@soyeht/soyeht 0.2.0 → 0.2.2

package/openclaw.plugin.json

@@ -5,7 +5,7 @@
   ],
   "name": "Soyeht",
   "description": "Channel plugin for the Soyeht Flutter mobile app",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soyeht/soyeht",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "OpenClaw channel plugin for the Soyeht Flutter mobile app",
   "type": "module",
   "main": "src/index.ts",

package/src/index.ts

@@ -23,6 +23,7 @@ import {
 import {
   handleSecurityIdentity,
   handleSecurityPair,
+  handleSecurityPairingInfo,
   handleSecurityPairingStart,
 } from "./pairing.js";
 import { PLUGIN_VERSION } from "./version.js";
@@ -89,6 +90,7 @@ const soyehtPlugin: OpenClawPluginDefinition = {
     // Security RPC
     api.registerGatewayMethod("soyeht.security.identity", handleSecurityIdentity(api, v2deps));
     api.registerGatewayMethod("soyeht.security.pairing.start", handleSecurityPairingStart(api, v2deps));
+    api.registerGatewayMethod("soyeht.security.pairing.info", handleSecurityPairingInfo(api, v2deps));
     api.registerGatewayMethod("soyeht.security.pair", handleSecurityPair(api, v2deps));
     api.registerGatewayMethod("soyeht.security.handshake.init", handleSecurityHandshake(api, v2deps));
     api.registerGatewayMethod("soyeht.security.handshake.finish", handleSecurityHandshakeFinish(api, v2deps));

package/src/pairing.ts

@@ -136,6 +136,61 @@ function resolveGatewayUrl(api: OpenClawPluginApi, configGatewayUrl: string): st
   return "";
 }
 
+// ---------------------------------------------------------------------------
+// soyeht.security.pairing.info — return session data for a given pairing token
+// ---------------------------------------------------------------------------
+
+export function handleSecurityPairingInfo(
+  _api: OpenClawPluginApi,
+  v2deps: SecurityV2Deps,
+): GatewayRequestHandler {
+  return async ({ params, respond }) => {
+    if (!v2deps.ready) {
+      respond(false, undefined, { code: "NOT_READY", message: "Service not ready" });
+      return;
+    }
+    if (!v2deps.identity) {
+      respond(false, undefined, { code: "NO_IDENTITY", message: "Identity not initialized" });
+      return;
+    }
+
+    const pairingToken = params["pairingToken"] as string | undefined;
+    if (!pairingToken) {
+      respond(false, undefined, {
+        code: "INVALID_PARAMS",
+        message: "Missing required param: pairingToken",
+      });
+      return;
+    }
+
+    const session = v2deps.pairingSessions.get(pairingToken);
+    if (!session) {
+      respond(false, undefined, {
+        code: "PAIRING_REQUIRED",
+        message: "No active pairing session. Scan a fresh QR code first.",
+      });
+      return;
+    }
+
+    if (session.expiresAt <= Date.now()) {
+      respond(false, undefined, {
+        code: "PAIRING_EXPIRED",
+        message: "Pairing QR expired. Scan a fresh QR code first.",
+      });
+      return;
+    }
+
+    respond(true, {
+      accountId: session.accountId,
+      expiresAt: session.expiresAt,
+      allowOverwrite: session.allowOverwrite,
+      pluginIdentityKey: v2deps.identity.signKey.publicKeyB64,
+      pluginDhKey: v2deps.identity.dhKey.publicKeyB64,
+      fingerprint: computeFingerprint(v2deps.identity),
+    });
+  };
+}
+
 // ---------------------------------------------------------------------------
 // soyeht.security.identity — expose plugin public keys
 // ---------------------------------------------------------------------------

package/src/qr.ts

@@ -0,0 +1,448 @@
+// ---------------------------------------------------------------------------
+// Minimal QR Code encoder — byte mode, EC level M, versions 1-20
+// Zero external dependencies. Used for terminal rendering on service start.
+// ---------------------------------------------------------------------------
+
+// Galois Field GF(2^8) with primitive polynomial 0x11d
+const EXP = new Uint8Array(256);
+const LOG = new Uint8Array(256);
+(function initGF() {
+  let v = 1;
+  for (let i = 0; i < 255; i++) {
+    EXP[i] = v;
+    LOG[v] = i;
+    v <<= 1;
+    if (v >= 256) v ^= 0x11d;
+  }
+  EXP[255] = EXP[0];
+})();
+
+function gfMul(a: number, b: number): number {
+  if (a === 0 || b === 0) return 0;
+  return EXP[(LOG[a] + LOG[b]) % 255];
+}
+
+function rsGenPoly(n: number): number[] {
+  let g = [1];
+  for (let i = 0; i < n; i++) {
+    const ng = new Array(g.length + 1).fill(0);
+    for (let j = 0; j < g.length; j++) {
+      ng[j] ^= g[j];
+      ng[j + 1] ^= gfMul(g[j], EXP[i]);
+    }
+    g = ng;
+  }
+  return g;
+}
+
+function rsEncode(data: number[], ecLen: number): number[] {
+  const gen = rsGenPoly(ecLen);
+  const msg = new Array(data.length + ecLen).fill(0);
+  for (let i = 0; i < data.length; i++) msg[i] = data[i];
+  for (let i = 0; i < data.length; i++) {
+    const coef = msg[i];
+    if (coef !== 0) {
+      for (let j = 0; j < gen.length; j++) {
+        msg[i + j] ^= gfMul(gen[j], coef);
+      }
+    }
+  }
+  return msg.slice(data.length);
+}
+
+// Version table: [totalCodewords, ecPerBlock, blocks1, dataPerBlock1, blocks2, dataPerBlock2]
+const VERSIONS: (number[] | null)[] = [
+  null,
+  [26, 10, 1, 16, 0, 0],
+  [44, 16, 1, 28, 0, 0],
+  [70, 26, 1, 44, 0, 0],
+  [100, 18, 2, 32, 0, 0],
+  [134, 24, 2, 43, 0, 0],
+  [172, 16, 4, 27, 0, 0],
+  [196, 18, 4, 31, 0, 0],
+  [242, 22, 4, 38, 0, 0],
+  [292, 22, 2, 36, 2, 37],
+  [346, 26, 4, 43, 1, 44],
+  [404, 30, 1, 50, 4, 51],
+  [466, 22, 6, 36, 2, 37],
+  [532, 22, 8, 37, 1, 38],
+  [581, 24, 4, 40, 5, 41],
+  [655, 24, 5, 41, 5, 42],
+  [733, 28, 7, 45, 3, 46],
+  [815, 28, 10, 46, 1, 47],
+  [901, 26, 9, 43, 4, 44],
+  [991, 26, 3, 44, 11, 45],
+  [1085, 28, 3, 41, 13, 42],
+];
+
+const DATA_CAP = VERSIONS.map((v) => {
+  if (!v) return 0;
+  return v[2] * v[3] + (v[4] ? v[4] * v[5] : 0);
+});
+
+function chooseVersion(dataLen: number): number {
+  for (let v = 1; v <= 20; v++) {
+    if (DATA_CAP[v] >= dataLen) return v;
+  }
+  return -1;
+}
+
+function encodeToBytes(str: string): number[] {
+  return Array.from(Buffer.from(str, "utf8"));
+}
+
+function buildBitstream(dataBytes: number[], version: number): number[] {
+  const bits: number[] = [];
+  function push(val: number, len: number) {
+    for (let i = len - 1; i >= 0; i--) bits.push((val >> i) & 1);
+  }
+  push(4, 4); // byte mode
+  const ccBits = version <= 9 ? 8 : 16;
+  push(dataBytes.length, ccBits);
+  for (const b of dataBytes) push(b, 8);
+  const totalBits = DATA_CAP[version] * 8;
+  push(0, Math.min(4, totalBits - bits.length));
+  while (bits.length % 8 !== 0) bits.push(0);
+  const padBytes = [0xec, 0x11];
+  let pi = 0;
+  while (bits.length < totalBits) {
+    push(padBytes[pi], 8);
+    pi = (pi + 1) % 2;
+  }
+  const out: number[] = [];
+  for (let i = 0; i < bits.length; i += 8) {
+    let b = 0;
+    for (let j = 0; j < 8; j++) b = (b << 1) | bits[i + j];
+    out.push(b);
+  }
+  return out;
+}
+
+function interleaveBlocks(data: number[], version: number): number[] {
+  const vInfo = VERSIONS[version]!;
+  const ecPerBlock = vInfo[1];
+  const blocks1 = vInfo[2], dPerBlock1 = vInfo[3];
+  const blocks2 = vInfo[4] || 0, dPerBlock2 = vInfo[5] || 0;
+  const dataBlocks: number[][] = [];
+  const ecBlocks: number[][] = [];
+  let offset = 0;
+  for (let i = 0; i < blocks1; i++) {
+    const block = data.slice(offset, offset + dPerBlock1);
+    dataBlocks.push(block);
+    ecBlocks.push(rsEncode(block, ecPerBlock));
+    offset += dPerBlock1;
+  }
+  for (let i = 0; i < blocks2; i++) {
+    const block = data.slice(offset, offset + dPerBlock2);
+    dataBlocks.push(block);
+    ecBlocks.push(rsEncode(block, ecPerBlock));
+    offset += dPerBlock2;
+  }
+  const result: number[] = [];
+  const maxDataLen = Math.max(dPerBlock1, dPerBlock2 || 0);
+  for (let i = 0; i < maxDataLen; i++) {
+    for (const block of dataBlocks) {
+      if (i < block.length) result.push(block[i]);
+    }
+  }
+  for (let i = 0; i < ecPerBlock; i++) {
+    for (const block of ecBlocks) {
+      if (i < block.length) result.push(block[i]);
+    }
+  }
+  return result;
+}
+
+const SIZE_FOR_VERSION = (v: number) => 17 + v * 4;
+
+function createMatrix(version: number): number[][] {
+  const size = SIZE_FOR_VERSION(version);
+  return Array.from({ length: size }, () => new Array(size).fill(-1));
+}
+
+function setMod(m: number[][], r: number, c: number, val: number) {
+  if (r >= 0 && r < m.length && c >= 0 && c < m.length) m[r][c] = val;
+}
+
+function placeFinderPattern(m: number[][], row: number, col: number) {
+  for (let r = -1; r <= 7; r++) {
+    for (let c = -1; c <= 7; c++) {
+      let val: number;
+      if (r === -1 || r === 7 || c === -1 || c === 7) val = 0;
+      else if (r === 0 || r === 6 || c === 0 || c === 6) val = 1;
+      else if (r >= 2 && r <= 4 && c >= 2 && c <= 4) val = 1;
+      else val = 0;
+      setMod(m, row + r, col + c, val);
+    }
+  }
+}
+
+const ALIGN_POS: (number[] | null)[] = [
+  null, [],
+  [6, 18], [6, 22], [6, 26], [6, 30], [6, 34],
+  [6, 22, 38], [6, 24, 42], [6, 26, 46], [6, 28, 50],
+  [6, 30, 54], [6, 32, 58], [6, 34, 62], [6, 26, 46, 66],
+  [6, 26, 48, 70], [6, 26, 50, 74], [6, 30, 54, 78],
+  [6, 30, 56, 82], [6, 30, 58, 86], [6, 34, 62, 90],
+];
+
+function placeAlignmentPatterns(m: number[][], version: number) {
+  if (version < 2) return;
+  const pos = ALIGN_POS[version]!;
+  for (const r of pos) {
+    for (const c of pos) {
+      if (m[r][c] !== -1) continue;
+      for (let dr = -2; dr <= 2; dr++) {
+        for (let dc = -2; dc <= 2; dc++) {
+          const val = (Math.abs(dr) === 2 || Math.abs(dc) === 2 || (dr === 0 && dc === 0)) ? 1 : 0;
+          setMod(m, r + dr, c + dc, val);
+        }
+      }
+    }
+  }
+}
+
+function placeTimingPatterns(m: number[][]) {
+  const size = m.length;
+  for (let i = 8; i < size - 8; i++) {
+    if (m[6][i] === -1) m[6][i] = (i % 2 === 0) ? 1 : 0;
+    if (m[i][6] === -1) m[i][6] = (i % 2 === 0) ? 1 : 0;
+  }
+}
+
+function reserveFormatBits(m: number[][]) {
+  const size = m.length;
+  for (let i = 0; i <= 8; i++) {
+    if (m[8][i] === -1) m[8][i] = 0;
+    if (m[i][8] === -1) m[i][8] = 0;
+  }
+  for (let i = 0; i <= 7; i++) {
+    if (m[8][size - 1 - i] === -1) m[8][size - 1 - i] = 0;
+  }
+  for (let i = 0; i <= 7; i++) {
+    if (m[size - 1 - i][8] === -1) m[size - 1 - i][8] = 0;
+  }
+}
+
+function reserveVersionBits(m: number[][], version: number) {
+  if (version < 7) return;
+  const size = m.length;
+  for (let i = 0; i < 6; i++) {
+    for (let j = 0; j < 3; j++) {
+      if (m[i][size - 11 + j] === -1) m[i][size - 11 + j] = 0;
+      if (m[size - 11 + j][i] === -1) m[size - 11 + j][i] = 0;
+    }
+  }
+}
+
+function placeDataBits(m: number[][], dataBits: number[]) {
+  const size = m.length;
+  let bitIdx = 0;
+  let upward = true;
+  for (let right = size - 1; right >= 1; right -= 2) {
+    if (right === 6) right = 5;
+    for (let cnt = 0; cnt < size; cnt++) {
+      const row = upward ? (size - 1 - cnt) : cnt;
+      for (let dx = 0; dx <= 1; dx++) {
+        const col = right - dx;
+        if (col < 0 || col >= size) continue;
+        if (m[row][col] !== -1) continue;
+        m[row][col] = (bitIdx < dataBits.length) ? dataBits[bitIdx] : 0;
+        bitIdx++;
+      }
+    }
+    upward = !upward;
+  }
+}
+
+const MASK_FNS: ((r: number, c: number) => boolean)[] = [
+  (r, c) => (r + c) % 2 === 0,
+  (r) => r % 2 === 0,
+  (_, c) => c % 3 === 0,
+  (r, c) => (r + c) % 3 === 0,
+  (r, c) => (Math.floor(r / 2) + Math.floor(c / 3)) % 2 === 0,
+  (r, c) => (r * c) % 2 + (r * c) % 3 === 0,
+  (r, c) => ((r * c) % 2 + (r * c) % 3) % 2 === 0,
+  (r, c) => ((r + c) % 2 + (r * c) % 3) % 2 === 0,
+];
+
+function applyMask(m: number[][], reserved: number[][], maskIdx: number) {
+  const fn = MASK_FNS[maskIdx];
+  const size = m.length;
+  for (let r = 0; r < size; r++) {
+    for (let c = 0; c < size; c++) {
+      if (reserved[r][c] === -1 && fn(r, c)) m[r][c] ^= 1;
+    }
+  }
+}
+
+function scorePenalty(m: number[][]): number {
+  const size = m.length;
+  let score = 0;
+  for (let r = 0; r < size; r++) {
+    let run = 1;
+    for (let c = 1; c < size; c++) {
+      if (m[r][c] === m[r][c - 1]) run++;
+      else { if (run >= 5) score += run - 2; run = 1; }
+    }
+    if (run >= 5) score += run - 2;
+  }
+  for (let c = 0; c < size; c++) {
+    let run = 1;
+    for (let r = 1; r < size; r++) {
+      if (m[r][c] === m[r - 1][c]) run++;
+      else { if (run >= 5) score += run - 2; run = 1; }
+    }
+    if (run >= 5) score += run - 2;
+  }
+  for (let r = 0; r < size - 1; r++) {
+    for (let c = 0; c < size - 1; c++) {
+      const v = m[r][c];
+      if (v === m[r][c + 1] && v === m[r + 1][c] && v === m[r + 1][c + 1]) score += 3;
+    }
+  }
+  return score;
+}
+
+// EC level M format info table (pre-computed with BCH)
+const FORMAT_BITS: number[] = [
+  0x5412, 0x5125, 0x5e7c, 0x5b4b, 0x45f9, 0x40ce, 0x4f97, 0x4aa0,
+  0x77c4, 0x72f3, 0x7daa, 0x789d, 0x662f, 0x6318, 0x6c41, 0x6976,
+];
+
+function placeFormatBits(m: number[][], maskIdx: number) {
+  const formatInfo = FORMAT_BITS[maskIdx]; // EC level M = index 0..7
+  const size = m.length;
+  const bits: number[] = [];
+  for (let i = 14; i >= 0; i--) bits.push((formatInfo >> i) & 1);
+  const pos1: [number, number][] = [
+    [0, 8], [1, 8], [2, 8], [3, 8], [4, 8], [5, 8], [7, 8], [8, 8],
+    [8, 7], [8, 5], [8, 4], [8, 3], [8, 2], [8, 1], [8, 0],
+  ];
+  for (let i = 0; i < 15; i++) m[pos1[i][0]][pos1[i][1]] = bits[i];
+  for (let i = 0; i < 7; i++) m[size - 1 - i][8] = bits[i];
+  for (let i = 7; i < 15; i++) m[8][size - 15 + i] = bits[i];
+}
+
+const VERSION_INFO: number[] = [
+  0, 0, 0, 0, 0, 0, 0,
+  0x07c94, 0x085bc, 0x09a99, 0x0a4d3, 0x0bbf6, 0x0c762, 0x0d847,
+  0x0e60d, 0x0f928, 0x10b78, 0x1145d, 0x12a17, 0x13532, 0x149a6,
+];
+
+function placeVersionBits(m: number[][], version: number) {
+  if (version < 7) return;
+  const info = VERSION_INFO[version];
+  const size = m.length;
+  for (let i = 0; i < 18; i++) {
+    const bit = (info >> i) & 1;
+    const r = Math.floor(i / 3);
+    const c = size - 11 + (i % 3);
+    m[r][c] = bit;
+    m[c][r] = bit;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+export type QRResult = {
+  matrix: number[][];
+  size: number;
+  version: number;
+};
+
+export function generateQR(text: string): QRResult | null {
+  const dataBytes = encodeToBytes(text);
+  let overhead = Math.ceil((4 + 8) / 8);
+  let version = chooseVersion(dataBytes.length + overhead);
+  if (version === -1) {
+    overhead = Math.ceil((4 + 16) / 8);
+    version = chooseVersion(dataBytes.length + overhead);
+  }
+  if (version === -1) return null;
+
+  const ccBits = version <= 9 ? 8 : 16;
+  const needed = Math.ceil((4 + ccBits + dataBytes.length * 8) / 8);
+  if (needed > DATA_CAP[version]) {
+    version++;
+    if (version > 20) return null;
+  }
+
+  const bitstream = buildBitstream(dataBytes, version);
+  const codewords = interleaveBlocks(bitstream, version);
+  const dataBits: number[] = [];
+  for (const cw of codewords) {
+    for (let j = 7; j >= 0; j--) dataBits.push((cw >> j) & 1);
+  }
+
+  const m = createMatrix(version);
+  placeFinderPattern(m, 0, 0);
+  placeFinderPattern(m, 0, m.length - 7);
+  placeFinderPattern(m, m.length - 7, 0);
+  placeAlignmentPatterns(m, version);
+  placeTimingPatterns(m);
+  m[(4 * version) + 9][8] = 1; // dark module
+  reserveFormatBits(m);
+  reserveVersionBits(m, version);
+
+  const reserved = m.map((row) => row.slice());
+  placeDataBits(m, dataBits);
+
+  let bestMask = 0;
+  let bestScore = Infinity;
+  for (let mask = 0; mask < 8; mask++) {
+    const trial = m.map((row) => row.slice());
+    applyMask(trial, reserved, mask);
+    placeFormatBits(trial, mask);
+    placeVersionBits(trial, version);
+    const s = scorePenalty(trial);
+    if (s < bestScore) { bestScore = s; bestMask = mask; }
+  }
+
+  applyMask(m, reserved, bestMask);
+  placeFormatBits(m, bestMask);
+  placeVersionBits(m, version);
+
+  return { matrix: m, size: m.length, version };
+}
+
+// ---------------------------------------------------------------------------
+// Terminal renderer — ANSI colors, half-block characters
+// ---------------------------------------------------------------------------
+
+export function renderQrTerminal(text: string): string | null {
+  const qr = generateQR(text);
+  if (!qr) return null;
+
+  const { matrix, size } = qr;
+  const quiet = 2;
+  const total = size + quiet * 2;
+
+  function mod(r: number, c: number): number {
+    if (r < quiet || r >= size + quiet || c < quiet || c >= size + quiet) return 0;
+    return matrix[r - quiet][c - quiet];
+  }
+
+  // ▄ (lower half block): foreground = lower half, background = upper half
+  function cell(top: number, bottom: number): string {
+    if (top === 1 && bottom === 1) return "\x1b[40m \x1b[0m";       // both black
+    if (top === 0 && bottom === 0) return "\x1b[47m \x1b[0m";       // both white
+    if (top === 1 && bottom === 0) return "\x1b[37;40m\u2584\x1b[0m"; // top black, bottom white
+    return "\x1b[30;47m\u2584\x1b[0m";                                // top white, bottom black
+  }
+
+  const lines: string[] = [];
+  for (let r = 0; r < total; r += 2) {
+    let line = "";
+    for (let c = 0; c < total; c++) {
+      const top = mod(r, c);
+      const bottom = (r + 1 < total) ? mod(r + 1, c) : 0;
+      line += cell(top, bottom);
+    }
+    lines.push(line);
+  }
+
+  return lines.join("\n");
+}

package/src/service.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { readFile, writeFile, rm } from "node:fs/promises";
 import { join } from "node:path";
 import type { OpenClawPluginApi, OpenClawPluginService, OpenClawPluginServiceContext } from "openclaw/plugin-sdk";
@@ -9,10 +10,11 @@ import {
 } from "./security.js";
 import { loadOrGenerateIdentity, loadPeers, loadSessions, saveSession } from "./identity.js";
 import { zeroBuffer } from "./ratchet.js";
-import { computeFingerprint, type X25519KeyPair } from "./crypto.js";
+import { base64UrlEncode, computeFingerprint, type X25519KeyPair } from "./crypto.js";
 import type { IdentityBundle, PeerIdentity } from "./identity.js";
 import type { RatchetState } from "./ratchet.js";
 import { createOutboundQueue, type OutboundQueue } from "./outbound-queue.js";
+import { renderQrTerminal } from "./qr.js";
 
 const HEARTBEAT_INTERVAL_MS = 60_000; // 60s
 
@@ -65,6 +67,61 @@ export function createSecurityV2Deps(): SecurityV2Deps {
   };
 }
 
+// ---------------------------------------------------------------------------
+// Auto-pairing QR display (terminal)
+// ---------------------------------------------------------------------------
+
+const AUTO_PAIRING_TTL_MS = 90_000;
+
+async function showPairingQr(api: OpenClawPluginApi, v2deps: SecurityV2Deps): Promise<void> {
+  const identity = v2deps.identity;
+  if (!identity) return;
+
+  const accountId = "default";
+
+  // Clear any stale pairing sessions for this account
+  for (const [token, session] of v2deps.pairingSessions) {
+    if (session.accountId === accountId) {
+      v2deps.pairingSessions.delete(token);
+    }
+  }
+
+  const pairingToken = base64UrlEncode(randomBytes(32));
+  const expiresAt = Date.now() + AUTO_PAIRING_TTL_MS;
+  const fingerprint = computeFingerprint(identity);
+
+  // Resolve gatewayUrl from config or runtime
+  let gatewayUrl = "";
+  const runtime = api.runtime as Record<string, unknown>;
+  if (typeof runtime["gatewayUrl"] === "string" && runtime["gatewayUrl"]) {
+    gatewayUrl = runtime["gatewayUrl"];
+  } else if (typeof runtime["baseUrl"] === "string" && runtime["baseUrl"]) {
+    gatewayUrl = runtime["baseUrl"];
+  }
+
+  v2deps.pairingSessions.set(pairingToken, {
+    token: pairingToken,
+    accountId,
+    expiresAt,
+    allowOverwrite: false,
+  });
+
+  // Compact QR: soyeht://pair?g=<gatewayUrl>&t=<token>&fp=<fingerprint>
+  // App fetches full key material via RPC soyeht.security.pairing.info
+  const qrText = `soyeht://pair?g=${encodeURIComponent(gatewayUrl)}&t=${pairingToken}&fp=${fingerprint}`;
+  const rendered = renderQrTerminal(qrText);
+
+  if (rendered) {
+    // Write QR directly to stdout to avoid logger prefixes breaking ANSI escape codes
+    process.stdout.write("\n" + rendered + "\n\n");
+    api.logger.info(`[soyeht] Scan the QR code above with the Soyeht app to pair`);
+    api.logger.info(`[soyeht] Fingerprint: ${fingerprint}`);
+    api.logger.info(`[soyeht] QR expires in ${AUTO_PAIRING_TTL_MS / 1000}s — restart plugin to generate a new one`);
+  } else {
+    api.logger.warn("[soyeht] QR code too large for terminal rendering. Use RPC soyeht.security.pairing.start instead.");
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Service
 // ---------------------------------------------------------------------------
@@ -110,6 +167,15 @@ export function createSoyehtService(
       }
       if (v2deps) v2deps.ready = true;
 
+      // Auto-generate and display pairing QR if no peers are paired
+      if (v2deps?.identity && v2deps.peers.size === 0) {
+        try {
+          await showPairingQr(api, v2deps);
+        } catch (err) {
+          api.logger.error("[soyeht] Failed to auto-generate pairing QR", { err });
+        }
+      }
+
       api.logger.info("[soyeht] Service started");
 
       heartbeatTimer = setInterval(async () => {

package/src/version.ts

@@ -1 +1 @@
-export const PLUGIN_VERSION = "0.2.0";
+export const PLUGIN_VERSION = "0.2.2";