@stagewhisper/stagewhisper 0.60.0 → 0.64.0

package/dist/index.js

@@ -252,8 +252,8 @@ function resolveGatewayConfig(api) {
 function isResponsesEndpointEnabled(api) {
   const cfg = api.config;
   const gw = cfg?.gateway ?? {};
-  const http = gw?.http ?? {};
-  const endpoints = http?.endpoints ?? {};
+  const http2 = gw?.http ?? {};
+  const endpoints = http2?.endpoints ?? {};
   const responses = endpoints?.responses ?? {};
   return responses?.enabled === true;
 }
@@ -431,7 +431,7 @@ function createHasher(hashCons) {
   hashC.create = () => hashCons();
   return hashC;
 }
-function randomBytes(bytesLength = 32) {
+function randomBytes2(bytesLength = 32) {
   if (crypto2 && typeof crypto2.getRandomValues === "function") {
     return crypto2.getRandomValues(new Uint8Array(bytesLength));
   }
@@ -2003,7 +2003,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
   });
   const { prehash } = eddsaOpts;
   const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
-  const randomBytes3 = eddsaOpts.randomBytes || randomBytes;
+  const randomBytes4 = eddsaOpts.randomBytes || randomBytes2;
   const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
   const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
     _abool2(phflag, "phflag");
@@ -2085,7 +2085,7 @@ function eddsa(Point, cHash, eddsaOpts = {}) {
     signature: 2 * _size,
     seed: _size
   };
-  function randomSecretKey(seed = randomBytes3(lengths.seed)) {
+  function randomSecretKey(seed = randomBytes4(lengths.seed)) {
     return _abytes2(seed, lengths.seed, "seed");
   }
   function keygen(seed) {
@@ -2280,7 +2280,7 @@ function montgomery(curveDef) {
   const is25519 = type === "x25519";
   if (!is25519 && type !== "x448")
     throw new Error("invalid type");
-  const randomBytes_ = rand || randomBytes;
+  const randomBytes_ = rand || randomBytes2;
   const montgomeryBits = is25519 ? 255 : 448;
   const fieldLen = is25519 ? 32 : 56;
   const Gu = is25519 ? BigInt(9) : BigInt(5);
@@ -3547,7 +3547,7 @@ var init_cryptoNode2 = __esm({
 });
 
 // node_modules/.pnpm/@noble+ciphers@1.3.0/node_modules/@noble/ciphers/esm/webcrypto.js
-function randomBytes2(bytesLength = 32) {
+function randomBytes3(bytesLength = 32) {
   if (crypto3 && typeof crypto3.getRandomValues === "function") {
     return crypto3.getRandomValues(new Uint8Array(bytesLength));
   }
@@ -3591,7 +3591,7 @@ function generateUUID() {
 }
 function seal(key, senderRole, sessionId, correlationId, contentType, plaintext) {
   const messageId = generateUUID();
-  const nonce = randomBytes2(24);
+  const nonce = randomBytes3(24);
   const metadata = {
     version: ENVELOPE_VERSION,
     sender_role: senderRole,
@@ -3666,7 +3666,7 @@ var init_crypto = __esm({
         this.publicKey = x25519.getPublicKey(secretKey);
       }
       static generate() {
-        const secretKey = randomBytes2(32);
+        const secretKey = randomBytes3(32);
         return new _IdentityKeypair(secretKey);
       }
       static fromSecretBytes(bytes) {
@@ -3987,6 +3987,987 @@ var stagewhisperPlugin = {
   }
 };
 
+// src/http-transport.ts
+import http from "node:http";
+import { Buffer as Buffer2 } from "node:buffer";
+import { randomUUID, timingSafeEqual } from "node:crypto";
+
+// src/core.ts
+var TASK_ID_REGEX = /^[0-9a-f-]{36}$/;
+var LOOPBACK_CALLBACK_URL_REGEX = /^https?:\/\/(127\.0\.0\.1|localhost)(:\d+)?\/?$/;
+var ALLOWED_REASONS = /* @__PURE__ */ new Set([
+  "transcript_chunk",
+  "chat_message",
+  "system_prelude"
+]);
+var MAX_BODY_BYTES = 262144;
+var MAX_PAYLOAD_TEXT_CHARS = 16e3;
+var MAX_SESSION_ID_CHARS = 128;
+var ALLOWED_HOSTNAMES = /* @__PURE__ */ new Set(["127.0.0.1", "localhost"]);
+function isTestTask(task) {
+  return task.action_type === "connectivity_test";
+}
+function buildTaskMessage(task) {
+  const lines = [];
+  lines.push(`**${task.title}**`);
+  lines.push("");
+  lines.push(task.request_text);
+  if (task.evidence_payload) {
+    const evidence = task.evidence_payload;
+    if (evidence["transcript_excerpt"]) {
+      lines.push("");
+      lines.push(`Context: ${evidence["transcript_excerpt"]}`);
+    }
+    if (evidence["signal_summary"]) {
+      lines.push(`Signal: ${evidence["signal_summary"]}`);
+    }
+    if (evidence["tone_summary"]) {
+      lines.push(`Tone: ${evidence["tone_summary"]}`);
+    }
+    if (evidence["playbook_label"]) {
+      lines.push(`Playbook: ${evidence["playbook_label"]}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Action type: ${task.action_type}`);
+  lines.push(`StageWhisper task: ${task.id}`);
+  lines.push(`Session: ${task.session_id}`);
+  return lines.join("\n");
+}
+async function dispatchTaskToAgent(options) {
+  const { api, task } = options;
+  const peerId = options.sessionPeerId ?? (isTestTask(task) ? `sw-test-${task.id}` : `sw-session-${task.session_id}`);
+  const sessionKey = buildAgentSessionKey({
+    agentId: "default",
+    channel: "stagewhisper",
+    peer: { kind: "direct", id: peerId },
+    dmScope: "per-channel-peer"
+  });
+  const messageContent = buildTaskMessage(task);
+  const result = await api.runtime.subagent.run({
+    sessionKey,
+    message: messageContent,
+    deliver: options.deliver ?? !isTestTask(task),
+    idempotencyKey: options.idempotencyKey ?? `sw-task-${task.id}`
+  });
+  return { runId: result.runId, sessionKey };
+}
+function isLoopbackCallbackUrl(url) {
+  return LOOPBACK_CALLBACK_URL_REGEX.test(url);
+}
+function normalizeOrigin(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
+  return parsed.origin.toLowerCase();
+}
+function allowedCallbackOrigins() {
+  const raw = process.env["STAGEWHISPER_ALLOW_CALLBACK_URLS"];
+  if (!raw) return /* @__PURE__ */ new Set();
+  const origins = raw.split(",").map((entry) => normalizeOrigin(entry.trim())).filter((origin) => origin !== null);
+  return new Set(origins);
+}
+function isAllowedCallbackUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  if (parsed.pathname !== "/" && parsed.pathname !== "") return false;
+  if (parsed.search || parsed.hash) return false;
+  if (allowedCallbackOrigins().has(parsed.origin.toLowerCase())) return true;
+  if (allowedIngressHosts().size === 0 && isLoopbackCallbackUrl(url)) return true;
+  return false;
+}
+function allowedIngressHosts() {
+  const raw = process.env["STAGEWHISPER_ALLOW_INGRESS_HOSTS"];
+  if (!raw) return /* @__PURE__ */ new Set();
+  const hosts = raw.split(",").map((entry) => entry.trim().toLowerCase()).filter((entry) => entry.length > 0);
+  return new Set(hosts);
+}
+function isAllowedHostHeader(host) {
+  if (!host) return false;
+  const trimmed = host.trim().toLowerCase();
+  if (!trimmed) return false;
+  const colonIdx = trimmed.lastIndexOf(":");
+  const hostname = colonIdx === -1 ? trimmed : trimmed.slice(0, colonIdx);
+  const port = colonIdx === -1 ? "" : trimmed.slice(colonIdx + 1);
+  if (port && !/^\d+$/.test(port)) return false;
+  if (ALLOWED_HOSTNAMES.has(hostname)) return true;
+  return allowedIngressHosts().has(hostname);
+}
+function buildChatId(sessionId, reason) {
+  if (reason === "transcript_chunk") return `sw:${sessionId}:reasoning`;
+  if (reason === "chat_message") return `sw:${sessionId}:chat`;
+  return null;
+}
+function buildCallbackUrl(baseUrl, taskId) {
+  return `${baseUrl.replace(/\/$/, "")}/tasks/${taskId}`;
+}
+function applyPrelude(text, prelude) {
+  if (!prelude) return text;
+  return `[Context: ${prelude}]
+
+${text}`;
+}
+function validateHttpTaskRequest(body) {
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    return { ok: false, error: "body must be a JSON object" };
+  }
+  const obj = body;
+  const task_id = obj["task_id"];
+  if (typeof task_id !== "string" || task_id.length === 0) {
+    return { ok: false, error: "task_id must be a non-empty string" };
+  }
+  if (!TASK_ID_REGEX.test(task_id)) {
+    return { ok: false, error: "task_id must match ^[0-9a-f-]{36}$" };
+  }
+  const session_id = obj["session_id"];
+  if (typeof session_id !== "string" || session_id.length === 0) {
+    return { ok: false, error: "session_id must be a non-empty string" };
+  }
+  if (session_id.length > MAX_SESSION_ID_CHARS) {
+    return {
+      ok: false,
+      error: `session_id must be <= ${MAX_SESSION_ID_CHARS} chars`
+    };
+  }
+  const reason = obj["reason"];
+  if (typeof reason !== "string" || reason.length === 0) {
+    return { ok: false, error: "reason must be a non-empty string" };
+  }
+  if (!ALLOWED_REASONS.has(reason)) {
+    return {
+      ok: false,
+      error: `reason must be one of ${Array.from(ALLOWED_REASONS).join(", ")}`
+    };
+  }
+  const payload = obj["payload"];
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return { ok: false, error: "payload must be an object" };
+  }
+  const payloadObj = payload;
+  const text = payloadObj["text"];
+  if (typeof text !== "string") {
+    return { ok: false, error: "payload.text must be a string" };
+  }
+  if (text.length > MAX_PAYLOAD_TEXT_CHARS) {
+    return {
+      ok: false,
+      error: `payload.text must be <= ${MAX_PAYLOAD_TEXT_CHARS} chars`
+    };
+  }
+  let callback;
+  const callbackRaw = obj["callback"];
+  if (callbackRaw !== void 0 && callbackRaw !== null) {
+    if (typeof callbackRaw !== "object" || Array.isArray(callbackRaw)) {
+      return { ok: false, error: "callback must be an object" };
+    }
+    const cbObj = callbackRaw;
+    const cbUrl = cbObj["url"];
+    const cbToken = cbObj["token"];
+    if (typeof cbUrl !== "string" || cbUrl.length === 0) {
+      return { ok: false, error: "callback.url must be a non-empty string" };
+    }
+    if (!isAllowedCallbackUrl(cbUrl)) {
+      return {
+        ok: false,
+        error: "callback.url must be a loopback base URL (http://127.0.0.1:PORT) or an origin listed in STAGEWHISPER_ALLOW_CALLBACK_URLS, with no path"
+      };
+    }
+    if (typeof cbToken !== "string" || cbToken.length < 16) {
+      return {
+        ok: false,
+        error: "callback.token must be a string of length >= 16"
+      };
+    }
+    callback = { url: cbUrl, token: cbToken };
+  }
+  const chatIdRaw = obj["chat_id"];
+  const chat_id = typeof chatIdRaw === "string" && chatIdRaw.length > 0 ? chatIdRaw : buildChatId(session_id, reason) ?? void 0;
+  const req = {
+    task_id,
+    session_id,
+    reason,
+    ...chat_id ? { chat_id } : {},
+    occurred_at: typeof obj["occurred_at"] === "string" ? obj["occurred_at"] : void 0,
+    payload: {
+      text,
+      ts_start_ms: typeof payloadObj["ts_start_ms"] === "number" ? payloadObj["ts_start_ms"] : void 0,
+      ts_end_ms: typeof payloadObj["ts_end_ms"] === "number" ? payloadObj["ts_end_ms"] : void 0,
+      is_final: typeof payloadObj["is_final"] === "boolean" ? payloadObj["is_final"] : void 0,
+      user_message_id: typeof payloadObj["user_message_id"] === "string" ? payloadObj["user_message_id"] : void 0
+    },
+    ...callback ? { callback } : {}
+  };
+  return { ok: true, req };
+}
+function httpTaskRequestToTaskPayload(req, overrides) {
+  if (req.reason === "system_prelude") return null;
+  const text = overrides?.text ?? req.payload.text;
+  const evidence = {
+    transcript_excerpt: text
+  };
+  if (typeof req.payload.ts_start_ms === "number") {
+    evidence["ts_start_ms"] = req.payload.ts_start_ms;
+  }
+  if (typeof req.payload.ts_end_ms === "number") {
+    evidence["ts_end_ms"] = req.payload.ts_end_ms;
+  }
+  if (typeof req.payload.is_final === "boolean") {
+    evidence["is_final"] = req.payload.is_final;
+  }
+  if (typeof req.payload.user_message_id === "string") {
+    evidence["user_message_id"] = req.payload.user_message_id;
+  }
+  if (req.chat_id) {
+    evidence["chat_id"] = req.chat_id;
+  }
+  const isChat = req.reason === "chat_message";
+  return {
+    id: req.task_id,
+    session_id: req.session_id,
+    title: isChat ? `Chat message in session ${req.session_id}` : `Transcript chunk from session ${req.session_id}`,
+    request_text: text,
+    action_type: req.reason,
+    status: "delivered",
+    evidence_payload: evidence,
+    created_at: req.occurred_at ?? (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/http-transport.ts
+var IDEMPOTENCY_MAX_SIZE = 1024;
+var IDEMPOTENCY_TTL_MS = 5 * 60 * 1e3;
+var CALLBACK_TIMEOUT_MS = 5e3;
+var CALLBACK_MAX_ATTEMPTS = 4;
+var CALLBACK_RETRY_BASE_MS = 250;
+var POLL_INTERVAL_MS = 500;
+function resolveRuntimeEvents(api) {
+  const runtime = api.runtime;
+  const events = runtime?.events;
+  if (!events) return null;
+  if (typeof events.onSessionTranscriptUpdate !== "function") return null;
+  return events;
+}
+var INCOMING_PATH = "/v1/incoming";
+var PING_PATH = "/v1/ping";
+function constantTimeTokenEqual(provided, expected) {
+  const a = Buffer2.from(provided);
+  const b = Buffer2.from(expected);
+  if (a.length !== b.length) {
+    const sink = Buffer2.alloc(Math.max(a.length, b.length));
+    timingSafeEqual(sink, sink);
+    return false;
+  }
+  return timingSafeEqual(a, b);
+}
+function extractBearerToken(header) {
+  if (!header) return null;
+  const match = /^Bearer\s+(\S.*)$/i.exec(header.trim());
+  if (!match) return null;
+  return match[1]?.trim() ?? null;
+}
+function isLoopbackAddress(addr) {
+  if (!addr) return false;
+  if (addr === "127.0.0.1" || addr === "::1") return true;
+  if (addr === "::ffff:127.0.0.1") return true;
+  return false;
+}
+function readBody(req, maxBytes) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    req.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > maxBytes) {
+        reject(new Error("body_too_large"));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on("end", () => {
+      resolve(Buffer2.concat(chunks).toString("utf8"));
+    });
+    req.on("error", (err) => reject(err));
+  });
+}
+function jsonResponse(status, body) {
+  const serialized = JSON.stringify(body);
+  return {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Length": String(Buffer2.byteLength(serialized))
+    },
+    body: serialized
+  };
+}
+function extractContentFromMessage(msg) {
+  const content = msg["content"];
+  if (typeof content === "string") return content;
+  if (Array.isArray(content)) {
+    for (const part of content) {
+      if (typeof part === "object" && part !== null && part["type"] === "text" && typeof part["text"] === "string") {
+        return part["text"];
+      }
+    }
+  }
+  return null;
+}
+function createHttpTransport(options) {
+  const { api } = options;
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 8765;
+  const token = options.token;
+  const callbackFetch = options.callbackFetch ?? fetch;
+  if (!token || token.length < 16) {
+    throw new Error("http-transport: token must be at least 16 characters");
+  }
+  const idempotency = /* @__PURE__ */ new Map();
+  const inflight = /* @__PURE__ */ new Set();
+  const chatTasks = /* @__PURE__ */ new Map();
+  const pendingPreludes = /* @__PURE__ */ new Map();
+  function rememberResult(taskId, status, body) {
+    idempotency.set(taskId, {
+      status,
+      body,
+      expiresAt: Date.now() + IDEMPOTENCY_TTL_MS
+    });
+    while (idempotency.size > IDEMPOTENCY_MAX_SIZE) {
+      const oldestKey = idempotency.keys().next().value;
+      if (oldestKey === void 0) break;
+      idempotency.delete(oldestKey);
+    }
+  }
+  function evictExpired() {
+    const now = Date.now();
+    for (const [key, entry] of idempotency) {
+      if (entry.expiresAt <= now) idempotency.delete(key);
+    }
+  }
+  function recordTerminalCallback(taskId, callback, body) {
+    const entry = idempotency.get(taskId);
+    if (!entry) return;
+    entry.terminal = { callback, body };
+  }
+  function consumePrelude(sessionId) {
+    const prelude = pendingPreludes.get(sessionId);
+    if (prelude !== void 0) pendingPreludes.delete(sessionId);
+    return prelude;
+  }
+  async function collectAssistantRepliesAfterMarker(sessionKey, markers) {
+    const session = await api.runtime.subagent.getSessionMessages({
+      sessionKey,
+      limit: 100
+    });
+    const messages = session.messages;
+    let markerIndex = -1;
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const msg = messages[i];
+      if (msg["role"] !== "user") continue;
+      const text = extractContentFromMessage(msg) ?? "";
+      if (markers.some((m) => text.includes(m))) {
+        markerIndex = i;
+        break;
+      }
+    }
+    if (markerIndex === -1) return [];
+    const replies = [];
+    for (let j = markerIndex + 1; j < messages.length; j++) {
+      const msg = messages[j];
+      const role = msg["role"];
+      if (role === "user") break;
+      if (role === "assistant" || role === "model") {
+        const text = extractContentFromMessage(msg);
+        if (text) replies.push(text);
+      }
+    }
+    return replies;
+  }
+  async function postCallback(callback, taskId, body) {
+    const url = buildCallbackUrl(callback.url, taskId);
+    const serialized = JSON.stringify(body);
+    let lastError = null;
+    for (let attempt = 0; attempt < CALLBACK_MAX_ATTEMPTS; attempt++) {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), CALLBACK_TIMEOUT_MS);
+      try {
+        const res = await callbackFetch(url, {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${callback.token}`
+          },
+          body: serialized,
+          signal: controller.signal
+        });
+        clearTimeout(timeoutId);
+        if (res.ok) return;
+        lastError = new Error(`callback returned status ${res.status}`);
+        if (res.status >= 400 && res.status < 500) {
+          throw lastError;
+        }
+      } catch (err) {
+        clearTimeout(timeoutId);
+        lastError = err;
+      }
+      if (attempt + 1 < CALLBACK_MAX_ATTEMPTS) {
+        await new Promise(
+          (r) => setTimeout(r, CALLBACK_RETRY_BASE_MS * 2 ** attempt)
+        );
+      }
+    }
+    throw lastError instanceof Error ? lastError : new Error(String(lastError ?? "callback_failed"));
+  }
+  async function redeliverTerminalCallback(record, taskId) {
+    try {
+      await postCallback(record.callback, taskId, record.body);
+      api.logger.info(
+        `[stagewhisper-http] redelivered terminal callback for ${taskId}`
+      );
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      api.logger.error(
+        `[stagewhisper-http] terminal callback redelivery failed for ${taskId}: ${errMsg}`
+      );
+    }
+  }
+  async function runReplyTaskAsync(taskRequest, kind) {
+    const callback = taskRequest.callback;
+    if (!callback) {
+      api.logger.error(
+        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} missing callback after validation`
+      );
+      return;
+    }
+    const userMessageId = taskRequest.payload.user_message_id;
+    const effectiveText = applyPrelude(
+      taskRequest.payload.text,
+      consumePrelude(taskRequest.session_id)
+    );
+    const taskPayload = httpTaskRequestToTaskPayload(taskRequest, {
+      text: effectiveText
+    });
+    if (!taskPayload) {
+      api.logger.error(
+        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} produced no payload`
+      );
+      return;
+    }
+    const peerId = `sw:${taskRequest.session_id}:${kind}`;
+    const sessionKey = buildAgentSessionKey({
+      agentId: "default",
+      channel: "stagewhisper",
+      peer: { kind: "direct", id: peerId },
+      dmScope: "per-channel-peer"
+    });
+    const chatIdReason = kind === "chat" ? "chat_message" : "transcript_chunk";
+    const chatId = taskRequest.chat_id ?? buildChatId(taskRequest.session_id, chatIdReason);
+    const markers = [`StageWhisper task: ${taskRequest.task_id}`];
+    if (userMessageId) markers.push(`[StageWhisper chat: ${userMessageId}]`);
+    let forwardedCount = 0;
+    const postMessage = async (replyText) => {
+      const messageId = randomUUID();
+      const body = {
+        task_id: taskRequest.task_id,
+        session_id: taskRequest.session_id,
+        chat_id: chatId,
+        user_message_id: userMessageId ?? null,
+        message_id: messageId,
+        status: "message",
+        reply_text: replyText,
+        occurred_at: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      recordTerminalCallback(taskRequest.task_id, callback, body);
+      try {
+        await postCallback(callback, taskRequest.task_id, body);
+        api.logger.info(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} forwarded message ${messageId}`
+        );
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        api.logger.error(
+          `[stagewhisper-http] callback POST failed for ${taskRequest.task_id}: ${errMsg}`
+        );
+      }
+    };
+    const postTyping = async () => {
+      try {
+        await postCallback(callback, taskRequest.task_id, {
+          task_id: taskRequest.task_id,
+          session_id: taskRequest.session_id,
+          chat_id: chatId,
+          user_message_id: userMessageId ?? null,
+          status: "typing",
+          label: "thinking"
+        });
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        api.logger.warn(
+          `[stagewhisper-http] typing callback failed for ${taskRequest.task_id}: ${errMsg}`
+        );
+      }
+    };
+    const events = resolveRuntimeEvents(api);
+    let unsubscribeTranscript = null;
+    let pollDone = false;
+    let flushing = null;
+    let flushQueued = false;
+    let wakePoll = () => {
+    };
+    const sleepUntilPoll = () => new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        wakePoll = () => {
+        };
+        resolve();
+      }, POLL_INTERVAL_MS);
+      wakePoll = () => {
+        clearTimeout(timer);
+        wakePoll = () => {
+        };
+        resolve();
+      };
+    });
+    const runFlushOnce = async () => {
+      try {
+        const replies = await collectAssistantRepliesAfterMarker(
+          sessionKey,
+          markers
+        );
+        while (forwardedCount < replies.length) {
+          const reply = replies[forwardedCount];
+          forwardedCount += 1;
+          if (reply.trim()) await postMessage(reply);
+        }
+      } catch (err) {
+        api.logger.warn(
+          `[stagewhisper-http] session flush failed for ${taskRequest.task_id}: ${err}`
+        );
+      }
+    };
+    const flushFromSession = async () => {
+      if (flushing) {
+        flushQueued = true;
+        await flushing;
+        return;
+      }
+      flushing = (async () => {
+        await runFlushOnce();
+        while (flushQueued) {
+          flushQueued = false;
+          await runFlushOnce();
+        }
+      })();
+      try {
+        await flushing;
+      } finally {
+        flushing = null;
+      }
+    };
+    try {
+      const dispatch = await dispatchTaskToAgent({
+        api,
+        task: taskPayload,
+        deliver: true,
+        idempotencyKey: `sw-http-task-${taskRequest.task_id}`,
+        sessionPeerId: peerId
+      });
+      api.logger.info(
+        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} dispatched (runId: ${dispatch.runId})`
+      );
+      const runId = dispatch.runId;
+      await postTyping();
+      if (events?.onSessionTranscriptUpdate) {
+        unsubscribeTranscript = events.onSessionTranscriptUpdate((update) => {
+          if (update.sessionKey && update.sessionKey !== sessionKey) return;
+          const message = update.message;
+          const role = message?.["role"];
+          if (role !== void 0 && role !== "assistant" && role !== "model") {
+            return;
+          }
+          void flushFromSession();
+        });
+      }
+      let pollLoop = Promise.resolve();
+      if (!events?.onSessionTranscriptUpdate) {
+        pollLoop = (async () => {
+          while (!pollDone) {
+            await sleepUntilPoll();
+            if (pollDone) break;
+            await flushFromSession();
+          }
+        })();
+      }
+      const waitResult = await api.runtime.subagent.waitForRun({
+        runId
+      });
+      pollDone = true;
+      wakePoll();
+      await pollLoop;
+      await flushFromSession();
+      if (waitResult.status === "error") {
+        api.logger.error(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} agent error: ${waitResult.error}`
+        );
+        try {
+          await postCallback(callback, taskRequest.task_id, {
+            task_id: taskRequest.task_id,
+            session_id: taskRequest.session_id,
+            chat_id: chatId,
+            user_message_id: userMessageId ?? null,
+            status: "errored",
+            error_code: "agent_error",
+            error_message: waitResult.error ?? "agent run error"
+          });
+        } catch (postErr) {
+          api.logger.error(
+            `[stagewhisper-http] errored callback failed for ${taskRequest.task_id}: ${postErr}`
+          );
+        }
+      } else {
+        api.logger.info(
+          `[stagewhisper-http] ${kind} task ${taskRequest.task_id} turn settled (${waitResult.status})`
+        );
+      }
+    } catch (err) {
+      const errMsg = err instanceof Error ? err.message : String(err);
+      api.logger.error(
+        `[stagewhisper-http] ${kind} task ${taskRequest.task_id} threw: ${errMsg}`
+      );
+      try {
+        await postCallback(callback, taskRequest.task_id, {
+          task_id: taskRequest.task_id,
+          session_id: taskRequest.session_id,
+          chat_id: chatId,
+          user_message_id: userMessageId ?? null,
+          status: "errored",
+          error_code: "execution_error",
+          error_message: errMsg
+        });
+      } catch (postErr) {
+        api.logger.error(
+          `[stagewhisper-http] errored callback failed for ${taskRequest.task_id}: ${postErr}`
+        );
+      }
+    } finally {
+      pollDone = true;
+      wakePoll();
+      unsubscribeTranscript?.();
+      inflight.delete(taskRequest.task_id);
+    }
+  }
+  async function handleChatMessageRequest(taskReq) {
+    if (!taskReq.callback) {
+      return jsonResponse(400, {
+        error: "chat_message requires callback {url, token}"
+      });
+    }
+    const ackBody = JSON.stringify({ status: "accepted", task_id: taskReq.task_id });
+    const response = {
+      status: 202,
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": String(Buffer2.byteLength(ackBody))
+      },
+      body: ackBody
+    };
+    rememberResult(taskReq.task_id, response.status, response.body);
+    const task = runReplyTaskAsync(taskReq, "chat");
+    chatTasks.set(taskReq.task_id, task);
+    void task.finally(() => {
+      if (chatTasks.get(taskReq.task_id) === task) {
+        chatTasks.delete(taskReq.task_id);
+      }
+    });
+    return response;
+  }
+  async function handleTranscriptChunkRequest(taskReq) {
+    if (taskReq.payload.is_final !== true) {
+      const response2 = jsonResponse(202, {
+        status: "accepted",
+        task_id: taskReq.task_id,
+        dispatched: false
+      });
+      rememberResult(taskReq.task_id, response2.status, response2.body);
+      inflight.delete(taskReq.task_id);
+      return response2;
+    }
+    if (!taskReq.callback) {
+      try {
+        const effectiveText = applyPrelude(
+          taskReq.payload.text,
+          consumePrelude(taskReq.session_id)
+        );
+        const taskPayload = httpTaskRequestToTaskPayload(taskReq, {
+          text: effectiveText
+        });
+        if (!taskPayload) {
+          return jsonResponse(400, { error: "invalid_payload_for_reason" });
+        }
+        const reasoningPeerId = `sw:${taskReq.session_id}:reasoning`;
+        const dispatch = await dispatchTaskToAgent({
+          api,
+          task: taskPayload,
+          deliver: true,
+          idempotencyKey: `sw-http-task-${taskReq.task_id}`,
+          sessionPeerId: reasoningPeerId
+        });
+        api.logger.info(
+          `[stagewhisper-http] dispatched one-way task ${taskReq.task_id} (runId: ${dispatch.runId})`
+        );
+        const response2 = jsonResponse(200, {
+          status: "accepted",
+          task_id: taskReq.task_id,
+          run_id: dispatch.runId,
+          dispatched: true
+        });
+        rememberResult(taskReq.task_id, response2.status, response2.body);
+        return response2;
+      } catch (err) {
+        const errMsg = err instanceof Error ? err.message : String(err);
+        api.logger.error(
+          `[stagewhisper-http] dispatch failed for ${taskReq.task_id}: ${errMsg}`
+        );
+        return jsonResponse(503, { error: "dispatch_failed", detail: errMsg });
+      } finally {
+        inflight.delete(taskReq.task_id);
+      }
+    }
+    const ackBody = JSON.stringify({ status: "accepted", task_id: taskReq.task_id });
+    const response = {
+      status: 202,
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": String(Buffer2.byteLength(ackBody))
+      },
+      body: ackBody
+    };
+    rememberResult(taskReq.task_id, response.status, response.body);
+    const task = runReplyTaskAsync(taskReq, "reasoning");
+    chatTasks.set(taskReq.task_id, task);
+    void task.finally(() => {
+      if (chatTasks.get(taskReq.task_id) === task) {
+        chatTasks.delete(taskReq.task_id);
+      }
+    });
+    return response;
+  }
+  function handleSystemPreludeRequest(taskReq) {
+    pendingPreludes.set(taskReq.session_id, taskReq.payload.text);
+    const response = jsonResponse(202, {
+      status: "accepted",
+      task_id: taskReq.task_id
+    });
+    rememberResult(taskReq.task_id, response.status, response.body);
+    inflight.delete(taskReq.task_id);
+    return response;
+  }
+  async function dispatchRoute(req) {
+    if (!isLoopbackAddress(req.remoteAddress)) {
+      api.logger.warn(
+        `[stagewhisper-http] rejecting non-loopback connection from ${req.remoteAddress}`
+      );
+      return jsonResponse(403, { error: "non_loopback_rejected" });
+    }
+    if (!isAllowedHostHeader(req.host)) {
+      api.logger.warn(
+        `[stagewhisper-http] rejecting disallowed Host header: ${req.host ?? "<missing>"}`
+      );
+      return jsonResponse(403, { error: "invalid_host" });
+    }
+    const providedToken = extractBearerToken(req.authorization);
+    if (!providedToken || !constantTimeTokenEqual(providedToken, token)) {
+      return jsonResponse(401, { error: "invalid_token" });
+    }
+    if (req.method === "POST" && req.url === PING_PATH) {
+      return jsonResponse(200, { ok: true });
+    }
+    if (req.method === "POST" && req.url === INCOMING_PATH) {
+      let parsed;
+      try {
+        parsed = req.body.length === 0 ? {} : JSON.parse(req.body);
+      } catch (err) {
+        return jsonResponse(400, {
+          error: `invalid_json: ${err instanceof Error ? err.message : String(err)}`
+        });
+      }
+      const validation = validateHttpTaskRequest(parsed);
+      if (!validation.ok) {
+        return jsonResponse(400, { error: validation.error });
+      }
+      const taskReq = validation.req;
+      evictExpired();
+      const cached = idempotency.get(taskReq.task_id);
+      if (cached && cached.expiresAt > Date.now()) {
+        if (cached.terminal) {
+          const terminal = cached.terminal;
+          const redelivery = redeliverTerminalCallback(terminal, taskReq.task_id);
+          chatTasks.set(taskReq.task_id, redelivery);
+          void redelivery.finally(() => {
+            if (chatTasks.get(taskReq.task_id) === redelivery) {
+              chatTasks.delete(taskReq.task_id);
+            }
+          });
+        }
+        return {
+          status: cached.status,
+          headers: {
+            "Content-Type": "application/json",
+            "Content-Length": String(Buffer2.byteLength(cached.body)),
+            "X-Idempotent-Replay": "true"
+          },
+          body: cached.body
+        };
+      }
+      if (inflight.has(taskReq.task_id)) {
+        return jsonResponse(503, { error: "task_in_flight" });
+      }
+      inflight.add(taskReq.task_id);
+      if (taskReq.reason === "chat_message") {
+        return handleChatMessageRequest(taskReq);
+      }
+      if (taskReq.reason === "system_prelude") {
+        return handleSystemPreludeRequest(taskReq);
+      }
+      return handleTranscriptChunkRequest(taskReq);
+    }
+    return jsonResponse(404, { error: "not_found" });
+  }
+  async function handleRealRequest(req, res) {
+    const method = req.method ?? "";
+    const url = req.url ?? "";
+    const authHeader = req.headers["authorization"];
+    const authorization = Array.isArray(authHeader) ? authHeader[0] : authHeader;
+    const hostHeader = req.headers["host"];
+    const hostValue = Array.isArray(hostHeader) ? hostHeader[0] : hostHeader;
+    const remoteAddress = req.socket.remoteAddress;
+    let body = "";
+    if (method === "POST") {
+      try {
+        body = await readBody(req, MAX_BODY_BYTES);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        const response = msg === "body_too_large" ? jsonResponse(413, { error: "body_too_large" }) : jsonResponse(400, { error: `invalid_body: ${msg}` });
+        writeResponse(res, response);
+        return;
+      }
+    }
+    const result = await dispatchRoute({
+      method,
+      url,
+      authorization,
+      host: hostValue,
+      remoteAddress,
+      body
+    });
+    writeResponse(res, result);
+  }
+  function writeResponse(res, response) {
+    res.statusCode = response.status;
+    for (const [key, value] of Object.entries(response.headers)) {
+      res.setHeader(key, value);
+    }
+    res.end(response.body);
+  }
+  let server = null;
+  return {
+    async start() {
+      if (server) return;
+      const srv = http.createServer((req, res) => {
+        handleRealRequest(req, res).catch((err) => {
+          api.logger.error(`[stagewhisper-http] unhandled error: ${err}`);
+          if (!res.headersSent) {
+            try {
+              writeResponse(res, jsonResponse(500, { error: "internal_error" }));
+            } catch {
+            }
+          }
+        });
+      });
+      server = srv;
+      await new Promise((resolve, reject) => {
+        const onError = (err) => {
+          srv.off("listening", onListening);
+          reject(err);
+        };
+        const onListening = () => {
+          srv.off("error", onError);
+          resolve();
+        };
+        srv.once("error", onError);
+        srv.once("listening", onListening);
+        srv.listen(port, host);
+      });
+      const addr = srv.address();
+      api.logger.info(
+        `[stagewhisper-http] listening on http://${host}:${typeof addr === "object" && addr ? addr.port : port}`
+      );
+    },
+    async stop() {
+      const srv = server;
+      if (!srv) return;
+      server = null;
+      await new Promise((resolve) => {
+        srv.close(() => resolve());
+        srv.closeAllConnections?.();
+      });
+      const pending = Array.from(chatTasks.values());
+      if (pending.length > 0) {
+        await Promise.allSettled(pending);
+      }
+      idempotency.clear();
+      inflight.clear();
+      chatTasks.clear();
+      pendingPreludes.clear();
+      api.logger.info("[stagewhisper-http] stopped");
+    },
+    address() {
+      const addr = server?.address();
+      if (typeof addr === "object" && addr !== null) return addr;
+      return null;
+    },
+    async handleSyntheticRequest(input) {
+      const headers = input.headers ?? {};
+      const authorization = headers["Authorization"] ?? headers["authorization"] ?? void 0;
+      const hostValue = headers["Host"] ?? headers["host"] ?? "127.0.0.1";
+      const remoteAddress = input.remoteAddress ?? "127.0.0.1";
+      const body = input.body ?? "";
+      return dispatchRoute({
+        method: input.method,
+        url: input.url,
+        authorization,
+        host: hostValue,
+        remoteAddress,
+        body
+      });
+    },
+    whenChatTaskSettled(taskId) {
+      return chatTasks.get(taskId);
+    }
+  };
+}
+
+// src/pairing.ts
+import { Buffer as Buffer3 } from "node:buffer";
+import { randomBytes } from "node:crypto";
+var PAIRING_CODE_PREFIX = "stagewhisper-pair:v1:";
+function encodePairingCode(url, token, label) {
+  const payload = JSON.stringify({ url, token, label });
+  const encoded = Buffer3.from(payload, "utf8").toString("base64url");
+  return `${PAIRING_CODE_PREFIX}${encoded}`;
+}
+function generateRelayToken() {
+  return randomBytes(32).toString("base64url");
+}
+
 // src/runtime.ts
 var runtimeStore = createPluginRuntimeStore(
   "StageWhisper plugin runtime not initialized"
@@ -3996,7 +4977,7 @@ var getRuntime = runtimeStore.getRuntime;
 
 // src/service.ts
 init_client();
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/health.ts
 var DEGRADED_THRESHOLD = 3;
@@ -4278,41 +5259,13 @@ function createRelayService(api) {
       };
     }
   }
-  function buildTaskMessage(task) {
-    const lines = [];
-    lines.push(`**${task.title}**`);
-    lines.push("");
-    lines.push(task.request_text);
-    if (task.evidence_payload) {
-      const evidence = task.evidence_payload;
-      if (evidence["transcript_excerpt"]) {
-        lines.push("");
-        lines.push(`Context: ${evidence["transcript_excerpt"]}`);
-      }
-      if (evidence["signal_summary"]) {
-        lines.push(`Signal: ${evidence["signal_summary"]}`);
-      }
-      if (evidence["tone_summary"]) {
-        lines.push(`Tone: ${evidence["tone_summary"]}`);
-      }
-      if (evidence["playbook_label"]) {
-        lines.push(`Playbook: ${evidence["playbook_label"]}`);
-      }
-    }
-    lines.push("");
-    lines.push(`Action type: ${task.action_type}`);
-    lines.push(`StageWhisper task: ${task.id}`);
-    lines.push(`Session: ${task.session_id}`);
-    return lines.join("\n");
-  }
-  function isTestTask(task) {
-    return task.action_type === "connectivity_test";
-  }
+  const buildTaskMessage2 = buildTaskMessage;
+  const isTestTask2 = isTestTask;
   async function updateStatus(client, task, status) {
-    if (isTestTask(task)) return;
+    if (isTestTask2(task)) return;
     await client.updateTaskStatus(task.id, status);
   }
-  function extractContentFromMessage(msg) {
+  function extractContentFromMessage2(msg) {
     const content = msg["content"];
     if (typeof content === "string") return content;
     if (Array.isArray(content)) {
@@ -4330,7 +5283,7 @@ function createRelayService(api) {
       if (!msg) continue;
       const role = msg["role"];
       if (role !== "assistant" && role !== "model") continue;
-      return extractContentFromMessage(msg);
+      return extractContentFromMessage2(msg);
     }
     return null;
   }
@@ -4381,13 +5334,13 @@ function createRelayService(api) {
       for (let i = 0; i < messages.length; i++) {
         const msg = messages[i];
         if (msg["role"] !== "user") continue;
-        const text = extractContentFromMessage(msg) ?? "";
+        const text = extractContentFromMessage2(msg) ?? "";
         if (!text.includes(`StageWhisper task: ${taskId}`)) continue;
         for (let j = i + 1; j < messages.length; j++) {
           const reply = messages[j];
           const role = reply["role"];
           if (role === "assistant" || role === "model") {
-            return extractContentFromMessage(reply);
+            return extractContentFromMessage2(reply);
           }
           if (role === "user") break;
         }
@@ -4423,13 +5376,13 @@ function createRelayService(api) {
       for (let i = 0; i < messages.length; i++) {
         const msg = messages[i];
         if (msg["role"] !== "user") continue;
-        const text = extractContentFromMessage(msg) ?? "";
+        const text = extractContentFromMessage2(msg) ?? "";
         if (!text.includes(marker)) continue;
         for (let j = i + 1; j < messages.length; j++) {
           const next = messages[j];
           const role = next["role"];
           if (role === "assistant" || role === "model") {
-            return extractContentFromMessage(next);
+            return extractContentFromMessage2(next);
           }
           if (role === "user") break;
         }
@@ -4505,7 +5458,7 @@ function createRelayService(api) {
     }
     const isByo = !!task.is_byo_encrypted;
     const effectiveTask = isByo ? decryptTaskFields(task, client) : task;
-    const messageContent = buildTaskMessage(effectiveTask);
+    const messageContent = buildTaskMessage2(effectiveTask);
     const peerId = `sw-session-${task.session_id}`;
     const sessionKey = buildAgentSessionKey({
       agentId: "default",
@@ -4548,7 +5501,7 @@ function createRelayService(api) {
     });
   }
   async function handleTestTask(task, client) {
-    const messageContent = buildTaskMessage(task);
+    const messageContent = buildTaskMessage2(task);
     const sessionKey = buildAgentSessionKey({
       agentId: "default",
       channel: "stagewhisper",
@@ -4558,7 +5511,7 @@ function createRelayService(api) {
       sessionKey,
       message: messageContent,
       deliver: false,
-      idempotencyKey: randomUUID()
+      idempotencyKey: randomUUID2()
     });
     api.logger.info(`Test task ${task.id} dispatched (runId: ${result.runId})`);
     const waitResult = await api.runtime.subagent.waitForRun({
@@ -4581,7 +5534,7 @@ function createRelayService(api) {
   async function handleTask(task, client) {
     api.logger.info(`Received task: ${task.title} (${task.id})`);
     try {
-      if (isTestTask(task)) {
+      if (isTestTask2(task)) {
         await handleTestTask(task, client);
       } else {
         await handleNormalTask(task, client);
@@ -5411,20 +6364,73 @@ function createRelayService(api) {
 }
 
 // plugin-main.ts
+function resolveTransportMode(api) {
+  const pluginCfg = api.pluginConfig ?? {};
+  const fromConfig = pluginCfg["transport"];
+  if (fromConfig === "http" || fromConfig === "sse") return fromConfig;
+  const envOverride = process.env["STAGEWHISPER_TRANSPORT"];
+  if (envOverride === "http" || envOverride === "sse") return envOverride;
+  return "sse";
+}
+function resolveHttpTransportToken(pluginCfg, env = process.env) {
+  if (typeof pluginCfg["httpToken"] === "string" && pluginCfg["httpToken"]) {
+    return pluginCfg["httpToken"];
+  }
+  if (env["STAGEWHISPER_HTTP_TOKEN"]) {
+    return env["STAGEWHISPER_HTTP_TOKEN"];
+  }
+  if (typeof pluginCfg["relayToken"] === "string") {
+    return pluginCfg["relayToken"];
+  }
+  return "";
+}
+function createHttpTransportService(api) {
+  const pluginCfg = api.pluginConfig ?? {};
+  const host = typeof pluginCfg["httpHost"] === "string" ? pluginCfg["httpHost"] : process.env["STAGEWHISPER_HTTP_HOST"] ?? "127.0.0.1";
+  const portRaw = pluginCfg["httpPort"];
+  const port = typeof portRaw === "number" ? portRaw : typeof portRaw === "string" ? Number(portRaw) : Number(process.env["STAGEWHISPER_HTTP_PORT"]) || 8765;
+  const token = resolveHttpTransportToken(pluginCfg);
+  let transport = null;
+  return {
+    id: "stagewhisper-http-transport",
+    async start(_ctx) {
+      if (!token || token.length < 16) {
+        api.logger.warn(
+          "StageWhisper HTTP transport requires `httpToken` (>=16 chars) in plugin config or STAGEWHISPER_HTTP_TOKEN env var \u2014 listener not started."
+        );
+        return;
+      }
+      transport = createHttpTransport({ api, host, port, token });
+      try {
+        await transport.start();
+        api.logger.info(`StageWhisper HTTP transport started on ${host}:${port}`);
+      } catch (err) {
+        api.logger.error(`StageWhisper HTTP transport failed to start: ${err}`);
+        transport = null;
+      }
+    },
+    async stop(_ctx) {
+      if (transport) {
+        await transport.stop();
+        transport = null;
+      }
+    }
+  };
+}
 async function ensureResponsesEndpoint(api) {
   try {
     const cfg = await api.runtime.config.loadConfig();
     const gw = cfg["gateway"] ?? {};
-    const http = gw["http"] ?? {};
-    const endpoints = http["endpoints"] ?? {};
+    const http2 = gw["http"] ?? {};
+    const endpoints = http2["endpoints"] ?? {};
     const responses = endpoints["responses"] ?? {};
     if (responses["enabled"] === true) return;
     const auth = gw["auth"] ?? {};
     if (auth["mode"] === "none" && !auth["token"] && !auth["password"]) return;
     responses["enabled"] = true;
     endpoints["responses"] = responses;
-    http["endpoints"] = endpoints;
-    gw["http"] = http;
+    http2["endpoints"] = endpoints;
+    gw["http"] = http2;
     cfg["gateway"] = gw;
     await api.runtime.config.writeConfigFile(cfg);
     api.logger.info(
@@ -5442,13 +6448,7 @@ var plugin_main_default = definePluginEntry({
     api.registerCli(
       ({ program }) => {
         const sw = program.command("stagewhisper").description("StageWhisper integration");
-        sw.command("pair").description(
-          "Pair with StageWhisper using a pairing code from the desktop app"
-        ).requiredOption("--code <code>", "Pairing code from Settings \u2192 Assistant").option(
-          "--api-url <url>",
-          "StageWhisper backend URL",
-          "https://api.stagewhisper.io"
-        ).option("--label <label>", "Label for this OpenClaw host", "OpenClaw").option("--no-enable-responses", "Skip enabling the gateway OpenResponses HTTP API").action(
+        sw.command("pair").description("Pair with StageWhisper using a pairing code from the desktop app").requiredOption("--code <code>", "Pairing code from Settings \u2192 Assistant").option("--api-url <url>", "StageWhisper backend URL", "https://api.stagewhisper.io").option("--label <label>", "Label for this OpenClaw host", "OpenClaw").option("--no-enable-responses", "Skip enabling the gateway OpenResponses HTTP API").action(
           async (opts) => {
             const { StageWhisperClient: StageWhisperClient2 } = await Promise.resolve().then(() => (init_client(), client_exports));
             const { IdentityKeypair: IdentityKeypair2 } = await Promise.resolve().then(() => (init_crypto(), crypto_exports));
@@ -5493,26 +6493,33 @@ var plugin_main_default = definePluginEntry({
                 const authMode = gwAuth["mode"];
                 const hasToken = typeof gwAuth["token"] === "string" && gwAuth["token"].length > 0;
                 if (authMode === "none" && !hasToken) {
-                  console.warn("  \u26A0 gateway.auth.mode is 'none' with no token \u2014 skipping HTTP API enablement.");
+                  console.warn(
+                    "  \u26A0 gateway.auth.mode is 'none' with no token \u2014 skipping HTTP API enablement."
+                  );
                   console.warn("    Set a gateway auth token first for reasoning to work.\n");
                 } else {
-                  const http = gw["http"] ?? {};
-                  const endpoints = http["endpoints"] ?? {};
+                  const http2 = gw["http"] ?? {};
+                  const endpoints = http2["endpoints"] ?? {};
                   const responses = endpoints["responses"] ?? {};
                   responses["enabled"] = true;
                   endpoints["responses"] = responses;
-                  http["endpoints"] = endpoints;
-                  gw["http"] = http;
+                  http2["endpoints"] = endpoints;
+                  gw["http"] = http2;
                   cfg["gateway"] = gw;
                 }
               }
               await api.runtime.config.writeConfigFile(cfg);
-              console.log(
-                `
-\u2713 Paired with StageWhisper (${result.label})`
-              );
+              console.log(`
+\u2713 Paired with StageWhisper (${result.label})`);
               console.log("  Config saved. Restart the gateway to activate:\n");
               console.log("  openclaw gateway restart\n");
+              console.log(
+                "  For local HTTP transport (transport: http), the desktop authenticates"
+              );
+              console.log(
+                "  against the loopback listener with this same relay token \u2014 no separate"
+              );
+              console.log("  httpToken is required unless you set one explicitly.\n");
             } catch (err) {
               console.error(`
 \u2717 Pairing failed: ${err}
@@ -5521,9 +6528,62 @@ var plugin_main_default = definePluginEntry({
             }
           }
         );
-        sw.command("unpair").description(
-          "Remove StageWhisper pairing (run before `openclaw plugins uninstall`)"
-        ).option("--keep-responses", "Keep the OpenResponses HTTP API enabled after unpair").action(async (opts) => {
+        sw.command("pair-code").description(
+          "Generate a StageWhisper Free pairing code for the local HTTP transport (no backend)"
+        ).option("--url <url>", "Relay URL StageWhisper Free should reach this gateway at").option("--port <port>", "Loopback port for the HTTP transport listener").option("--label <label>", "Label shown in StageWhisper Free", "OpenClaw").action(async (opts) => {
+          try {
+            const cfg = await api.runtime.config.loadConfig();
+            const plugins = cfg["plugins"] ?? {};
+            const entries = plugins["entries"] ?? {};
+            const swEntry = entries["stagewhisper"] ?? {};
+            const swConfig = swEntry["config"] ?? {};
+            const host = typeof swConfig["httpHost"] === "string" && swConfig["httpHost"] ? swConfig["httpHost"] : "127.0.0.1";
+            const port = opts.port ? Number(opts.port) : typeof swConfig["httpPort"] === "number" ? swConfig["httpPort"] : 8765;
+            if (!Number.isInteger(port) || port < 1024 || port > 65535) {
+              console.error(`
+\u2717 Invalid port ${port} (must be 1024-65535)
+`);
+              process.exit(1);
+            }
+            let token = typeof swConfig["httpToken"] === "string" ? swConfig["httpToken"] : "";
+            if (token.length < 16) {
+              token = generateRelayToken();
+            }
+            const label = (opts.label ?? swConfig["label"] ?? "OpenClaw").trim() || "OpenClaw";
+            swConfig["transport"] = "http";
+            swConfig["httpHost"] = host;
+            swConfig["httpPort"] = port;
+            swConfig["httpToken"] = token;
+            swConfig["label"] = label;
+            swEntry["config"] = swConfig;
+            entries["stagewhisper"] = swEntry;
+            plugins["entries"] = entries;
+            cfg["plugins"] = plugins;
+            await api.runtime.config.writeConfigFile(cfg);
+            const relayUrl = (opts.url ?? "").trim() || `http://${host}:${port}`;
+            const code = encodePairingCode(relayUrl, token, label);
+            console.log("\nStageWhisper Free pairing code:\n");
+            console.log(`  ${code}
+`);
+            console.log("Paste it into StageWhisper Free under Settings \u2192 Connection.");
+            console.log(
+              "Restart the gateway so the HTTP transport listens: openclaw gateway restart"
+            );
+            if (relayUrl.startsWith("http://127.0.0.1")) {
+              console.log(
+                "\nRunning on a remote host? Tunnel the port from the machine running Free:"
+              );
+              console.log(`  ssh -L ${port}:127.0.0.1:${port} <this-host>
+`);
+            }
+          } catch (err) {
+            console.error(`
+\u2717 Failed to generate pairing code: ${err}
+`);
+            process.exit(1);
+          }
+        });
+        sw.command("unpair").description("Remove StageWhisper pairing (run before `openclaw plugins uninstall`)").option("--keep-responses", "Keep the OpenResponses HTTP API enabled after unpair").action(async (opts) => {
           try {
             const cfg = await api.runtime.config.loadConfig();
             const plugins = cfg["plugins"] ?? {};
@@ -5541,15 +6601,19 @@ var plugin_main_default = definePluginEntry({
             }
             if (!opts.keepResponses) {
               const gw = cfg["gateway"];
-              const http = gw?.["http"];
-              const endpoints = http?.["endpoints"];
+              const http2 = gw?.["http"];
+              const endpoints = http2?.["endpoints"];
               const responses = endpoints?.["responses"];
               if (responses?.["enabled"] === true) {
                 delete responses["enabled"];
-                if (Object.keys(responses).length === 0 && endpoints) delete endpoints["responses"];
-                if (endpoints && Object.keys(endpoints).length === 0 && http) delete http["endpoints"];
-                if (http && Object.keys(http).length === 0 && gw) delete gw["http"];
-                console.log("  \u2139 Disabled gateway.http.endpoints.responses. Use --keep-responses to preserve it.");
+                if (Object.keys(responses).length === 0 && endpoints)
+                  delete endpoints["responses"];
+                if (endpoints && Object.keys(endpoints).length === 0 && http2)
+                  delete http2["endpoints"];
+                if (http2 && Object.keys(http2).length === 0 && gw) delete gw["http"];
+                console.log(
+                  "  \u2139 Disabled gateway.http.endpoints.responses. Use --keep-responses to preserve it."
+                );
               }
             }
             await api.runtime.config.writeConfigFile(cfg);
@@ -5563,7 +6627,11 @@ var plugin_main_default = definePluginEntry({
             process.exit(1);
           }
         });
-        sw.command("reasoning-check").description("Test reasoning capability against the local OpenResponses endpoint").option("--model <model>", "Model to use (omit to use your configured default)", "openclaw/default").action(async (opts) => {
+        sw.command("reasoning-check").description("Test reasoning capability against the local OpenResponses endpoint").option(
+          "--model <model>",
+          "Model to use (omit to use your configured default)",
+          "openclaw/default"
+        ).action(async (opts) => {
           const { callOpenResponses: callOpenResponses2, isResponsesEndpointEnabled: isResponsesEndpointEnabled2 } = await Promise.resolve().then(() => (init_openresponses(), openresponses_exports));
           const modelLabel = opts.model === "openclaw/default" ? "default (configured)" : opts.model;
           const cfg = api.config;
@@ -5578,7 +6646,9 @@ var plugin_main_default = definePluginEntry({
           console.log(`  responses.enabled:  ${responsesEnabled ? "\u2713 true" : "\u2717 false"}`);
           if (!responsesEnabled) {
             console.warn("\n\u26A0 responses.enabled is false in the running config.");
-            console.warn("  The plugin auto-enables it on startup \u2014 restart the gateway if you haven't:");
+            console.warn(
+              "  The plugin auto-enables it on startup \u2014 restart the gateway if you haven't:"
+            );
             console.warn("  openclaw gateway restart\n");
           }
           if (!hasToken) {
@@ -5652,9 +6722,7 @@ Testing reasoning with model: ${modelLabel}`);
           } catch (err) {
             const elapsed = Date.now() - start;
             console.error(`\u2717 Reasoning check failed after ${elapsed}ms`);
-            console.error(
-              `  Error: ${err instanceof Error ? err.message : String(err)}`
-            );
+            console.error(`  Error: ${err instanceof Error ? err.message : String(err)}`);
             process.exitCode = 1;
           }
         });
@@ -5663,9 +6731,7 @@ Testing reasoning with model: ${modelLabel}`);
           const configured = !!(cfg?.["integrationId"] && cfg?.["relayToken"]);
           if (!configured) {
             console.log("\nStageWhisper: not paired\n");
-            console.log(
-              "  Run: openclaw stagewhisper pair --code <CODE> [--api-url <URL>]\n"
-            );
+            console.log("  Run: openclaw stagewhisper pair --code <CODE> [--api-url <URL>]\n");
             console.log(
               "  Get the pairing code from StageWhisper desktop: Settings \u2192 Assistant \u2192 Generate Pairing Code\n"
             );
@@ -5699,10 +6765,16 @@ StageWhisper:`);
     if (api.registrationMode !== "full") return;
     ensureResponsesEndpoint(api);
     setRuntime(api.runtime);
-    const service = createRelayService(api);
-    api.registerService(service);
+    const transportMode = resolveTransportMode(api);
+    api.logger.info(`StageWhisper transport: ${transportMode}`);
+    if (transportMode === "http") {
+      api.registerService(createHttpTransportService(api));
+    } else {
+      api.registerService(createRelayService(api));
+    }
   }
 });
 export {
-  plugin_main_default as default
+  plugin_main_default as default,
+  resolveHttpTransportToken
 };