@clawos-dev/clawd 0.1.2 → 0.2.1

package/dist/cli.cjs

@@ -293,8 +293,8 @@ var require_req = __commonJS({
       if (req.originalUrl) {
         _req.url = req.originalUrl;
       } else {
-        const path12 = req.path;
-        _req.url = typeof path12 === "string" ? path12 : req.url ? req.url.path || req.url : void 0;
+        const path16 = req.path;
+        _req.url = typeof path16 === "string" ? path16 : req.url ? req.url.path || req.url : void 0;
       }
       if (req.query) {
         _req.query = req.query;
@@ -459,14 +459,14 @@ var require_redact = __commonJS({
       }
       return obj;
     }
-    function parsePath(path12) {
+    function parsePath(path16) {
       const parts = [];
       let current = "";
       let inBrackets = false;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path12.length; i++) {
-        const char = path12[i];
+      for (let i = 0; i < path16.length; i++) {
+        const char = path16[i];
         if (!inBrackets && char === ".") {
           if (current) {
             parts.push(current);
@@ -597,10 +597,10 @@ var require_redact = __commonJS({
       return current;
     }
     function redactPaths(obj, paths, censor, remove = false) {
-      for (const path12 of paths) {
-        const parts = parsePath(path12);
+      for (const path16 of paths) {
+        const parts = parsePath(path16);
         if (parts.includes("*")) {
-          redactWildcardPath(obj, parts, censor, path12, remove);
+          redactWildcardPath(obj, parts, censor, path16, remove);
         } else {
           if (remove) {
             removeKey(obj, parts);
@@ -685,8 +685,8 @@ var require_redact = __commonJS({
           }
         } else {
           if (afterWildcard.includes("*")) {
-            const wrappedCensor = typeof censor === "function" ? (value, path12) => {
-              const fullPath = [...pathArray.slice(0, pathLength), ...path12];
+            const wrappedCensor = typeof censor === "function" ? (value, path16) => {
+              const fullPath = [...pathArray.slice(0, pathLength), ...path16];
               return censor(value, fullPath);
             } : censor;
             redactWildcardPath(current, afterWildcard, wrappedCensor, originalPath, remove);
@@ -721,8 +721,8 @@ var require_redact = __commonJS({
         return null;
       }
       const pathStructure = /* @__PURE__ */ new Map();
-      for (const path12 of pathsToClone) {
-        const parts = parsePath(path12);
+      for (const path16 of pathsToClone) {
+        const parts = parsePath(path16);
         let current = pathStructure;
         for (let i = 0; i < parts.length; i++) {
           const part = parts[i];
@@ -774,24 +774,24 @@ var require_redact = __commonJS({
       }
       return cloneSelectively(obj, pathStructure);
     }
-    function validatePath(path12) {
-      if (typeof path12 !== "string") {
+    function validatePath(path16) {
+      if (typeof path16 !== "string") {
         throw new Error("Paths must be (non-empty) strings");
       }
-      if (path12 === "") {
+      if (path16 === "") {
         throw new Error("Invalid redaction path ()");
       }
-      if (path12.includes("..")) {
-        throw new Error(`Invalid redaction path (${path12})`);
+      if (path16.includes("..")) {
+        throw new Error(`Invalid redaction path (${path16})`);
       }
-      if (path12.includes(",")) {
-        throw new Error(`Invalid redaction path (${path12})`);
+      if (path16.includes(",")) {
+        throw new Error(`Invalid redaction path (${path16})`);
       }
       let bracketCount = 0;
       let inQuotes = false;
       let quoteChar = "";
-      for (let i = 0; i < path12.length; i++) {
-        const char = path12[i];
+      for (let i = 0; i < path16.length; i++) {
+        const char = path16[i];
         if ((char === '"' || char === "'") && bracketCount > 0) {
           if (!inQuotes) {
             inQuotes = true;
@@ -805,20 +805,20 @@ var require_redact = __commonJS({
         } else if (char === "]" && !inQuotes) {
           bracketCount--;
           if (bracketCount < 0) {
-            throw new Error(`Invalid redaction path (${path12})`);
+            throw new Error(`Invalid redaction path (${path16})`);
           }
         }
       }
       if (bracketCount !== 0) {
-        throw new Error(`Invalid redaction path (${path12})`);
+        throw new Error(`Invalid redaction path (${path16})`);
       }
     }
     function validatePaths(paths) {
       if (!Array.isArray(paths)) {
         throw new TypeError("paths must be an array");
       }
-      for (const path12 of paths) {
-        validatePath(path12);
+      for (const path16 of paths) {
+        validatePath(path16);
       }
     }
     function slowRedact(options = {}) {
@@ -986,8 +986,8 @@ var require_redaction = __commonJS({
         if (shape[k] === null) {
           o[k] = (value) => topCensor(value, [k]);
         } else {
-          const wrappedCensor = typeof censor === "function" ? (value, path12) => {
-            return censor(value, [k, ...path12]);
+          const wrappedCensor = typeof censor === "function" ? (value, path16) => {
+            return censor(value, [k, ...path16]);
           } : censor;
           o[k] = Redact({
             paths: shape[k],
@@ -1205,10 +1205,10 @@ var require_atomic_sleep = __commonJS({
 var require_sonic_boom = __commonJS({
   "../node_modules/.pnpm/sonic-boom@4.2.1/node_modules/sonic-boom/index.js"(exports2, module2) {
     "use strict";
-    var fs12 = require("fs");
+    var fs16 = require("fs");
     var EventEmitter = require("events");
     var inherits = require("util").inherits;
-    var path12 = require("path");
+    var path16 = require("path");
     var sleep = require_atomic_sleep();
     var assert = require("assert");
     var BUSY_WRITE_TIMEOUT = 100;
@@ -1262,20 +1262,20 @@ var require_sonic_boom = __commonJS({
       const mode = sonic.mode;
       if (sonic.sync) {
         try {
-          if (sonic.mkdir) fs12.mkdirSync(path12.dirname(file), { recursive: true });
-          const fd = fs12.openSync(file, flags, mode);
+          if (sonic.mkdir) fs16.mkdirSync(path16.dirname(file), { recursive: true });
+          const fd = fs16.openSync(file, flags, mode);
           fileOpened(null, fd);
         } catch (err) {
           fileOpened(err);
           throw err;
         }
       } else if (sonic.mkdir) {
-        fs12.mkdir(path12.dirname(file), { recursive: true }, (err) => {
+        fs16.mkdir(path16.dirname(file), { recursive: true }, (err) => {
           if (err) return fileOpened(err);
-          fs12.open(file, flags, mode, fileOpened);
+          fs16.open(file, flags, mode, fileOpened);
         });
       } else {
-        fs12.open(file, flags, mode, fileOpened);
+        fs16.open(file, flags, mode, fileOpened);
       }
     }
     function SonicBoom(opts) {
@@ -1316,8 +1316,8 @@ var require_sonic_boom = __commonJS({
         this.flush = flushBuffer;
         this.flushSync = flushBufferSync;
         this._actualWrite = actualWriteBuffer;
-        fsWriteSync = () => fs12.writeSync(this.fd, this._writingBuf);
-        fsWrite = () => fs12.write(this.fd, this._writingBuf, this.release);
+        fsWriteSync = () => fs16.writeSync(this.fd, this._writingBuf);
+        fsWrite = () => fs16.write(this.fd, this._writingBuf, this.release);
       } else if (contentMode === void 0 || contentMode === kContentModeUtf8) {
         this._writingBuf = "";
         this.write = write;
@@ -1326,15 +1326,15 @@ var require_sonic_boom = __commonJS({
         this._actualWrite = actualWrite;
         fsWriteSync = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs12.writeSync(this.fd, this._writingBuf);
+            return fs16.writeSync(this.fd, this._writingBuf);
           }
-          return fs12.writeSync(this.fd, this._writingBuf, "utf8");
+          return fs16.writeSync(this.fd, this._writingBuf, "utf8");
         };
         fsWrite = () => {
           if (Buffer.isBuffer(this._writingBuf)) {
-            return fs12.write(this.fd, this._writingBuf, this.release);
+            return fs16.write(this.fd, this._writingBuf, this.release);
           }
-          return fs12.write(this.fd, this._writingBuf, "utf8", this.release);
+          return fs16.write(this.fd, this._writingBuf, "utf8", this.release);
         };
       } else {
         throw new Error(`SonicBoom supports "${kContentModeUtf8}" and "${kContentModeBuffer}", but passed ${contentMode}`);
@@ -1391,7 +1391,7 @@ var require_sonic_boom = __commonJS({
           }
         }
         if (this._fsync) {
-          fs12.fsyncSync(this.fd);
+          fs16.fsyncSync(this.fd);
         }
         const len = this._len;
         if (this._reopening) {
@@ -1505,7 +1505,7 @@ var require_sonic_boom = __commonJS({
       const onDrain = () => {
         if (!this._fsync) {
           try {
-            fs12.fsync(this.fd, (err) => {
+            fs16.fsync(this.fd, (err) => {
               this._flushPending = false;
               cb(err);
             });
@@ -1607,7 +1607,7 @@ var require_sonic_boom = __commonJS({
       const fd = this.fd;
       this.once("ready", () => {
         if (fd !== this.fd) {
-          fs12.close(fd, (err) => {
+          fs16.close(fd, (err) => {
             if (err) {
               return this.emit("error", err);
             }
@@ -1656,7 +1656,7 @@ var require_sonic_boom = __commonJS({
           buf = this._bufs[0];
         }
         try {
-          const n = Buffer.isBuffer(buf) ? fs12.writeSync(this.fd, buf) : fs12.writeSync(this.fd, buf, "utf8");
+          const n = Buffer.isBuffer(buf) ? fs16.writeSync(this.fd, buf) : fs16.writeSync(this.fd, buf, "utf8");
           const releasedBufObj = releaseWritingBuf(buf, this._len, n);
           buf = releasedBufObj.writingBuf;
           this._len = releasedBufObj.len;
@@ -1672,7 +1672,7 @@ var require_sonic_boom = __commonJS({
         }
       }
       try {
-        fs12.fsyncSync(this.fd);
+        fs16.fsyncSync(this.fd);
       } catch {
       }
     }
@@ -1693,7 +1693,7 @@ var require_sonic_boom = __commonJS({
           buf = mergeBuf(this._bufs[0], this._lens[0]);
         }
         try {
-          const n = fs12.writeSync(this.fd, buf);
+          const n = fs16.writeSync(this.fd, buf);
           buf = buf.subarray(n);
           this._len = Math.max(this._len - n, 0);
           if (buf.length <= 0) {
@@ -1721,13 +1721,13 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : this._bufs.shift() || "";
       if (this.sync) {
         try {
-          const written = Buffer.isBuffer(this._writingBuf) ? fs12.writeSync(this.fd, this._writingBuf) : fs12.writeSync(this.fd, this._writingBuf, "utf8");
+          const written = Buffer.isBuffer(this._writingBuf) ? fs16.writeSync(this.fd, this._writingBuf) : fs16.writeSync(this.fd, this._writingBuf, "utf8");
           release(null, written);
         } catch (err) {
           release(err);
         }
       } else {
-        fs12.write(this.fd, this._writingBuf, release);
+        fs16.write(this.fd, this._writingBuf, release);
       }
     }
     function actualWriteBuffer() {
@@ -1736,7 +1736,7 @@ var require_sonic_boom = __commonJS({
       this._writingBuf = this._writingBuf.length ? this._writingBuf : mergeBuf(this._bufs.shift(), this._lens.shift());
       if (this.sync) {
         try {
-          const written = fs12.writeSync(this.fd, this._writingBuf);
+          const written = fs16.writeSync(this.fd, this._writingBuf);
           release(null, written);
         } catch (err) {
           release(err);
@@ -1745,7 +1745,7 @@ var require_sonic_boom = __commonJS({
         if (kCopyBuffer) {
           this._writingBuf = Buffer.from(this._writingBuf);
         }
-        fs12.write(this.fd, this._writingBuf, release);
+        fs16.write(this.fd, this._writingBuf, release);
       }
     }
     function actualClose(sonic) {
@@ -1761,12 +1761,12 @@ var require_sonic_boom = __commonJS({
       sonic._lens = [];
       assert(typeof sonic.fd === "number", `sonic.fd must be a number, got ${typeof sonic.fd}`);
       try {
-        fs12.fsync(sonic.fd, closeWrapped);
+        fs16.fsync(sonic.fd, closeWrapped);
       } catch {
       }
       function closeWrapped() {
         if (sonic.fd !== 1 && sonic.fd !== 2) {
-          fs12.close(sonic.fd, done);
+          fs16.close(sonic.fd, done);
         } else {
           done();
         }
@@ -2497,7 +2497,7 @@ var require_transport = __commonJS({
       stream.flushSync();
     }
     function transport(fullOptions) {
-      const { pipeline, targets, levels, dedupe, worker = {}, caller = getCallers(), sync = false } = fullOptions;
+      const { pipeline: pipeline2, targets, levels, dedupe, worker = {}, caller = getCallers(), sync = false } = fullOptions;
       const options = {
         ...fullOptions.options
       };
@@ -2525,9 +2525,9 @@ var require_transport = __commonJS({
             };
           });
         });
-      } else if (pipeline) {
+      } else if (pipeline2) {
         target = bundlerOverrides["pino-worker"] || join2(__dirname, "worker.js");
-        options.pipelines = [pipeline.map((dest) => {
+        options.pipelines = [pipeline2.map((dest) => {
           return {
             ...dest,
             target: fixTarget(dest.target)
@@ -4130,7 +4130,7 @@ var require_multistream = __commonJS({
 var require_pino = __commonJS({
   "../node_modules/.pnpm/pino@9.14.0/node_modules/pino/pino.js"(exports2, module2) {
     "use strict";
-    var os9 = require("os");
+    var os11 = require("os");
     var stdSerializers = require_pino_std_serializers();
     var caller = require_caller();
     var redaction = require_redaction();
@@ -4177,7 +4177,7 @@ var require_pino = __commonJS({
     } = symbols;
     var { epochTime, nullTime } = time;
     var { pid } = process;
-    var hostname = os9.hostname();
+    var hostname = os11.hostname();
     var defaultErrorSerializer = stdSerializers.err;
     var defaultOptions = {
       level: "info",
@@ -6540,7 +6540,7 @@ var require_websocket = __commonJS({
     var net = require("net");
     var tls = require("tls");
     var { randomBytes, createHash } = require("crypto");
-    var { Duplex, Readable } = require("stream");
+    var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
     var Receiver2 = require_receiver();
@@ -7958,6 +7958,7 @@ var import_node_os = __toESM(require("os"), 1);
 var import_node_path = __toESM(require("path"), 1);
 var DEFAULT_PORT = 18790;
 var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_CLAWOS_API = "https://api.clawos.chat";
 function parseArgs(argv) {
   const out = {};
   for (let i = 0; i < argv.length; i++) {
@@ -7986,8 +7987,14 @@ function parseArgs(argv) {
         out.logLevel = v;
         break;
       }
-      case "--server-url":
-        out.serverUrl = next();
+      case "--tunnel":
+        out.tunnel = true;
+        break;
+      case "--clawos-api":
+        out.clawosApi = next();
+        break;
+      case "--auth-token":
+        out.authToken = next();
         break;
       case "--help":
       case "-h":
@@ -8029,14 +8036,26 @@ function resolveConfig(opts) {
   const port = args.port ?? (typeof fileCfg.port === "number" ? fileCfg.port : DEFAULT_PORT);
   const host = typeof fileCfg.host === "string" && fileCfg.host || DEFAULT_HOST;
   const logLevel = args.logLevel ?? fileCfg.logLevel ?? "info";
-  const serverUrl = args.serverUrl ?? (typeof fileCfg.serverUrl === "string" ? fileCfg.serverUrl : null);
+  const env = opts.env;
+  const fileTunnel = fileCfg.tunnel === true;
+  const fileClawosApi = typeof fileCfg.clawosApi === "string" ? fileCfg.clawosApi : null;
+  const fileAuthToken = typeof fileCfg.authToken === "string" ? fileCfg.authToken : null;
+  const tunnel = args.tunnel === true || fileTunnel || env.CLAWD_TUNNEL === "1";
+  const clawosApi = args.clawosApi ?? env.CLAWOS_API ?? fileClawosApi ?? (tunnel ? DEFAULT_CLAWOS_API : null);
+  const authToken = args.authToken ?? env.CLAWD_AUTH_TOKEN ?? fileAuthToken;
+  const noTunnelPersist = env.CLAWD_NO_TUNNEL_PERSIST === "1" || env.NODE_ENV === "development";
+  const frpcBinary = env.CLAWD_FRPC_BIN ?? null;
   return {
     port,
     host,
     dataDir,
     configPath: args.config ? configPath : import_node_fs.default.existsSync(configPath) ? configPath : null,
     logLevel,
-    serverUrl
+    tunnel,
+    clawosApi,
+    authToken,
+    noTunnelPersist,
+    frpcBinary
   };
 }
 var HELP_TEXT = `clawd [options]
@@ -8044,14 +8063,20 @@ var HELP_TEXT = `clawd [options]
   --data-dir <path>       \u6570\u636E\u76EE\u5F55\uFF0C\u9ED8\u8BA4 ~/.clawd
   --config <path>         \u914D\u7F6E\u6587\u4EF6\uFF0C\u9ED8\u8BA4 <data-dir>/config.json
   --log-level <level>     debug / info / warn / error\uFF08\u9ED8\u8BA4 info\uFF09
-  --server-url <url>      \u53CD\u8FDE\u8FDC\u7AEF WS server\uFF08v2 \u9884\u7559\uFF09
+  --tunnel                \u542F\u7528 frp tunnel \u628A\u672C\u5730\u7AEF\u53E3\u66B4\u9732\u5230\u516C\u7F51
+  --clawos-api <url>      tunnel register \u63A5\u53E3\u7684 base url\uFF08\u9ED8\u8BA4 https://api.clawos.chat\uFF09
+  --auth-token <s>        \u6307\u5B9A daemon auth token\uFF1B\u7F3A\u7701\u65F6 tunnel \u6A21\u5F0F\u4ECE ~/.clawd/auth.json \u590D\u7528\uFF0C\u6CA1\u6709\u5C31\u751F\u6210
   --help / -h             \u663E\u793A\u5E2E\u52A9
   --version / -v          \u663E\u793A\u7248\u672C
+
+Env (advanced):
+  CLAWD_FRPC_BIN          \u81EA\u5E26 frpc \u4E8C\u8FDB\u5236\u8DEF\u5F84\uFF08\u9ED8\u8BA4\u6309\u9700\u4E0B\u8F7D\u5230 ~/.clawd/bin/frpc\uFF09
+  CLAWD_NO_TUNNEL_PERSIST \u542F\u52A8\u65F6\u4E0D\u590D\u7528 ~/.clawd/tunnel.json\uFF08dev only\uFF1BNODE_ENV=development \u81EA\u52A8\u5F00\u542F\uFF09
 `;
 
 // src/index.ts
-var import_node_os8 = __toESM(require("os"), 1);
-var import_node_path11 = __toESM(require("path"), 1);
+var import_node_os10 = __toESM(require("os"), 1);
+var import_node_path15 = __toESM(require("path"), 1);
 
 // src/logger.ts
 var import_node_fs2 = __toESM(require("fs"), 1);
@@ -8642,8 +8667,8 @@ function getErrorMap() {
 
 // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path12, errorMaps, issueData } = params;
-  const fullPath = [...path12, ...issueData.path || []];
+  const { data, path: path16, errorMaps, issueData } = params;
+  const fullPath = [...path16, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -8759,11 +8784,11 @@ var errorUtil;
 
 // ../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path12, key) {
+  constructor(parent, value, path16, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path12;
+    this._path = path16;
     this._key = key;
   }
   get path() {
@@ -12591,6 +12616,22 @@ var RecentDirEntrySchema = external_exports.object({
 var HistoryRecentDirsResponseSchema = external_exports.object({
   dirs: external_exports.array(RecentDirEntrySchema)
 });
+var AuthRequestFrameSchema = external_exports.object({
+  type: external_exports.literal("auth"),
+  token: external_exports.string().min(1),
+  scheme: external_exports.literal("bearer").optional()
+});
+var AuthOkFrameSchema = external_exports.object({
+  type: external_exports.literal("auth:ok"),
+  version: external_exports.string().min(1).optional(),
+  protocolVersion: external_exports.number().int().nonnegative().optional()
+});
+var TunnelExitedEventSchema = external_exports.object({
+  type: external_exports.literal("tunnel:exited"),
+  code: external_exports.number().int().nullable(),
+  subdomain: external_exports.string().nullable(),
+  url: external_exports.string().nullable()
+});
 
 // ../protocol/src/frames.ts
 var PROTOCOL_VERSION = 1;
@@ -14005,11 +14046,11 @@ Diff.prototype = {
       }
     }
   },
-  addToPath: function addToPath(path12, added, removed, oldPosInc, options) {
-    var last = path12.lastComponent;
+  addToPath: function addToPath(path16, added, removed, oldPosInc, options) {
+    var last = path16.lastComponent;
     if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) {
       return {
-        oldPos: path12.oldPos + oldPosInc,
+        oldPos: path16.oldPos + oldPosInc,
         lastComponent: {
           count: last.count + 1,
           added,
@@ -14019,7 +14060,7 @@ Diff.prototype = {
       };
     } else {
       return {
-        oldPos: path12.oldPos + oldPosInc,
+        oldPos: path16.oldPos + oldPosInc,
         lastComponent: {
           count: 1,
           added,
@@ -14862,10 +14903,10 @@ function attachmentToHistoryMessage(o, ts) {
     const memories = raw.map((m) => {
       if (!m || typeof m !== "object") return null;
       const rec = m;
-      const path12 = typeof rec.path === "string" ? rec.path : null;
+      const path16 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path12 || content == null) return null;
-      const entry = { path: path12, content };
+      if (!path16 || content == null) return null;
+      const entry = { path: path16, content };
       if (typeof rec.mtimeMs === "number") entry.mtimeMs = rec.mtimeMs;
       return entry;
     }).filter((m) => m !== null);
@@ -15601,10 +15642,10 @@ function parseAttachment(obj) {
     const memories = raw.map((m) => {
       if (!m || typeof m !== "object") return null;
       const rec = m;
-      const path12 = typeof rec.path === "string" ? rec.path : null;
+      const path16 = typeof rec.path === "string" ? rec.path : null;
       const content = typeof rec.content === "string" ? rec.content : null;
-      if (!path12 || content == null) return null;
-      const out = { path: path12, content };
+      if (!path16 || content == null) return null;
+      const out = { path: path16, content };
       if (typeof rec.mtimeMs === "number") out.mtimeMs = rec.mtimeMs;
       return out;
     }).filter((m) => m !== null);
@@ -16217,7 +16258,7 @@ var LocalWsServer = class {
         this.logger?.error("ws server error", { err: err.message });
         reject(err);
       });
-      wss.on("connection", (socket) => this.onConnection(socket));
+      wss.on("connection", (socket, req) => this.onConnection(socket, req?.socket?.remoteAddress));
       this.wss = wss;
     });
   }
@@ -16246,13 +16287,37 @@ var LocalWsServer = class {
       }
     }
   }
+  // 广播给所有已连接客户端（无视 session 订阅）。
+  // 用于 daemon 级事件，例如 tunnel:exited。未通过 auth 的连接被自动跳过。
+  broadcastAll(frame) {
+    const gate = this.opts.authGate;
+    for (const c of this.clients.values()) {
+      if (gate && !gate.isAuthed(c.handle.id)) continue;
+      this.safeSend(c.ws, frame);
+    }
+  }
   firstSubscriber(sessionId) {
     for (const c of this.clients.values()) {
       if (c.handle.subscribedSessions.has(sessionId)) return c.handle;
     }
     return null;
   }
-  onConnection(socket) {
+  // AuthGate 用：按 client id 关闭连接（替代之前的反射访问）
+  closeClient(clientId, code, reason) {
+    const c = this.clients.get(clientId);
+    if (!c) return;
+    try {
+      c.ws.close(code, reason);
+    } catch {
+    }
+  }
+  // AuthGate 用：按 client id 发送一帧（auth:ok 等）
+  sendToClient(clientId, frame) {
+    const c = this.clients.get(clientId);
+    if (!c) return;
+    this.safeSend(c.ws, frame);
+  }
+  onConnection(socket, remoteAddress) {
     const id = v4_default();
     const subscribedSessions = /* @__PURE__ */ new Set();
     const handle = {
@@ -16268,27 +16333,38 @@ var LocalWsServer = class {
       }
     }, this.pingIntervalMs);
     this.clients.set(id, { handle, ws: socket, pingTimer });
-    this.logger?.info("client connected", { clientId: id, total: this.clients.size });
+    this.logger?.info("client connected", { clientId: id, total: this.clients.size, remoteAddress });
+    const authGate = this.opts.authGate;
+    let authed = true;
+    if (authGate) {
+      const authHandle = { id, remoteAddress };
+      authed = authGate.registerConnection(authHandle);
+    }
     try {
-      const readyFrame = this.opts.readyFrameBuilder();
-      this.safeSend(socket, { type: "ready", ...readyFrame });
+      if (authed) {
+        const readyFrame = this.opts.readyFrameBuilder();
+        this.safeSend(socket, { type: "ready", ...readyFrame });
+      } else {
+        this.safeSend(socket, { type: "ready", protocolVersion: this.opts.protocolVersion });
+      }
     } catch (err) {
       this.logger?.warn("ready frame build failed", { err: err.message });
     }
     socket.on("message", (data) => {
-      this.onMessage(handle, data);
+      this.onMessage(handle, data, remoteAddress);
     });
     socket.on("close", () => {
       const c = this.clients.get(id);
       if (c?.pingTimer) clearInterval(c.pingTimer);
       this.clients.delete(id);
+      authGate?.unregister(id);
       this.logger?.info("client disconnected", { clientId: id, remaining: this.clients.size });
     });
     socket.on("error", (err) => {
       this.logger?.warn("client socket error", { clientId: id, err: err.message });
     });
   }
-  onMessage(client, data) {
+  onMessage(client, data, remoteAddress) {
     let frame;
     try {
       frame = JSON.parse(data.toString());
@@ -16296,6 +16372,22 @@ var LocalWsServer = class {
       this.safeSend(this.clients.get(client.id).ws, { type: "error", code: "VALIDATION_ERROR", message: "invalid json" });
       return;
     }
+    const authGate = this.opts.authGate;
+    if (authGate) {
+      const wasAuthed = authGate.isAuthed(client.id);
+      const verdict = authGate.handleFrame({ id: client.id, remoteAddress }, frame);
+      if (verdict !== "pass") {
+        if (!wasAuthed && authGate.isAuthed(client.id)) {
+          try {
+            const full = this.opts.readyFrameBuilder();
+            this.safeSend(this.clients.get(client.id).ws, { type: "ready", ...full });
+          } catch (err) {
+            this.logger?.warn("post-auth ready frame build failed", { err: err.message });
+          }
+        }
+        return;
+      }
+    }
     if (frame.type === "ping") {
       this.safeSend(this.clients.get(client.id).ws, { type: "pong", at: Date.now() });
       return;
@@ -16340,6 +16432,99 @@ var LocalWsServer = class {
   }
 };
 
+// src/transport/auth.ts
+var AuthGate = class {
+  states = /* @__PURE__ */ new Map();
+  opts;
+  constructor(opts) {
+    this.opts = { ...opts, timeoutMs: opts.timeoutMs ?? 5e3 };
+  }
+  // 新连接接入；返回 isAuthed（豁免时直接 true）
+  registerConnection(handle) {
+    const enforce = this.opts.shouldEnforce(handle.remoteAddress);
+    if (!enforce) {
+      this.states.set(handle.id, { authed: true, enforce: false, timer: null });
+      return true;
+    }
+    const setT = this.opts.setTimer ?? ((cb, ms) => setTimeout(cb, ms));
+    const timer = setT(() => {
+      const st = this.states.get(handle.id);
+      if (!st || st.authed) return;
+      this.opts.closeConnection(handle, 1008, "auth timeout");
+    }, this.opts.timeoutMs);
+    this.states.set(handle.id, { authed: false, enforce: true, timer });
+    return false;
+  }
+  unregister(handleId) {
+    const st = this.states.get(handleId);
+    if (st?.timer != null) {
+      const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
+      clear(st.timer);
+    }
+    this.states.delete(handleId);
+  }
+  isAuthed(handleId) {
+    return this.states.get(handleId)?.authed ?? false;
+  }
+  // 收到一帧时调；返回 'consumed' / 'reject' / 'pass'
+  // - consumed：这一帧是 auth 帧（成功或失败），调用方不要再走业务路由
+  // - reject：未通过 auth 但帧不是 auth 帧，调用方应放弃此帧（gate 已关连接）
+  // - pass：已 authed，调用方继续走业务路由
+  handleFrame(handle, frame) {
+    const st = this.states.get(handle.id);
+    if (!st) return "reject";
+    if (st.authed) return "pass";
+    const parsed = AuthRequestFrameSchema.safeParse(frame);
+    if (!parsed.success) {
+      const reason = frame.type === "auth" ? "auth failed" : "auth required";
+      this.opts.closeConnection(handle, 1008, reason);
+      this.markFailed(handle.id);
+      return frame.type === "auth" ? "consumed" : "reject";
+    }
+    if (!this.opts.expectedToken) {
+      this.opts.closeConnection(handle, 1008, "auth not configured");
+      this.markFailed(handle.id);
+      return "consumed";
+    }
+    if (!constantTimeEqual(parsed.data.token, this.opts.expectedToken)) {
+      this.opts.closeConnection(handle, 1008, "auth failed");
+      this.markFailed(handle.id);
+      return "consumed";
+    }
+    if (st.timer != null) {
+      const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
+      clear(st.timer);
+    }
+    st.authed = true;
+    st.timer = null;
+    this.opts.sendOk(handle, { type: "auth:ok" });
+    return "consumed";
+  }
+  markFailed(handleId) {
+    const st = this.states.get(handleId);
+    if (!st) return;
+    if (st.timer != null) {
+      const clear = this.opts.clearTimer ?? ((h) => clearTimeout(h));
+      clear(st.timer);
+    }
+    st.timer = null;
+  }
+};
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff2 = 0;
+  for (let i = 0; i < a.length; i++) diff2 |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff2 === 0;
+}
+function buildShouldEnforce(opts) {
+  if (opts.tunnel) return () => true;
+  return (addr) => !isLocalhost(addr);
+}
+function isLocalhost(addr) {
+  if (!addr) return false;
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+
 // src/discovery/state-file.ts
 var import_node_fs10 = __toESM(require("fs"), 1);
 var import_node_path9 = __toESM(require("path"), 1);
@@ -16399,17 +16584,532 @@ var StateFileManager = class {
   }
 };
 
-// src/workspace/git.ts
-var import_node_child_process3 = require("child_process");
+// src/tunnel/tunnel-manager.ts
+var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
+var import_node_child_process4 = require("child_process");
+
+// src/tunnel/tunnel-store.ts
 var import_node_fs11 = __toESM(require("fs"), 1);
-var import_node_os7 = __toESM(require("os"), 1);
 var import_node_path10 = __toESM(require("path"), 1);
+var TunnelStore = class {
+  constructor(filePath) {
+    this.filePath = filePath;
+  }
+  filePath;
+  async get() {
+    try {
+      const raw = await import_node_fs11.default.promises.readFile(this.filePath, "utf8");
+      const obj = JSON.parse(raw);
+      if (!isPersistedTunnel(obj)) return null;
+      return obj;
+    } catch (err) {
+      const code = err?.code;
+      if (code === "ENOENT") return null;
+      return null;
+    }
+  }
+  async set(v) {
+    const dir = import_node_path10.default.dirname(this.filePath);
+    await import_node_fs11.default.promises.mkdir(dir, { recursive: true });
+    const data = JSON.stringify(v, null, 2);
+    const tmp = `${this.filePath}.tmp.${process.pid}.${Date.now()}`;
+    await import_node_fs11.default.promises.writeFile(tmp, data, { mode: 384 });
+    if (process.platform !== "win32") {
+      try {
+        await import_node_fs11.default.promises.chmod(tmp, 384);
+      } catch {
+      }
+    }
+    await import_node_fs11.default.promises.rename(tmp, this.filePath);
+  }
+  async clear() {
+    try {
+      await import_node_fs11.default.promises.unlink(this.filePath);
+    } catch (err) {
+      const code = err?.code;
+      if (code !== "ENOENT") throw err;
+    }
+  }
+};
+function isPersistedTunnel(o) {
+  if (!o || typeof o !== "object") return false;
+  const r = o;
+  return typeof r.subdomain === "string" && typeof r.frpsHost === "string" && typeof r.frpsPort === "number" && typeof r.frpsToken === "string" && typeof r.url === "string" && typeof r.registeredAt === "string";
+}
+
+// src/tunnel/register-client.ts
+var TunnelRegisterError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "TunnelRegisterError";
+  }
+  cause;
+};
+async function registerTunnel(opts) {
+  const f = opts.fetchImpl ?? globalThis.fetch;
+  if (!f) throw new TunnelRegisterError("fetch is not available (Node >= 18 required)");
+  const url = `${opts.api.replace(/\/+$/, "")}/api/tunnel/register`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
+  let res;
+  try {
+    res = await f(url, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ gatewayCount: 1, deviceKeys: [opts.deviceKey] }),
+      signal: ctrl.signal
+    });
+  } catch (err) {
+    clearTimeout(timer);
+    throw new TunnelRegisterError(`tunnel register network error: ${err.message}`, err);
+  }
+  clearTimeout(timer);
+  if (!res.ok) {
+    let bodyText = "";
+    try {
+      bodyText = (await res.text()).slice(0, 200);
+    } catch {
+    }
+    throw new TunnelRegisterError(`tunnel register failed: HTTP ${res.status} ${bodyText}`);
+  }
+  let payload;
+  try {
+    payload = await res.json();
+  } catch (err) {
+    throw new TunnelRegisterError(`tunnel register: invalid json response`, err);
+  }
+  const tunnels = payload.tunnels;
+  if (!Array.isArray(tunnels) || tunnels.length === 0) {
+    throw new TunnelRegisterError(`tunnel register: missing tunnels in response`);
+  }
+  const t = tunnels[0];
+  if (typeof t.subdomain !== "string" || typeof t.url !== "string" || typeof t.frpsHost !== "string" || typeof t.frpsPort !== "number" || typeof t.token !== "string") {
+    throw new TunnelRegisterError(`tunnel register: malformed tunnel entry`);
+  }
+  return {
+    subdomain: t.subdomain,
+    url: t.url,
+    frpsHost: t.frpsHost,
+    frpsPort: t.frpsPort,
+    frpsToken: t.token
+  };
+}
+
+// src/tunnel/frpc-config.ts
+function buildFrpcToml(input) {
+  const localIP = input.localIP ?? "127.0.0.1";
+  const lines = [];
+  lines.push(`serverAddr = "${escape(input.serverAddr)}"`);
+  lines.push(`serverPort = ${input.serverPort}`);
+  lines.push(`auth.method = "token"`);
+  lines.push(`auth.token = "${escape(input.authToken)}"`);
+  lines.push(`log.level = "${input.logLevel ?? "info"}"`);
+  lines.push("");
+  lines.push("[[proxies]]");
+  lines.push(`name = "${escape(input.proxyName)}"`);
+  lines.push('type = "http"');
+  lines.push(`localIP = "${escape(localIP)}"`);
+  lines.push(`localPort = ${input.localPort}`);
+  lines.push(`subdomain = "${escape(input.subdomain)}"`);
+  return lines.join("\n") + "\n";
+}
+function escape(v) {
+  return v.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+
+// src/tunnel/frpc-binary.ts
+var import_node_fs12 = __toESM(require("fs"), 1);
+var import_node_os7 = __toESM(require("os"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
+var import_node_child_process3 = require("child_process");
+var import_node_stream = require("stream");
+var import_promises = require("stream/promises");
+var FRPC_VERSION = "0.68.0";
+var UnsupportedPlatformError = class extends Error {
+  constructor(platform, arch) {
+    super(`unsupported frpc platform: ${platform}/${arch}`);
+    this.platform = platform;
+    this.arch = arch;
+  }
+  platform;
+  arch;
+};
+function detectPlatform(opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  const arch = opts.arch ?? process.arch;
+  let oss;
+  if (platform === "darwin") oss = "darwin";
+  else if (platform === "linux") oss = "linux";
+  else throw new UnsupportedPlatformError(platform, arch);
+  let a;
+  if (arch === "arm64" || arch === "aarch64") a = "arm64";
+  else if (arch === "x64" || arch === "amd64") a = "amd64";
+  else throw new UnsupportedPlatformError(platform, arch);
+  return { os: oss, arch: a };
+}
+function frpcDownloadUrl(version2, p) {
+  return `https://github.com/fatedier/frp/releases/download/v${version2}/frp_${version2}_${p.os}_${p.arch}.tar.gz`;
+}
+async function ensureFrpcBinary(opts) {
+  if (opts.override) {
+    if (!import_node_fs12.default.existsSync(opts.override)) {
+      throw new Error(`frpc binary not found at override path: ${opts.override}`);
+    }
+    return opts.override;
+  }
+  const version2 = opts.version ?? FRPC_VERSION;
+  const platform = opts.platform ?? detectPlatform();
+  const binDir = import_node_path11.default.join(opts.dataDir, "bin");
+  import_node_fs12.default.mkdirSync(binDir, { recursive: true });
+  cleanupStaleArtifacts(binDir);
+  const stableBin = import_node_path11.default.join(binDir, "frpc");
+  if (import_node_fs12.default.existsSync(stableBin)) return stableBin;
+  const partialBin = `${stableBin}.partial`;
+  const tarballPath = import_node_path11.default.join(binDir, `frp_${version2}_${platform.os}_${platform.arch}.tar.gz.partial`);
+  try {
+    const url = frpcDownloadUrl(version2, platform);
+    await downloadToFile(url, tarballPath, opts.fetchImpl);
+    if (opts.installFromTarball) {
+      await opts.installFromTarball(tarballPath, partialBin);
+    } else {
+      await extractFrpcFromTarball(tarballPath, binDir, version2, platform, partialBin);
+    }
+    import_node_fs12.default.chmodSync(partialBin, 493);
+    import_node_fs12.default.renameSync(partialBin, stableBin);
+  } finally {
+    safeUnlink(tarballPath);
+    safeUnlink(partialBin);
+  }
+  return stableBin;
+}
+function cleanupStaleArtifacts(binDir) {
+  let entries;
+  try {
+    entries = import_node_fs12.default.readdirSync(binDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (name.endsWith(".partial") || name.startsWith("extract-")) {
+      const full = import_node_path11.default.join(binDir, name);
+      try {
+        import_node_fs12.default.rmSync(full, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+function safeUnlink(p) {
+  try {
+    import_node_fs12.default.unlinkSync(p);
+  } catch {
+  }
+}
+async function downloadToFile(url, dest, fetchImpl) {
+  const f = fetchImpl ?? globalThis.fetch;
+  if (!f) throw new Error("fetch is not available (Node >= 18 required)");
+  const res = await f(url, { redirect: "follow" });
+  if (!res.ok || !res.body) {
+    throw new Error(`download failed: ${res.status} ${res.statusText}`);
+  }
+  const out = import_node_fs12.default.createWriteStream(dest);
+  const nodeStream = import_node_stream.Readable.fromWeb(res.body);
+  await (0, import_promises.pipeline)(nodeStream, out);
+}
+async function extractFrpcFromTarball(tarball, binDir, version2, platform, destBin) {
+  const work = import_node_path11.default.join(binDir, `extract-${process.pid}-${Date.now()}`);
+  import_node_fs12.default.mkdirSync(work, { recursive: true });
+  try {
+    await new Promise((resolve, reject) => {
+      const proc = (0, import_node_child_process3.spawn)("tar", ["xzf", tarball, "-C", work], { stdio: "pipe" });
+      proc.on("error", reject);
+      proc.on("exit", (code) => code === 0 ? resolve() : reject(new Error(`tar exited ${code}`)));
+    });
+    const dirName = `frp_${version2}_${platform.os}_${platform.arch}`;
+    const src = import_node_path11.default.join(work, dirName, "frpc");
+    if (!import_node_fs12.default.existsSync(src)) {
+      throw new Error(`frpc not found inside tarball at ${src}`);
+    }
+    import_node_fs12.default.copyFileSync(src, destBin);
+  } finally {
+    import_node_fs12.default.rmSync(work, { recursive: true, force: true });
+  }
+}
+
+// src/tunnel/tunnel-manager.ts
+var DEFAULT_TUNNEL_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var TunnelManager = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.store = deps.store ?? new TunnelStore(import_node_path12.default.join(deps.dataDir, "tunnel.json"));
+    this.ttlMs = deps.ttlMs ?? DEFAULT_TUNNEL_TTL_MS;
+    this.startupTimeoutMs = deps.startupTimeoutMs ?? 15e3;
+  }
+  deps;
+  proc = null;
+  current = null;
+  store;
+  ttlMs;
+  startupTimeoutMs;
+  exitHookInstalled = false;
+  // 标记是否在主动 stop 中：true 时不要把 frpc 退出 emit 成 onFrpcExit
+  stopping = false;
+  get url() {
+    return this.current?.url ?? null;
+  }
+  async start(opts) {
+    const { logger } = this.deps;
+    if (!this.deps.noPersist) {
+      const cached = await this.store.get();
+      if (cached && this.isFresh(cached)) {
+        logger?.info("tunnel: trying cached credentials", { subdomain: cached.subdomain });
+        const r2 = await this.tryStart(cached, opts.localPort);
+        if (r2.ok) {
+          this.proc = r2.proc;
+          this.current = cached;
+          this.installProcessExitHandlers();
+          this.attachExitListener(r2.proc);
+          return { url: cached.url, subdomain: cached.subdomain };
+        }
+        logger?.warn("tunnel: cached credentials failed, re-registering", { err: r2.error.message });
+      }
+    }
+    const reg = await (this.deps.registerImpl ?? registerTunnel)({
+      api: this.deps.clawosApi,
+      deviceKey: this.deps.deviceKey
+    });
+    const persisted = {
+      subdomain: reg.subdomain,
+      frpsHost: reg.frpsHost,
+      frpsPort: reg.frpsPort,
+      frpsToken: reg.frpsToken,
+      url: reg.url,
+      registeredAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await this.store.set(persisted);
+    const r = await this.tryStart(persisted, opts.localPort);
+    if (!r.ok) throw r.error;
+    this.proc = r.proc;
+    this.current = persisted;
+    this.installProcessExitHandlers();
+    this.attachExitListener(r.proc);
+    return { url: persisted.url, subdomain: persisted.subdomain };
+  }
+  async stop() {
+    this.stopping = true;
+    const proc = this.proc;
+    this.proc = null;
+    if (!proc) return;
+    proc.kill("SIGTERM");
+    await new Promise((resolve) => {
+      const t = setTimeout(() => {
+        try {
+          proc.kill("SIGKILL");
+        } catch {
+        }
+        resolve();
+      }, 5e3);
+      proc.once("exit", () => {
+        clearTimeout(t);
+        resolve();
+      });
+    });
+  }
+  // 同步杀子进程：父进程崩溃 / SIGHUP / process.exit 路径下使用，
+  // async stop() 跑不完时的兜底，避免留下孤儿 frpc。
+  killSync() {
+    const proc = this.proc;
+    this.proc = null;
+    if (!proc) return;
+    try {
+      proc.kill("SIGTERM");
+    } catch {
+    }
+  }
+  isFresh(t) {
+    const age = Date.now() - new Date(t.registeredAt).getTime();
+    return Number.isFinite(age) && age < this.ttlMs;
+  }
+  attachExitListener(proc) {
+    proc.on("exit", (code) => {
+      this.deps.logger?.warn("frpc exited", { code });
+      if (this.stopping) return;
+      const cur = this.current;
+      this.proc = null;
+      this.deps.onFrpcExit?.({
+        code,
+        subdomain: cur?.subdomain ?? null,
+        url: cur?.url ?? null
+      });
+    });
+  }
+  installProcessExitHandlers() {
+    if (this.exitHookInstalled) return;
+    if (this.deps.installProcessExitHandlers !== true) return;
+    this.exitHookInstalled = true;
+    const sync = () => this.killSync();
+    process.once("exit", sync);
+    process.once("SIGHUP", sync);
+    process.once("uncaughtException", sync);
+  }
+  async tryStart(t, localPort) {
+    try {
+      const frpcBin = await (this.deps.ensureFrpcImpl ?? ensureFrpcBinary)({
+        dataDir: this.deps.dataDir,
+        override: this.deps.frpcBinaryOverride ?? void 0
+      });
+      const tomlPath = import_node_path12.default.join(this.deps.dataDir, "frpc.toml");
+      const toml = buildFrpcToml({
+        serverAddr: t.frpsHost,
+        serverPort: t.frpsPort,
+        authToken: t.frpsToken,
+        proxyName: "clawd",
+        subdomain: t.subdomain,
+        localPort,
+        logLevel: "info"
+      });
+      await import_node_fs13.default.promises.writeFile(tomlPath, toml, { mode: 384 });
+      const proc = (this.deps.spawnImpl ?? import_node_child_process4.spawn)(frpcBin, ["-c", tomlPath], {
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const logFilePath = import_node_path12.default.join(this.deps.dataDir, "frpc.log");
+      const logStream = import_node_fs13.default.createWriteStream(logFilePath, { flags: "a", mode: 384 });
+      logStream.on("error", () => {
+      });
+      const tee = (chunk) => {
+        logStream.write(String(chunk));
+      };
+      proc.stdout?.on("data", tee);
+      proc.stderr?.on("data", tee);
+      proc.once("exit", () => {
+        logStream.end();
+      });
+      const ready = await waitForFrpcReady(proc, this.startupTimeoutMs);
+      if (!ready.ok) {
+        try {
+          proc.kill("SIGTERM");
+        } catch {
+        }
+        return { ok: false, error: new Error(ready.error) };
+      }
+      this.deps.logger?.info("tunnel: frpc up", { subdomain: t.subdomain, url: t.url });
+      return { ok: true, proc };
+    } catch (err) {
+      if (err instanceof TunnelRegisterError) throw err;
+      return { ok: false, error: err };
+    }
+  }
+};
+async function waitForFrpcReady(proc, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let buf = "";
+    const finish = (r) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(r);
+    };
+    const onData = (chunk) => {
+      buf += String(chunk);
+      if (/start proxy success/.test(buf) || /\[clawd\] success/.test(buf)) {
+        finish({ ok: true });
+      }
+      if (/login to server failed|authentication failed/i.test(buf)) {
+        finish({ ok: false, error: `frpc handshake failed: ${buf.trim().slice(-200)}` });
+      }
+    };
+    const onExit = (code) => {
+      finish({ ok: false, error: `frpc exited before ready (code=${code})` });
+    };
+    const onErr = (err) => finish({ ok: false, error: `frpc spawn error: ${err.message}` });
+    const cleanup = () => {
+      proc.stdout?.off("data", onData);
+      proc.stderr?.off("data", onData);
+      proc.off("exit", onExit);
+      proc.off("error", onErr);
+      clearTimeout(timer);
+    };
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    proc.on("exit", onExit);
+    proc.on("error", onErr);
+    const timer = setTimeout(() => {
+      finish({ ok: false, error: `frpc startup timeout after ${timeoutMs}ms` });
+    }, timeoutMs);
+  });
+}
+
+// src/tunnel/device-key.ts
+var import_node_os8 = __toESM(require("os"), 1);
+var import_node_crypto3 = __toESM(require("crypto"), 1);
+var DERIVE_SALT = "clawd-tunnel-device-v1";
+function deriveStableDeviceKey(opts = {}) {
+  const hostname = opts.hostname ?? import_node_os8.default.hostname();
+  const uid = opts.uid ?? (typeof import_node_os8.default.userInfo === "function" ? import_node_os8.default.userInfo().uid : 0);
+  const input = `${hostname}::${uid}`;
+  return import_node_crypto3.default.createHmac("sha256", DERIVE_SALT).update(input).digest("hex").slice(0, 32);
+}
+
+// src/auth-store.ts
+var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
+var import_node_crypto4 = __toESM(require("crypto"), 1);
+var AUTH_FILE_NAME = "auth.json";
+function authFilePath(dataDir) {
+  return import_node_path13.default.join(dataDir, AUTH_FILE_NAME);
+}
+function loadOrCreateAuthToken(opts) {
+  const file = authFilePath(opts.dataDir);
+  const existing = readAuthFile(file);
+  if (existing && existing.token) return existing.token;
+  const token = (opts.generate ?? defaultGenerate)();
+  const now = (opts.now ?? (() => /* @__PURE__ */ new Date()))();
+  writeAuthFile(file, { token, createdAt: now.toISOString() });
+  return token;
+}
+function defaultGenerate() {
+  return import_node_crypto4.default.randomBytes(32).toString("base64url");
+}
+function readAuthFile(file) {
+  try {
+    const raw = import_node_fs14.default.readFileSync(file, "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.token === "string" && parsed.token.length > 0) {
+      return {
+        token: parsed.token,
+        createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : (/* @__PURE__ */ new Date(0)).toISOString()
+      };
+    }
+    return null;
+  } catch (err) {
+    const code = err?.code;
+    if (code === "ENOENT") return null;
+    return null;
+  }
+}
+function writeAuthFile(file, content) {
+  import_node_fs14.default.mkdirSync(import_node_path13.default.dirname(file), { recursive: true });
+  import_node_fs14.default.writeFileSync(file, JSON.stringify(content, null, 2), { mode: 384 });
+  try {
+    import_node_fs14.default.chmodSync(file, 384);
+  } catch {
+  }
+}
+
+// src/workspace/git.ts
+var import_node_child_process5 = require("child_process");
+var import_node_fs15 = __toESM(require("fs"), 1);
+var import_node_os9 = __toESM(require("os"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
 var import_node_util = require("util");
-var pexec = (0, import_node_util.promisify)(import_node_child_process3.execFile);
+var pexec = (0, import_node_util.promisify)(import_node_child_process5.execFile);
 function normalizePath(p) {
-  const resolved = import_node_path10.default.resolve(p);
+  const resolved = import_node_path14.default.resolve(p);
   try {
-    return import_node_fs11.default.realpathSync(resolved);
+    return import_node_fs15.default.realpathSync(resolved);
   } catch {
     return resolved;
   }
@@ -16496,7 +17196,7 @@ function sanitizeLabel(raw) {
 function computePrefix() {
   let username;
   try {
-    username = import_node_os7.default.userInfo().username;
+    username = import_node_os9.default.userInfo().username;
   } catch {
     username = void 0;
   }
@@ -16510,13 +17210,13 @@ function flattenToDirName(branch) {
 }
 function encodeClaudeProjectDir(absPath) {
   if (!absPath || typeof absPath !== "string") return "";
-  let canonical = import_node_path10.default.resolve(absPath);
+  let canonical = import_node_path14.default.resolve(absPath);
   try {
-    canonical = import_node_fs11.default.realpathSync(canonical);
+    canonical = import_node_fs15.default.realpathSync(canonical);
   } catch {
     try {
-      const parent = import_node_fs11.default.realpathSync(import_node_path10.default.dirname(canonical));
-      canonical = import_node_path10.default.join(parent, import_node_path10.default.basename(canonical));
+      const parent = import_node_fs15.default.realpathSync(import_node_path14.default.dirname(canonical));
+      canonical = import_node_path14.default.join(parent, import_node_path14.default.basename(canonical));
     } catch {
     }
   }
@@ -16540,11 +17240,11 @@ async function createWorktree(input) {
   if (!isGitRoot) {
     throw new Error(`\u76EE\u5F55 ${cwd} \u4E0D\u662F git repo \u6839`);
   }
-  const parent = import_node_path10.default.dirname(import_node_path10.default.resolve(cwd));
-  if (parent === "/" || parent === import_node_path10.default.resolve(cwd)) {
+  const parent = import_node_path14.default.dirname(import_node_path14.default.resolve(cwd));
+  if (parent === "/" || parent === import_node_path14.default.resolve(cwd)) {
     throw new Error("repo \u5728\u78C1\u76D8\u6839\u76EE\u5F55\uFF0C\u65E0\u6CD5\u5728\u540C\u7EA7\u521B\u5EFA worktree");
   }
-  const worktreeRoot = import_node_path10.default.join(parent, dirName);
+  const worktreeRoot = import_node_path14.default.join(parent, dirName);
   try {
     await pexec("git", ["-C", cwd, "rev-parse", "--verify", `refs/heads/${baseBranch}`], {
       timeout: 3e3
@@ -16561,7 +17261,7 @@ async function createWorktree(input) {
     const msg = err.message;
     if (msg.startsWith("\u5206\u652F ")) throw err;
   }
-  if (import_node_fs11.default.existsSync(worktreeRoot)) {
+  if (import_node_fs15.default.existsSync(worktreeRoot)) {
     throw new Error(`\u76EE\u5F55 ${worktreeRoot} \u5DF2\u5B58\u5728\uFF0C\u8BF7\u6362\u4E00\u4E2A label \u6216\u6E05\u7406\u540E\u91CD\u8BD5`);
   }
   try {
@@ -16591,8 +17291,8 @@ async function removeWorktree(input) {
     );
     const gitCommonDir = stdout.trim();
     if (!gitCommonDir) throw new Error("empty git-common-dir");
-    const absGitCommon = import_node_path10.default.isAbsolute(gitCommonDir) ? gitCommonDir : import_node_path10.default.resolve(worktreeRoot, gitCommonDir);
-    repoRoot = import_node_path10.default.dirname(absGitCommon);
+    const absGitCommon = import_node_path14.default.isAbsolute(gitCommonDir) ? gitCommonDir : import_node_path14.default.resolve(worktreeRoot, gitCommonDir);
+    repoRoot = import_node_path14.default.dirname(absGitCommon);
   } catch {
     repoRoot = null;
   }
@@ -16604,7 +17304,7 @@ async function removeWorktree(input) {
     } catch (err) {
       const stderr = err.stderr || err.message;
       const lower = stderr.toLowerCase();
-      const vanished = lower.includes("not a working tree") || lower.includes("is not a working tree") || !import_node_fs11.default.existsSync(worktreeRoot);
+      const vanished = lower.includes("not a working tree") || lower.includes("is not a working tree") || !import_node_fs15.default.existsSync(worktreeRoot);
       if (!vanished) {
         const firstLine = stderr.split("\n")[0].trim();
         throw new Error(`\u6E05\u7406 worktree \u5931\u8D25\uFF1A${firstLine}`);
@@ -16625,10 +17325,10 @@ async function removeWorktree(input) {
   try {
     const encoded = encodeClaudeProjectDir(worktreeRoot);
     if (encoded) {
-      const projectsRoot = import_node_path10.default.join(import_node_os7.default.homedir(), ".claude", "projects");
-      const target = import_node_path10.default.resolve(projectsRoot, encoded);
-      if (target.startsWith(projectsRoot + import_node_path10.default.sep) && target !== projectsRoot) {
-        import_node_fs11.default.rmSync(target, { recursive: true, force: true });
+      const projectsRoot = import_node_path14.default.join(import_node_os9.default.homedir(), ".claude", "projects");
+      const target = import_node_path14.default.resolve(projectsRoot, encoded);
+      if (target.startsWith(projectsRoot + import_node_path14.default.sep) && target !== projectsRoot) {
+        import_node_fs15.default.rmSync(target, { recursive: true, force: true });
       }
     }
   } catch {
@@ -16650,13 +17350,13 @@ function listRecentDirs(store, limit = 50) {
 }
 
 // src/version.ts
-var version = "0.1.2";
+var version = "0.2.1";
 
 // src/index.ts
 async function startDaemon(config) {
   const logger = createLogger({
     level: config.logLevel,
-    file: import_node_path11.default.join(config.dataDir, "clawd.log")
+    file: import_node_path15.default.join(config.dataDir, "clawd.log")
   });
   logger.info("starting clawd", { version, config: { port: config.port, host: config.host, dataDir: config.dataDir } });
   const stateMgr = new StateFileManager({ dataDir: config.dataDir });
@@ -16667,9 +17367,20 @@ async function startDaemon(config) {
   if (pre.status === "stale") {
     logger.warn("stale state file detected, overwriting", { pid: pre.existing.pid });
   }
-  if (config.serverUrl) {
-    throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, "remote server transport not implemented yet");
-  }
+  let resolvedAuthToken = null;
+  if (config.authToken && config.authToken.trim()) {
+    resolvedAuthToken = config.authToken.trim();
+  } else if (config.tunnel) {
+    resolvedAuthToken = loadOrCreateAuthToken({ dataDir: config.dataDir });
+  }
+  const authMode = resolvedAuthToken == null ? "none" : "first-message";
+  let wsServer = null;
+  const authGate = authMode === "first-message" ? new AuthGate({
+    shouldEnforce: buildShouldEnforce({ tunnel: config.tunnel }),
+    expectedToken: resolvedAuthToken,
+    closeConnection: (h, code, reason) => wsServer?.closeClient(h.id, code, reason),
+    sendOk: (h, payload) => wsServer?.sendToClient(h.id, payload)
+  }) : null;
   resetRegistry();
   registerAdapter(
     "claude",
@@ -16703,14 +17414,17 @@ async function startDaemon(config) {
     onStatus: (sessionId, status) => transport?.broadcastToSession(sessionId, { type: "session:status", sessionId, status })
   });
   const handlers = buildMethodHandlers({ manager, workspace, skills, history, observer, getAdapter, store });
-  const wsServer = new LocalWsServer({
+  wsServer = new LocalWsServer({
     host: config.host,
     port: config.port,
     logger,
-    readyFrameBuilder: () => buildReadyFrame({ manager, getAdapter })
+    readyFrameBuilder: () => buildReadyFrame({ manager, getAdapter }),
+    protocolVersion: PROTOCOL_VERSION,
+    authGate: authGate ?? void 0
   });
   transport = wsServer;
-  wsServer.onFrame(async (client, frame) => {
+  const wss = wsServer;
+  wss.onFrame(async (client, frame) => {
     const type = frame.type;
     if (!METHOD_NAMES.includes(type)) {
       throw new ClawdError(ERROR_CODES.METHOD_NOT_ALLOWED, `unknown method: ${type}`);
@@ -16734,27 +17448,79 @@ async function startDaemon(config) {
       }
     }
   });
-  await wsServer.start();
+  await wss.start();
   const url = `ws://${config.host}:${config.port}`;
-  const state = {
+  let stateSnapshot = {
     pid: process.pid,
     transport: "local-ws",
     url,
     version,
     protocolVersion: PROTOCOL_VERSION,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    authMode,
+    authToken: resolvedAuthToken ?? void 0
   };
-  stateMgr.write(state);
+  stateMgr.write(stateSnapshot);
   process.stdout.write(`Ready: ${url}
 `);
+  if (authMode === "first-message" && resolvedAuthToken) {
+    process.stdout.write(`Auth Token: ${resolvedAuthToken}
+`);
+  }
+  let tunnelMgr = null;
+  if (config.tunnel) {
+    if (!config.clawosApi) {
+      throw new ClawdError(ERROR_CODES.INTERNAL, "--tunnel requires --clawos-api");
+    }
+    tunnelMgr = new TunnelManager({
+      dataDir: config.dataDir,
+      clawosApi: config.clawosApi,
+      deviceKey: deriveStableDeviceKey(),
+      frpcBinaryOverride: config.frpcBinary,
+      noPersist: config.noTunnelPersist,
+      logger,
+      installProcessExitHandlers: true,
+      onFrpcExit: (info) => {
+        wss.broadcastAll({ type: "tunnel:exited", code: info.code, subdomain: info.subdomain, url: info.url });
+      }
+    });
+    try {
+      const r = await tunnelMgr.start({ localPort: config.port });
+      stateSnapshot = { ...stateSnapshot, tunnelUrl: r.url };
+      stateMgr.write(stateSnapshot);
+      process.stdout.write(`Tunnel: ${r.url}
+`);
+      if (resolvedAuthToken) {
+        process.stdout.write(`Connect: ${r.url}#token=${resolvedAuthToken}
+`);
+      }
+    } catch (err) {
+      try {
+        await tunnelMgr.stop();
+      } catch {
+      }
+      tunnelMgr = null;
+      stateMgr.delete();
+      await wss.stop();
+      throw err;
+    }
+  }
   const shutdown = async () => {
     logger.info("stopping clawd");
     observer.stopAll();
     manager.stopAll();
-    await wsServer.stop();
+    if (tunnelMgr) {
+      await tunnelMgr.stop();
+    }
+    await wss.stop();
     stateMgr.delete();
   };
-  return { stop: shutdown, url };
+  return {
+    stop: shutdown,
+    url,
+    tunnelUrl: stateSnapshot.tunnelUrl ?? null,
+    authToken: resolvedAuthToken
+  };
 }
 function buildMethodHandlers(deps) {
   const { manager, workspace, skills, history, observer, getAdapter: getAdapter2, store } = deps;
@@ -16975,7 +17741,7 @@ function buildReadyFrame(deps) {
   return {
     version,
     protocolVersion: PROTOCOL_VERSION,
-    hostname: import_node_os8.default.hostname(),
+    hostname: import_node_os10.default.hostname(),
     os: process.platform,
     tools,
     runningSessions: info.runningSessions
@@ -16997,7 +17763,10 @@ async function main() {
   }
   const config = resolveConfig({ argv, env: process.env });
   const runtime = await startDaemon(config);
+  let shuttingDown = false;
   const shutdown = async (signal) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
     try {
       console.error(`[clawd] received ${signal}, shutting down`);
       await runtime.stop();