@matelink/cli 2026.4.7

package/bin/matecli.mjs

@@ -0,0 +1,3093 @@
+#!/usr/bin/env node
+
+import {
+  randomBytes,
+  randomUUID,
+  generateKeyPairSync,
+  createPrivateKey,
+  createPublicKey,
+  createHash,
+  sign,
+} from "node:crypto";
+import { spawn, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+
+const NUMERIC_CODE_LENGTH = 4;
+const GROUP_SIZE = 4;
+const DEFAULT_RELAY_WORKER_WAIT_SECONDS = 600;
+const DEFAULT_RELAY_URL = "http://43.134.64.199:8090";
+const DEFAULT_GATEWAY_HOST = "127.0.0.1";
+const DEFAULT_WEBHOOK_PATH = "/testnextim/webhook";
+const DEFAULT_BIND_PATH = "/testnextim/bind";
+const GATEWAY_RPC_CLI_TIMEOUT_MS = 20000;
+const CLI_PACKAGE_NAME = "@matelink/cli";
+const CLI_COMMAND_NAME = "matecli";
+// Relay worker defaults to full operator scope so gateway HTTP routes and RPC-adjacent
+// compatibility endpoints remain available without per-method scope juggling.
+const DEFAULT_GATEWAY_SCOPES = "operator.admin";
+const CLI_ENTRY = fileURLToPath(import.meta.url);
+
+function printHelp() {
+  console.log(
+    [
+      `${CLI_COMMAND_NAME} CLI`,
+      "",
+      "Usage:",
+      `  ${CLI_COMMAND_NAME} setup [--relay <url>] [--public-base <url>] [--mode <relay>] [--account <id>] [--restart|--no-restart] [--json]`,
+      `  ${CLI_COMMAND_NAME} pair <1234|123456|XXXX-XXXX> [--mode <relay>]`,
+      `  ${CLI_COMMAND_NAME} reset [--relay <url>] [--gateway <url>] [--json]`,
+      `  ${CLI_COMMAND_NAME} bridge [--relay <url>] [--gateway <url>] [--json] (Deprecated)`,
+      `  ${CLI_COMMAND_NAME} pair-url [<1234|123456|XXXX-XXXX>] [--account <id>] [--code <1234|123456|XXXX-XXXX>] [--json]`,
+      `  ${CLI_COMMAND_NAME} status [--json]`,
+      "",
+      `Package: ${CLI_PACKAGE_NAME}`,
+      "",
+      "Environment:",
+      "  OPENCLAW_HOME   Override OpenClaw home directory (default: ~/.openclaw)",
+      "  OPENIM_RELAY_URL / OPENIM_RELAY_TOKEN",
+      `  TESTNEXTIM_RELAY_URL   Override relay base URL (default: ${DEFAULT_RELAY_URL})`,
+      "  TESTNEXTIM_RELAY_TOKEN Bearer token used for pair publish/bind endpoints",
+      "  OPENCLAW_TESTNEXTIM_GATEWAY_BASE_URL  Local gateway base (overrides openclaw.json gateway.port)",
+      "  OPENCLAW_GATEWAY_PORT / OPENCLAW_GATEWAY_HOST Optional explicit local gateway host/port override",
+      "",
+      "Tip:",
+      "  pair command will auto-start relay bridge worker in detached mode.",
+      "  Use --no-serve-relay if you do not want auto bridge worker.",
+    ].join("\n"),
+  );
+}
+
+function fail(message, code = 1) {
+  console.error(`${CLI_COMMAND_NAME}: ${message}`);
+  process.exit(code);
+}
+
+function parseArgs(argv) {
+  const args = [...argv];
+  const command = args.shift() ?? "help";
+  const options = {
+    account: undefined,
+    json: false,
+    relay: undefined,
+    noRelay: false,
+    code: undefined,
+    gateway: undefined,
+    publicBase: undefined,
+    restart: true,
+    waitBind: false,
+    waitSeconds: DEFAULT_RELAY_WORKER_WAIT_SECONDS,
+    serveRelay: true,
+    mode: undefined,
+  };
+
+  while (args.length > 0) {
+    const token = args.shift();
+    if (!token) break;
+
+    if (token === "--json") {
+      options.json = true;
+      continue;
+    }
+    if (token === "--no-relay") {
+      options.noRelay = true;
+      continue;
+    }
+    if (token === "--wait-bind") {
+      options.waitBind = true;
+      continue;
+    }
+    if (token === "--no-wait-bind") {
+      options.waitBind = false;
+      continue;
+    }
+    if (token === "--serve-relay") {
+      options.serveRelay = true;
+      continue;
+    }
+    if (token === "--no-serve-relay") {
+      options.serveRelay = false;
+      continue;
+    }
+
+    if (token === "--relay") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --relay");
+      options.relay = value.trim();
+      continue;
+    }
+    if (token === "--gateway") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --gateway");
+      options.gateway = value.trim();
+      continue;
+    }
+    if (token === "--public-base") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --public-base");
+      options.publicBase = value.trim();
+      continue;
+    }
+    if (token === "--wait-seconds") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --wait-seconds");
+      const parsed = Number.parseInt(value.trim(), 10);
+      if (!Number.isFinite(parsed) || parsed < 0) fail("--wait-seconds must be >= 0");
+      options.waitSeconds = Math.min(parsed, 3600);
+      continue;
+    }
+    if (token === "--restart") {
+      options.restart = true;
+      continue;
+    }
+    if (token === "--no-restart") {
+      options.restart = false;
+      continue;
+    }
+    if (token === "--account") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --account");
+      options.account = value.trim();
+      continue;
+    }
+    if (token === "--mode") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --mode");
+      const normalizedMode = normalizeChatTransportMode(value.trim(), "__invalid__");
+      if (normalizedMode !== "relay") {
+        fail("--mode must be relay");
+      }
+      options.mode = normalizedMode;
+      continue;
+    }
+    if (token === "--code") {
+      const value = args.shift();
+      if (!value || value.startsWith("--")) fail("missing value for --code");
+      options.code = value.trim();
+      continue;
+    }
+
+    if (token === "-h" || token === "--help" || token === "help") {
+      return { command: "help", options };
+    }
+    if (token.startsWith("--")) {
+      fail(`unknown option: ${token}`);
+    }
+
+    if (command === "pair" || command === "pair-url") {
+      if (!options.code) {
+        options.code = token.trim();
+        continue;
+      }
+      if (!options.account) {
+        options.account = token.trim();
+        continue;
+      }
+      fail(`unexpected argument: ${token}`);
+    }
+
+    fail(`unknown option: ${token}`);
+  }
+
+  return { command, options };
+}
+
+function resolveOpenClawHome() {
+  return process.env.OPENCLAW_HOME?.trim() || path.join(os.homedir(), ".openclaw");
+}
+
+function resolveOpenClawConfigPath() {
+  return path.join(resolveOpenClawHome(), "openclaw.json");
+}
+
+function resolveTestNextIMStatePath() {
+  return path.join(resolveOpenClawHome(), "testnextim.state.json");
+}
+
+function resolveBridgeLockPath({ relayUrl, gatewayId, gatewayBaseUrl }) {
+  const digest = createHash("sha256")
+    .update(
+      [
+        String(relayUrl ?? "").trim(),
+        String(gatewayId ?? "").trim(),
+        String(gatewayBaseUrl ?? "").trim(),
+      ].join("|"),
+    )
+    .digest("hex")
+    .slice(0, 24);
+  return path.join(resolveOpenClawHome(), "locks", `testnextim-bridge-${digest}.lock`);
+}
+
+function readJsonFile(filePath) {
+  let content;
+  try {
+    content = fs.readFileSync(filePath, "utf8");
+  } catch {
+    fail(`cannot read config file: ${filePath}`);
+  }
+  try {
+    return JSON.parse(content);
+  } catch {
+    fail(`invalid JSON in config file: ${filePath}`);
+  }
+}
+
+function writeJsonFile(filePath, value) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function readOptionalJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
+function isPidAlive(pid) {
+  const normalized = Number(pid);
+  if (!Number.isFinite(normalized) || normalized <= 0) {
+    return false;
+  }
+  try {
+    process.kill(normalized, 0);
+    return true;
+  } catch (error) {
+    if (error && typeof error === "object" && error.code === "EPERM") {
+      return true;
+    }
+    return false;
+  }
+}
+
+function acquireBridgeLock({
+  relayUrl,
+  gatewayId,
+  gatewayBaseUrl,
+}) {
+  const lockPath = resolveBridgeLockPath({ relayUrl, gatewayId, gatewayBaseUrl });
+  fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+
+  const meta = {
+    pid: process.pid,
+    relayUrl,
+    gatewayId,
+    gatewayBaseUrl,
+    startedAt: new Date().toISOString(),
+  };
+
+  const writeLockFile = () => {
+    const fd = fs.openSync(lockPath, "wx");
+    fs.writeFileSync(fd, `${JSON.stringify(meta, null, 2)}\n`, "utf8");
+    let released = false;
+    const release = () => {
+      if (released) {
+        return;
+      }
+      released = true;
+      try {
+        const current = ensureObject(readOptionalJsonFile(lockPath));
+        if (Number(current.pid) === process.pid) {
+          fs.unlinkSync(lockPath);
+        }
+      } catch {}
+      try {
+        fs.closeSync(fd);
+      } catch {}
+    };
+    return {
+      acquired: true,
+      lockPath,
+      release,
+    };
+  };
+
+  try {
+    return writeLockFile();
+  } catch (error) {
+    if (!error || typeof error !== "object" || error.code !== "EEXIST") {
+      throw error;
+    }
+  }
+
+  const existing = ensureObject(readOptionalJsonFile(lockPath));
+  if (isPidAlive(existing.pid)) {
+    return {
+      acquired: false,
+      lockPath,
+      ownerPid: Number(existing.pid) || null,
+    };
+  }
+
+  try {
+    fs.unlinkSync(lockPath);
+  } catch {}
+
+  try {
+    return writeLockFile();
+  } catch (error) {
+    if (!error || typeof error !== "object" || error.code !== "EEXIST") {
+      throw error;
+    }
+    const current = ensureObject(readOptionalJsonFile(lockPath));
+    return {
+      acquired: false,
+      lockPath,
+      ownerPid: Number(current.pid) || null,
+    };
+  }
+}
+
+function randomHex(bytesLength = 16) {
+  return randomBytes(bytesLength).toString("hex");
+}
+
+function normalizeAccountId(accountId) {
+  const value = (accountId ?? "").trim();
+  if (!value) return "default";
+  return value.toLowerCase();
+}
+
+function ensureObject(value) {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return { ...value };
+  }
+  return {};
+}
+
+function ensureArray(value) {
+  if (Array.isArray(value)) {
+    return [...value];
+  }
+  return [];
+}
+
+function normalizeUserId(value) {
+  return String(value ?? "").trim().toLowerCase();
+}
+
+function formatCode(raw) {
+  return `${raw.slice(0, GROUP_SIZE)}-${raw.slice(GROUP_SIZE)}`;
+}
+
+function normalizeProvidedCode(raw) {
+  const compact = String(raw ?? "")
+    .trim()
+    .toUpperCase()
+    .replace(/\s+/g, "")
+    .replace(/-/g, "");
+  if (/^\d{4}$/.test(compact)) return compact;
+  if (/^\d{6}$/.test(compact)) return compact;
+  if (/^[A-Z0-9]{8}$/.test(compact)) return formatCode(compact);
+  fail("invalid --code format. expected 1234, 123456 or XXXX-XXXX");
+}
+
+function generatePairCode() {
+  // Default one-click code is short numeric for terminal typing.
+  const min = 10 ** (NUMERIC_CODE_LENGTH - 1);
+  const max = 10 ** NUMERIC_CODE_LENGTH;
+  return String(min + Math.floor(Math.random() * (max - min)));
+}
+
+function readChannelSection(config) {
+  const state = readOptionalJsonFile(resolveTestNextIMStatePath());
+  const channels = config?.channels;
+  const legacy =
+    channels && typeof channels === "object"
+      ? channels.testnextim ?? channels["custom-im"] ?? {}
+      : {};
+  return {
+    ...ensureObject(legacy),
+    ...ensureObject(state),
+  };
+}
+
+function parseNonNegativeInt(value, fallback = 0) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value >= 0 ? Math.trunc(value) : fallback;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const parsed = Number.parseInt(value.trim(), 10);
+    if (Number.isFinite(parsed) && parsed >= 0) {
+      return parsed;
+    }
+  }
+  return fallback;
+}
+
+
+function normalizePath(input, fallback) {
+  const value = typeof input === "string" ? input.trim() : "";
+  if (!value) return fallback;
+  return value.startsWith("/") ? value : `/${value}`;
+}
+
+function normalizeChatTransportMode(raw, fallback = "relay") {
+  const value = String(raw ?? "")
+    .trim()
+    .toLowerCase();
+  if (value === "relay") return "relay";
+  return fallback;
+}
+
+function trimSlash(input) {
+  return input.replace(/\/+$/, "");
+}
+
+function normalizeBaseUrl(input) {
+  const value = typeof input === "string" ? input.trim() : "";
+  if (!value) return null;
+  return trimSlash(value);
+}
+
+function buildBindUrl({ base, bindPath, accountId, code }) {
+  if (!base || typeof base !== "string" || !base.trim()) return null;
+  const normalizedBase = trimSlash(base.trim());
+  const normalizedPath = normalizePath(bindPath, DEFAULT_BIND_PATH);
+  const qp = new URLSearchParams({ accountId, code });
+  return `${normalizedBase}${normalizedPath}?${qp.toString()}`;
+}
+
+function buildGatewayResponsesUrl(base) {
+  const normalized = normalizeBaseUrl(base);
+  if (!normalized) fail("gateway base URL is required");
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    fail(`invalid gateway base URL: ${base}`);
+  }
+  parsed.pathname = "/v1/responses";
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.toString();
+}
+
+function buildGatewayWsUrl(base) {
+  const normalized = normalizeBaseUrl(base);
+  if (!normalized) fail("gateway base URL is required");
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    fail(`invalid gateway base URL: ${base}`);
+  }
+  if (parsed.protocol === "https:") {
+    parsed.protocol = "wss:";
+  } else {
+    parsed.protocol = "ws:";
+  }
+  parsed.pathname = "/";
+  parsed.search = "";
+  parsed.hash = "";
+  return parsed.toString();
+}
+
+function resolveAppSecret(section) {
+  return (
+    (typeof section.appSecret === "string" ? section.appSecret.trim() : "") ||
+    process.env.TESTNEXTIM_APP_SECRET?.trim() ||
+    process.env.CUSTOM_IM_APP_SECRET?.trim() ||
+    ""
+  );
+}
+
+function ensureManualPairSafety(section) {
+  const appSecret = resolveAppSecret(section);
+  if (!appSecret) {
+    fail(
+      [
+        "manual pair-code mode requires testnextim appSecret.",
+        "Run:",
+        `  export TESTNEXTIM_APP_SECRET="<your-secret>"`,
+      ].join("\n"),
+    );
+  }
+}
+
+function resolveRelayUrl(options, section) {
+  if (options.noRelay) return null;
+  const fromOption = normalizeBaseUrl(options.relay);
+  if (fromOption) return fromOption;
+  const fromEnv =
+    normalizeBaseUrl(process.env.OPENIM_RELAY_URL) ||
+    normalizeBaseUrl(process.env.TESTNEXTIM_RELAY_URL);
+  if (fromEnv) return fromEnv;
+  return DEFAULT_RELAY_URL;
+}
+
+function parseGatewayPortEnvValue(raw) {
+  const trimmed = String(raw ?? "").trim();
+  if (!trimmed) {
+    return null;
+  }
+  if (/^\d+$/.test(trimmed)) {
+    const parsed = Number.parseInt(trimmed, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+  }
+  const bracketedIpv6Match = trimmed.match(/^\[[^\]]+\]:(\d+)$/);
+  if (bracketedIpv6Match?.[1]) {
+    const parsed = Number.parseInt(bracketedIpv6Match[1], 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+  }
+  const firstColon = trimmed.indexOf(":");
+  const lastColon = trimmed.lastIndexOf(":");
+  if (firstColon <= 0 || firstColon !== lastColon) {
+    return null;
+  }
+  const suffix = trimmed.slice(firstColon + 1);
+  if (!/^\d+$/.test(suffix)) {
+    return null;
+  }
+  const parsed = Number.parseInt(suffix, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+
+function extractPortFromText(raw) {
+  const text = String(raw ?? "").trim();
+  if (!text) return null;
+  const direct = parseGatewayPortEnvValue(text);
+  if (direct != null) return direct;
+  const matches = text.match(/\b\d{2,5}\b/g) ?? [];
+  for (let i = matches.length - 1; i >= 0; i -= 1) {
+    const parsed = parseGatewayPortEnvValue(matches[i]);
+    if (parsed != null) return parsed;
+  }
+  return null;
+}
+
+function readGatewayPortViaOpenClawCli() {
+  const result = spawnSync("openclaw", ["config", "get", "gateway.port"], {
+    encoding: "utf8",
+  });
+  if (result.status !== 0) {
+    return null;
+  }
+  return extractPortFromText(result.stdout);
+}
+
+function formatHostForUrl(host) {
+  const value = String(host ?? "").trim();
+  if (!value) return "";
+  if (value.startsWith("[") && value.endsWith("]")) {
+    return value;
+  }
+  if (value.includes(":")) {
+    return `[${value}]`;
+  }
+  return value;
+}
+
+function resolveGatewayPort(config) {
+  const fromEnv = parseGatewayPortEnvValue(process.env.OPENCLAW_GATEWAY_PORT);
+  if (fromEnv != null) {
+    return fromEnv;
+  }
+  const fromConfig = Number.parseInt(String(config?.gateway?.port ?? "").trim(), 10);
+  if (Number.isFinite(fromConfig) && fromConfig > 0) {
+    return fromConfig;
+  }
+  const fromCli = readGatewayPortViaOpenClawCli();
+  if (fromCli != null) {
+    return fromCli;
+  }
+  return null;
+}
+
+function resolveGatewayBaseUrl(options, config) {
+  const fromOption = normalizeBaseUrl(options.gateway);
+  if (fromOption) return fromOption;
+  const fromEnv =
+    normalizeBaseUrl(process.env.OPENCLAW_TESTNEXTIM_GATEWAY_BASE_URL) ||
+    normalizeBaseUrl(process.env.OPENCLAW_CUSTOM_IM_GATEWAY_BASE_URL);
+  if (fromEnv) return fromEnv;
+  const gatewayPort = resolveGatewayPort(config);
+  if (gatewayPort == null) {
+    fail(
+      [
+        "gateway base URL is not configured.",
+        "Set one of the following and retry:",
+        "  - openclaw.json -> gateway.port",
+        "  - OPENCLAW_GATEWAY_PORT env",
+        "  - --gateway http://host:port",
+      ].join("\n"),
+    );
+  }
+  const bindMode = String(config?.gateway?.bind ?? "").trim().toLowerCase();
+  const customBindHost = String(config?.gateway?.customBindHost ?? "").trim();
+  const host =
+    String(process.env.OPENCLAW_GATEWAY_HOST ?? "").trim() ||
+    (bindMode === "custom" && customBindHost ? customBindHost : DEFAULT_GATEWAY_HOST);
+  return `http://${formatHostForUrl(host)}:${gatewayPort}`;
+}
+
+function isLoopbackBaseUrl(value) {
+  const normalized = normalizeBaseUrl(value);
+  if (!normalized) return false;
+  try {
+    const parsed = new URL(normalized);
+    const host = parsed.hostname.trim().toLowerCase();
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+  } catch {
+    return false;
+  }
+}
+
+function resolveGatewayAuthToken(config) {
+  const fromConfig = String(config?.gateway?.auth?.token ?? "").trim();
+  if (fromConfig) return fromConfig;
+  return String(process.env.OPENCLAW_GATEWAY_TOKEN ?? "").trim();
+}
+
+function relayAuthHeaders() {
+  const token =
+    process.env.OPENIM_RELAY_TOKEN?.trim() ??
+    process.env.TESTNEXTIM_RELAY_TOKEN?.trim() ??
+    "";
+  if (!token) return {};
+  return { authorization: `Bearer ${token}` };
+}
+
+function relayGatewayHeaders(gatewayToken) {
+  const token = String(gatewayToken ?? "").trim();
+  if (!token) {
+    fail(`missing relay gateway token. run \`${CLI_COMMAND_NAME} pair <code>\` once to initialize bridge credentials.`);
+  }
+  return { authorization: `Bearer ${token}` };
+}
+
+function safeJsonParse(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+function extractErrorMessage(decoded, fallback) {
+  if (decoded && typeof decoded === "object") {
+    if (typeof decoded.error === "string" && decoded.error.trim()) return decoded.error.trim();
+    if (typeof decoded.message === "string" && decoded.message.trim()) return decoded.message.trim();
+  }
+  return fallback;
+}
+
+async function fetchWithTimeout(url, options = {}, timeoutMs = 30000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(new Error(`fetch timeout after ${timeoutMs}ms`)), timeoutMs);
+  try {
+    return await fetch(url, {
+      ...options,
+      signal: controller.signal,
+    });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function normalizeGatewayIdRaw(value) {
+  return String(value ?? "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9_-]/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+function generateRelayGatewayId(accountId) {
+  const normalizedAccount = normalizeGatewayIdRaw(accountId) || "default";
+  return `gw-${normalizedAccount}-${randomHex(4)}`;
+}
+
+function resolveRelayCredentialsFromSection(section) {
+  return {
+    gatewayId:
+      (typeof section?.relayGatewayId === "string" ? section.relayGatewayId.trim() : "") ||
+      process.env.TESTNEXTIM_RELAY_GATEWAY_ID?.trim() ||
+      "",
+    clientToken:
+      (typeof section?.relayClientToken === "string" ? section.relayClientToken.trim() : "") ||
+      process.env.TESTNEXTIM_RELAY_CLIENT_TOKEN?.trim() ||
+      "",
+    gatewayToken:
+      (typeof section?.relayGatewayToken === "string" ? section.relayGatewayToken.trim() : "") ||
+      process.env.TESTNEXTIM_RELAY_GATEWAY_TOKEN?.trim() ||
+      "",
+  };
+}
+
+function updateTestNextIMState(mutator) {
+  const statePath = resolveTestNextIMStatePath();
+  const current = ensureObject(readOptionalJsonFile(statePath));
+  const next = ensureObject(mutator(current) ?? current);
+  writeJsonFile(statePath, next);
+  return {
+    statePath,
+    state: next,
+  };
+}
+
+function persistTestNextIMSettings({
+  bindPublicBaseUrl,
+  transportMode,
+}) {
+  return updateTestNextIMState((current) => {
+    const next = ensureObject(current);
+    if (bindPublicBaseUrl != null) {
+      const normalized = normalizeBaseUrl(bindPublicBaseUrl);
+      if (normalized) {
+        next.bindPublicBaseUrl = normalized;
+      } else {
+        delete next.bindPublicBaseUrl;
+      }
+    }
+    if (transportMode) {
+      next.chatTransportMode = normalizeChatTransportMode(transportMode, "relay");
+    }
+    return next;
+  });
+}
+
+function persistBindState({
+  accountId,
+  clientUserId,
+  accessToken,
+}) {
+  return updateTestNextIMState((current) => {
+    const next = ensureObject(current);
+    const normalizedAccountId = normalizeAccountId(accountId);
+    const normalizedUserId = normalizeUserId(clientUserId);
+    const normalizedToken = String(accessToken ?? "").trim();
+    next.accountId = normalizedAccountId;
+    if (normalizedUserId) {
+      next.linkedUserId = normalizedUserId;
+      next.clientUserId = normalizedUserId;
+    }
+    if (normalizedToken) {
+      next.accessToken = normalizedToken;
+    }
+    return next;
+  });
+}
+
+function resetLocalBindingState({
+  accountId,
+}) {
+  return updateTestNextIMState((current) => {
+    const next = ensureObject(current);
+    const normalizedAccountId = normalizeAccountId(accountId || next.accountId);
+    next.accountId = normalizedAccountId;
+    delete next.linkedUserId;
+    delete next.clientUserId;
+    delete next.accessToken;
+    next.relayGatewayId = generateRelayGatewayId(normalizedAccountId);
+    next.relayClientToken = randomHex(24);
+    next.relayGatewayToken = randomHex(24);
+    return next;
+  });
+}
+
+async function readRelayGatewayBinding({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+}) {
+  const url = `${trimSlash(relayUrl)}/v1/gateways/${encodeURIComponent(gatewayId)}/binding`;
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      ...relayGatewayHeaders(gatewayToken),
+    },
+  });
+  const text = await response.text();
+  const decoded = text ? safeJsonParse(text) : null;
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    const message = extractErrorMessage(
+      decoded,
+      `relay binding lookup failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+  const binding =
+    decoded && typeof decoded === "object" && decoded.binding && typeof decoded.binding === "object"
+      ? decoded.binding
+      : null;
+  if (!binding) {
+    return null;
+  }
+  return {
+    code: typeof binding.code === "string" ? binding.code.trim() : "",
+    clientUserId:
+      typeof binding.clientUserId === "string" ? binding.clientUserId.trim() : "",
+    accountId: typeof binding.accountId === "string" ? binding.accountId.trim() : "",
+    gatewayId: typeof binding.gatewayId === "string" ? binding.gatewayId.trim() : "",
+    expiresAt: typeof binding.expiresAt === "string" ? binding.expiresAt.trim() : "",
+  };
+}
+
+async function resetRelayGatewayBinding({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+}) {
+  const url = `${trimSlash(relayUrl)}/v1/gateways/${encodeURIComponent(gatewayId)}/reset`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      ...relayGatewayHeaders(gatewayToken),
+    },
+  });
+  const text = await response.text();
+  const decoded = text ? safeJsonParse(text) : null;
+  if (response.status === 404) {
+    return {
+      ok: false,
+      notFound: true,
+      clearedCodes: [],
+    };
+  }
+  if (!response.ok) {
+    const message = extractErrorMessage(
+      decoded,
+      `relay reset failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+  return {
+    ok: true,
+    notFound: false,
+    clearedCodes: Array.isArray(decoded?.clearedCodes)
+      ? decoded.clearedCodes
+          .map((item) => String(item ?? "").trim())
+          .filter(Boolean)
+      : [],
+  };
+}
+
+function ensureRelayBridgeCredentials({
+  accountId,
+  relayUrl,
+}) {
+  if (!relayUrl) {
+    return {
+      statePath: resolveTestNextIMStatePath(),
+      section: readChannelSection({}),
+      changed: false,
+      changes: [],
+      credentials: null,
+    };
+  }
+
+  const currentState = ensureObject(readOptionalJsonFile(resolveTestNextIMStatePath()));
+  const section = ensureObject(currentState);
+  const changes = [];
+
+  const current = resolveRelayCredentialsFromSection(section);
+  const gatewayId = current.gatewayId || generateRelayGatewayId(accountId);
+  const clientToken = current.clientToken || randomHex(24);
+  const gatewayToken = current.gatewayToken || randomHex(24);
+
+  if (!current.gatewayId) {
+    section.relayGatewayId = gatewayId;
+    changes.push("state.relayGatewayId=<generated>");
+  }
+  if (!current.clientToken) {
+    section.relayClientToken = clientToken;
+    changes.push("state.relayClientToken=<generated>");
+  }
+  if (!current.gatewayToken) {
+    section.relayGatewayToken = gatewayToken;
+    changes.push("state.relayGatewayToken=<generated>");
+  }
+
+  if (changes.length > 0) {
+    writeJsonFile(resolveTestNextIMStatePath(), section);
+  }
+
+  return {
+    statePath: resolveTestNextIMStatePath(),
+    section,
+    changed: changes.length > 0,
+    changes,
+    credentials: {
+      gatewayId,
+      clientToken,
+      gatewayToken,
+    },
+  };
+}
+
+function restartOpenClaw() {
+  const result = spawnSync("openclaw", ["daemon", "restart"], {
+    encoding: "utf8",
+  });
+  if (result.status === 0) {
+    return {
+      ok: true,
+      command: "openclaw daemon restart",
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+    };
+  }
+  return {
+    ok: false,
+    command: "openclaw daemon restart",
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    status: result.status ?? 1,
+  };
+}
+
+function listBridgeProcesses({ relayUrl, gatewayBaseUrl }) {
+  let result;
+  if (process.platform === "win32") {
+    const script = [
+      "$ErrorActionPreference = 'SilentlyContinue'",
+      "Get-CimInstance Win32_Process |",
+      "Where-Object { $_.CommandLine -and $_.CommandLine -like '*testnextim*bridge*' } |",
+      "ForEach-Object { \"$($_.ProcessId)`t$($_.CommandLine)\" }",
+    ].join(" ");
+    result = spawnSync("powershell.exe", ["-NoProfile", "-Command", script], {
+      encoding: "utf8",
+      windowsHide: true,
+    });
+  } else {
+    result = spawnSync("ps", ["-ax", "-o", "pid=,command="], {
+      encoding: "utf8",
+    });
+  }
+  if (result.status !== 0) {
+    return [];
+  }
+
+  return String(result.stdout ?? "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((line) => {
+      const match = line.match(/^(\d+)\s+(.*)$/);
+      if (!match) return null;
+      return { pid: Number.parseInt(match[1], 10), command: match[2] };
+    })
+    .filter(Boolean)
+    .filter(
+      (entry) =>
+        Number.isFinite(entry.pid) &&
+        entry.pid !== process.pid &&
+        entry.command.includes("testnextim") &&
+        entry.command.includes("bridge") &&
+        entry.command.includes(relayUrl) &&
+        entry.command.includes(gatewayBaseUrl),
+    );
+}
+
+function stopBridgeProcesses({ relayUrl, gatewayBaseUrl }) {
+  const entries = listBridgeProcesses({ relayUrl, gatewayBaseUrl });
+  let stopped = 0;
+  for (const entry of entries) {
+    try {
+      process.kill(entry.pid, "SIGTERM");
+      stopped += 1;
+    } catch {}
+  }
+  return {
+    count: stopped,
+    pids: entries.map((entry) => entry.pid),
+  };
+}
+
+function resolvePublishedGatewayBaseUrl({
+  relayUrl,
+  bindPublicBaseUrl,
+  localGatewayBaseUrl,
+}) {
+  const relayBase = normalizeBaseUrl(relayUrl);
+  if (relayBase) return relayBase;
+  const publicBindBase = normalizeBaseUrl(bindPublicBaseUrl);
+  if (publicBindBase && isLoopbackBaseUrl(localGatewayBaseUrl)) {
+    return publicBindBase;
+  }
+  return localGatewayBaseUrl;
+}
+
+async function probeGatewayResponsesEndpoint({
+  gatewayBaseUrl,
+  gatewayAuthToken,
+}) {
+  const url = buildGatewayResponsesUrl(gatewayBaseUrl);
+  const headers = {
+    "content-type": "application/json",
+    "x-openclaw-scopes": DEFAULT_GATEWAY_SCOPES,
+  };
+  if (gatewayAuthToken) {
+    headers.authorization = `Bearer ${gatewayAuthToken}`;
+  }
+
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({}),
+    });
+    return {
+      ok: ![401, 403, 404].includes(response.status),
+      status: response.status,
+      url,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      url,
+      error: String(error instanceof Error ? error.message : error),
+    };
+  }
+}
+
+function prepareConfig({
+  config,
+}) {
+  let next = ensureObject(config);
+  const changes = [];
+
+  const gateway = ensureObject(next.gateway);
+  const auth = ensureObject(gateway.auth);
+  const rawAuthMode = String(auth.mode ?? "").trim().toLowerCase();
+  if (!rawAuthMode || rawAuthMode === "none") {
+    auth.mode = "token";
+    changes.push("gateway.auth.mode=token");
+  }
+  if (!String(auth.token ?? "").trim()) {
+    auth.token = randomHex(24);
+    changes.push("gateway.auth.token=<generated>");
+  }
+  gateway.auth = auth;
+
+  const http = ensureObject(gateway.http);
+  const endpoints = ensureObject(http.endpoints);
+  const responses = ensureObject(endpoints.responses);
+  if (responses.enabled !== true) {
+    responses.enabled = true;
+    changes.push("gateway.http.endpoints.responses.enabled=true");
+  }
+  endpoints.responses = responses;
+  http.endpoints = endpoints;
+  gateway.http = http;
+  next.gateway = gateway;
+
+  const channels = ensureObject(next.channels);
+  if (channels.testnextim != null) {
+    delete channels.testnextim;
+    changes.push("channels.testnextim removed (independent CLI mode)");
+  }
+
+  if (channels.openim != null) {
+    delete channels.openim;
+    changes.push("channels.openim removed (legacy cleanup)");
+  }
+
+  if (channels["custom-im"] != null) {
+    delete channels["custom-im"];
+    changes.push("channels.custom-im removed (legacy cleanup)");
+  }
+  next.channels = channels;
+
+  const plugins = ensureObject(next.plugins);
+  const entries = ensureObject(plugins.entries);
+  if (entries.testnextim != null) {
+    delete entries.testnextim;
+    changes.push("plugins.entries.testnextim removed (independent CLI mode)");
+  }
+  plugins.entries = entries;
+  const allow = ensureArray(plugins.allow);
+  const filteredAllow = allow.filter((item) => item !== "testnextim");
+  if (filteredAllow.length !== allow.length) {
+    changes.push("plugins.allow -= testnextim");
+  }
+  plugins.allow = filteredAllow;
+  next.plugins = plugins;
+
+  return {
+    config: next,
+    changed: changes.length > 0,
+    changes,
+  };
+}
+
+async function publishPairToRelay({
+  relayUrl,
+  code,
+  transportMode,
+  clientUserId,
+  bindUrl,
+  gatewayBaseUrl,
+  gatewayToken,
+  relayGatewayId,
+  relayClientToken,
+  relayGatewayToken,
+  accountId,
+}) {
+  const url = `${relayUrl}/v1/pair-sessions`;
+  const headers = {
+    "content-type": "application/json",
+    ...relayAuthHeaders(),
+  };
+  const response = await fetch(url, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      code,
+      transportMode: normalizeChatTransportMode(transportMode, "relay"),
+      ...(clientUserId ? { clientUserId } : {}),
+      bindUrl,
+      gatewayBaseUrl,
+      ...(gatewayToken ? { gatewayToken } : {}),
+      ...(relayGatewayId ? { relayGatewayId } : {}),
+      ...(relayClientToken ? { relayClientToken } : {}),
+      ...(relayGatewayToken ? { relayGatewayToken } : {}),
+      accountId,
+      ttlSeconds: 600,
+      source: "testnextim-cli",
+    }),
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    fail(`relay publish failed (${response.status}): ${text || response.statusText}`);
+  }
+  return {
+    relayLookupUrl: `${relayUrl}/v1/pair-sessions/${encodeURIComponent(code)}`,
+    relayPayload: text ? safeJsonParse(text) : null,
+  };
+}
+
+async function readPairSessionFromRelay({ relayUrl, code }) {
+  const url = `${relayUrl}/v1/pair-sessions/${encodeURIComponent(code)}`;
+  const response = await fetch(url, { method: "GET" });
+  const text = await response.text();
+  const decoded = text ? safeJsonParse(text) : null;
+  if (response.status === 404) {
+    return null;
+  }
+  if (!response.ok) {
+    const message = extractErrorMessage(
+      decoded,
+      `relay lookup failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+  const session =
+    decoded && typeof decoded === "object" && decoded.session && typeof decoded.session === "object"
+      ? decoded.session
+      : null;
+  if (!session) return null;
+  return {
+    code: typeof session.code === "string" ? session.code.trim() : "",
+    transportMode: normalizeChatTransportMode(session.transportMode, "relay"),
+    clientUserID:
+      typeof session.clientUserId === "string"
+        ? session.clientUserId.trim()
+        : "",
+    bindUrl: typeof session.bindUrl === "string" ? session.bindUrl.trim() : "",
+    gatewayBaseUrl:
+      typeof session.gatewayBaseUrl === "string"
+        ? session.gatewayBaseUrl.trim()
+        : "",
+    accountId:
+      typeof session.accountId === "string" ? session.accountId.trim() : "",
+    source: typeof session.source === "string" ? session.source.trim() : "",
+    consumed: session.consumed === true,
+  };
+}
+
+async function readRelayNextBindRequest({ relayUrl, code, after, waitSeconds }) {
+  const url = new URL(`${relayUrl}/v1/pair-sessions/${encodeURIComponent(code)}/bind-requests/next`);
+  if (after) {
+    url.searchParams.set("after", after);
+  }
+  url.searchParams.set("waitSeconds", String(waitSeconds));
+
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      ...relayAuthHeaders(),
+    },
+  });
+
+  if (response.status === 204) {
+    return null;
+  }
+  const text = await response.text();
+  const decoded = text ? safeJsonParse(text) : null;
+  if (!response.ok) {
+    const message = extractErrorMessage(
+      decoded,
+      `relay bind request poll failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+
+  const request = decoded?.request;
+  if (!request || typeof request !== "object") {
+    return null;
+  }
+  return {
+    requestId: typeof request.requestId === "string" ? request.requestId.trim() : "",
+    userId: typeof request.userId === "string" ? request.userId.trim() : "",
+    accessToken:
+      typeof request.accessToken === "string" ? request.accessToken.trim() : "",
+    accountId:
+      typeof request.accountId === "string" ? request.accountId.trim() : undefined,
+    restart:
+      typeof request.restart === "boolean"
+        ? request.restart
+        : request.restart == null
+          ? undefined
+          : Boolean(request.restart),
+    requestedAt:
+      typeof request.requestedAt === "string" ? request.requestedAt.trim() : undefined,
+  };
+}
+
+async function publishRelayBindResult({ relayUrl, code, payload }) {
+  const url = `${relayUrl}/v1/pair-sessions/${encodeURIComponent(code)}/bind-results`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...relayAuthHeaders(),
+    },
+    body: JSON.stringify(payload),
+  });
+
+  const text = await response.text();
+  if (!response.ok) {
+    const decoded = text ? safeJsonParse(text) : null;
+    const message = extractErrorMessage(
+      decoded,
+      `relay bind result publish failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+}
+
+async function waitAndProxyBind({
+  configPath,
+  relayUrl,
+  code,
+  accountId,
+  waitSeconds,
+  json,
+}) {
+  const deadline = Date.now() + waitSeconds * 1000;
+  let after = new Date(Date.now() - 1000).toISOString();
+
+  if (!json) {
+    console.log(`Relay worker waiting for bind request (${waitSeconds}s)...`);
+  }
+
+  while (Date.now() < deadline) {
+    const remainingSeconds = Math.max(1, Math.ceil((deadline - Date.now()) / 1000));
+    const request = await readRelayNextBindRequest({
+      relayUrl,
+      code,
+      after,
+      waitSeconds: Math.min(remainingSeconds, 30),
+    });
+
+    if (!request) {
+      continue;
+    }
+
+    if (request.requestedAt) {
+      after = request.requestedAt;
+    } else {
+      after = new Date().toISOString();
+    }
+
+    if (!request.requestId) {
+      continue;
+    }
+
+    const bindAccountId = normalizeAccountId(request.accountId || accountId);
+    const linkedUserId = request.userId || request.accessToken || "";
+
+    if (!json) {
+      console.log(`Relay bind request received: ${request.requestId}`);
+      console.log(`Recording relay bind state for account: ${bindAccountId}`);
+    }
+
+    let bindError = null;
+    let restartState = { ok: true, restarted: false };
+    try {
+      persistBindState({
+        accountId: bindAccountId,
+        clientUserId: linkedUserId,
+        accessToken: request.accessToken,
+      });
+      const shouldRestart =
+        typeof request.restart === "boolean" ? request.restart : true;
+      if (shouldRestart) {
+        const restartResult = restartOpenClaw();
+        restartState = { ok: restartResult.ok, restarted: true };
+        if (!restartResult.ok) {
+          bindError =
+            restartResult.stderr?.trim() ||
+            restartResult.stdout?.trim() ||
+            "openclaw restart failed";
+        }
+      }
+    } catch (error) {
+      bindError = String(error instanceof Error ? error.message : error);
+    }
+
+    const payload = bindError
+      ? {
+          requestId: request.requestId,
+          status: "error",
+          error: bindError,
+          message: "failed to apply relay bind state on gateway host",
+          configUpdated: false,
+          restarted: restartState.restarted,
+          mode: "relay",
+        }
+      : {
+          requestId: request.requestId,
+          status: "ok",
+          message: "relay bind state saved",
+          configUpdated: true,
+          restarted: restartState.restarted,
+          mode: "relay",
+        };
+
+    await publishRelayBindResult({ relayUrl, code, payload });
+
+    if (payload.status !== "ok") {
+      fail(`gateway bind failed: ${bindError}`);
+    }
+
+    return {
+      requestId: request.requestId,
+      gatewayStatus: 200,
+      message: payload.message ?? "bind success",
+      configUpdated: payload.configUpdated === true,
+      restarted: payload.restarted === true,
+      mode: payload.mode ?? null,
+    };
+  }
+
+  fail("relay bind worker timeout: no bind request received");
+}
+
+async function readRelayNextGatewayRequest({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  waitSeconds,
+}) {
+  const url = new URL(`${relayUrl}/v1/gateways/${encodeURIComponent(gatewayId)}/requests/next`);
+  url.searchParams.set("waitSeconds", String(waitSeconds));
+
+  let response;
+  try {
+    response = await fetchWithTimeout(url, {
+      method: "GET",
+      headers: {
+        ...relayGatewayHeaders(gatewayToken),
+      },
+    }, (Math.max(waitSeconds, 1) + 15) * 1000);
+  } catch (error) {
+    const message = String(error instanceof Error ? error.message : error);
+    if (message.includes("timeout")) {
+      return null;
+    }
+    throw error;
+  }
+
+  if (response.status === 204) {
+    return null;
+  }
+
+  const text = await response.text();
+  const decoded = text ? safeJsonParse(text) : null;
+  if (!response.ok) {
+    const message = extractErrorMessage(
+      decoded,
+      `relay gateway poll failed (HTTP ${response.status})`,
+    );
+    fail(message);
+  }
+
+  const request = decoded?.request;
+  if (!request || typeof request !== "object") return null;
+
+  return {
+    requestId: typeof request.requestId === "string" ? request.requestId.trim() : "",
+    agentId: typeof request.agentId === "string" ? request.agentId.trim() : "main",
+    sessionKey:
+      typeof request.sessionKey === "string" ? request.sessionKey.trim() : "",
+    stream: request.stream === true,
+    request: request.request ?? null,
+  };
+}
+
+async function publishRelayGatewayEvent({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  requestId,
+  payload,
+}) {
+  const url = `${relayUrl}/v1/gateways/${encodeURIComponent(gatewayId)}/requests/${encodeURIComponent(requestId)}/events`;
+  const response = await fetchWithTimeout(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...relayGatewayHeaders(gatewayToken),
+    },
+    body: JSON.stringify(payload),
+  }, 20000);
+
+  const text = await response.text();
+  if (!response.ok) {
+    const decoded = text ? safeJsonParse(text) : null;
+    const message = extractErrorMessage(
+      decoded,
+      `relay gateway event publish failed (HTTP ${response.status})`,
+    );
+    throw new Error(message);
+  }
+}
+
+async function publishRelayGatewayChatEvent({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  payload,
+}) {
+  const url = `${relayUrl}/v1/gateways/${encodeURIComponent(gatewayId)}/chat-events`;
+  const response = await fetchWithTimeout(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...relayGatewayHeaders(gatewayToken),
+    },
+    body: JSON.stringify(payload ?? {}),
+  }, 20000);
+
+  const text = await response.text();
+  if (!response.ok) {
+    const decoded = text ? safeJsonParse(text) : null;
+    const message = extractErrorMessage(
+      decoded,
+      `relay gateway chat event publish failed (HTTP ${response.status})`,
+    );
+    throw new Error(message);
+  }
+}
+
+function parseRelayRpcRequest(gatewayRequest) {
+  const payload =
+    gatewayRequest?.request && typeof gatewayRequest.request === "object"
+      ? gatewayRequest.request
+      : null;
+  if (!payload || payload.__relayKind !== "rpc") {
+    return null;
+  }
+  const method = typeof payload.method === "string" ? payload.method.trim() : "";
+  if (!method) {
+    return null;
+  }
+  const params =
+    payload.params && typeof payload.params === "object" && !Array.isArray(payload.params)
+      ? payload.params
+      : {};
+  return { method, params };
+}
+
+function parseJsonFromOutput(raw) {
+  const text = String(raw ?? "").trim();
+  if (!text) return null;
+  const parsed = safeJsonParse(text);
+  if (parsed != null) return parsed;
+  const lines = text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0);
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const decoded = safeJsonParse(lines[i]);
+    if (decoded != null) {
+      return decoded;
+    }
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Gateway device identity + signed connect payload (ported from clawpilot)
+// ---------------------------------------------------------------------------
+
+const GATEWAY_PROTOCOL_VERSION = 3;
+const GATEWAY_CLIENT_IDENTITY_PATH = path.join(
+  os.homedir(),
+  ".clawai",
+  "device-identity.json",
+);
+const ED25519_SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+
+function base64UrlEncode(buf) {
+  return Buffer.from(buf)
+    .toString("base64")
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replace(/=+$/g, "");
+}
+
+function rawPublicKeyBytes(publicKeyPem) {
+  const key = createPublicKey(publicKeyPem);
+  const spki = key.export({ type: "spki", format: "der" });
+  if (
+    spki.length === ED25519_SPKI_PREFIX.length + 32 &&
+    spki.subarray(0, ED25519_SPKI_PREFIX.length).equals(ED25519_SPKI_PREFIX)
+  ) {
+    return spki.subarray(ED25519_SPKI_PREFIX.length);
+  }
+  return spki;
+}
+
+function loadOrCreateGatewayDeviceIdentity() {
+  if (fs.existsSync(GATEWAY_CLIENT_IDENTITY_PATH)) {
+    try {
+      const stored = JSON.parse(fs.readFileSync(GATEWAY_CLIENT_IDENTITY_PATH, "utf8"));
+      if (stored?.deviceId && stored?.publicKeyPem && stored?.privateKeyPem) {
+        return {
+          deviceId: String(stored.deviceId),
+          publicKeyPem: String(stored.publicKeyPem),
+          privateKeyPem: String(stored.privateKeyPem),
+        };
+      }
+    } catch {
+      // fall through and regenerate
+    }
+  }
+
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const publicKeyPem = publicKey.export({ type: "spki", format: "pem" }).toString();
+  const privateKeyPem = privateKey.export({ type: "pkcs8", format: "pem" }).toString();
+  const deviceId = createHash("sha256")
+    .update(rawPublicKeyBytes(publicKeyPem))
+    .digest("hex");
+  const identity = { deviceId, publicKeyPem, privateKeyPem };
+  fs.mkdirSync(path.dirname(GATEWAY_CLIENT_IDENTITY_PATH), { recursive: true });
+  fs.writeFileSync(
+    GATEWAY_CLIENT_IDENTITY_PATH,
+    `${JSON.stringify({ version: 1, ...identity, createdAtMs: Date.now() }, null, 2)}\n`,
+    { mode: 0o600 },
+  );
+  return identity;
+}
+
+function buildSignedGatewayDevice(identity, opts) {
+  const version = opts.nonce ? "v2" : "v1";
+  const payload = [
+    version,
+    identity.deviceId,
+    opts.clientId,
+    opts.clientMode,
+    opts.role,
+    opts.scopes.join(","),
+    String(opts.signedAtMs),
+    opts.token ?? "",
+    ...(version === "v2" ? [opts.nonce ?? ""] : []),
+  ].join("|");
+  const key = createPrivateKey(identity.privateKeyPem);
+  const signature = base64UrlEncode(sign(null, Buffer.from(payload, "utf8"), key));
+  return {
+    id: identity.deviceId,
+    publicKey: base64UrlEncode(rawPublicKeyBytes(identity.publicKeyPem)),
+    signature,
+    signedAt: opts.signedAtMs,
+    nonce: opts.nonce,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Persistent WebSocket gateway client (like clawpilot's OpenClawGatewayClient)
+// ---------------------------------------------------------------------------
+
+let _gatewayWsClient = null;
+let _gatewayWsBridgePublisher = null;
+
+function setGatewayWsBridgePublisher(publisher) {
+  _gatewayWsBridgePublisher = typeof publisher === "function" ? publisher : null;
+}
+
+function getOrCreateGatewayWsClient({ gatewayBaseUrl, gatewayAuthToken }) {
+  if (_gatewayWsClient && _gatewayWsClient.wsUrl === buildGatewayWsUrl(gatewayBaseUrl)) {
+    return _gatewayWsClient;
+  }
+  if (_gatewayWsClient) {
+    _gatewayWsClient.close();
+  }
+  _gatewayWsClient = createGatewayWsClient({ gatewayBaseUrl, gatewayAuthToken });
+  return _gatewayWsClient;
+}
+
+function createGatewayWsClient({ gatewayBaseUrl, gatewayAuthToken }) {
+  const wsUrl = buildGatewayWsUrl(gatewayBaseUrl);
+  const pending = new Map();
+  let ws = null;
+  let identity = loadOrCreateGatewayDeviceIdentity();
+  let connected = false;
+  let connectPromise = null;
+  let stopped = false;
+  let connectTimer = null;
+  let tickTimer = null;
+  let connectSent = false;
+  let connectNonce = null;
+  let storedDeviceToken = null;
+  let tickIntervalMs = 30000;
+  let lastTickAt = 0;
+
+  function doConnect() {
+    if (stopped) return Promise.reject(new Error("gateway client stopped"));
+    if (connected && ws?.readyState === 1) return Promise.resolve();
+    if (connectPromise) return connectPromise;
+
+    connectPromise = new Promise(async (resolve, reject) => {
+      // Node 22+ has global WebSocket; older Node needs the ws package
+      let WsClass = typeof WebSocket !== "undefined" ? WebSocket : null;
+      if (!WsClass) {
+        try {
+          const mod = await import("ws");
+          WsClass = mod.default || mod.WebSocket;
+        } catch {
+          reject(new Error("WebSocket not available (install ws package or use Node 22+)"));
+          connectPromise = null;
+          return;
+        }
+      }
+
+      try {
+        ws = new WsClass(wsUrl);
+      } catch (err) {
+        reject(new Error(`gateway ws create failed: ${err}`));
+        connectPromise = null;
+        return;
+      }
+
+      const timeout = setTimeout(() => {
+        if (!connected) {
+          ws?.close();
+          reject(new Error("gateway websocket connect timeout"));
+          connectPromise = null;
+        }
+      }, 15000);
+
+      function cleanup() {
+        clearTimeout(timeout);
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
+        if (tickTimer) {
+          clearInterval(tickTimer);
+          tickTimer = null;
+        }
+        connected = false;
+        connectSent = false;
+        connectNonce = null;
+        lastTickAt = 0;
+        connectPromise = null;
+        flushPending(new Error("gateway disconnected"));
+      }
+
+      ws.onopen = () => {
+        connectSent = false;
+        connectNonce = null;
+        connectTimer = setTimeout(() => sendConnect(), 1000);
+      };
+
+      ws.onmessage = (event) => {
+        const raw = typeof event.data === "string" ? event.data : String(event.data);
+        handleMessage(raw);
+      };
+
+      ws.onclose = () => cleanup();
+
+      ws.onerror = (err) => {
+        if (!connected) {
+          clearTimeout(timeout);
+          reject(new Error(`gateway ws error: ${err?.message || err}`));
+          connectPromise = null;
+        }
+      };
+
+      function handleMessage(raw) {
+        let parsed;
+        try { parsed = JSON.parse(raw); } catch { return; }
+        if (typeof parsed?.type !== "string") return;
+
+        if (parsed.type === "event") {
+          const eventName = typeof parsed.event === "string" ? parsed.event.trim() : "";
+          if (eventName === "connect.challenge") {
+            const nonce = typeof parsed.payload?.nonce === "string"
+              ? parsed.payload.nonce
+              : null;
+            if (nonce) {
+              connectNonce = nonce;
+            }
+            sendConnect();
+            return;
+          }
+          if (eventName === "tick") {
+            lastTickAt = Date.now();
+            return;
+          }
+          return;
+        }
+
+        if (parsed.type === "res") {
+          const p = pending.get(parsed.id);
+          if (!p) return;
+          pending.delete(parsed.id);
+          if (parsed.ok) {
+            p.resolve(parsed.payload);
+          } else {
+            p.reject(new Error(parsed.error?.message ?? "gateway rpc error"));
+          }
+          return;
+        }
+
+        if (parsed.type === "req") {
+          const requestId = typeof parsed.id === "string" ? parsed.id : "";
+          const method = typeof parsed.method === "string" ? parsed.method.trim() : "";
+          const params =
+            parsed.params && typeof parsed.params === "object" ? parsed.params : null;
+
+          if (requestId && ws?.readyState === 1) {
+            ws.send(JSON.stringify({ type: "res", id: requestId, ok: true }));
+          }
+
+          if (method === "chat.push" && params && _gatewayWsBridgePublisher) {
+            Promise.resolve()
+              .then(() => _gatewayWsBridgePublisher("chat", params, { gatewayBaseUrl, gatewayAuthToken }))
+              .catch((error) => {
+                console.error(`[testnextim] relay chat event publish failed: ${String(error?.message ?? error)}`);
+              });
+          }
+        }
+      }
+
+      function startTickWatch() {
+        if (tickTimer) {
+          clearInterval(tickTimer);
+        }
+        const interval = Math.max(tickIntervalMs, 1000);
+        tickTimer = setInterval(() => {
+          if (stopped || !lastTickAt) {
+            return;
+          }
+          if (Date.now() - lastTickAt > tickIntervalMs * 2) {
+            ws?.close(4000, "tick timeout");
+          }
+        }, interval);
+      }
+
+      function sendConnect() {
+        if (connectSent) return;
+        connectSent = true;
+        if (connectTimer) {
+          clearTimeout(connectTimer);
+          connectTimer = null;
+        }
+        const role = "operator";
+        const scopes = [
+          "operator.admin",
+          "operator.read",
+          "operator.write",
+          "operator.approvals",
+          "operator.pairing",
+        ];
+        const clientId = "openclaw-macos";
+        const clientMode = "ui";
+        const signedAtMs = Date.now();
+        const authToken = storedDeviceToken ?? gatewayAuthToken ?? undefined;
+        const device = buildSignedGatewayDevice(identity, {
+          clientId,
+          clientMode,
+          role,
+          scopes,
+          signedAtMs,
+          token: authToken,
+          nonce: connectNonce ?? undefined,
+        });
+        const params = {
+          minProtocol: GATEWAY_PROTOCOL_VERSION,
+          maxProtocol: GATEWAY_PROTOCOL_VERSION,
+          role,
+          scopes,
+          caps: ["tool-events"],
+          client: {
+            id: clientId,
+            displayName: "TestNextIM Bridge",
+            version: "1.0.0",
+            platform: process.platform,
+            mode: clientMode,
+          },
+          device,
+          auth: authToken ? { token: authToken } : undefined,
+        };
+        request("connect", params).then((hello) => {
+          clearTimeout(timeout);
+          connected = true;
+          const deviceToken = hello?.auth?.deviceToken;
+          if (typeof deviceToken === "string" && deviceToken.trim()) {
+            storedDeviceToken = deviceToken.trim();
+          }
+          if (typeof hello?.policy?.tickIntervalMs === "number" && hello.policy.tickIntervalMs > 0) {
+            tickIntervalMs = hello.policy.tickIntervalMs;
+          }
+          lastTickAt = Date.now();
+          startTickWatch();
+          resolve();
+        }).catch((err) => {
+          storedDeviceToken = null;
+          clearTimeout(timeout);
+          ws?.close();
+          reject(err);
+        });
+      }
+    });
+
+    return connectPromise;
+  }
+
+  function request(method, params) {
+    if (!ws || ws.readyState !== 1) {
+      return Promise.reject(new Error("gateway not connected"));
+    }
+    const id = randomUUID();
+    const frame = { type: "req", id, method, params };
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(new Error(`gateway rpc timeout: ${method}`));
+      }, 30000);
+      pending.set(id, {
+        resolve: (v) => { clearTimeout(timer); resolve(v); },
+        reject: (e) => { clearTimeout(timer); reject(e); },
+      });
+      ws.send(JSON.stringify(frame));
+    });
+  }
+
+  function flushPending(err) {
+    for (const p of pending.values()) p.reject(err);
+    pending.clear();
+  }
+
+  return {
+    wsUrl,
+    async call(method, params) {
+      await doConnect();
+      return request(method, params);
+    },
+    close() {
+      stopped = true;
+      ws?.close();
+      ws = null;
+      flushPending(new Error("gateway client closed"));
+    },
+  };
+}
+
+async function callGatewayRpcLocal({
+  gatewayBaseUrl,
+  gatewayAuthToken,
+  method,
+  params,
+}) {
+  if (method === "__gateway.features") {
+    return {
+      ok: true,
+      methods: ["sessions.list", "sessions.abort", "sessions.usage", "sessions.patch",
+        "usage.cost", "agents.files.list", "agents.files.get", "agents.files.set",
+        "skills.status", "models.list", "chat.history", "chat.abort",
+        "config.get", "config.patch"],
+    };
+  }
+
+  // In bridge mode the CLI path is more reliable than the shared WebSocket client,
+  // especially while long-running streamed chats are also active.
+  return callGatewayRpcLocalViaCli({ gatewayBaseUrl, gatewayAuthToken, method, params });
+}
+
+async function callGatewayRpcLocalViaCli({
+  gatewayBaseUrl,
+  gatewayAuthToken,
+  method,
+  params,
+}) {
+  const wsUrl = buildGatewayWsUrl(gatewayBaseUrl);
+  const args = [
+    "gateway",
+    "call",
+    method,
+    "--url",
+    wsUrl,
+    "--params",
+    JSON.stringify(params ?? {}),
+    "--json",
+  ];
+  if (gatewayAuthToken) {
+    args.push("--token", gatewayAuthToken);
+  }
+
+  const child = spawn("openclaw", args, {
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    try {
+      child.kill("SIGKILL");
+    } catch {
+      // noop
+    }
+  }, GATEWAY_RPC_CLI_TIMEOUT_MS);
+
+  const [stdoutChunks, stderrChunks] = await Promise.all([
+    new Promise((resolve) => {
+      const chunks = [];
+      child.stdout?.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      child.stdout?.on("end", () => resolve(chunks));
+      child.stdout?.on("error", () => resolve(chunks));
+    }),
+    new Promise((resolve) => {
+      const chunks = [];
+      child.stderr?.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      child.stderr?.on("end", () => resolve(chunks));
+      child.stderr?.on("error", () => resolve(chunks));
+    }),
+    new Promise((resolve) => child.on("close", resolve)),
+  ]);
+  clearTimeout(timeout);
+
+  const stdoutText = Buffer.concat(stdoutChunks).toString("utf8");
+  const stderrText = Buffer.concat(stderrChunks).toString("utf8");
+  if (timedOut) {
+    throw new Error(`openclaw gateway call timed out after ${Math.round(GATEWAY_RPC_CLI_TIMEOUT_MS / 1000)}s`);
+  }
+  const exitCode = child.exitCode ?? 1;
+  if (exitCode !== 0) {
+    const msg = stderrText.trim() || stdoutText.trim() || `openclaw gateway call failed (${exitCode})`;
+    throw new Error(msg);
+  }
+
+  const decoded = parseJsonFromOutput(stdoutText);
+  if (decoded == null) {
+    if (!stdoutText.trim()) {
+      return { ok: true, payload: null };
+    }
+    throw new Error("gateway rpc returned non-JSON output");
+  }
+  return decoded;
+}
+
+function extractAssistantTextFromHistory(history) {
+  const messages = Array.isArray(history?.messages) ? history.messages : [];
+  const assistant = [...messages]
+    .reverse()
+    .find((item) => String(item?.role ?? "").trim().toLowerCase() === "assistant");
+  if (!assistant || !Array.isArray(assistant.content)) {
+    return "";
+  }
+  for (const block of assistant.content) {
+    if (block?.type === "text" && typeof block.text === "string" && block.text.trim()) {
+      return block.text.trim();
+    }
+  }
+  return "";
+}
+
+async function handleGatewayChatEvent({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  gatewayBaseUrl,
+  gatewayAuthToken,
+  payload,
+}) {
+  const eventPayload =
+    payload && typeof payload === "object" && !Array.isArray(payload) ? { ...payload } : {};
+  const sessionKey = typeof eventPayload.sessionKey === "string"
+    ? eventPayload.sessionKey.trim()
+    : "";
+  const state = typeof eventPayload.state === "string" ? eventPayload.state.trim() : "";
+  let text = "";
+
+  if (state === "final" && sessionKey) {
+    try {
+      const client = getOrCreateGatewayWsClient({ gatewayBaseUrl, gatewayAuthToken });
+      let history = await client.call("chat.history", { sessionKey, limit: 10 });
+      text = extractAssistantTextFromHistory(history);
+      if (!text) {
+        await new Promise((resolve) => setTimeout(resolve, 600));
+        history = await client.call("chat.history", { sessionKey, limit: 10 });
+        text = extractAssistantTextFromHistory(history);
+      }
+    } catch (error) {
+      console.warn(`[testnextim] chat.history fetch failed for relay event: ${String(error?.message ?? error)}`);
+    }
+  }
+
+  await publishRelayGatewayChatEvent({
+    relayUrl,
+    gatewayId,
+    gatewayToken,
+    payload: {
+      event: "chat",
+      state,
+      sessionKey,
+      runId: typeof eventPayload.runId === "string" ? eventPayload.runId.trim() : "",
+      text,
+      payload: eventPayload,
+    },
+  });
+}
+
+async function proxyGatewayRequestLocal({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  gatewayBaseUrl,
+  gatewayAuthToken,
+  gatewayRequest,
+  json,
+}) {
+  const requestId = gatewayRequest.requestId;
+  if (!requestId) {
+    return;
+  }
+
+  const relayRpc = parseRelayRpcRequest(gatewayRequest);
+  if (relayRpc) {
+    try {
+      const rpcResult = await callGatewayRpcLocal({
+        gatewayBaseUrl,
+        gatewayAuthToken,
+        method: relayRpc.method,
+        params: relayRpc.params,
+      });
+      await publishRelayGatewayEvent({
+        relayUrl,
+        gatewayId,
+        gatewayToken,
+        requestId,
+        payload: {
+          event: "response",
+          statusCode: 200,
+          contentType: "application/json; charset=utf-8",
+          body: JSON.stringify(rpcResult ?? {}),
+        },
+      });
+    } catch (error) {
+      await publishRelayGatewayEvent({
+        relayUrl,
+        gatewayId,
+        gatewayToken,
+        requestId,
+        payload: {
+          event: "error",
+          error: String(error instanceof Error ? error.message : error),
+        },
+      });
+    }
+    return;
+  }
+
+  const sessionKey = gatewayRequest.sessionKey;
+  if (!sessionKey) {
+    return;
+  }
+
+  const localUrl = buildGatewayResponsesUrl(gatewayBaseUrl);
+  const headers = {
+    "content-type": "application/json",
+    "x-openclaw-agent-id": gatewayRequest.agentId || "main",
+    "x-openclaw-session-key": sessionKey,
+    "x-openclaw-scopes": DEFAULT_GATEWAY_SCOPES,
+  };
+  if (gatewayAuthToken) {
+    headers.authorization = `Bearer ${gatewayAuthToken}`;
+  }
+  if (gatewayRequest.stream) {
+    headers.accept = "text/event-stream";
+  }
+
+  const payload = gatewayRequest.request && typeof gatewayRequest.request === "object"
+    ? gatewayRequest.request
+    : {};
+
+  let response;
+  try {
+    response = await fetch(localUrl, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload),
+    });
+  } catch (error) {
+    await publishRelayGatewayEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      requestId,
+      payload: {
+        event: "error",
+        error: String(error instanceof Error ? error.message : error),
+      },
+    });
+    return;
+  }
+
+  const contentType = response.headers.get("content-type") ?? "";
+
+  if (!gatewayRequest.stream || !contentType.toLowerCase().includes("text/event-stream")) {
+    const body = await response.text();
+    await publishRelayGatewayEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      requestId,
+      payload: {
+        event: "response",
+        statusCode: response.status,
+        contentType,
+        body,
+      },
+    });
+    return;
+  }
+
+  await publishRelayGatewayEvent({
+    relayUrl,
+    gatewayId,
+    gatewayToken,
+    requestId,
+    payload: {
+      event: "start",
+      statusCode: response.status,
+      contentType,
+    },
+  });
+
+  if (!response.body) {
+    await publishRelayGatewayEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      requestId,
+      payload: {
+        event: "end",
+      },
+    });
+    return;
+  }
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) {
+      break;
+    }
+    const text = decoder.decode(value, { stream: true });
+    if (!text) {
+      continue;
+    }
+    await publishRelayGatewayEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      requestId,
+      payload: {
+        event: "chunk",
+        data: text,
+      },
+    });
+  }
+
+  const tail = decoder.decode();
+  if (tail) {
+    await publishRelayGatewayEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      requestId,
+      payload: {
+        event: "chunk",
+        data: tail,
+      },
+    });
+  }
+
+  await publishRelayGatewayEvent({
+    relayUrl,
+    gatewayId,
+    gatewayToken,
+    requestId,
+    payload: {
+      event: "end",
+    },
+  });
+
+  if (!json) {
+    console.log(`Relayed stream request: ${requestId}`);
+  }
+}
+
+async function runRelayBridge({
+  relayUrl,
+  gatewayId,
+  gatewayToken,
+  gatewayBaseUrl,
+  gatewayAuthToken,
+  json,
+}) {
+  if (!relayUrl) {
+    fail("relay URL is required for bridge mode");
+  }
+  if (!gatewayId) {
+    fail(`relay gateway ID is missing. run \`${CLI_COMMAND_NAME} pair <code>\` first`);
+  }
+
+  if (!json) {
+    console.log(`Relay bridge online. gatewayId=${gatewayId}`);
+    console.log(`Relay URL: ${relayUrl}`);
+    console.log(`Local Gateway: ${gatewayBaseUrl}`);
+  }
+
+  setGatewayWsBridgePublisher(async (event, payload) => {
+    if (event !== "chat") {
+      return;
+    }
+    await handleGatewayChatEvent({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      gatewayBaseUrl,
+      gatewayAuthToken,
+      payload,
+    });
+  });
+
+  const activeRequests = new Set();
+
+  while (true) {
+    const request = await readRelayNextGatewayRequest({
+      relayUrl,
+      gatewayId,
+      gatewayToken,
+      waitSeconds: 30,
+    });
+    if (!request) {
+      continue;
+    }
+
+    if (!request.requestId || !request.sessionKey) {
+      continue;
+    }
+
+    const requestKind = request.stream
+      ? "stream"
+      : parseRelayRpcRequest(request)?.method || "response";
+    if (!json) {
+      console.log(`Bridge request start: ${request.requestId} (${requestKind})`);
+    }
+
+    const task = (async () => {
+      try {
+        await proxyGatewayRequestLocal({
+          relayUrl,
+          gatewayId,
+          gatewayToken,
+          gatewayBaseUrl,
+          gatewayAuthToken,
+          gatewayRequest: request,
+          json,
+        });
+      } catch (error) {
+        if (!json) {
+          console.error(`bridge proxy error: ${String(error instanceof Error ? error.message : error)}`);
+        }
+        try {
+          await publishRelayGatewayEvent({
+            relayUrl,
+            gatewayId,
+            gatewayToken,
+            requestId: request.requestId,
+            payload: {
+              event: "error",
+              error: String(error instanceof Error ? error.message : error),
+            },
+          });
+        } catch {
+          // noop
+        }
+      } finally {
+        if (!json) {
+          console.log(`Bridge request end: ${request.requestId} (${requestKind})`);
+        }
+      }
+    })();
+
+    activeRequests.add(task);
+    task.finally(() => {
+      activeRequests.delete(task);
+    });
+  }
+}
+
+function startRelayBridgeDetached({
+  relayUrl,
+  gatewayBaseUrl,
+}) {
+  const existing = listBridgeProcesses({ relayUrl, gatewayBaseUrl });
+  if (existing.length > 0) {
+    return { started: false, alreadyRunning: true, mode: "process", count: existing.length };
+  }
+
+  const child = spawn(
+    process.execPath,
+    [CLI_ENTRY, "bridge", "--relay", relayUrl, "--gateway", gatewayBaseUrl],
+    {
+      detached: true,
+      stdio: "ignore",
+      env: { ...process.env },
+      windowsHide: process.platform === "win32",
+    },
+  );
+  child.unref();
+  return { started: true, alreadyRunning: false, mode: "detached" };
+}
+
+async function runPair({
+  json,
+  account,
+  relay,
+  noRelay,
+  mode,
+  code: explicitCode,
+  gateway,
+  waitBind,
+  waitSeconds,
+  serveRelay,
+}) {
+  if (!explicitCode || !String(explicitCode).trim()) {
+    fail(`pair code is required. Usage: ${CLI_COMMAND_NAME} pair <1234|123456|XXXX-XXXX>`);
+  }
+  const code = normalizeProvidedCode(explicitCode);
+  const configPath = resolveOpenClawConfigPath();
+  let config = readJsonFile(configPath);
+  let section = readChannelSection(config);
+  const relayUrl = resolveRelayUrl({ relay, noRelay }, section);
+  if (!relayUrl) {
+    fail(
+      [
+        "relay URL is required.",
+        "Relay is enabled but no URL is available.",
+        `Use the built-in default (${DEFAULT_RELAY_URL}) or pass --relay <url> / TESTNEXTIM_RELAY_URL.`,
+      ].join("\n"),
+    );
+  }
+
+  const currentSession = await readPairSessionFromRelay({ relayUrl, code });
+  if (!currentSession) {
+    fail(
+      [
+        `pair code not found in relay: ${code}`,
+        "Please generate the code from mobile app first.",
+      ].join("\n"),
+    );
+  }
+  if (currentSession.consumed) {
+    fail(`pair code has already been consumed: ${code}`);
+  }
+
+  const accountId = normalizeAccountId(currentSession.accountId || account);
+  const transportMode = normalizeChatTransportMode(
+    mode,
+    normalizeChatTransportMode(currentSession.transportMode, "relay"),
+  );
+  const clientUserId = String(currentSession.clientUserID ?? "").trim().toLowerCase();
+  if (!clientUserId) {
+    fail(
+      [
+        `pair code ${code} is missing clientUserId in relay session.`,
+        "Please regenerate the pair code from the latest app and try again.",
+      ].join("\n"),
+    );
+  }
+
+  const prepared = prepareConfig({
+    config,
+  });
+  config = prepared.config;
+  if (prepared.changed) {
+    writeJsonFile(configPath, config);
+  }
+  section = readChannelSection(config);
+  if (!json && prepared.changed) {
+    console.log("Updated openclaw.json: removed stale testnextim plugin/channel config.");
+  }
+
+  const bindPath = normalizePath(section.bindPath, DEFAULT_BIND_PATH);
+
+  const bindPublicBaseUrl =
+    (typeof section.bindPublicBaseUrl === "string"
+      ? section.bindPublicBaseUrl
+      : "") ||
+    process.env.OPENCLAW_TESTNEXTIM_PUBLIC_BASE_URL?.trim() ||
+    process.env.OPENCLAW_CUSTOM_IM_PUBLIC_BASE_URL?.trim() ||
+    "";
+
+  const localGatewayBaseUrl = resolveGatewayBaseUrl({ gateway }, config);
+  const gatewayAuthToken = resolveGatewayAuthToken(config);
+
+  const localBindUrl = buildBindUrl({
+    base: localGatewayBaseUrl,
+    bindPath,
+    accountId,
+    code,
+  });
+
+  const publicBindUrl = buildBindUrl({
+    base: bindPublicBaseUrl,
+    bindPath,
+    accountId,
+    code,
+  });
+  const relayBindUrl = currentSession.bindUrl || publicBindUrl || localBindUrl;
+  if (!relayBindUrl) {
+    fail("unable to determine bindUrl for this pair code");
+  }
+
+  const ensured = ensureRelayBridgeCredentials({
+    accountId,
+    relayUrl,
+  });
+  section = ensured.section;
+  const relayCredentials = ensured.credentials;
+  if (relayCredentials?.gatewayId && relayCredentials?.gatewayToken) {
+    const existingBinding = await readRelayGatewayBinding({
+      relayUrl,
+      gatewayId: relayCredentials.gatewayId,
+      gatewayToken: relayCredentials.gatewayToken,
+    });
+    const existingCode =
+      existingBinding?.code && /^[A-Za-z0-9-]+$/.test(existingBinding.code)
+        ? normalizeProvidedCode(existingBinding.code)
+        : "";
+    if (existingBinding && existingCode !== code) {
+      fail(
+        [
+          "This host is already bound to a device.",
+          existingBinding.clientUserId
+            ? `Current clientUserId: ${existingBinding.clientUserId}`
+            : null,
+          existingBinding.code ? `Active pair code: ${existingBinding.code}` : null,
+          `Run \`${CLI_COMMAND_NAME} reset\` first to clear the current binding, then retry pairing.`,
+        ]
+          .filter(Boolean)
+          .join("\n"),
+      );
+    }
+  }
+  const publishedGatewayBaseUrl = resolvePublishedGatewayBaseUrl({
+    relayUrl,
+    bindPublicBaseUrl,
+    localGatewayBaseUrl,
+  });
+  const publishedGatewayToken =
+    normalizeBaseUrl(publishedGatewayBaseUrl) === normalizeBaseUrl(relayUrl)
+      ? ""
+      : gatewayAuthToken;
+
+  const requiresGatewayRestart = prepared.changed;
+  let restartResult = null;
+  let gatewayProbe = null;
+
+  if (requiresGatewayRestart) {
+    restartResult = restartOpenClaw();
+    if (!restartResult.ok) {
+      fail(
+        [
+          "OpenClaw restart failed after updating testnextim config.",
+          "Run `openclaw daemon restart` and retry.",
+          restartResult.stderr?.trim() || restartResult.stdout?.trim() || "",
+        ]
+          .filter(Boolean)
+          .join("\n"),
+      );
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1500));
+  }
+
+  gatewayProbe = await probeGatewayResponsesEndpoint({
+    gatewayBaseUrl: localGatewayBaseUrl,
+    gatewayAuthToken,
+  });
+  if (!gatewayProbe.ok) {
+    if (!restartResult) {
+      restartResult = restartOpenClaw();
+      if (!restartResult.ok) {
+        fail(
+          [
+            "OpenClaw gateway is not ready and restart failed.",
+            "Run `openclaw daemon restart` and retry.",
+            restartResult.stderr?.trim() || restartResult.stdout?.trim() || "",
+          ]
+            .filter(Boolean)
+            .join("\n"),
+        );
+      }
+      await new Promise((resolve) => setTimeout(resolve, 1500));
+      gatewayProbe = await probeGatewayResponsesEndpoint({
+        gatewayBaseUrl: localGatewayBaseUrl,
+        gatewayAuthToken,
+      });
+    }
+
+    if (!gatewayProbe.ok) {
+      fail(
+        [
+          "local OpenClaw gateway `/v1/responses` is not ready for relay bridge.",
+          `Checked: ${gatewayProbe.url}`,
+          gatewayProbe.status
+            ? `HTTP ${gatewayProbe.status} (expected non-401/403/404)`
+            : gatewayProbe.error || "request failed",
+          "Make sure OpenClaw daemon is running and the responses endpoint is enabled.",
+        ].join("\n"),
+      );
+    }
+  }
+
+  const relayResult = await publishPairToRelay({
+    relayUrl,
+    code,
+    transportMode,
+    clientUserId,
+    bindUrl: relayBindUrl,
+    gatewayBaseUrl: publishedGatewayBaseUrl,
+    gatewayToken: publishedGatewayToken,
+    relayGatewayId: relayCredentials?.gatewayId,
+    relayClientToken: relayCredentials?.clientToken,
+    relayGatewayToken: relayCredentials?.gatewayToken,
+    accountId,
+  });
+
+  const output = {
+    command: "pair",
+    accountId,
+    clientUserId,
+    code,
+    transportMode,
+    bindPath,
+    bindPublicBaseUrl: bindPublicBaseUrl || null,
+    bindUrl: publicBindUrl,
+    localBindUrl,
+    relayBindUrl,
+    relayUrl,
+    relayLookupUrl: relayResult?.relayLookupUrl ?? null,
+    relayWorkerEnabled: Boolean(serveRelay),
+    relayWorkerResult: null,
+    localGatewayBaseUrl,
+    publishedGatewayBaseUrl,
+    gatewayRestarted: Boolean(restartResult?.ok),
+    relayGatewayId: relayCredentials?.gatewayId ?? null,
+  };
+
+  if (serveRelay && !json) {
+    try {
+      const bridgeResult = startRelayBridgeDetached({
+        relayUrl,
+        gatewayBaseUrl: localGatewayBaseUrl,
+      });
+      output.relayWorkerResult = bridgeResult;
+    } catch (error) {
+      output.relayWorkerResult = {
+        mode: "detached",
+        started: false,
+        error: String(error instanceof Error ? error.message : error),
+      };
+      console.warn(`Failed to start relay bridge worker: ${output.relayWorkerResult.error}`);
+    }
+  }
+
+  if (json) {
+    console.log(JSON.stringify(output, null, 2));
+  } else {
+    console.log(`Pair code: ${code}`);
+    console.log(`Transport Mode: ${transportMode}`);
+    if (publicBindUrl) console.log(`Public Bind URL: ${publicBindUrl}`);
+    console.log(`Local Bind URL: ${localBindUrl}`);
+    console.log(`Relay Bind URL: ${relayBindUrl}`);
+    console.log(`Published Gateway Base: ${publishedGatewayBaseUrl}`);
+    if (relayResult?.relayLookupUrl) {
+      console.log(`Relay Lookup: ${relayResult.relayLookupUrl}`);
+    }
+    if (relayCredentials?.gatewayId) {
+      console.log(`Relay Gateway ID: ${relayCredentials.gatewayId}`);
+    }
+    if (clientUserId) {
+      console.log(`Client User ID: ${clientUserId}`);
+    }
+    if (serveRelay) {
+      if (output.relayWorkerResult?.started) {
+        console.log("Relay bridge worker: started (detached)");
+      } else if (output.relayWorkerResult?.alreadyRunning) {
+        console.log(`Relay bridge worker: already running (${output.relayWorkerResult.mode})`);
+      } else {
+        console.log("Relay bridge worker: failed to start");
+      }
+    }
+    console.log(code);
+  }
+}
+
+async function runReset({ json, relay, noRelay, gateway }) {
+  const configPath = resolveOpenClawConfigPath();
+  const config = readJsonFile(configPath);
+  const section = readChannelSection(config);
+  const relayUrl = resolveRelayUrl({ relay, noRelay }, section);
+  const gatewayBaseUrl = resolveGatewayBaseUrl({ gateway }, config);
+  const accountId = normalizeAccountId(section.accountId);
+  const creds = resolveRelayCredentialsFromSection(section);
+
+  let activeBinding = null;
+  let relayResetResult = null;
+  if (relayUrl && creds.gatewayId && creds.gatewayToken) {
+    activeBinding = await readRelayGatewayBinding({
+      relayUrl,
+      gatewayId: creds.gatewayId,
+      gatewayToken: creds.gatewayToken,
+    });
+    relayResetResult = await resetRelayGatewayBinding({
+      relayUrl,
+      gatewayId: creds.gatewayId,
+      gatewayToken: creds.gatewayToken,
+    });
+  }
+
+  const stoppedBridges =
+    relayUrl && gatewayBaseUrl
+      ? stopBridgeProcesses({ relayUrl, gatewayBaseUrl })
+      : { count: 0, pids: [] };
+  const nextState = resetLocalBindingState({ accountId });
+
+  const output = {
+    command: "reset",
+    relayUrl: relayUrl || null,
+    gatewayBaseUrl,
+    previousGatewayId: creds.gatewayId || null,
+    clearedBinding: activeBinding,
+    relayReset:
+      relayResetResult == null
+        ? null
+        : {
+            ok: relayResetResult.ok,
+            notFound: relayResetResult.notFound,
+            clearedCodes: relayResetResult.clearedCodes,
+          },
+    stoppedBridgeCount: stoppedBridges.count,
+    nextGatewayId: nextState.state.relayGatewayId ?? null,
+    statePath: nextState.statePath,
+  };
+
+  if (json) {
+    console.log(JSON.stringify(output, null, 2));
+    return;
+  }
+
+  if (activeBinding) {
+    console.log(
+      `Cleared binding: ${activeBinding.clientUserId || "(unknown client)"}${
+        activeBinding.code ? ` · code ${activeBinding.code}` : ""
+      }`,
+    );
+  } else {
+    console.log("No active binding found on relay.");
+  }
+  if (relayResetResult?.ok) {
+    console.log("Relay binding reset: done");
+  } else if (relayResetResult?.notFound) {
+    console.log("Relay binding reset: nothing to clear");
+  } else {
+    console.log("Relay binding reset: skipped");
+  }
+  if (stoppedBridges.count > 0) {
+    console.log(`Stopped relay bridge processes: ${stoppedBridges.count}`);
+  }
+  console.log(`Local state reset: ${nextState.statePath}`);
+  console.log(`You can now run \`${CLI_COMMAND_NAME} pair <code>\` again.`);
+}
+
+function runSetup({
+  json,
+  account,
+  relay,
+  mode,
+  publicBase,
+  restart,
+}) {
+  const configPath = resolveOpenClawConfigPath();
+  let config = readJsonFile(configPath);
+  let section = readChannelSection(config);
+  const relayUrl = resolveRelayUrl({ relay, noRelay: false }, section);
+  if (!relayUrl) {
+    fail(
+      [
+        "setup requires relay URL.",
+        "Relay is enabled but no URL is available.",
+        `Use the built-in default (${DEFAULT_RELAY_URL}) or pass --relay <url> / TESTNEXTIM_RELAY_URL.`,
+      ].join("\n"),
+    );
+  }
+  const accountId = normalizeAccountId(account);
+
+  const prepared = prepareConfig({
+    config,
+  });
+  config = prepared.config;
+
+  const setupChanges = [...prepared.changes];
+  if (prepared.changed) {
+    writeJsonFile(configPath, config);
+  }
+  const persistedSettings = persistTestNextIMSettings({
+    bindPublicBaseUrl: publicBase,
+    transportMode: normalizeChatTransportMode(mode, "relay"),
+  });
+  section = readChannelSection(config);
+
+  if (relayUrl) {
+    const ensured = ensureRelayBridgeCredentials({
+      accountId: "default",
+      relayUrl,
+    });
+    section = ensured.section;
+    for (const item of ensured.changes) {
+      setupChanges.push(item);
+    }
+  }
+
+  let restartResult = null;
+  if (restart) {
+    restartResult = restartOpenClaw();
+  }
+
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          command: "setup",
+          configPath,
+          statePath: persistedSettings.statePath,
+          changed: setupChanges.length > 0,
+          changes: setupChanges,
+          restarted: restart,
+          accountId,
+          relayUrl: resolveRelayUrl({ relay: null, noRelay: false }, section),
+          transportMode: normalizeChatTransportMode(section.chatTransportMode, "relay"),
+          restartResult: restartResult
+            ? {
+                ok: restartResult.ok,
+                command: restartResult.command,
+                status: restartResult.status ?? 0,
+              }
+            : null,
+        },
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+
+  if (setupChanges.length > 0) {
+    console.log(`Updated config: ${configPath}`);
+    for (const item of setupChanges) {
+      console.log(`- ${item}`);
+    }
+  } else {
+    console.log(`Config already prepared: ${configPath}`);
+  }
+  console.log(`State file: ${persistedSettings.statePath}`);
+  console.log(`Chat transport mode: ${normalizeChatTransportMode(section.chatTransportMode, "relay")}`);
+  if (restart) {
+    if (restartResult?.ok) {
+      console.log("OpenClaw restarted.");
+    } else {
+      console.log("OpenClaw restart failed. You can run manually:");
+      console.log("  openclaw daemon restart");
+      if (restartResult?.stderr?.trim()) {
+        console.log(restartResult.stderr.trim());
+      }
+    }
+  }
+}
+
+function runPairUrl({ json, account, code: explicitCode }) {
+  const configPath = resolveOpenClawConfigPath();
+  const config = readJsonFile(configPath);
+  const section = readChannelSection(config);
+  const relayUrl = resolveRelayUrl({ relay: null, noRelay: false }, section);
+
+  const accountId = normalizeAccountId(account);
+  const code = explicitCode ? normalizeProvidedCode(explicitCode) : generatePairCode();
+  const bindPath = normalizePath(section.bindPath, DEFAULT_BIND_PATH);
+  const bindPublicBaseUrl =
+    (typeof section.bindPublicBaseUrl === "string"
+      ? section.bindPublicBaseUrl
+      : "") ||
+    process.env.OPENCLAW_TESTNEXTIM_PUBLIC_BASE_URL?.trim() ||
+    process.env.OPENCLAW_CUSTOM_IM_PUBLIC_BASE_URL?.trim() ||
+    "";
+  const bindUrl = buildBindUrl({
+    base: bindPublicBaseUrl,
+    bindPath,
+    accountId,
+    code,
+  });
+  const relayBindUrl = relayUrl
+    ? `${trimSlash(relayUrl)}/v1/pair-sessions/${encodeURIComponent(code)}/bind?${new URLSearchParams({ accountId, code }).toString()}`
+    : null;
+  const resolvedBindUrl = bindUrl || relayBindUrl;
+  if (!resolvedBindUrl) {
+    fail("unable to determine bindUrl");
+  }
+
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          command: "pair-url",
+          accountId,
+          code,
+          bindUrl: resolvedBindUrl,
+        },
+        null,
+        2,
+      ),
+    );
+    return;
+  }
+
+  console.log(resolvedBindUrl);
+}
+
+async function runBridge({ json, relay, noRelay, gateway }) {
+  const configPath = resolveOpenClawConfigPath();
+  const config = readJsonFile(configPath);
+  const section = readChannelSection(config);
+  const relayUrl = resolveRelayUrl({ relay, noRelay }, section);
+  const creds = resolveRelayCredentialsFromSection(section);
+  const gatewayBaseUrl = resolveGatewayBaseUrl({ gateway }, config);
+  const gatewayAuthToken = resolveGatewayAuthToken(config);
+
+  if (!relayUrl) {
+    fail(
+      [
+        "relay URL is required for bridge mode.",
+        "Relay is enabled but no URL is available.",
+        `Use the built-in default (${DEFAULT_RELAY_URL}) or pass --relay <url> / TESTNEXTIM_RELAY_URL.`,
+      ].join("\n"),
+    );
+  }
+  if (!creds.gatewayId) {
+    fail(`relay gateway ID is missing. run \`${CLI_COMMAND_NAME} pair <code>\` first`);
+  }
+  if (!creds.gatewayToken) {
+    fail(`relay gateway token is missing. run \`${CLI_COMMAND_NAME} pair <code>\` first`);
+  }
+
+  const bridgeLock = acquireBridgeLock({
+    relayUrl,
+    gatewayId: creds.gatewayId,
+    gatewayBaseUrl,
+  });
+  if (!bridgeLock.acquired) {
+    if (json) {
+      console.log(
+        JSON.stringify(
+          {
+            command: "bridge",
+            status: "already_running",
+            relayUrl,
+            gatewayId: creds.gatewayId,
+            gatewayBaseUrl,
+            ownerPid: bridgeLock.ownerPid ?? null,
+            lockPath: bridgeLock.lockPath,
+          },
+          null,
+          2,
+        ),
+      );
+    } else {
+      console.log(
+        [
+          "Relay bridge already running for this gateway.",
+          `relay=${relayUrl}`,
+          `gateway=${gatewayBaseUrl}`,
+          bridgeLock.ownerPid ? `owner pid=${bridgeLock.ownerPid}` : null,
+        ]
+          .filter(Boolean)
+          .join(" "),
+      );
+    }
+    return;
+  }
+
+  const cleanupBridgeLock = () => {
+    try {
+      bridgeLock.release?.();
+    } catch {}
+  };
+  process.on("exit", cleanupBridgeLock);
+  process.on("SIGINT", () => {
+    cleanupBridgeLock();
+    process.exit(0);
+  });
+  process.on("SIGTERM", () => {
+    cleanupBridgeLock();
+    process.exit(0);
+  });
+  process.on("SIGHUP", () => {
+    cleanupBridgeLock();
+    process.exit(0);
+  });
+
+  try {
+    if (json) {
+      console.log(
+        JSON.stringify(
+          {
+            command: "bridge",
+            status: "running",
+            relayUrl,
+            gatewayId: creds.gatewayId,
+            gatewayBaseUrl,
+            lockPath: bridgeLock.lockPath,
+          },
+          null,
+          2,
+        ),
+      );
+    }
+
+    await runRelayBridge({
+      relayUrl,
+      gatewayId: creds.gatewayId,
+      gatewayToken: creds.gatewayToken,
+      gatewayBaseUrl,
+      gatewayAuthToken,
+      json,
+    });
+  } finally {
+    cleanupBridgeLock();
+  }
+}
+
+function runStatus({ json }) {
+  const configPath = resolveOpenClawConfigPath();
+  const config = readJsonFile(configPath);
+  const section = readChannelSection(config);
+  const creds = resolveRelayCredentialsFromSection(section);
+
+  const status = {
+    configPath,
+    statePath: resolveTestNextIMStatePath(),
+    channel: "testnextim",
+    enabled: section?.enabled !== false,
+    name: section?.name ?? "TestNextIM",
+    bindPublicBaseUrl:
+      typeof section?.bindPublicBaseUrl === "string" ? section.bindPublicBaseUrl : null,
+    relayUrl: resolveRelayUrl({ relay: null, noRelay: false }, section),
+    transportMode: normalizeChatTransportMode(section?.chatTransportMode, "relay"),
+    gatewayBaseUrl: resolveGatewayBaseUrl({ gateway: null }, config),
+    webhookPath: normalizePath(section?.webhookPath, DEFAULT_WEBHOOK_PATH),
+    bindPath: normalizePath(section?.bindPath, DEFAULT_BIND_PATH),
+    hasAppSecret: Boolean(resolveAppSecret(section)),
+    hasAccessToken: Boolean(
+      typeof section?.accessToken === "string" && section.accessToken.trim(),
+    ),
+    relayGatewayId: creds.gatewayId || null,
+    hasRelayClientToken: Boolean(creds.clientToken),
+    hasRelayGatewayToken: Boolean(creds.gatewayToken),
+    linkedUserId:
+      typeof section?.linkedUserId === "string" && section.linkedUserId.trim()
+        ? section.linkedUserId.trim()
+        : null,
+  };
+
+  if (json) {
+    console.log(JSON.stringify(status, null, 2));
+    return;
+  }
+
+  console.log(`Config: ${status.configPath}`);
+  console.log(`Channel: ${status.channel}`);
+  console.log(`Enabled: ${status.enabled ? "yes" : "no"}`);
+  console.log(`Bind Base: ${status.bindPublicBaseUrl ?? "(not set)"}`);
+  console.log(`Relay URL: ${status.relayUrl ?? "(not set)"}`);
+  console.log(`Transport Mode: ${status.transportMode}`);
+  console.log(`Local Gateway Base: ${status.gatewayBaseUrl}`);
+  console.log(`Webhook Path: ${status.webhookPath}`);
+  console.log(`Bind Path: ${status.bindPath}`);
+  console.log(`Relay Gateway ID: ${status.relayGatewayId ?? "(missing)"}`);
+  console.log(`Relay Client Token: ${status.hasRelayClientToken ? "set" : "missing"}`);
+  console.log(`Relay Gateway Token: ${status.hasRelayGatewayToken ? "set" : "missing"}`);
+  console.log(`App Secret: ${status.hasAppSecret ? "set" : "missing"}`);
+  console.log(`Access Token: ${status.hasAccessToken ? "set" : "missing"}`);
+  console.log(`Linked User: ${status.linkedUserId ?? "(not linked)"}`);
+}
+
+async function main() {
+  const { command, options } = parseArgs(process.argv.slice(2));
+  switch (command) {
+    case "setup":
+    case "prepare":
+      runSetup(options);
+      return;
+    case "pair":
+      await runPair(options);
+      return;
+    case "reset":
+      await runReset(options);
+      return;
+    case "bridge":
+      await runBridge(options);
+      return;
+    case "pair-url":
+      runPairUrl(options);
+      return;
+    case "status":
+      runStatus(options);
+      return;
+    case "help":
+    default:
+      printHelp();
+  }
+}
+
+main().catch((error) => {
+  fail(String(error instanceof Error ? error.message : error));
+});