts

@@ -20,6 +20,7 @@ export interface PluginConfig {
 }
 export interface BridgeConfig {
     gatewayToken: string;
+    dataDir: string;
 }
 export declare class GatewayBridge extends EventEmitter {
     private readonly gatewayUrl;

package/dist/gateway-bridge.js

@@ -9,6 +9,9 @@
  * 3. Reconnect with exponential backoff on disconnect.
  */
 import { EventEmitter } from 'node:events';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 import { WebSocket } from 'ws';
 import { PLUGIN_VERSION } from './index.js';
 // Reconnect backoff constants (milliseconds)
@@ -19,6 +22,62 @@ const CLIENT_ID = 'gateway-client';
 const CLIENT_MODE = 'backend';
 const ROLE = 'operator';
 const SCOPES = ['operator.read', 'operator.write', 'operator.admin'];
+// ---------------------------------------------------------------------------
+// Device Identity — ed25519 key generation + connect payload signing
+// Required by OpenClaw ≥2.15 to prevent scope clearing on connect.
+// ---------------------------------------------------------------------------
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+function _derivePublicKeyRaw(publicKeyPem) {
+    const spki = crypto.createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
+    if (spki.length === ED25519_SPKI_PREFIX.length + 32 &&
+        spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
+        return spki.subarray(ED25519_SPKI_PREFIX.length);
+    }
+    return spki;
+}
+function _fingerprintPublicKey(publicKeyPem) {
+    return crypto.createHash('sha256').update(_derivePublicKeyRaw(publicKeyPem)).digest('hex');
+}
+function _base64UrlEncode(buf) {
+    return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/g, '');
+}
+function _loadOrCreateDeviceIdentity(identityPath) {
+    try {
+        if (fs.existsSync(identityPath)) {
+            const parsed = JSON.parse(fs.readFileSync(identityPath, 'utf8'));
+            if (parsed?.version === 1 && parsed.deviceId && parsed.publicKeyPem && parsed.privateKeyPem) {
+                return parsed;
+            }
+        }
+    }
+    catch { /* regenerate */ }
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+    const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+    const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+    const identity = {
+        version: 1,
+        deviceId: _fingerprintPublicKey(publicKeyPem),
+        publicKeyPem,
+        privateKeyPem,
+        createdAtMs: Date.now(),
+    };
+    fs.mkdirSync(path.dirname(identityPath), { recursive: true });
+    fs.writeFileSync(identityPath, JSON.stringify(identity, null, 2) + '\n', { mode: 0o600 });
+    return identity;
+}
+function _buildDeviceAuth(identity, params) {
+    const signedAt = Date.now();
+    const payload = [
+        'v2', identity.deviceId, params.clientId, params.clientMode,
+        params.role, params.scopes.join(','), String(signedAt),
+        params.token || '', params.nonce,
+    ].join('|');
+    const privateKey = crypto.createPrivateKey(identity.privateKeyPem);
+    const signature = _base64UrlEncode(crypto.sign(null, Buffer.from(payload, 'utf8'), privateKey));
+    const publicKeyB64Url = _base64UrlEncode(_derivePublicKeyRaw(identity.publicKeyPem));
+    return { id: identity.deviceId, publicKey: publicKeyB64Url, signature, signedAt, nonce: params.nonce };
+}
+// ---------------------------------------------------------------------------
 export class GatewayBridge extends EventEmitter {
     gatewayUrl;
     config;
@@ -121,9 +180,11 @@ export class GatewayBridge extends EventEmitter {
         }
         const type = msg['type'];
         const event = msg['event'];
-        // connect.challenge → send token-only connect request (loopback skips nonce)
+        // connect.challenge → send signed connect request with device identity
         if (type === 'event' && event === 'connect.challenge') {
-            this._sendConnect();
+            const payload = msg['payload'];
+            const nonce = payload?.['nonce'] ?? '';
+            this._sendConnect(nonce);
             return;
         }
         // hello-ok → handshake complete
@@ -138,7 +199,17 @@ export class GatewayBridge extends EventEmitter {
             }
         }
     }
-    _sendConnect() {
+    _sendConnect(nonce) {
+        const identityPath = path.join(this.config.dataDir, 'device-identity.json');
+        const identity = _loadOrCreateDeviceIdentity(identityPath);
+        const device = _buildDeviceAuth(identity, {
+            clientId: CLIENT_ID,
+            clientMode: CLIENT_MODE,
+            role: ROLE,
+            scopes: SCOPES,
+            token: this.config.gatewayToken,
+            nonce,
+        });
         this.send(JSON.stringify({
             type: 'req',
             id: 'gw-connect-1',
@@ -154,6 +225,7 @@ export class GatewayBridge extends EventEmitter {
                 },
                 role: ROLE,
                 scopes: SCOPES,
+                device,
                 auth: { token: this.config.gatewayToken },
                 caps: ['tool-events'],
             },

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 /**
- * @shellchat/tunnel — OpenClaw plugin entry point
+ * @clawchatsai/connector — OpenClaw plugin entry point
  *
- * Registers ShellChat as a gateway plugin, providing:
+ * Registers ClawChats as a gateway plugin, providing:
  * - Local HTTP API bridge via createApp()
  * - WebRTC DataChannel for browser connections
  * - Signaling client for NAT traversal
@@ -10,7 +10,7 @@
  * Spec: specs/multitenant-p2p.md sections 6.1-6.2
  */
 export declare const PLUGIN_ID = "connector";
-export declare const PLUGIN_VERSION = "0.0.12";
+export declare const PLUGIN_VERSION = "0.0.13";
 interface PluginServiceContext {
     stateDir: string;
     logger: {

package/dist/index.js

@@ -1,7 +1,7 @@
 /**
- * @shellchat/tunnel — OpenClaw plugin entry point
+ * @clawchatsai/connector — OpenClaw plugin entry point
  *
- * Registers ShellChat as a gateway plugin, providing:
+ * Registers ClawChats as a gateway plugin, providing:
  * - Local HTTP API bridge via createApp()
  * - WebRTC DataChannel for browser connections
  * - Signaling client for NAT traversal
@@ -19,7 +19,7 @@ import { checkForUpdates, performUpdate } from './updater.js';
 // Inline from shared/api-version.ts to avoid rootDir conflict
 const CURRENT_API_VERSION = 1;
 export const PLUGIN_ID = 'connector';
-export const PLUGIN_VERSION = '0.0.12';
+export const PLUGIN_VERSION = '0.0.13';
 /** Max DataChannel message size (~256KB, leave room for envelope) */
 const MAX_DC_MESSAGE_SIZE = 256 * 1024;
 /** Active DataChannel connections: connectionId → send function */
@@ -32,7 +32,7 @@ let _stopRequested = false;
 // ---------------------------------------------------------------------------
 // Config helpers
 // ---------------------------------------------------------------------------
-const CONFIG_DIR = path.join(process.env.HOME || '/root', '.openclaw', 'shellchats');
+const CONFIG_DIR = path.join(process.env.HOME || '/root', '.openclaw', 'clawchats');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 const RUNTIME_FILE = path.join(CONFIG_DIR, 'runtime.json');
 function loadConfig() {
@@ -73,11 +73,11 @@ async function ensureNativeModules(ctx) {
         ctx.logger.error('Try running manually: cd ~/.openclaw/extensions/connector && npm rebuild better-sqlite3');
     }
 }
-async function startShellChat(ctx, api) {
+async function startClawChats(ctx, api) {
     _stopRequested = false;
     let config = loadConfig();
     if (!config) {
-        ctx.logger.info('ShellChats not configured. Waiting for setup...');
+        ctx.logger.info('ClawChats not configured. Waiting for setup...');
         fs.mkdirSync(CONFIG_DIR, { recursive: true });
         while (!config && !_stopRequested) {
             await new Promise(r => setTimeout(r, 2000));
@@ -85,7 +85,7 @@ async function startShellChat(ctx, api) {
         }
         if (_stopRequested || !config)
             return;
-        ctx.logger.info('Setup detected — connecting to ShellChats...');
+        ctx.logger.info('Setup detected — connecting to ClawChats...');
     }
     // 1. Check for updates
     const update = await checkForUpdates();
@@ -95,7 +95,7 @@ async function startShellChat(ctx, api) {
             try {
                 await performUpdate();
                 ctx.logger.info(`Updated to ${update.latest}. Requesting graceful restart...`);
-                api.runtime.requestRestart?.('shellchats update');
+                api.runtime.requestRestart?.('clawchats update');
                 return; // will restart with new version
             }
             catch (e) {
@@ -108,14 +108,14 @@ async function startShellChat(ctx, api) {
     const gwAuth = gwCfg?.['gateway']?.['auth'];
     const gatewayToken = gwAuth?.['token'] || config.gatewayToken || '';
     if (!gatewayToken) {
-        ctx.logger.error('No gateway token available. Re-run: openclaw shellchats setup <token>');
+        ctx.logger.error('No gateway token available. Re-run: openclaw clawchats setup <token>');
         return;
     }
     // 3. Ensure native modules are built (OpenClaw installs with --ignore-scripts)
     await ensureNativeModules(ctx);
     // 4. Import server.js and create app instance with plugin paths
-    const dataDir = path.join(ctx.stateDir, 'shellchats', 'data');
-    const uploadsDir = path.join(ctx.stateDir, 'shellchats', 'uploads');
+    const dataDir = path.join(ctx.stateDir, 'clawchats', 'data');
+    const uploadsDir = path.join(ctx.stateDir, 'clawchats', 'uploads');
     // Dynamic import of server.js (plain JS, no type declarations)
     // @ts-expect-error — server.js is plain JS with no .d.ts
     const serverModule = await import('../server.js');
@@ -228,11 +228,11 @@ async function startShellChat(ctx, api) {
         }, null, 2), { mode: 0o600 });
         ctx.logger.info(`Health endpoint on 127.0.0.1:${addr.port}`);
     });
-    ctx.logger.info('ShellChat service started');
+    ctx.logger.info('ClawChats service started');
 }
-async function stopShellChat(ctx) {
+async function stopClawChats(ctx) {
     _stopRequested = true;
-    ctx.logger.info('ShellChat service stopping...');
+    ctx.logger.info('ClawChats service stopping...');
     // 0. Tear down health endpoint
     if (healthServer) {
         healthServer.close();
@@ -259,7 +259,7 @@ async function stopShellChat(ctx) {
     // 4. Close SQLite databases
     app?.shutdown();
     app = null;
-    ctx.logger.info('ShellChat service stopped');
+    ctx.logger.info('ClawChats service stopped');
 }
 // ---------------------------------------------------------------------------
 // DataChannel message handler (spec section 6.4)
@@ -386,7 +386,7 @@ function broadcastToClients(msg) {
 // ---------------------------------------------------------------------------
 function formatStatus() {
     const lines = [];
-    lines.push(`ShellChat Plugin v${PLUGIN_VERSION}`);
+    lines.push(`ClawChats Plugin v${PLUGIN_VERSION}`);
     lines.push(`Gateway: ${app?.gatewayClient?.connected ? 'connected' : 'disconnected'}`);
     lines.push(`Signaling: ${signaling?.isConnected ? 'connected' : 'disconnected'}`);
     lines.push(`Clients: ${connectedClients.size}`);
@@ -410,7 +410,7 @@ async function handleSetup(token) {
         console.error('Setup token has expired. Generate a new one from clawchats.ai.');
         return;
     }
-    console.log('Setting up ShellChats...');
+    console.log('Setting up ClawChats...');
     console.log(`  Server: ${tokenData.serverUrl}`);
     // Generate API key for signaling server auth
     const { randomBytes } = await import('node:crypto');
@@ -467,7 +467,7 @@ async function handleSetup(token) {
                 const uploadsDir = path.join(CONFIG_DIR, 'uploads');
                 fs.mkdirSync(dataDir, { recursive: true });
                 fs.mkdirSync(uploadsDir, { recursive: true });
-                console.log('  ShellChats is ready!');
+                console.log('  ClawChats is ready!');
                 console.log('  Open clawchats.ai in your browser to start chatting.');
                 ws.close();
                 resolve();
@@ -497,7 +497,7 @@ async function handleStatus() {
         runtime = JSON.parse(fs.readFileSync(RUNTIME_FILE, 'utf8'));
     }
     catch {
-        console.log('ShellChats: offline (service not running)');
+        console.log('ClawChats: offline (service not running)');
         return;
     }
     // Verify PID is alive
@@ -505,7 +505,7 @@ async function handleStatus() {
         process.kill(runtime.pid, 0);
     }
     catch {
-        console.log('ShellChats: offline (stale runtime file)');
+        console.log('ClawChats: offline (stale runtime file)');
         try {
             fs.unlinkSync(RUNTIME_FILE);
         }
@@ -524,20 +524,20 @@ async function handleStatus() {
             req.setTimeout(3000, () => { req.destroy(); reject(new Error('timeout')); });
         });
         const status = JSON.parse(body);
-        console.log(`ShellChats Plugin v${status.version}`);
+        console.log(`ClawChats Plugin v${status.version}`);
         console.log(`Uptime: ${Math.floor(status.uptime)}s`);
         console.log(`Gateway: ${status.gateway.connected ? 'connected' : 'disconnected'}`);
         console.log(`Signaling: ${status.signaling.connected ? 'connected' : 'disconnected'}`);
         console.log(`Clients: ${status.clients.active}`);
     }
     catch {
-        console.log('ShellChats: offline (could not reach service)');
+        console.log('ClawChats: offline (could not reach service)');
     }
 }
 async function handleReset() {
     try {
         fs.rmSync(CONFIG_DIR, { recursive: true, force: true });
-        console.log('ShellChats data removed. Plugin disconnected.');
+        console.log('ClawChats data removed. Plugin disconnected.');
     }
     catch (e) {
         console.error(`Reset failed: ${e.message}`);
@@ -554,7 +554,7 @@ async function handleImport(sourcePath) {
         console.error(`Source must be a directory: ${resolvedSource}`);
         return;
     }
-    // Destination: ~/.openclaw/shellchats/data/
+    // Destination: ~/.openclaw/clawchats/data/
     const destDataDir = path.join(CONFIG_DIR, 'data');
     fs.mkdirSync(destDataDir, { recursive: true });
     // Import .db files
@@ -586,7 +586,7 @@ async function handleImport(sourcePath) {
         }
     }
     // Also try to migrate config.json from the parent directory
-    // e.g. if source is ~/.openclaw/shellchat/data/, config is at ~/.openclaw/shellchat/config.json
+    // e.g. if source is ~/.openclaw/clawchats/data/, config is at ~/.openclaw/clawchats/config.json
     const parentConfigPath = path.join(path.dirname(resolvedSource), 'config.json');
     if (fs.existsSync(parentConfigPath)) {
         try {
@@ -605,26 +605,26 @@ async function handleImport(sourcePath) {
 // ---------------------------------------------------------------------------
 const plugin = {
     id: PLUGIN_ID,
-    name: 'ShellChats',
-    description: 'Connects your gateway to ShellChats via WebRTC P2P',
+    name: 'ClawChats',
+    description: 'Connects your gateway to ClawChats via WebRTC P2P',
     register(api) {
         // Background service: signaling + gateway bridge + future WebRTC
         api.registerService({
             id: 'connector-service',
-            start: (ctx) => startShellChat(ctx, api),
-            stop: (ctx) => stopShellChat(ctx),
+            start: (ctx) => startClawChats(ctx, api),
+            stop: (ctx) => stopClawChats(ctx),
         });
         // CLI commands
         api.registerCli((ctx) => {
-            const cmd = ctx.program.command('shellchats');
+            const cmd = ctx.program.command('clawchats');
             cmd.command('setup <token>')
-                .description('Set up ShellChats with a setup token')
+                .description('Set up ClawChats with a setup token')
                 .action((token) => handleSetup(String(token)));
             cmd.command('status')
-                .description('Show ShellChats connection status')
+                .description('Show ClawChats connection status')
                 .action(() => handleStatus());
             cmd.command('reset')
-                .description('Disconnect and remove all ShellChats data')
+                .description('Disconnect and remove all ClawChats data')
                 .action(() => handleReset());
             cmd.command('import <path>')
                 .description('Import databases and config from a folder (e.g. migrate from old data directory)')
@@ -632,8 +632,8 @@ const plugin = {
         });
         // Slash command for status from any channel
         api.registerCommand({
-            name: 'shellchats',
-            description: 'Show ShellChats tunnel status',
+            name: 'clawchats',
+            description: 'Show ClawChats tunnel status',
             handler: () => ({ text: formatStatus() }),
         });
     },

package/dist/migrate.d.ts

@@ -1,5 +1,5 @@
 /**
- * Schema migration runner for the ShellChat plugin SQLite database.
+ * Schema migration runner for the ClawChats plugin SQLite database.
  *
  * - Tracks schema version in a `_schema_version` table
  * - Runs migrations sequentially from current version to target

package/dist/migrate.js

@@ -1,5 +1,5 @@
 /**
- * Schema migration runner for the ShellChat plugin SQLite database.
+ * Schema migration runner for the ClawChats plugin SQLite database.
  *
  * - Tracks schema version in a `_schema_version` table
  * - Runs migrations sequentially from current version to target

package/dist/shim.js

@@ -46,7 +46,7 @@ class FakeReq extends Readable {
             }
             else if (parsed && parsed['_multipart']) {
                 // Multipart form data: { _multipart: true, fields: { key: string | { filename, contentType, data } } }
-                const boundary = '----ShellChatBoundary' + Date.now();
+                const boundary = '----ClawChatsBoundary' + Date.now();
                 this.headers['content-type'] = `multipart/form-data; boundary=${boundary}`;
                 const fields = parsed['fields'] || {};
                 const parts = [];

package/dist/signaling-client.d.ts

@@ -1,5 +1,5 @@
 /**
- * SignalingClient — persistent WSS connection to the ShellChat signaling server.
+ * SignalingClient — persistent WSS connection to the ClawChats signaling server.
  *
  * Responsibilities:
  * - Authenticate with the signaling server on connect (gateway-auth)

package/dist/signaling-client.js

@@ -1,5 +1,5 @@
 /**
- * SignalingClient — persistent WSS connection to the ShellChat signaling server.
+ * SignalingClient — persistent WSS connection to the ClawChats signaling server.
  *
  * Responsibilities:
  * - Authenticate with the signaling server on connect (gateway-auth)

package/dist/webrtc-peer.d.ts

@@ -109,7 +109,7 @@ export declare class WebRTCPeerManager extends EventEmitter {
     handleIceCandidate(connectionId: string, candidate: unknown): void;
     /**
      * Close all active peer connections and DataChannels.
-     * Called during plugin shutdown (stopShellChat).
+     * Called during plugin shutdown (stopClawChats).
      */
     closeAll(): void;
     /**

package/dist/webrtc-peer.js

@@ -194,7 +194,7 @@ export class WebRTCPeerManager extends EventEmitter {
     }
     /**
      * Close all active peer connections and DataChannels.
-     * Called during plugin shutdown (stopShellChat).
+     * Called during plugin shutdown (stopClawChats).
      */
     closeAll() {
         console.log(`[WebRTCPeerManager] Closing all connections (${this.peerConnections.size} peers, ${this.activeChannels.size} channels)`);

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "connector",
-  "name": "ShellChats",
-  "description": "Connects your OpenClaw gateway to ShellChats via WebRTC P2P",
+  "name": "ClawChats",
+  "description": "Connects your OpenClaw gateway to ClawChats via WebRTC P2P",
   "kind": "integration",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@clawchatsai/connector",
-  "version": "0.0.12",
+  "version": "0.0.14",
   "type": "module",
-  "description": "ShellChat OpenClaw plugin — P2P tunnel + local API bridge",
+  "description": "ClawChats OpenClaw plugin — P2P tunnel + local API bridge",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [

package/server.js

@@ -1,4 +1,4 @@
-// ShellChat Backend Server
+// ClawChats Backend Server
 // Single-file Node.js HTTP server with SQLite storage
 // See specs/backend-session-architecture.md for full spec
 
@@ -16,9 +16,55 @@ import { WebSocket as WS, WebSocketServer } from 'ws';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+// ─── Device Identity (ed25519 signing for OpenClaw ≥2.15 scope preservation) ─
+
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+
+function _derivePublicKeyRaw(publicKeyPem) {
+  const spki = crypto.createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
+  if (spki.length === ED25519_SPKI_PREFIX.length + 32 &&
+      spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)) {
+    return spki.subarray(ED25519_SPKI_PREFIX.length);
+  }
+  return spki;
+}
+
+function _fingerprintPublicKey(publicKeyPem) {
+  return crypto.createHash('sha256').update(_derivePublicKeyRaw(publicKeyPem)).digest('hex');
+}
+
+function _base64UrlEncode(buf) {
+  return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/g, '');
+}
+
+function _loadOrCreateDeviceIdentity(identityPath) {
+  try {
+    if (fs.existsSync(identityPath)) {
+      const parsed = JSON.parse(fs.readFileSync(identityPath, 'utf8'));
+      if (parsed?.version === 1 && parsed.deviceId && parsed.publicKeyPem && parsed.privateKeyPem) return parsed;
+    }
+  } catch { /* regenerate */ }
+  const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+  const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+  const identity = { version: 1, deviceId: _fingerprintPublicKey(publicKeyPem), publicKeyPem, privateKeyPem, createdAtMs: Date.now() };
+  fs.mkdirSync(path.dirname(identityPath), { recursive: true });
+  fs.writeFileSync(identityPath, JSON.stringify(identity, null, 2) + '\n', { mode: 0o600 });
+  return identity;
+}
+
+function _buildDeviceAuth(identity, { clientId, clientMode, role, scopes, token, nonce }) {
+  const signedAt = Date.now();
+  const payload = ['v2', identity.deviceId, clientId, clientMode, role, scopes.join(','), String(signedAt), token || '', nonce].join('|');
+  const privateKey = crypto.createPrivateKey(identity.privateKeyPem);
+  const signature = _base64UrlEncode(crypto.sign(null, Buffer.from(payload, 'utf8'), privateKey));
+  const publicKeyB64Url = _base64UrlEncode(_derivePublicKeyRaw(identity.publicKeyPem));
+  return { id: identity.deviceId, publicKey: publicKeyB64Url, signature, signedAt, nonce };
+}
+
 // ─── Configuration ──────────────────────────────────────────────────────────
 
-const PORT = parseInt(process.env.SHELLCHAT_PORT || '3001', 10);
+const PORT = parseInt(process.env.CLAWCHATS_PORT || process.env.SHELLCHAT_PORT || '3001', 10);
 const DATA_DIR = path.join(__dirname, 'data');
 const UPLOADS_DIR = path.join(__dirname, 'uploads');
 const WORKSPACES_FILE = path.join(DATA_DIR, 'workspaces.json');
@@ -128,9 +174,9 @@ function parseConfigField(field) {
 }
 
 // Load auth token from config.js or env var
-let AUTH_TOKEN = process.env.SHELLCHAT_AUTH_TOKEN || parseConfigField('authToken') || '';
+let AUTH_TOKEN = process.env.CLAWCHATS_AUTH_TOKEN || process.env.SHELLCHAT_AUTH_TOKEN || parseConfigField('authToken') || '';
 if (!AUTH_TOKEN) {
-  console.error('WARNING: No auth token configured. Set SHELLCHAT_AUTH_TOKEN or create config.js');
+  console.error('WARNING: No auth token configured. Set CLAWCHATS_AUTH_TOKEN or create config.js');
 }
 
 // Load gateway WebSocket URL
@@ -837,7 +883,7 @@ async function handleMarkMessagesRead(req, res, params) {
   // Broadcast unread-update to ALL browser clients (so other tabs/devices sync)
   const workspace = getWorkspaces().active;
   gatewayClient.broadcastToBrowsers(JSON.stringify({
-    type: 'shellchat',
+    type: 'clawchats',
     event: 'unread-update',
     workspace,
     threadId,
@@ -2233,6 +2279,13 @@ class GatewayClient {
     // Handle connect.challenge (handshake)
     if (msg.type === 'event' && msg.event === 'connect.challenge') {
       console.log('Received connect.challenge, sending auth...');
+      const nonce = msg.payload?.nonce || '';
+      const identityPath = path.join(DATA_DIR, 'device-identity.json');
+      const identity = _loadOrCreateDeviceIdentity(identityPath);
+      const device = _buildDeviceAuth(identity, {
+        clientId: 'gateway-client', clientMode: 'backend', role: 'operator',
+        scopes: ['operator.read', 'operator.write', 'operator.admin'], token: AUTH_TOKEN, nonce
+      });
       this.ws.send(JSON.stringify({
         type: 'req',
         id: 'gw-connect-1',
@@ -2243,6 +2296,7 @@ class GatewayClient {
           client: { id: 'gateway-client', version: '0.1.0', platform: 'node', mode: 'backend' },
           role: 'operator',
           scopes: ['operator.read', 'operator.write', 'operator.admin'],
+          device,
           auth: { token: AUTH_TOKEN },
           caps: ['tool-events']
         }
@@ -2315,7 +2369,7 @@ class GatewayClient {
 
   saveAssistantMessage(sessionKey, message, seq) {
     const parsed = parseSessionKey(sessionKey);
-    if (!parsed) return; // Non-ShellChat session key, silently ignore
+    if (!parsed) return; // Non-ClawChats session key, silently ignore
 
     // Guard: verify workspace still exists
     const ws = getWorkspaces();
@@ -2370,7 +2424,7 @@ class GatewayClient {
 
       // Broadcast message-saved for active thread reload
       this.broadcastToBrowsers(JSON.stringify({
-        type: 'shellchat',
+        type: 'clawchats',
         event: 'message-saved',
         threadId: parsed.threadId,
         workspace: parsed.workspace,
@@ -2384,7 +2438,7 @@ class GatewayClient {
       // Always broadcast unread-update — browser sends read receipts to clear
       const workspaceUnreadTotal = db.prepare('SELECT COALESCE(SUM(unread_count), 0) as total FROM threads').get().total;
       this.broadcastToBrowsers(JSON.stringify({
-        type: 'shellchat',
+        type: 'clawchats',
         event: 'unread-update',
         workspace: parsed.workspace,
         threadId: parsed.threadId,
@@ -2562,7 +2616,7 @@ class GatewayClient {
     if (!parsed) return;
 
     this.broadcastToBrowsers(JSON.stringify({
-      type: 'shellchat',
+      type: 'clawchats',
       event: 'agent-activity',
       workspace: parsed.workspace,
       threadId: parsed.threadId,
@@ -2707,7 +2761,7 @@ class GatewayClient {
 
             // Notify browsers to re-render this message with activity data
             this.broadcastToBrowsers(JSON.stringify({
-              type: 'shellchat',
+              type: 'clawchats',
               event: 'activity-saved',
               workspace: parsed.workspace,
               threadId: parsed.threadId,
@@ -2790,7 +2844,7 @@ class GatewayClient {
 
   broadcastGatewayStatus(connected) {
     const msg = JSON.stringify({
-      type: 'shellchat',
+      type: 'clawchats',
       event: 'gateway-status',
       connected
     });
@@ -2819,7 +2873,7 @@ class GatewayClient {
     // Send current gateway status
     if (ws.readyState === WS.OPEN) {
       ws.send(JSON.stringify({
-        type: 'shellchat',
+        type: 'clawchats',
         event: 'gateway-status',
         connected: this.connected
       }));
@@ -2833,7 +2887,7 @@ class GatewayClient {
       }
       if (streams.length > 0) {
         ws.send(JSON.stringify({
-          type: 'shellchat',
+          type: 'clawchats',
           event: 'stream-sync',
           streams
         }));
@@ -2870,7 +2924,7 @@ class GatewayClient {
           // Broadcast unread-update clear to ALL browser clients
           const workspaceUnreadTotal = db.prepare('SELECT COALESCE(SUM(unread_count), 0) as total FROM threads').get().total;
           this.broadcastToBrowsers(JSON.stringify({
-            type: 'shellchat',
+            type: 'clawchats',
             event: 'unread-update',
             workspace,
             threadId,
@@ -2898,7 +2952,7 @@ function syncThreadUnreadCount(db, threadId) {
 function parseSessionKey(sessionKey) {
   if (!sessionKey) return null;
   const match = sessionKey.match(/^agent:main:([^:]+):chat:([^:]+)$/);
-  if (!match) return null; // Non-ShellChat keys — silently ignore
+  if (!match) return null; // Non-ClawChats keys — silently ignore
   return { workspace: match[1], threadId: match[2] };
 }
 
@@ -2919,7 +2973,7 @@ const gatewayClient = new GatewayClient();
 
 // ─── createApp Factory ───────────────────────────────────────────────────────
 // Returns an isolated instance of the app state + handlers.
-// Used by the plugin (signaling/index.js) to embed ShellChat logic without
+// Used by the plugin (signaling/index.js) to embed ClawChats logic without
 // spinning up a standalone HTTP server.
 
 export function createApp(config = {}) {
@@ -2932,7 +2986,7 @@ export function createApp(config = {}) {
 
   let _AUTH_TOKEN = config.authToken !== undefined
     ? config.authToken
-    : (process.env.SHELLCHAT_AUTH_TOKEN || parseConfigField('authToken') || '');
+    : (process.env.CLAWCHATS_AUTH_TOKEN || process.env.SHELLCHAT_AUTH_TOKEN || parseConfigField('authToken') || '');
 
   // Separate token for gateway WS auth (falls back to _AUTH_TOKEN for direct mode)
   const _GATEWAY_TOKEN = config.gatewayToken !== undefined
@@ -3178,7 +3232,7 @@ export function createApp(config = {}) {
     const remaining = syncThreadUnreadCount(db, threadId);
     const workspace = _getWorkspaces().active;
     _gatewayClient.broadcastToBrowsers(JSON.stringify({
-      type: 'shellchat', event: 'unread-update', workspace, threadId,
+      type: 'clawchats', event: 'unread-update', workspace, threadId,
       action: 'read', messageIds, unreadCount: remaining, timestamp: Date.now()
     }));
     send(res, 200, { unread_count: remaining });
@@ -3567,7 +3621,14 @@ export function createApp(config = {}) {
       try { msg = JSON.parse(data); } catch { console.error('Invalid JSON from gateway:', data); return; }
       if (msg.type === 'event' && msg.event === 'connect.challenge') {
         console.log('Received connect.challenge, sending auth...');
-        this.ws.send(JSON.stringify({ type: 'req', id: 'gw-connect-1', method: 'connect', params: { minProtocol: 3, maxProtocol: 3, client: { id: 'gateway-client', version: '0.1.0', platform: 'node', mode: 'backend' }, role: 'operator', scopes: ['operator.read', 'operator.write', 'operator.admin'], auth: { token: _GATEWAY_TOKEN }, caps: ['tool-events'] } }));
+        const _nonce = msg.payload?.nonce || '';
+        const _identityPath = path.join(_DATA_DIR, 'device-identity.json');
+        const _identity = _loadOrCreateDeviceIdentity(_identityPath);
+        const _device = _buildDeviceAuth(_identity, {
+          clientId: 'gateway-client', clientMode: 'backend', role: 'operator',
+          scopes: ['operator.read', 'operator.write', 'operator.admin'], token: _GATEWAY_TOKEN, nonce: _nonce
+        });
+        this.ws.send(JSON.stringify({ type: 'req', id: 'gw-connect-1', method: 'connect', params: { minProtocol: 3, maxProtocol: 3, client: { id: 'gateway-client', version: '0.1.0', platform: 'node', mode: 'backend' }, role: 'operator', scopes: ['operator.read', 'operator.write', 'operator.admin'], device: _device, auth: { token: _GATEWAY_TOKEN }, caps: ['tool-events'] } }));
         return;
       }
       if (msg.type === 'res' && msg.payload?.type === 'hello-ok') { console.log('Gateway handshake complete'); this.connected = true; this.broadcastGatewayStatus(true); }
@@ -3618,9 +3679,9 @@ export function createApp(config = {}) {
         const threadInfo = db.prepare('SELECT title FROM threads WHERE id = ?').get(parsed.threadId);
         const unreadCount = db.prepare('SELECT COUNT(*) as c FROM unread_messages WHERE thread_id = ?').get(parsed.threadId).c;
         const preview = content.length > 120 ? content.substring(0, 120) + '...' : content;
-        this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'message-saved', threadId: parsed.threadId, workspace: parsed.workspace, messageId, timestamp: now, title: threadInfo?.title || 'Chat', preview, unreadCount }));
+        this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'message-saved', threadId: parsed.threadId, workspace: parsed.workspace, messageId, timestamp: now, title: threadInfo?.title || 'Chat', preview, unreadCount }));
         const workspaceUnreadTotal = db.prepare('SELECT COALESCE(SUM(unread_count), 0) as total FROM threads').get().total;
-        this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'unread-update', workspace: parsed.workspace, threadId: parsed.threadId, messageId, action: 'new', unreadCount, workspaceUnreadTotal, title: threadInfo?.title || 'Chat', preview, timestamp: now }));
+        this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'unread-update', workspace: parsed.workspace, threadId: parsed.threadId, messageId, action: 'new', unreadCount, workspaceUnreadTotal, title: threadInfo?.title || 'Chat', preview, timestamp: now }));
         console.log(`Saved assistant message to ${parsed.workspace}/${parsed.threadId} (seq: ${seq})`);
       } catch (e) { console.error(`Failed to save assistant message:`, e.message); }
     }
@@ -3698,7 +3759,7 @@ export function createApp(config = {}) {
     broadcastActivityUpdate(runId, log) {
       const parsed = log.sessionKey ? parseSessionKey(log.sessionKey) : null;
       if (!parsed) return;
-      this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'agent-activity', workspace: parsed.workspace, threadId: parsed.threadId, runId, steps: log.steps, summary: this.generateActivitySummary(log.steps) }));
+      this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'agent-activity', workspace: parsed.workspace, threadId: parsed.threadId, runId, steps: log.steps, summary: this.generateActivitySummary(log.steps) }));
     }
 
     finalizeActivityLog(runId, log) {
@@ -3763,7 +3824,7 @@ export function createApp(config = {}) {
               metadata.activitySummary = this.generateActivitySummary(log.steps);
               db.prepare('UPDATE messages SET metadata = ? WHERE id = ?').run(JSON.stringify(metadata), msg.id);
               console.log(`[ActivityLog] Saved ${toolSteps.length} tool steps for message ${msg.id}`);
-              this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'activity-saved', workspace: parsed.workspace, threadId: parsed.threadId, messageId: msg.id }));
+              this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'activity-saved', workspace: parsed.workspace, threadId: parsed.threadId, messageId: msg.id }));
             }
           }
         } catch (e) { console.error('Failed to save activity log:', e.message); }
@@ -3803,7 +3864,7 @@ export function createApp(config = {}) {
     }
 
     broadcastGatewayStatus(connected) {
-      this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'gateway-status', connected }));
+      this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'gateway-status', connected }));
     }
 
     sendToGateway(data) {
@@ -3822,12 +3883,12 @@ export function createApp(config = {}) {
     addBrowserClient(ws) {
       this.browserClients.set(ws, { activeWorkspace: null, activeThreadId: null });
       if (ws.readyState === WS.OPEN) {
-        ws.send(JSON.stringify({ type: 'shellchat', event: 'gateway-status', connected: this.connected }));
+        ws.send(JSON.stringify({ type: 'clawchats', event: 'gateway-status', connected: this.connected }));
         const streams = [];
         for (const [sessionKey, state] of this.streamState.entries()) {
           if (state.state === 'streaming') streams.push({ sessionKey, threadId: state.threadId, buffer: state.buffer });
         }
-        if (streams.length > 0) ws.send(JSON.stringify({ type: 'shellchat', event: 'stream-sync', streams }));
+        if (streams.length > 0) ws.send(JSON.stringify({ type: 'clawchats', event: 'stream-sync', streams }));
       }
     }
 
@@ -3847,7 +3908,7 @@ export function createApp(config = {}) {
           if (deleted.changes > 0) {
             syncThreadUnreadCount(db, threadId);
             const workspaceUnreadTotal = db.prepare('SELECT COALESCE(SUM(unread_count), 0) as total FROM threads').get().total;
-            this.broadcastToBrowsers(JSON.stringify({ type: 'shellchat', event: 'unread-update', workspace, threadId, action: 'clear', unreadCount: 0, workspaceUnreadTotal, timestamp: Date.now() }));
+            this.broadcastToBrowsers(JSON.stringify({ type: 'clawchats', event: 'unread-update', workspace, threadId, action: 'clear', unreadCount: 0, workspaceUnreadTotal, timestamp: Date.now() }));
           }
         } catch (e) { console.error('Failed to auto-clear unreads on active-thread:', e.message); }
       }
@@ -3963,7 +4024,7 @@ export function createApp(config = {}) {
             const token = msg.params?.auth?.token;
             if (token === _AUTH_TOKEN || !_AUTH_TOKEN) {
               console.log('Browser client authenticated');
-              ws.send(JSON.stringify({ type: 'res', id: msg.id, ok: true, payload: { type: 'hello-ok', protocol: 3, server: { version: '0.1.0', host: 'shellchat-backend' } } }));
+              ws.send(JSON.stringify({ type: 'res', id: msg.id, ok: true, payload: { type: 'hello-ok', protocol: 3, server: { version: '0.1.0', host: 'clawchats-backend' } } }));
             } else {
               console.log('Browser client auth failed');
               ws.send(JSON.stringify({ type: 'res', id: msg.id, ok: false, error: { code: 'AUTH_FAILED', message: 'Invalid auth token' } }));
@@ -3971,12 +4032,12 @@ export function createApp(config = {}) {
             }
             return;
           }
-          if (msg.type === 'shellchat') {
+          if (msg.type === 'clawchats' || msg.type === 'shellchat') { // backward compat: accept legacy 'shellchat' type
             if (msg.action === 'active-thread') { _gatewayClient.setActiveThread(ws, msg.workspace, msg.threadId); console.log(`Browser client set active thread: ${msg.workspace}/${msg.threadId}`); return; }
-            if (msg.action === 'debug-start') { const result = _debugLogger.start(msg.ts, ws); if (result.error === 'already-active') ws.send(JSON.stringify({ type: 'shellchat', event: 'debug-error', error: 'Recording already active in another tab', sessionId: result.sessionId })); else ws.send(JSON.stringify({ type: 'shellchat', event: 'debug-started', sessionId: result.sessionId })); return; }
-            if (msg.action === 'debug-dump') { const { sessionId, files } = _debugLogger.saveDump(msg); ws.send(JSON.stringify({ type: 'shellchat', event: 'debug-saved', sessionId, files })); return; }
+            if (msg.action === 'debug-start') { const result = _debugLogger.start(msg.ts, ws); if (result.error === 'already-active') ws.send(JSON.stringify({ type: 'clawchats', event: 'debug-error', error: 'Recording already active in another tab', sessionId: result.sessionId })); else ws.send(JSON.stringify({ type: 'clawchats', event: 'debug-started', sessionId: result.sessionId })); return; }
+            if (msg.action === 'debug-dump') { const { sessionId, files } = _debugLogger.saveDump(msg); ws.send(JSON.stringify({ type: 'clawchats', event: 'debug-saved', sessionId, files })); return; }
           }
-        } catch { /* Not JSON or not a ShellChat message, forward to gateway */ }
+        } catch { /* Not JSON or not a ClawChats message, forward to gateway */ }
         _gatewayClient.sendToGateway(msgStr);
       });
 
@@ -4025,7 +4086,7 @@ if (isDirectRun) {
   });
 
   server.listen(PORT, () => {
-    console.log(`ShellChat backend listening on port ${PORT}`);
+    console.log(`ClawChats backend listening on port ${PORT}`);
     console.log(`Active workspace: ${app.getWorkspaces().active}`);
     console.log(`Data dir: ${app.dataDir}`);