@nordbyte/nordrelay 0.5.2 → 0.7.0

package/plugins/nordrelay/scripts/nordrelay.mjs

@@ -35,6 +35,10 @@ function readRuntimePackageVersion() {
 function parseArgs(argv) {
   const copy = [...argv];
   let command = "foreground";
+  if (copy[0] === "--help" || copy[0] === "-h") {
+    command = "help";
+    copy.shift();
+  }
   if (copy[0] === "--version" || copy[0] === "-v") {
     command = "version";
     copy.shift();
@@ -53,6 +57,7 @@ function parseArgs(argv) {
     port: undefined,
     restartAfterUpdate: true,
     updateMethod: undefined,
+    buildBeforeStart: false,
   };
 
   for (let i = 0; i < copy.length; i += 1) {
@@ -63,9 +68,14 @@ function parseArgs(argv) {
     else if (arg === "--host") options.host = requireValue(copy, ++i, arg);
     else if (arg === "--port") options.port = Number.parseInt(requireValue(copy, ++i, arg), 10);
     else if (arg === "--method") options.updateMethod = requireValue(copy, ++i, arg);
+    else if (arg === "--build") options.buildBeforeStart = true;
     else if (arg === "--no-restart") options.restartAfterUpdate = false;
     else if (arg === "--restart") options.restartAfterUpdate = true;
     else if (arg === "--token") options.telegramBotToken = requireValue(copy, ++i, arg);
+    else if (arg === "--disable-telegram") options.disableTelegram = true;
+    else if (arg === "--enable-discord") options.enableDiscord = true;
+    else if (arg === "--discord-token") options.discordBotToken = requireValue(copy, ++i, arg);
+    else if (arg === "--discord-client-id") options.discordClientId = requireValue(copy, ++i, arg);
     else if (arg === "--admin-email") options.adminEmail = requireValue(copy, ++i, arg);
     else if (arg === "--admin-name") options.adminName = requireValue(copy, ++i, arg);
     else if (arg === "--admin-password") options.adminPassword = requireValue(copy, ++i, arg);
@@ -81,6 +91,9 @@ function parseArgs(argv) {
   options.pidFile = path.join(options.home, "nordrelay.pid");
   options.stateFile = path.join(options.home, "state.json");
   options.logFile = path.join(options.home, "nordrelay.log");
+  options.webPidFile = path.join(options.home, "nordrelay-web.pid");
+  options.webStateFile = path.join(options.home, "web-state.json");
+  options.webLogFile = path.join(options.home, "nordrelay-web.log");
   return options;
 }
 
@@ -175,6 +188,26 @@ async function readPid(pidFile) {
   }
 }
 
+async function readWebState(options) {
+  return await readJson(options.webStateFile, {});
+}
+
+async function readWebPid(options) {
+  return await readPid(options.webPidFile);
+}
+
+async function isWebDashboardRunning(options) {
+  return isProcessRunning(await readWebPid(options));
+}
+
+async function writeWebState(options, patch) {
+  await writeJsonAtomic(options.webStateFile, {
+    updatedAt: nowIso(),
+    logFile: options.webLogFile,
+    ...patch,
+  });
+}
+
 function resolveDashboardEndpoint(options, settings = {}) {
   const host = options.host || process.env.NORDRELAY_DASHBOARD_HOST || "127.0.0.1";
   const rawPort = options.port ?? Number.parseInt(process.env.NORDRELAY_DASHBOARD_PORT || "31878", 10);
@@ -199,6 +232,7 @@ function formatDashboardUrl(endpoint) {
 async function commandStart(options, settings = {}) {
   await mkdirp(options.home);
   loadEnvFiles(options.home);
+  await prepareRuntimeForLaunch(options);
   const dashboard = resolveDashboardEndpoint(options);
 
   const currentPid = await readPid(options.pidFile);
@@ -216,7 +250,7 @@ async function commandStart(options, settings = {}) {
   });
 
   const logFd = fs.openSync(options.logFile, "a");
-  const child = spawn(process.execPath, [SCRIPT_PATH, "foreground", ...options.rawFlags], {
+  const child = spawn(process.execPath, [SCRIPT_PATH, "foreground", ...runtimeForwardFlags(options.rawFlags)], {
     cwd: RUNTIME_ROOT,
     detached: true,
     env: process.env,
@@ -233,7 +267,9 @@ async function commandStart(options, settings = {}) {
     console.log(`Workspace: ${state.workspace || "-"}`);
     console.log(`Mode: ${state.sessionMode || "per Telegram context"}`);
     if (!settings.skipWebHint) {
-      console.log(`WebUI: ${formatDashboardUrl(dashboard)} (run \`nordrelay web\` to start it)`);
+      const webPid = await readWebPid(options);
+      const webHint = isProcessRunning(webPid) ? `(running with PID ${webPid})` : "(run `nordrelay web` to start it)";
+      console.log(`WebUI: ${formatDashboardUrl(dashboard)} ${webHint}`);
     }
     console.log(`Log: ${options.logFile}`);
     return;
@@ -251,7 +287,9 @@ async function commandStart(options, settings = {}) {
 
   console.log(`Started ${APP_NAME} ${VERSION} with PID ${child.pid}`);
   if (!settings.skipWebHint) {
-    console.log(`WebUI: ${formatDashboardUrl(dashboard)} (run \`nordrelay web\` to start it)`);
+    const webPid = await readWebPid(options);
+    const webHint = isProcessRunning(webPid) ? `(running with PID ${webPid})` : "(run `nordrelay web` to start it)";
+    console.log(`WebUI: ${formatDashboardUrl(dashboard)} ${webHint}`);
   }
   console.log(`Startup is still in progress. Log: ${options.logFile}`);
 }
@@ -286,7 +324,51 @@ async function waitForState(stateFile, pid, timeoutMs) {
   return await readJson(stateFile);
 }
 
-async function commandStop(options) {
+async function stopWebDashboard(options, settings = {}) {
+  const pid = await readWebPid(options);
+  if (!isProcessRunning(pid)) {
+    await fsp.rm(options.webPidFile, { force: true });
+    const state = await readWebState(options);
+    if (state.status === "running" || state.status === "starting") {
+      await writeWebState(options, { status: "stopped", pid: null });
+    }
+    if (!settings.quiet) {
+      console.log("WebUI is not running.");
+    }
+    return false;
+  }
+
+  process.kill(pid, "SIGTERM");
+  for (let i = 0; i < 40; i += 1) {
+    if (!isProcessRunning(pid)) break;
+    await sleep(250);
+  }
+
+  if (isProcessRunning(pid)) {
+    process.kill(pid, "SIGKILL");
+    for (let i = 0; i < 20; i += 1) {
+      if (!isProcessRunning(pid)) break;
+      await sleep(250);
+    }
+  }
+
+  if (isProcessRunning(pid)) {
+    console.log(`WebUI PID ${pid} did not exit after SIGTERM/SIGKILL.`);
+    process.exitCode = 1;
+    return false;
+  }
+  await fsp.rm(options.webPidFile, { force: true });
+  await writeWebState(options, { status: "stopped", pid: null });
+  if (!settings.quiet) {
+    console.log(`Stopped WebUI PID ${pid}.`);
+  }
+  return true;
+}
+
+async function commandStop(options, settings = {}) {
+  if (!settings.keepWeb) {
+    await stopWebDashboard(options);
+  }
   const pid = await readPid(options.pidFile);
   if (!isProcessRunning(pid)) {
     console.log("Connector is not running.");
@@ -313,10 +395,19 @@ async function commandStatus(options) {
   loadEnvFiles(options.home);
   const dashboard = resolveDashboardEndpoint(options);
   const pid = await readPid(options.pidFile);
+  const webPid = await readWebPid(options);
   const state = await readJson(options.stateFile, {});
+  const webState = await readWebState(options);
   const running = isProcessRunning(pid);
+  const webRunning = isProcessRunning(webPid);
+  const webStatus = webRunning ? "running" : webState.status === "running" || webState.status === "starting" ? "stale" : webState.status || "stopped";
+  if (!webRunning && (webState.status === "running" || webState.status === "starting")) {
+    await fsp.rm(options.webPidFile, { force: true });
+    await writeWebState(options, { status: "stopped", pid: null });
+  }
   console.log(`Status: ${state.status || (running ? "running" : "stopped")}`);
   console.log(`PID: ${pid || "-"} (${running ? "running" : "not running"})`);
+  console.log(`WebUI PID: ${webPid || "-"} (${webRunning ? "running" : "not running"})`);
   console.log(`Workspace: ${state.workspace || "-"}`);
   console.log(`Mode: ${state.sessionMode || "per Telegram context"}`);
   console.log(`Auth: ${state.authenticated === undefined ? "-" : state.authenticated ? "yes" : "no"}`);
@@ -326,8 +417,11 @@ async function commandStatus(options) {
   console.log(`OpenClaw CLI: ${state.openClawCli || "-"}`);
   console.log(`Claude Code CLI: ${state.claudeCodeCli || "-"}`);
   console.log(`OpenClaw Gateway: ${state.openClawGateway || process.env.OPENCLAW_GATEWAY_URL || "-"}`);
-  console.log(`WebUI: ${formatDashboardUrl(dashboard)}`);
+  console.log(`Peers: ${state.peerEnabled ? state.peerUrl || "enabled" : "disabled"}`);
+  if (state.peerTlsFingerprint) console.log(`Peer TLS fingerprint: ${state.peerTlsFingerprint}`);
+  console.log(`WebUI: ${formatDashboardUrl(dashboard)} (${webStatus})`);
   console.log(`Log: ${options.logFile}`);
+  console.log(`WebUI log: ${options.webLogFile}`);
   if (state.error) console.log(`Error: ${state.error}`);
 }
 
@@ -579,9 +673,17 @@ async function commandInit(options) {
     return;
   }
 
-  const telegramBotToken = options.telegramBotToken ||
-    process.env.TELEGRAM_BOT_TOKEN ||
-    await ask(null, "Telegram bot token", "");
+  const enableTelegram = options.disableTelegram ? "false" : await askChoice(null, "Enable Telegram", "true");
+  const telegramBotToken = enableTelegram === "true"
+    ? options.telegramBotToken || process.env.TELEGRAM_BOT_TOKEN || await ask(null, "Telegram bot token", "")
+    : "";
+  const enableDiscord = options.enableDiscord ? "true" : await askChoice(null, "Enable Discord", "false");
+  const discordBotToken = enableDiscord === "true"
+    ? options.discordBotToken || process.env.DISCORD_BOT_TOKEN || await ask(null, "Discord bot token", "")
+    : "";
+  const discordClientId = enableDiscord === "true"
+    ? options.discordClientId || process.env.DISCORD_CLIENT_ID || await ask(null, "Discord client ID", "")
+    : "";
   const adminEmail = options.adminEmail || await ask(null, "Admin email", "");
   const adminName = options.adminName || await ask(null, "Admin name", "Admin");
   const adminPassword = options.adminPassword || await askSecret(null, "Admin password", "");
@@ -593,7 +695,9 @@ async function commandInit(options) {
   const enableClaudeCode = options.enableClaudeCode ? "true" : await askChoice(null, "Enable Claude Code", "false");
   const stateBackend = options.stateBackend || await askChoice(null, "State backend (json/sqlite)", "json");
 
-  if (!telegramBotToken) throw new Error("Telegram bot token is required.");
+  if (enableTelegram === "true" && !telegramBotToken) throw new Error("Telegram bot token is required when Telegram is enabled.");
+  if (enableDiscord === "true" && !discordBotToken) throw new Error("Discord bot token is required when Discord is enabled.");
+  if (enableTelegram !== "true" && enableDiscord !== "true") throw new Error("At least one chat adapter must be enabled.");
   if (!adminEmail) throw new Error("Admin email is required.");
   if (!adminPassword) throw new Error("Admin password is required.");
   if (enableCodex !== "true" && enablePi !== "true" && enableHermes !== "true" && enableOpenClaw !== "true" && enableClaudeCode !== "true") throw new Error("At least one agent must be enabled.");
@@ -610,7 +714,14 @@ async function commandInit(options) {
   const lines = [
     "# NordRelay local runtime config.",
     "# Keep this file private; it contains bot credentials.",
+    `TELEGRAM_ENABLED=${enableTelegram}`,
     `TELEGRAM_BOT_TOKEN=${telegramBotToken}`,
+    `DISCORD_ENABLED=${enableDiscord}`,
+    `DISCORD_BOT_TOKEN=${discordBotToken}`,
+    `DISCORD_CLIENT_ID=${discordClientId}`,
+    "DISCORD_COMMAND_MODE=both",
+    "DISCORD_MESSAGE_CONTENT_ENABLED=true",
+    "DISCORD_AUTO_REGISTER_COMMANDS=true",
     `NORDRELAY_CODEX_ENABLED=${enableCodex}`,
     `NORDRELAY_PI_ENABLED=${enablePi}`,
     `NORDRELAY_HERMES_ENABLED=${enableHermes}`,
@@ -625,6 +736,11 @@ async function commandInit(options) {
     "OPENCLAW_DEFAULT_PROFILE=default",
     "CLAUDE_CODE_DEFAULT_PROFILE=default",
     "CLAUDE_CODE_MAX_TURNS=100",
+    "NORDRELAY_PEER_ENABLED=false",
+    "NORDRELAY_PEER_HOST=127.0.0.1",
+    "NORDRELAY_PEER_PORT=31979",
+    "NORDRELAY_PEER_TLS_ENABLED=true",
+    "NORDRELAY_PEER_REQUIRE_TLS=true",
     `NORDRELAY_STATE_BACKEND=${stateBackend === "sqlite" ? "sqlite" : "json"}`,
     "TELEGRAM_TRANSPORT=polling",
     "TELEGRAM_AUTO_SEND_ARTIFACTS=false",
@@ -653,6 +769,142 @@ async function createUserStore(home) {
   return new mod.UserStore(home);
 }
 
+async function peerModules() {
+  const required = [
+    "peer-store.js",
+    "peer-identity.js",
+    "peer-client.js",
+  ];
+  for (const file of required) {
+    const modulePath = path.join(RUNTIME_ROOT, "dist", file);
+    if (!fs.existsSync(modulePath)) {
+      throw new Error(`Missing peer runtime. Run \`npm run build\` in ${RUNTIME_ROOT}.`);
+    }
+  }
+  const [store, identity, client] = await Promise.all(required.map((file) => import(pathToFileURL(path.join(RUNTIME_ROOT, "dist", file)).href)));
+  return { store, identity, client };
+}
+
+function parsePeerFlags(argv) {
+  const copy = [...argv];
+  const subcommand = copy[0] && !copy[0].startsWith("-") ? copy.shift() : "list";
+  const flags = { subcommand, url: undefined };
+  if (["add", "test", "revoke"].includes(subcommand) && copy[0] && !copy[0].startsWith("-")) {
+    flags.url = copy.shift();
+    flags.id = flags.url;
+  }
+  for (let i = 0; i < copy.length; i += 1) {
+    const arg = copy[i];
+    if (arg === "--name") flags.name = requireValue(copy, ++i, arg);
+    else if (arg === "--code") flags.code = requireValue(copy, ++i, arg);
+    else if (arg === "--public-url") flags.publicUrl = requireValue(copy, ++i, arg);
+    else if (arg === "--expires" || arg === "--expires-minutes") flags.expiresMinutes = Number.parseInt(requireValue(copy, ++i, arg), 10);
+    else if (arg === "--scopes") flags.scopes = requireValue(copy, ++i, arg);
+    else if (arg === "--agents") flags.agents = requireValue(copy, ++i, arg);
+    else if (arg === "--workspaces") flags.workspaces = requireValue(copy, ++i, arg);
+    else if (arg === "--workspace-aliases" || arg === "--aliases") flags.workspaceAliases = requireValue(copy, ++i, arg);
+  }
+  return flags;
+}
+
+function csv(value) {
+  return value ? value.split(",").map((item) => item.trim()).filter(Boolean) : undefined;
+}
+
+function aliasMap(value) {
+  if (!value) return undefined;
+  return Object.fromEntries(value.split(",").map((item) => item.split("=", 2).map((part) => part.trim())).filter(([alias, workspace]) => alias && workspace));
+}
+
+async function commandPeer(options) {
+  await mkdirp(options.home);
+  loadEnvFiles(options.home);
+  const flags = parsePeerFlags(options.rawFlags);
+  const { store: storeMod, identity: identityMod, client: clientMod } = await peerModules();
+  const store = new storeMod.PeerStore(options.home);
+  const identity = identityMod.loadOrCreatePeerIdentity(options.home, process.env.NORDRELAY_PEER_NAME);
+
+  if (flags.subcommand === "identity") {
+    console.log(`Node ID: ${identity.public.nodeId}`);
+    console.log(`Name: ${identity.public.name}`);
+    console.log(`Fingerprint: ${identity.public.fingerprint}`);
+    console.log(`Created: ${identity.public.createdAt}`);
+    return;
+  }
+
+  if (flags.subcommand === "list") {
+    const peers = store.listPublic();
+    if (peers.length === 0) {
+      console.log("No peers configured.");
+      console.log("Create an invite with `nordrelay peer invite` or add a peer with `nordrelay peer add <url> --code <code>`.");
+      return;
+    }
+    for (const peer of peers) {
+      console.log(`${peer.id} ${peer.enabled ? "enabled" : "disabled"} ${peer.name}`);
+      console.log(`  URL: ${peer.url || "-"}`);
+      console.log(`  Node: ${peer.nodeId} ${peer.fingerprint}`);
+      console.log(`  Direction: ${peer.direction}`);
+      console.log(`  Scopes: ${peer.scopes.join(",") || "-"}`);
+      console.log(`  Agents: ${peer.allowedAgents.join(",") || "all"}`);
+      const aliases = Object.entries(peer.workspaceAliases || {}).map(([alias, workspace]) => `${alias}=${workspace}`).join(",");
+      if (aliases) console.log(`  Workspace aliases: ${aliases}`);
+      if (peer.lastSeenAt) console.log(`  Last seen: ${peer.lastSeenAt}`);
+      if (peer.lastLatencyMs !== undefined) console.log(`  Latency: ${peer.lastLatencyMs}ms`);
+      if (peer.remoteVersion) console.log(`  Remote version: ${peer.remoteVersion}`);
+      if (peer.lastError) console.log(`  Last error: ${peer.lastError}`);
+    }
+    return;
+  }
+
+  if (flags.subcommand === "invite") {
+    const url = process.env.NORDRELAY_PEER_PUBLIC_URL || `${process.env.NORDRELAY_PEER_TLS_ENABLED === "false" ? "http" : "https"}://${process.env.NORDRELAY_PEER_HOST || "127.0.0.1"}:${process.env.NORDRELAY_PEER_PORT || "31979"}`;
+    const created = store.createInvitation({
+      name: flags.name,
+      expiresInMs: Number.isFinite(flags.expiresMinutes) ? flags.expiresMinutes * 60 * 1000 : undefined,
+      scopes: csv(flags.scopes),
+      allowedAgents: csv(flags.agents),
+      allowedWorkspaceRoots: csv(flags.workspaces),
+      workspaceAliases: aliasMap(flags.workspaceAliases),
+    });
+    console.log(`Pairing code: ${created.code}`);
+    console.log(`Expires: ${created.invitation.expiresAt}`);
+    console.log(`Fingerprint: ${identity.public.fingerprint}`);
+    console.log(`Command: nordrelay peer add ${url} --code ${created.code}`);
+    return;
+  }
+
+  if (flags.subcommand === "add") {
+    const url = flags.url || await ask(null, "Peer URL", "");
+    const code = flags.code || await ask(null, "Pairing code", "");
+    const result = await clientMod.pairPeer({
+      url,
+      code,
+      name: flags.name,
+      publicUrl: flags.publicUrl,
+    }, identity, store);
+    console.log(`Added peer ${result.peer.name} (${result.peer.id}).`);
+    console.log(`Node: ${result.peer.nodeId}`);
+    console.log(`Fingerprint: ${result.peer.fingerprint}`);
+    if (result.tlsFingerprint) console.log(`TLS fingerprint: ${result.tlsFingerprint}`);
+    return;
+  }
+
+  if (flags.subcommand === "test") {
+    const id = flags.id || await ask(null, "Peer id", "");
+    const response = await new clientMod.RemoteRelayClient(store).rpc(id, "peer.ping");
+    console.log(`Peer ${id} ok: ${JSON.stringify(response)}`);
+    return;
+  }
+
+  if (flags.subcommand === "revoke") {
+    const id = flags.id || await ask(null, "Peer id", "");
+    console.log(store.revokePeer(id) ? `Revoked peer ${id}.` : `Peer not found: ${id}`);
+    return;
+  }
+
+  throw new Error("Usage: nordrelay peer [identity|list|invite|add|test|revoke]");
+}
+
 function parseUserFlags(argv) {
   const copy = [...argv];
   const subcommand = copy[0] && !copy[0].startsWith("-") ? copy.shift() : "list";
@@ -664,6 +916,7 @@ function parseUserFlags(argv) {
     else if (arg === "--password") flags.password = requireValue(copy, ++i, arg);
     else if (arg === "--group" || arg === "--groups") flags.groups = requireValue(copy, ++i, arg);
     else if (arg === "--telegram-user-id") flags.telegramUserId = Number.parseInt(requireValue(copy, ++i, arg), 10);
+    else if (arg === "--discord-user-id") flags.discordUserId = requireValue(copy, ++i, arg);
     else if (arg === "--user-id") flags.userId = requireValue(copy, ++i, arg);
   }
   return flags;
@@ -695,8 +948,8 @@ async function commandUser(options) {
       ? ["admin"]
       : (flags.groups ? flags.groups.split(",").map((item) => item.trim()).filter(Boolean) : ["user"]);
     const created = flags.subcommand === "create-admin"
-      ? store.createAdmin({ email, displayName: name, password, telegramUserId: flags.telegramUserId })
-      : store.createUser({ email, displayName: name, password, groupIds, telegramUserId: flags.telegramUserId });
+      ? store.createAdmin({ email, displayName: name, password, telegramUserId: flags.telegramUserId, discordUserId: flags.discordUserId })
+      : store.createUser({ email, displayName: name, password, groupIds, telegramUserId: flags.telegramUserId, discordUserId: flags.discordUserId });
     console.log(`Created user ${created.user.email} (${created.groups.map((group) => group.name).join(", ")}).`);
     return;
   }
@@ -721,7 +974,17 @@ async function commandUser(options) {
     return;
   }
 
-  if (flags.subcommand === "link-code") {
+  if (flags.subcommand === "link-discord") {
+    const email = flags.email || await ask(null, "Email", "");
+    const discordUserId = flags.discordUserId || await ask(null, "Discord user id", "");
+    const user = store.getUserByEmail(email);
+    if (!user) throw new Error(`User not found: ${email}`);
+    store.linkDiscordUser(user.user.id, { discordUserId });
+    console.log(`Linked Discord user ${discordUserId} to ${user.user.email}.`);
+    return;
+  }
+
+  if (flags.subcommand === "link-code" || flags.subcommand === "telegram-link-code") {
     const email = flags.email || await ask(null, "Email", "");
     const user = store.getUserByEmail(email);
     if (!user) throw new Error(`User not found: ${email}`);
@@ -731,7 +994,17 @@ async function commandUser(options) {
     return;
   }
 
-  throw new Error("Usage: nordrelay user [list|create-admin|create|reset-password|link-telegram|link-code]");
+  if (flags.subcommand === "discord-link-code") {
+    const email = flags.email || await ask(null, "Email", "");
+    const user = store.getUserByEmail(email);
+    if (!user) throw new Error(`User not found: ${email}`);
+    const code = store.createDiscordLinkCode(user.user.id);
+    console.log(`Discord link code for ${user.user.email}: ${code.code}`);
+    console.log(`Expires: ${code.expiresAt}`);
+    return;
+  }
+
+  throw new Error("Usage: nordrelay user [list|create-admin|create|reset-password|link-telegram|link-discord|link-code|telegram-link-code|discord-link-code]");
 }
 
 async function commandDoctor(options) {
@@ -741,11 +1014,39 @@ async function commandDoctor(options) {
   const userSnapshot = userStore?.snapshot();
   const checks = [];
   checks.push(check("Node.js >= 22", Number.parseInt(process.versions.node.split(".")[0], 10) >= 22, process.version));
-  checks.push(check("Telegram bot token", Boolean(process.env.TELEGRAM_BOT_TOKEN), process.env.TELEGRAM_BOT_TOKEN ? "configured" : "missing"));
+  const telegramRequested = process.env.TELEGRAM_ENABLED !== "false";
+  const discordRequested = process.env.DISCORD_ENABLED === "true";
+  const telegramUsable = telegramRequested && Boolean(process.env.TELEGRAM_BOT_TOKEN);
+  const discordUsable = discordRequested && Boolean(process.env.DISCORD_BOT_TOKEN);
+  checks.push(check(
+    "Telegram bot token",
+    !telegramRequested || telegramUsable,
+    telegramRequested ? (telegramUsable ? "configured" : "missing; Telegram adapter will be disabled") : "disabled",
+    telegramRequested && !discordUsable ? "fail" : "warn",
+  ));
+  checks.push(check(
+    "Discord bot token",
+    !discordRequested || discordUsable,
+    discordRequested ? (discordUsable ? "configured" : "missing; Discord adapter will be disabled") : "disabled",
+    discordRequested && !telegramUsable ? "fail" : "warn",
+  ));
+  checks.push(check(
+    "Usable chat adapter",
+    telegramUsable || discordUsable,
+    telegramUsable && discordUsable ? "Telegram and Discord" : telegramUsable ? "Telegram" : discordUsable ? "Discord" : "none",
+    "fail",
+  ));
+  checks.push(check("Discord client ID", !discordUsable || Boolean(process.env.DISCORD_CLIENT_ID), discordUsable ? (process.env.DISCORD_CLIENT_ID ? "configured" : "missing; slash command auto-registration disabled") : "disabled", "warn"));
   checks.push(check("User store", Boolean(userStore), userStore ? userStore.filePath : "missing runtime", userStore ? "pass" : "fail"));
   checks.push(check("Admin user", Boolean(userSnapshot?.adminConfigured), userSnapshot?.adminConfigured ? "configured" : "missing"));
   checks.push(check("WebUI login", true, "required for every dashboard request"));
   checks.push(check("Telegram access", true, "requires linked active users and enabled group chats"));
+  checks.push(check("Discord access", true, "requires linked active users and enabled channels"));
+  const peerEnabled = process.env.NORDRELAY_PEER_ENABLED === "true";
+  const peerTlsEnabled = process.env.NORDRELAY_PEER_TLS_ENABLED !== "false";
+  const peerHost = process.env.NORDRELAY_PEER_HOST || "127.0.0.1";
+  checks.push(check("Peer server", peerEnabled, peerEnabled ? `${peerHost}:${process.env.NORDRELAY_PEER_PORT || "31979"}` : "disabled", "warn"));
+  checks.push(check("Peer TLS", !peerEnabled || peerTlsEnabled || isLoopbackName(peerHost), peerTlsEnabled ? "enabled" : "plaintext loopback only", peerEnabled ? "fail" : "warn"));
   checks.push(check("Codex enabled flag", process.env.NORDRELAY_CODEX_ENABLED !== "false", `NORDRELAY_CODEX_ENABLED=${process.env.NORDRELAY_CODEX_ENABLED ?? "true"}`));
   checks.push(check("Pi enabled flag", process.env.NORDRELAY_PI_ENABLED === "true" || process.env.NORDRELAY_PI_ENABLED === undefined, `NORDRELAY_PI_ENABLED=${process.env.NORDRELAY_PI_ENABLED ?? "false"}`, process.env.NORDRELAY_PI_ENABLED === "true" ? "pass" : "warn"));
   checks.push(check("Hermes enabled flag", process.env.NORDRELAY_HERMES_ENABLED === "true", `NORDRELAY_HERMES_ENABLED=${process.env.NORDRELAY_HERMES_ENABLED ?? "false"}`, process.env.NORDRELAY_HERMES_ENABLED === "true" ? "pass" : "warn"));
@@ -850,8 +1151,22 @@ async function checkOpenClawGateway() {
 async function commandWeb(options) {
   await mkdirp(options.home);
   loadEnvFiles(options.home);
-  const { host, port } = resolveDashboardEndpoint(options, { strict: true });
+  await prepareRuntimeForLaunch(options);
   await ensureConnectorStartedForWeb(options);
+  await startWebDashboard(options, { detached: false });
+}
+
+async function startWebDashboard(options, settings = {}) {
+  await mkdirp(options.home);
+  loadEnvFiles(options.home);
+  const { host, port } = resolveDashboardEndpoint(options, { strict: true });
+  const currentPid = await readWebPid(options);
+  if (isProcessRunning(currentPid)) {
+    console.log(`NordRelay dashboard already running with PID ${currentPid}.`);
+    console.log(`NordRelay dashboard: ${formatDashboardUrl({ host, port })}`);
+    return;
+  }
+  await fsp.rm(options.webPidFile, { force: true });
   const entry = await resolveWebRuntimeEntry();
   if (!entry) {
     throw new Error(`Missing dashboard runtime. Run \`npm install\` and \`npm run build\` in ${RUNTIME_ROOT}.`);
@@ -864,12 +1179,43 @@ async function commandWeb(options) {
     NORDRELAY_DASHBOARD_HOST: host,
     NORDRELAY_DASHBOARD_PORT: String(port),
   };
+  await writeWebState(options, {
+    status: "starting",
+    pid: null,
+    host,
+    port,
+    url: formatDashboardUrl({ host, port }),
+  });
+  const stdio = settings.detached
+    ? ["ignore", fs.openSync(options.webLogFile, "a"), fs.openSync(options.webLogFile, "a")]
+    : "inherit";
   const child = spawn(entry.command, [...entry.args, "--host", host, "--port", String(port), "--home", options.home], {
     cwd: RUNTIME_ROOT,
     env,
-    stdio: "inherit",
+    detached: Boolean(settings.detached),
+    stdio,
+  });
+  await fsp.writeFile(options.webPidFile, `${child.pid}\n`);
+  await writeWebState(options, {
+    status: "running",
+    pid: child.pid,
+    host,
+    port,
+    url: formatDashboardUrl({ host, port }),
   });
 
+  if (settings.detached) {
+    child.unref();
+    if (Array.isArray(stdio)) {
+      fs.closeSync(stdio[1]);
+      fs.closeSync(stdio[2]);
+    }
+    console.log(`NordRelay dashboard started with PID ${child.pid}.`);
+    console.log(`NordRelay dashboard: ${formatDashboardUrl({ host, port })}`);
+    console.log(`WebUI log: ${options.webLogFile}`);
+    return;
+  }
+
   const forwardSignal = (signal) => {
     if (isProcessRunning(child.pid)) {
       child.kill(signal);
@@ -878,9 +1224,23 @@ async function commandWeb(options) {
   process.once("SIGINT", () => forwardSignal("SIGINT"));
   process.once("SIGTERM", () => forwardSignal("SIGTERM"));
 
-  const exit = await new Promise((resolve) => {
+  const exit = await new Promise((resolve, reject) => {
+    child.once("error", reject);
     child.once("exit", (code, signal) => resolve({ code, signal }));
   });
+  const pid = await readWebPid(options);
+  if (pid === child.pid) {
+    await fsp.rm(options.webPidFile, { force: true });
+  }
+  await writeWebState(options, {
+    status: exit.code === 0 ? "stopped" : "error",
+    pid: null,
+    host,
+    port,
+    url: formatDashboardUrl({ host, port }),
+    exitCode: exit.code,
+    signal: exit.signal,
+  });
   if (exit.signal) {
     process.kill(process.pid, exit.signal);
     return;
@@ -891,6 +1251,7 @@ async function commandWeb(options) {
 async function commandForeground(options) {
   await mkdirp(options.home);
   loadEnvFiles(options.home);
+  await prepareRuntimeForLaunch(options);
   process.chdir(RUNTIME_ROOT);
 
   await writeJsonAtomic(options.stateFile, {
@@ -976,6 +1337,157 @@ async function resolveRuntimeEntry() {
   return null;
 }
 
+async function prepareRuntimeForLaunch(options) {
+  if (options.buildBeforeStart) {
+    await buildRuntime();
+    options.buildBeforeStart = false;
+    return;
+  }
+  warnIfRuntimeBuildIsStale();
+}
+
+function runtimeForwardFlags(flags) {
+  return flags.filter((flag) => flag !== "--build");
+}
+
+async function buildRuntime() {
+  if (!isSourceRuntime()) {
+    throw new Error(`Runtime build is only available from a source checkout. Current runtime: ${RUNTIME_ROOT}`);
+  }
+  const npm = resolveNpmSpawnCommand();
+  if (!npm) {
+    throw new Error("npm was not found. Install Node.js/npm or add npm to PATH.");
+  }
+  console.log("Building NordRelay runtime...");
+  await runInteractiveStep("Build runtime", npm.command, [...npm.argsPrefix, "run", "build"], {
+    cwd: RUNTIME_ROOT,
+    shell: npm.shell,
+  });
+}
+
+function warnIfRuntimeBuildIsStale() {
+  const status = runtimeBuildStatus();
+  if (!status || !status.stale) {
+    return;
+  }
+  const source = status.sourcePath ? path.relative(RUNTIME_ROOT, status.sourcePath) : "source files";
+  const target = status.targetPath ? path.relative(RUNTIME_ROOT, status.targetPath) : "dist";
+  const reason = status.missing
+    ? `missing ${target}`
+    : `${source} is newer than ${target}`;
+  console.warn(`Warning: NordRelay runtime build may be stale (${reason}). Run \`nordrelay restart --build\` or \`npm run build\`.`);
+}
+
+function runtimeBuildStatus() {
+  if (!isSourceRuntime()) {
+    return null;
+  }
+  const source = newestMtime([
+    path.join(RUNTIME_ROOT, "src"),
+    path.join(RUNTIME_ROOT, "plugins", "nordrelay", "scripts"),
+    path.join(RUNTIME_ROOT, "scripts"),
+    path.join(RUNTIME_ROOT, "package.json"),
+    path.join(RUNTIME_ROOT, "tsconfig.json"),
+    path.join(RUNTIME_ROOT, "tsconfig.webui.json"),
+  ]);
+  const distTargets = [
+    path.join(RUNTIME_ROOT, "dist", "index.js"),
+    path.join(RUNTIME_ROOT, "dist", "web-dashboard.js"),
+    path.join(RUNTIME_ROOT, "dist", "webui-assets", "dashboard.js"),
+    path.join(RUNTIME_ROOT, "dist", "webui-assets", "dashboard.css"),
+  ];
+  const missingTarget = distTargets.find((target) => !fs.existsSync(target));
+  if (missingTarget) {
+    return {
+      stale: true,
+      missing: true,
+      sourcePath: source.path,
+      sourceMtimeMs: source.mtimeMs,
+      targetPath: missingTarget,
+      targetMtimeMs: 0,
+    };
+  }
+  const target = oldestMtime(distTargets);
+  return {
+    stale: source.mtimeMs > target.mtimeMs,
+    missing: false,
+    sourcePath: source.path,
+    sourceMtimeMs: source.mtimeMs,
+    targetPath: target.path,
+    targetMtimeMs: target.mtimeMs,
+  };
+}
+
+function isSourceRuntime() {
+  return fs.existsSync(path.join(RUNTIME_ROOT, "src", "index.ts")) &&
+    fs.existsSync(path.join(RUNTIME_ROOT, "scripts", "build-web-assets.mjs"));
+}
+
+function newestMtime(paths) {
+  let newest = { path: null, mtimeMs: 0 };
+  for (const itemPath of paths) {
+    const candidate = newestMtimeForPath(itemPath);
+    if (candidate.mtimeMs > newest.mtimeMs) {
+      newest = candidate;
+    }
+  }
+  return newest;
+}
+
+function newestMtimeForPath(itemPath) {
+  if (!fs.existsSync(itemPath)) {
+    return { path: itemPath, mtimeMs: 0 };
+  }
+  const stat = fs.statSync(itemPath);
+  if (!stat.isDirectory()) {
+    return { path: itemPath, mtimeMs: stat.mtimeMs };
+  }
+  let newest = { path: itemPath, mtimeMs: stat.mtimeMs };
+  for (const entry of fs.readdirSync(itemPath, { withFileTypes: true })) {
+    if (entry.name === "node_modules" || entry.name === "dist" || entry.name === ".git") {
+      continue;
+    }
+    const candidate = newestMtimeForPath(path.join(itemPath, entry.name));
+    if (candidate.mtimeMs > newest.mtimeMs) {
+      newest = candidate;
+    }
+  }
+  return newest;
+}
+
+function oldestMtime(paths) {
+  let oldest = { path: null, mtimeMs: Number.POSITIVE_INFINITY };
+  for (const itemPath of paths) {
+    const mtimeMs = fs.statSync(itemPath).mtimeMs;
+    if (mtimeMs < oldest.mtimeMs) {
+      oldest = { path: itemPath, mtimeMs };
+    }
+  }
+  return oldest;
+}
+
+async function runInteractiveStep(label, command, args, settings = {}) {
+  console.log(`${label}: ${formatCommand(command, args)}`);
+  const useShell = Boolean(settings.shell);
+  const child = spawn(useShell ? formatShellCommand(command, args) : command, useShell ? [] : args, {
+    cwd: settings.cwd || RUNTIME_ROOT,
+    env: process.env,
+    shell: useShell,
+    stdio: "inherit",
+    windowsHide: false,
+  });
+  const exit = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+  if (exit.signal) {
+    throw new Error(`${label} stopped with signal ${exit.signal}`);
+  }
+  if (exit.code !== 0) {
+    throw new Error(`${label} failed with exit code ${exit.code ?? "unknown"}`);
+  }
+}
+
 async function resolveWebRuntimeEntry() {
   const distEntry = path.join(RUNTIME_ROOT, "dist", "web-dashboard.js");
   if (fs.existsSync(distEntry)) {
@@ -1121,6 +1633,10 @@ function isWindowsShellScript(filePath) {
   return process.platform === "win32" && /\.(?:cmd|bat)$/i.test(filePath);
 }
 
+function isLoopbackName(host) {
+  return host === "127.0.0.1" || host === "::1" || host === "localhost";
+}
+
 function validateStateBackend() {
   const backend = process.env.NORDRELAY_STATE_BACKEND || "json";
   if (backend === "json") return { ok: true, detail: "NORDRELAY_STATE_BACKEND=json" };
@@ -1164,19 +1680,61 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+function printHelp() {
+  console.log(`${APP_NAME} ${VERSION}`);
+  console.log("");
+  console.log("Usage: nordrelay <command> [options]");
+  console.log("");
+  console.log("Commands:");
+  console.log("  init                 Create local config and first admin user");
+  console.log("  user                 Manage users, groups, and channel links");
+  console.log("  peer                 Manage secure NordRelay peer federation");
+  console.log("  doctor               Validate the local setup");
+  console.log("  web, dashboard       Start the WebUI and connector");
+  console.log("  start                Start the connector");
+  console.log("  stop                 Stop the connector and WebUI");
+  console.log("  restart              Restart the connector");
+  console.log("  status               Show connector and WebUI status");
+  console.log("  update               Update NordRelay");
+  console.log("  foreground           Run the connector in the foreground");
+  console.log("  version              Print the installed version");
+  console.log("");
+  console.log("Options:");
+  console.log("  --home <path>        Runtime home directory");
+  console.log("  --host <host>        WebUI bind host");
+  console.log("  --port <port>        WebUI port");
+  console.log("  --build              Build source runtime before start/web/restart");
+  console.log("  --force              Overwrite existing config during init");
+  console.log("  --help, -h           Show this help");
+  console.log("  --version, -v        Show the installed version");
+}
+
 async function main() {
   const options = parseArgs(process.argv.slice(2));
+  if (options.command === "help") {
+    printHelp();
+    return;
+  }
   if (options.command === "start") return commandStart(options);
   if (options.command === "stop") return commandStop(options);
   if (options.command === "status") return commandStatus(options);
   if (options.command === "init") return commandInit(options);
   if (options.command === "user") return commandUser(options);
+  if (options.command === "peer") return commandPeer(options);
   if (options.command === "doctor") return commandDoctor(options);
   if (options.command === "update") return commandUpdate(options);
   if (options.command === "web" || options.command === "dashboard") return commandWeb(options);
   if (options.command === "restart") {
+    await mkdirp(options.home);
+    loadEnvFiles(options.home);
+    await prepareRuntimeForLaunch(options);
+    const webWasRunning = await isWebDashboardRunning(options);
     await commandStop(options);
-    return commandStart(options);
+    await commandStart(options);
+    if (webWasRunning && process.exitCode !== 1) {
+      await startWebDashboard(options, { detached: true });
+    }
+    return;
   }
   if (options.command === "foreground") return commandForeground(options);
   if (options.command === "--version" || options.command === "version") {
@@ -1185,7 +1743,8 @@ async function main() {
   }
 
   console.error(`Unknown command: ${options.command}`);
-  console.error("Usage: nordrelay [init|user|doctor|web|start|stop|restart|status|update|foreground|version]");
+  console.error("Usage: nordrelay [init|user|peer|doctor|web|start|stop|restart|status|update|foreground|version]");
+  console.error("Run `nordrelay --help` for details.");
   process.exitCode = 2;
 }