@simonyea/holysheep-cli 2.1.51 → 2.1.53

package/dist/configure-worker.js

@@ -1399,7 +1399,7 @@ var require_codex = __commonJS({
       }
       const content = stripManagedTomlConfig(readTomlConfig());
       const newConfig = [
-        `model = "${model || "gpt-5.4"}"`,
+        `model = "${model || "gpt-5.5"}"`,
         `model_provider = "holysheep"`,
         "",
         content,
@@ -1422,7 +1422,7 @@ var require_codex = __commonJS({
         if (fs.existsSync(CONFIG_FILE_JSON)) {
           jsonConfig = JSON.parse(fs.readFileSync(CONFIG_FILE_JSON, "utf8"));
         }
-        jsonConfig.model = model || "gpt-5.4";
+        jsonConfig.model = model || "gpt-5.5";
         jsonConfig.model_provider = "holysheep";
         jsonConfig.provider = "holysheep";
         if (!jsonConfig.model_providers) jsonConfig.model_providers = {};
@@ -1479,7 +1479,7 @@ var require_codex = __commonJS({
         return isConfiguredInToml();
       },
       configure(apiKey, _baseUrlAnthropicNoV1, baseUrlOpenAI) {
-        const model = "gpt-5.4";
+        const model = "gpt-5.5";
         writeTomlConfig(apiKey, baseUrlOpenAI, model);
         writeJsonConfigIfNeeded(apiKey, baseUrlOpenAI, model);
         neutralizeAuthJson();
@@ -1995,7 +1995,13 @@ var require_openclaw_bridge = __commonJS({
     function sendJson(res, statusCode, payload) {
       res.writeHead(statusCode, {
         "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store"
+        "cache-control": "no-store",
+        // [hs36] Mirror the OPTIONS preflight ACAO so browsers can read the
+        // response from a different-port origin (e.g. the AionUi WebUI on :9876
+        // fetching /v1/models from the bridge on :18788). Without this header on
+        // the actual GET/POST response, Chrome/Firefox treat it as ERR_FAILED
+        // even though the OPTIONS preflight succeeds.
+        "access-control-allow-origin": "*"
       });
       res.end(JSON.stringify(payload));
     }
@@ -2009,7 +2015,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const firstChunk = {
         id: payload.id,
@@ -2429,7 +2438,9 @@ var require_openclaw_bridge = __commonJS({
         res.writeHead(200, {
           "content-type": "text/event-stream; charset=utf-8",
           "cache-control": "no-cache, no-transform",
-          connection: "keep-alive"
+          connection: "keep-alive",
+          // [hs36] CORS for SSE byte-passthrough relay path.
+          "access-control-allow-origin": "*"
         });
         try {
           await pipeStream(upstream.body, (chunk) => res.write(chunk));
@@ -2503,7 +2514,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const msgId = `chatcmpl_${Date.now()}`;
       const created = Math.floor(Date.now() / 1e3);
@@ -3723,6 +3737,18 @@ var require_hermes = __commonJS({
     __name(readConfig, "readConfig");
     function patchConfigYaml(apiKey, baseUrlOpenAI, primaryModel) {
       if (!fs.existsSync(CONFIG_YAML)) {
+        const cleanBase2 = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
+        const model2 = primaryModel || "claude-sonnet-4-6";
+        const minimal = `model:
+  base_url: ${cleanBase2}
+  api_key: ${apiKey}
+  default: ${model2}
+providers:
+  custom:
+    base_url: ${cleanBase2}
+    api_key: ${apiKey}
+`;
+        fs.writeFileSync(CONFIG_YAML, minimal, "utf8");
         return;
       }
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
@@ -3766,7 +3792,6 @@ var require_hermes = __commonJS({
         "  custom:",
         `    base_url: ${cleanBase}`,
         `    api_key: ${apiKey}`,
-        `    default_model: ${model}`,
         "    type: openai"
       ];
       let start = -1, end = -1;
@@ -3879,7 +3904,7 @@ var require_hermes = __commonJS({
     __name(writeConfig, "writeConfig");
     function buildHolySheepBlock(apiKey, baseUrlOpenAI, primaryModel) {
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
-      const model = primaryModel || "gpt-5.4";
+      const model = primaryModel || "gpt-4o";
       return [
         "[providers.holysheep]",
         "# Managed by @simonyea/holysheep-cli. Do not edit by hand \u2014 run `hs setup`.",
@@ -3946,10 +3971,11 @@ var require_hermes = __commonJS({
         return commandExists("hermes");
       },
       isConfigured() {
-        return isConfiguredInToml(readConfig());
+        return isConfiguredInToml(readConfig()) && fs.existsSync(CONFIG_YAML);
       },
       configure(apiKey, _baseUrlAnthropic, baseUrlOpenAI, primaryModel) {
-        const hermesPrimaryModel = /^claude-/i.test(primaryModel || "") ? "gpt-5.4" : primaryModel || "gpt-5.4";
+        const THINKING_MODELS = /^(gpt-5|o[0-9]|claude-)/i;
+        const hermesPrimaryModel = THINKING_MODELS.test(primaryModel || "") ? "gpt-4o" : primaryModel || "gpt-4o";
         const merged = mergeConfig(apiKey, baseUrlOpenAI, hermesPrimaryModel);
         writeConfig(merged);
         try {
@@ -3993,11 +4019,11 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@simonyea/holysheep-cli",
-      version: "2.1.51",
+      version: "2.1.53",
       description: "Claude Code/Cursor/Cline API relay for China \u2014 \xA51=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
       scripts: {
         build: "node scripts/build.mjs",
-        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
+        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/aionui-wrapper-csp-rewrite.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
         prepublishOnly: "npm run build && npm test && node scripts/check-tarball-size.js"
       },
       keywords: [
@@ -4445,6 +4471,7 @@ var require_env_config = __commonJS({
     module2.exports = {
       name: "\u5168\u5C40\u73AF\u5883\u53D8\u91CF",
       id: "env-config",
+      installCmd: "\u5185\u7F6E\u529F\u80FD\uFF08\u65E0\u9700\u5B89\u88C5\uFF09",
       checkInstalled() {
         return true;
       },

package/dist/index.js

@@ -12,11 +12,11 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@simonyea/holysheep-cli",
-      version: "2.1.51",
+      version: "2.1.53",
       description: "Claude Code/Cursor/Cline API relay for China \u2014 \xA51=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
       scripts: {
         build: "node scripts/build.mjs",
-        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
+        test: "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/aionui-wrapper-csp-rewrite.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
         prepublishOnly: "npm run build && npm test && node scripts/check-tarball-size.js"
       },
       keywords: [
@@ -1945,7 +1945,7 @@ var require_codex = __commonJS({
       }
       const content = stripManagedTomlConfig(readTomlConfig());
       const newConfig = [
-        `model = "${model || "gpt-5.4"}"`,
+        `model = "${model || "gpt-5.5"}"`,
         `model_provider = "holysheep"`,
         "",
         content,
@@ -1968,7 +1968,7 @@ var require_codex = __commonJS({
         if (fs.existsSync(CONFIG_FILE_JSON)) {
           jsonConfig = JSON.parse(fs.readFileSync(CONFIG_FILE_JSON, "utf8"));
         }
-        jsonConfig.model = model || "gpt-5.4";
+        jsonConfig.model = model || "gpt-5.5";
         jsonConfig.model_provider = "holysheep";
         jsonConfig.provider = "holysheep";
         if (!jsonConfig.model_providers) jsonConfig.model_providers = {};
@@ -2025,7 +2025,7 @@ var require_codex = __commonJS({
         return isConfiguredInToml();
       },
       configure(apiKey, _baseUrlAnthropicNoV1, baseUrlOpenAI) {
-        const model = "gpt-5.4";
+        const model = "gpt-5.5";
         writeTomlConfig(apiKey, baseUrlOpenAI, model);
         writeJsonConfigIfNeeded(apiKey, baseUrlOpenAI, model);
         neutralizeAuthJson();
@@ -2541,7 +2541,13 @@ var require_openclaw_bridge = __commonJS({
     function sendJson(res, statusCode, payload) {
       res.writeHead(statusCode, {
         "content-type": "application/json; charset=utf-8",
-        "cache-control": "no-store"
+        "cache-control": "no-store",
+        // [hs36] Mirror the OPTIONS preflight ACAO so browsers can read the
+        // response from a different-port origin (e.g. the AionUi WebUI on :9876
+        // fetching /v1/models from the bridge on :18788). Without this header on
+        // the actual GET/POST response, Chrome/Firefox treat it as ERR_FAILED
+        // even though the OPTIONS preflight succeeds.
+        "access-control-allow-origin": "*"
       });
       res.end(JSON.stringify(payload));
     }
@@ -2555,7 +2561,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const firstChunk = {
         id: payload.id,
@@ -2975,7 +2984,9 @@ var require_openclaw_bridge = __commonJS({
         res.writeHead(200, {
           "content-type": "text/event-stream; charset=utf-8",
           "cache-control": "no-cache, no-transform",
-          connection: "keep-alive"
+          connection: "keep-alive",
+          // [hs36] CORS for SSE byte-passthrough relay path.
+          "access-control-allow-origin": "*"
         });
         try {
           await pipeStream(upstream.body, (chunk) => res.write(chunk));
@@ -3049,7 +3060,10 @@ var require_openclaw_bridge = __commonJS({
       res.writeHead(200, {
         "content-type": "text/event-stream; charset=utf-8",
         "cache-control": "no-cache, no-transform",
-        connection: "keep-alive"
+        connection: "keep-alive",
+        // [hs36] Mirror sendJson's ACAO so SSE streams reach the WebUI from a
+        // cross-port loopback origin. See sendJson comment for rationale.
+        "access-control-allow-origin": "*"
       });
       const msgId = `chatcmpl_${Date.now()}`;
       const created = Math.floor(Date.now() / 1e3);
@@ -4269,6 +4283,18 @@ var require_hermes = __commonJS({
     __name(readConfig, "readConfig");
     function patchConfigYaml(apiKey, baseUrlOpenAI, primaryModel) {
       if (!fs.existsSync(CONFIG_YAML)) {
+        const cleanBase2 = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
+        const model2 = primaryModel || "claude-sonnet-4-6";
+        const minimal = `model:
+  base_url: ${cleanBase2}
+  api_key: ${apiKey}
+  default: ${model2}
+providers:
+  custom:
+    base_url: ${cleanBase2}
+    api_key: ${apiKey}
+`;
+        fs.writeFileSync(CONFIG_YAML, minimal, "utf8");
         return;
       }
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
@@ -4312,7 +4338,6 @@ var require_hermes = __commonJS({
         "  custom:",
         `    base_url: ${cleanBase}`,
         `    api_key: ${apiKey}`,
-        `    default_model: ${model}`,
         "    type: openai"
       ];
       let start = -1, end = -1;
@@ -4425,7 +4450,7 @@ var require_hermes = __commonJS({
     __name(writeConfig, "writeConfig");
     function buildHolySheepBlock(apiKey, baseUrlOpenAI, primaryModel) {
       const cleanBase = String(baseUrlOpenAI || "https://api.holysheep.ai/v1").replace(/\/+$/, "");
-      const model = primaryModel || "gpt-5.4";
+      const model = primaryModel || "gpt-4o";
       return [
         "[providers.holysheep]",
         "# Managed by @simonyea/holysheep-cli. Do not edit by hand \u2014 run `hs setup`.",
@@ -4492,10 +4517,11 @@ var require_hermes = __commonJS({
         return commandExists2("hermes");
       },
       isConfigured() {
-        return isConfiguredInToml(readConfig());
+        return isConfiguredInToml(readConfig()) && fs.existsSync(CONFIG_YAML);
       },
       configure(apiKey, _baseUrlAnthropic, baseUrlOpenAI, primaryModel) {
-        const hermesPrimaryModel = /^claude-/i.test(primaryModel || "") ? "gpt-5.4" : primaryModel || "gpt-5.4";
+        const THINKING_MODELS = /^(gpt-5|o[0-9]|claude-)/i;
+        const hermesPrimaryModel = THINKING_MODELS.test(primaryModel || "") ? "gpt-4o" : primaryModel || "gpt-4o";
         const merged = mergeConfig(apiKey, baseUrlOpenAI, hermesPrimaryModel);
         writeConfig(merged);
         try {
@@ -4627,6 +4653,7 @@ var require_env_config = __commonJS({
     module2.exports = {
       name: "\u5168\u5C40\u73AF\u5883\u53D8\u91CF",
       id: "env-config",
+      installCmd: "\u5185\u7F6E\u529F\u80FD\uFF08\u65E0\u9700\u5B89\u88C5\uFF09",
       checkInstalled() {
         return true;
       },
@@ -8802,6 +8829,7 @@ var require_aionui_wrapper = __commonJS({
     var codexTool = require_codex();
     var droidTool = require_droid();
     var hermesTool = require_hermes();
+    var openclawTool = require_openclaw();
     var BRIDGE_DIR = path.join(os.homedir(), ".holysheep");
     var BRIDGE_CRED_FILE = path.join(BRIDGE_DIR, "aionui-bridge.json");
     var TOKEN_TTL_MS = 3e4;
@@ -8821,6 +8849,11 @@ var require_aionui_wrapper = __commonJS({
     var cachedAionUiCookie = null;
     var cachedAionUiCookieAt = 0;
     var AIONUI_COOKIE_TTL_MS = 10 * 60 * 1e3;
+    var _startupWarnings = {
+      notInstalled: [],
+      // tool ids that are installed but not configured
+      openclawNeedsPairing: false
+    };
     function log(msg) {
       console.log(`[holysheep-web] ${msg}`);
     }
@@ -9114,6 +9147,90 @@ var require_aionui_wrapper = __commonJS({
       return legacyModule;
     }
     __name(legacy, "legacy");
+    var _cachedOpenClawOrigins = null;
+    var _cachedOpenClawOriginsAt = 0;
+    var OPENCLAW_ORIGIN_TTL_MS = 6e4;
+    function getOpenClawOrigins() {
+      if (_cachedOpenClawOrigins && nowMs() - _cachedOpenClawOriginsAt < OPENCLAW_ORIGIN_TTL_MS) {
+        return _cachedOpenClawOrigins;
+      }
+      const origins = [];
+      try {
+        const bridgePort = openclawTool.getBridgePort();
+        const gatewayPort = openclawTool.getGatewayPort();
+        if (bridgePort) origins.push(`http://127.0.0.1:${bridgePort}`);
+        if (gatewayPort) origins.push(`http://127.0.0.1:${gatewayPort}`);
+      } catch {
+      }
+      _cachedOpenClawOrigins = origins;
+      _cachedOpenClawOriginsAt = nowMs();
+      return origins;
+    }
+    __name(getOpenClawOrigins, "getOpenClawOrigins");
+    function appendOriginsToDirective(directiveValue, origins) {
+      const tokens = new Set(directiveValue.trim().split(/\s+/).filter(Boolean));
+      for (const o of origins) tokens.add(o);
+      return Array.from(tokens).join(" ");
+    }
+    __name(appendOriginsToDirective, "appendOriginsToDirective");
+    function rewriteCspHeaders(outHeaders) {
+      const origins = getOpenClawOrigins();
+      if (origins.length === 0) return;
+      for (const key of Object.keys(outHeaders)) {
+        const lower = key.toLowerCase();
+        if (lower !== "content-security-policy" && lower !== "content-security-policy-report-only") {
+          continue;
+        }
+        const value = outHeaders[key];
+        const cspString = Array.isArray(value) ? value.join("; ") : String(value || "");
+        if (!cspString) continue;
+        const directives = cspString.split(";").map((s) => s.trim()).filter(Boolean);
+        let foundConnect = false;
+        const rewritten = directives.map((d) => {
+          const m = d.match(/^(connect-src)\s+(.*)$/i);
+          if (!m) return d;
+          foundConnect = true;
+          return `connect-src ${appendOriginsToDirective(m[2], origins)}`;
+        });
+        if (!foundConnect) {
+          rewritten.push(`connect-src 'self' ws: wss: blob: ${origins.join(" ")}`);
+        }
+        outHeaders[key] = rewritten.join("; ");
+      }
+    }
+    __name(rewriteCspHeaders, "rewriteCspHeaders");
+    function _buildStartupBannerScript() {
+      const notInstalled = _startupWarnings.notInstalled || [];
+      const needsPairing = _startupWarnings.openclawNeedsPairing;
+      if (notInstalled.length === 0 && !needsPairing) return "";
+      const lines = [];
+      if (notInstalled.length > 0) {
+        const names = notInstalled.map((id) => {
+          const map = { codex: "Codex", droid: "Droid", hermes: "Hermes", "gemini-cli": "Gemini CLI" };
+          return map[id] || id;
+        });
+        lines.push(`\u26A0\uFE0F \u4EE5\u4E0B CLI \u5DE5\u5177\u672A\u5B89\u88C5\uFF1A${names.join("\u3001")}\u3002\u8BF7\u8FD0\u884C <code>hs setup</code> \u5B89\u88C5\u5E76\u914D\u7F6E\u3002`);
+      }
+      if (needsPairing) {
+        lines.push("\u26A0\uFE0F OpenClaw Gateway \u9700\u8981 Pairing \u8BA4\u8BC1\u3002\u8BF7\u8FD0\u884C <code>hs openclaw</code> \u5B8C\u6210\u914D\u7F6E\uFF0C\u5426\u5219 OpenClaw \u5BF9\u8BDD\u5C06\u6301\u7EED\u62A5\u9519\u3002");
+      }
+      const msgJson = JSON.stringify(lines);
+      return `<script>
+(function(){
+  var KEY='hs-startup-banner-dismissed';
+  if(sessionStorage.getItem(KEY)) return;
+  var msgs=${msgJson};
+  if(!msgs||!msgs.length) return;
+  var d=document.createElement('div');
+  d.style.cssText='position:fixed;bottom:16px;right:16px;z-index:99999;max-width:420px;background:#ff8c00;color:#fff;padding:12px 16px;border-radius:8px;font-size:13px;line-height:1.5;box-shadow:0 4px 16px rgba(0,0,0,.3);cursor:pointer';
+  d.innerHTML=msgs.join('<br><br>')+'<br><span style="font-size:11px;opacity:.8">\u70B9\u51FB\u5173\u95ED (\u672C\u6B21\u4F1A\u8BDD\u4E0D\u518D\u663E\u793A)</span>';
+  d.addEventListener('click',function(){document.body.removeChild(d);sessionStorage.setItem(KEY,'1')});
+  setTimeout(function(){if(d.parentNode)document.body.removeChild(d);},30000);
+  document.body.appendChild(d);
+})();
+</script>`;
+    }
+    __name(_buildStartupBannerScript, "_buildStartupBannerScript");
     var BODYLESS_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     function proxyHttp(req, res, internalPort) {
       const headers = { ...req.headers };
@@ -9137,6 +9254,33 @@ var require_aionui_wrapper = __commonJS({
         delete outHeaders["connection"];
         delete outHeaders["keep-alive"];
         delete outHeaders["proxy-connection"];
+        rewriteCspHeaders(outHeaders);
+        const contentType = (outHeaders["content-type"] || "").toLowerCase();
+        const isHtml = contentType.includes("text/html");
+        const bannerScript = isHtml ? _buildStartupBannerScript() : "";
+        if (bannerScript) {
+          delete outHeaders["content-length"];
+          res.writeHead(upRes.statusCode, upRes.statusMessage, outHeaders);
+          const chunks = [];
+          upRes.on("data", (c) => chunks.push(c));
+          upRes.on("end", () => {
+            let html = Buffer.concat(chunks).toString("utf8");
+            const idx = html.lastIndexOf("</body>");
+            if (idx !== -1) {
+              html = html.slice(0, idx) + bannerScript + html.slice(idx);
+            } else {
+              html += bannerScript;
+            }
+            res.end(html);
+          });
+          upRes.on("error", () => {
+            try {
+              res.end();
+            } catch {
+            }
+          });
+          return;
+        }
         res.writeHead(upRes.statusCode, upRes.statusMessage, outHeaders);
         upRes.pipe(res);
       });
@@ -9317,6 +9461,12 @@ var require_aionui_wrapper = __commonJS({
               aionuiSource: ctx.runtimeSource
             });
           }
+          if (route === "/api/holysheep/__wrapper/startup-warnings" && req.method === "GET") {
+            return sendJson(res, 200, {
+              notInstalled: _startupWarnings.notInstalled,
+              openclawNeedsPairing: _startupWarnings.openclawNeedsPairing
+            });
+          }
           return proxyHttp(req, res, ctx.internalPort);
         } catch (e) {
           try {
@@ -9398,7 +9548,7 @@ var require_aionui_wrapper = __commonJS({
         log("skipping auto-config for all CLI tools: no HolySheep apiKey available");
         return;
       }
-      const summary = { configured: [], skipped: [], failed: [] };
+      const summary = { configured: [], skipped: [], failed: [], notInstalled: [] };
       try {
         _ensureClaudeProxyConfig(apiKey);
         summary.configured.push("claude-code");
@@ -9434,6 +9584,17 @@ var require_aionui_wrapper = __commonJS({
       ];
       for (const s of siblings) {
         try {
+          let installed = true;
+          try {
+            installed = typeof s.tool.checkInstalled === "function" ? Boolean(s.tool.checkInstalled()) : true;
+          } catch {
+            installed = true;
+          }
+          if (!installed) {
+            summary.notInstalled.push(s.id);
+            log(`${s.id} not installed \u2014 skipping auto-config (binary not found)`);
+            continue;
+          }
           let already = false;
           try {
             already = typeof s.tool.isConfigured === "function" ? Boolean(s.tool.isConfigured()) : false;
@@ -9458,10 +9619,30 @@ var require_aionui_wrapper = __commonJS({
           log(`warn: auto-config ${s.id} failed: ${err && err.message ? err.message : err}`);
         }
       }
-      log(`CLI auto-config summary: configured=[${summary.configured.join(",")}] skipped=[${summary.skipped.join(",")}] failed=[${summary.failed.map((f) => f.tool).join(",")}]`);
+      log(`CLI auto-config summary: configured=[${summary.configured.join(",")}] skipped=[${summary.skipped.join(",")}] failed=[${summary.failed.map((f) => f.tool).join(",")}] notInstalled=[${summary.notInstalled.join(",")}]`);
       return summary;
     }
     __name(_ensureAllClisConfigured, "_ensureAllClisConfigured");
+    function _checkOpenClawPairingNeeded() {
+      var _a, _b;
+      try {
+        if (typeof openclawTool.checkInstalled !== "function" || !openclawTool.checkInstalled()) return false;
+        if (typeof openclawTool.isConfigured !== "function" || !openclawTool.isConfigured()) return false;
+        const OPENCLAW_CONFIG_FILE = path.join(os.homedir(), ".openclaw", "openclaw.json");
+        if (!fs.existsSync(OPENCLAW_CONFIG_FILE)) return false;
+        let cfg;
+        try {
+          cfg = JSON.parse(fs.readFileSync(OPENCLAW_CONFIG_FILE, "utf8"));
+        } catch {
+          return false;
+        }
+        const authMode = (_b = (_a = cfg == null ? void 0 : cfg.gateway) == null ? void 0 : _a.auth) == null ? void 0 : _b.mode;
+        return authMode !== void 0 && authMode !== "none";
+      } catch {
+        return false;
+      }
+    }
+    __name(_checkOpenClawPairingNeeded, "_checkOpenClawPairingNeeded");
     function _ensureClaudeProxyConfig(apiKey) {
       const config = claudeProcessProxy.readConfig();
       const next = claudeCodeTool.buildBridgeConfig(apiKey, BASE_URL_ANTHROPIC, {
@@ -9527,6 +9708,48 @@ var require_aionui_wrapper = __commonJS({
       }
     }
     __name(ensureClaudeProcessProxyRunning, "ensureClaudeProcessProxyRunning");
+    function ensureOpenClawBridgeRunning() {
+      let bridgePort;
+      try {
+        if (typeof openclawTool.isConfigured === "function" && !openclawTool.isConfigured()) {
+          log("OpenClaw bridge pre-start skipped: openclaw not configured (run `hs setup` to enable)");
+          return { skipped: true, reason: "not-configured" };
+        }
+        bridgePort = openclawTool.getBridgePort();
+      } catch (e) {
+        log(`OpenClaw bridge pre-start skipped: cannot read openclaw config (${e && e.message ? e.message : e})`);
+        return { skipped: true, reason: "config-read-failed" };
+      }
+      try {
+        disableBridgeWatchdog();
+      } catch (e) {
+        log(`warn: failed to disable bridge watchdog (continuing): ${e && e.message ? e.message : e}`);
+      }
+      try {
+        const ok = openclawTool.ensureBridgeRunning(bridgePort);
+        if (ok) {
+          log(`OpenClaw bridge ready on 127.0.0.1:${bridgePort} (watchdog disabled \u2014 gateway-less mode)`);
+          return { started: true, port: bridgePort };
+        }
+        log(`OpenClaw bridge failed to start on :${bridgePort} \u2014 OpenClaw chat panel will be unavailable`);
+        return { skipped: true, reason: "start-failed", port: bridgePort };
+      } catch (e) {
+        log(`OpenClaw bridge pre-start error (continuing): ${e && e.message ? e.message : e}`);
+        return { skipped: true, reason: "spawn-error" };
+      }
+    }
+    __name(ensureOpenClawBridgeRunning, "ensureOpenClawBridgeRunning");
+    function disableBridgeWatchdog() {
+      const { BRIDGE_CONFIG_FILE } = require_openclaw_bridge();
+      if (!fs.existsSync(BRIDGE_CONFIG_FILE)) return;
+      const raw = JSON.parse(fs.readFileSync(BRIDGE_CONFIG_FILE, "utf8"));
+      if (!raw.watchdog) raw.watchdog = {};
+      if (raw.watchdog.enabled === false && raw.gatewayPid == null) return;
+      raw.watchdog.enabled = false;
+      raw.gatewayPid = null;
+      fs.writeFileSync(BRIDGE_CONFIG_FILE, JSON.stringify(raw, null, 2), "utf8");
+    }
+    __name(disableBridgeWatchdog, "disableBridgeWatchdog");
     async function startWrapper({ port, runtimeDir, runtimeVersion, runtimeSource, bunPath }) {
       ensureRuntimeBuiltinResources(runtimeDir);
       const hsNative = detectHolySheepAionUi(runtimeDir);
@@ -9544,12 +9767,27 @@ var require_aionui_wrapper = __commonJS({
             return null;
           }
         })();
-        if (__apiKeyForAutoConfig) _ensureAllClisConfigured(__apiKeyForAutoConfig);
-        else log("CLI auto-config skipped: no HolySheep apiKey (run `hs login`)");
+        if (__apiKeyForAutoConfig) {
+          const summary = _ensureAllClisConfigured(__apiKeyForAutoConfig);
+          if (summary && summary.notInstalled && summary.notInstalled.length > 0) {
+            _startupWarnings.notInstalled = summary.notInstalled;
+          }
+        } else {
+          log("CLI auto-config skipped: no HolySheep apiKey (run `hs login`)");
+        }
       } catch (e) {
         log("warn: CLI auto-config error (continuing): " + (e && e.message ? e.message : e));
       }
+      try {
+        _startupWarnings.openclawNeedsPairing = _checkOpenClawPairingNeeded();
+        if (_startupWarnings.openclawNeedsPairing) {
+          log('warn: OpenClaw gateway auth.mode is not "none" \u2014 users will see "pairing required" errors. Run `hs openclaw` to fix.');
+        }
+      } catch (e) {
+        log("warn: OpenClaw pairing check failed (continuing): " + (e && e.message ? e.message : e));
+      }
       const claudeProxyHandle = await ensureClaudeProcessProxyRunning();
+      ensureOpenClawBridgeRunning();
       const debug = process.env.HS_WEB_DEBUG === "1";
       const { PACKAGE_ROOT, cliVersion, ptyHermesWrapperPath } = require_paths();
       const cliRoot = PACKAGE_ROOT;
@@ -9700,7 +9938,12 @@ ${tail.split(/\r?\n/).map((ln) => `  ${ln}`).join("\n")}
       ensureRuntimeBuiltinResources,
       // [HolySheep v2.1.43] Exported for aionui-wrapper-claude-proxy.test.js
       ensureClaudeProcessProxyRunning,
-      probeLocalPort
+      probeLocalPort,
+      // [HolySheep v2.1.51 / hs36] Exported for tests
+      ensureOpenClawBridgeRunning,
+      rewriteCspHeaders,
+      getOpenClawOrigins,
+      appendOriginsToDirective
     };
   }
 });

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@simonyea/holysheep-cli",
-  "version": "2.1.51",
+  "version": "2.1.53",
   "description": "Claude Code/Cursor/Cline API relay for China — ¥1=$1, WeChat/Alipay payment, no credit card, no VPN. One command setup for all AI coding tools.",
   "scripts": {
     "build": "node scripts/build.mjs",
-    "test": "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
+    "test": "node tests/droid.test.js && node tests/workspace-store.test.js && node tests/runtime-stale-upgrade.test.js && node tests/hermes.test.js && node tests/preflight.test.js && node tests/opencode-auth-purge.test.js && node tests/shell-winpath.test.js && node tests/openclaw-atomic-write.test.js && node tests/opencode-default-model.test.js && node tests/paths-bundled.test.js && node tests/aionui-runtime-resources.test.js && node tests/aionui-wrapper-claude-proxy.test.js && node tests/aionui-wrapper-probe.test.js && node tests/aionui-wrapper-proxy-integration.test.js && node tests/aionui-wrapper-all-clis-autoconf.test.js && node tests/aionui-wrapper-env-signal.test.js && node tests/aionui-wrapper-csp-rewrite.test.js && node tests/version-check.test.js && node tests/runclaude-missing-binary.test.js",
     "prepublishOnly": "npm run build && npm test && node scripts/check-tarball-size.js"
   },
   "keywords": [