@syengup/friday-channel-next 0.0.39 → 0.0.40

package/dist/src/agent/node-pairing-bridge.d.ts

@@ -0,0 +1,9 @@
+export declare function loadNodePairingModule(): {
+    listNodePairing: Function;
+    approveNodePairing: Function;
+};
+/** Vitest-only: inject mock pairing functions. */
+export declare function __setMockNodePairingForTests(mock: {
+    listNodePairing: Function;
+    approveNodePairing: Function;
+}): void;

package/dist/src/agent/node-pairing-bridge.js

@@ -0,0 +1,19 @@
+import { createRequire } from "node:module";
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+const OPENCLAW_DIST = "/opt/homebrew/lib/node_modules/openclaw/dist";
+let cache = null;
+export function loadNodePairingModule() {
+    if (cache)
+        return cache;
+    const file = readdirSync(OPENCLAW_DIST).find((f) => f.startsWith("node-pairing-") && f.endsWith(".js") && !f.includes("authz"));
+    if (!file)
+        throw new Error("node-pairing module not found in OpenClaw dist");
+    const gatewayRequire = createRequire(join(OPENCLAW_DIST, "_"));
+    cache = gatewayRequire(`./${file.replace(/\.js$/, "")}`);
+    return cache;
+}
+/** Vitest-only: inject mock pairing functions. */
+export function __setMockNodePairingForTests(mock) {
+    cache = mock;
+}

package/dist/src/http/handlers/device-approve.js

@@ -1,24 +1,7 @@
-import { exec } from "node:child_process";
+import { listDevicePairing, approveDevicePairing } from "openclaw/plugin-sdk/device-bootstrap";
 import { readJsonBody } from "../middleware/body.js";
 import { extractBearerToken } from "../middleware/auth.js";
 import { createFridayNextLogger } from "../../logging.js";
-const EXEC_ENV = process.platform === "win32"
-    ? process.env
-    : { ...process.env, PATH: `/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:${process.env.PATH ?? ""}` };
-function execAsync(command, timeoutMs) {
-    return new Promise((resolve, reject) => {
-        const child = exec(command, { encoding: "utf-8", timeout: timeoutMs, maxBuffer: 1024 * 1024, env: EXEC_ENV }, (error, stdout, stderr) => {
-            if (error) {
-                reject(error);
-            }
-            else {
-                resolve({ stdout, stderr });
-            }
-        });
-        child.stdout?.on("data", () => { });
-        child.stderr?.on("data", () => { });
-    });
-}
 export async function handleDeviceApprove(req, res) {
     const log = createFridayNextLogger("device-approve");
     if (req.method !== "POST") {
@@ -49,32 +32,18 @@ export async function handleDeviceApprove(req, res) {
         return true;
     }
     const normalizedDeviceId = rawDeviceId.trim().toUpperCase();
-    let listStdout;
+    let pairing;
     try {
-        const result = await execAsync("openclaw devices list --json", 15000);
-        listStdout = result.stdout;
+        pairing = await listDevicePairing();
     }
     catch (err) {
-        const stderr = err?.stderr?.trim();
-        log.error(`devices list failed: ${err instanceof Error ? err.message : String(err)}`);
-        res.statusCode = 502;
-        res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ error: "Failed to list devices from gateway", detail: stderr || undefined }));
-        return true;
-    }
-    let listData;
-    try {
-        listData = JSON.parse(listStdout);
-    }
-    catch {
-        log.error(`devices list returned invalid JSON: ${listStdout.slice(0, 200)}`);
+        log.error(`listDevicePairing failed: ${err instanceof Error ? err.message : String(err)}`);
         res.statusCode = 502;
         res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ error: "Unexpected response from gateway device list" }));
+        res.end(JSON.stringify({ error: "Failed to list devices from gateway" }));
         return true;
     }
-    const pending = listData.pending ?? [];
-    const match = pending.find((entry) => entry.deviceId.trim().toUpperCase() === normalizedDeviceId);
+    const match = pairing.pending.find((entry) => entry.deviceId.trim().toUpperCase() === normalizedDeviceId);
     if (!match) {
         res.statusCode = 404;
         res.setHeader("Content-Type", "application/json");
@@ -86,31 +55,30 @@ export async function handleDeviceApprove(req, res) {
     }
     const requestId = match.requestId;
     log.info(`approving deviceId=${normalizedDeviceId} requestId=${requestId}`);
-    let approveStdout;
+    let approved;
     try {
-        const result = await execAsync(`openclaw devices approve ${requestId} --json`, 15000);
-        approveStdout = result.stdout;
+        approved = await approveDevicePairing(requestId);
     }
     catch (err) {
-        const stderr = err?.stderr?.trim();
-        log.error(`devices approve failed: ${err instanceof Error ? err.message : String(err)}`);
+        log.error(`approveDevicePairing failed: ${err instanceof Error ? err.message : String(err)}`);
         res.statusCode = 502;
         res.setHeader("Content-Type", "application/json");
         res.end(JSON.stringify({
-            error: "Device approval command failed",
-            detail: stderr || (err instanceof Error ? err.message : "Unknown error"),
+            error: "Device approval failed",
+            detail: err instanceof Error ? err.message : "Unknown error",
         }));
         return true;
     }
-    let approveData;
-    try {
-        approveData = JSON.parse(approveStdout);
+    if (!approved) {
+        res.statusCode = 404;
+        res.setHeader("Content-Type", "application/json");
+        res.end(JSON.stringify({ error: "Pending device request not found" }));
+        return true;
     }
-    catch {
-        log.error(`devices approve returned non-JSON: ${approveStdout.slice(0, 200)}`);
-        res.statusCode = 502;
+    if (approved.status === "forbidden") {
+        res.statusCode = 403;
         res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ error: "Unexpected response from device approval" }));
+        res.end(JSON.stringify({ error: `Device approval forbidden: ${approved.reason ?? "unknown"}` }));
         return true;
     }
     res.statusCode = 200;
@@ -118,8 +86,8 @@ export async function handleDeviceApprove(req, res) {
     res.end(JSON.stringify({
         ok: true,
         deviceId: normalizedDeviceId,
-        requestId: approveData.requestId,
-        approvedAtMs: approveData.device?.approvedAtMs,
+        requestId: approved.requestId,
+        approvedAtMs: approved.device?.approvedAtMs,
     }));
     return true;
 }

package/dist/src/http/handlers/nodes-approve.js

@@ -1,24 +1,7 @@
-import { exec } from "node:child_process";
 import { readJsonBody } from "../middleware/body.js";
 import { extractBearerToken } from "../middleware/auth.js";
 import { createFridayNextLogger } from "../../logging.js";
-const EXEC_ENV = process.platform === "win32"
-    ? process.env
-    : { ...process.env, PATH: `/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:${process.env.PATH ?? ""}` };
-function execAsync(command, timeoutMs) {
-    return new Promise((resolve, reject) => {
-        const child = exec(command, { encoding: "utf-8", timeout: timeoutMs, maxBuffer: 1024 * 1024, env: EXEC_ENV }, (error, stdout, stderr) => {
-            if (error) {
-                reject(error);
-            }
-            else {
-                resolve({ stdout, stderr });
-            }
-        });
-        child.stdout?.on("data", () => { });
-        child.stderr?.on("data", () => { });
-    });
-}
+import { loadNodePairingModule } from "../../agent/node-pairing-bridge.js";
 export async function handleNodesApprove(req, res) {
     const log = createFridayNextLogger("nodes-approve");
     if (req.method !== "POST") {
@@ -49,28 +32,16 @@ export async function handleNodesApprove(req, res) {
         return true;
     }
     const normalizedNodeId = rawNodeId.trim().toUpperCase();
-    let listStdout;
-    try {
-        const result = await execAsync("openclaw nodes list --json", 15000);
-        listStdout = result.stdout;
-    }
-    catch (err) {
-        const stderr = err?.stderr?.trim();
-        log.error(`nodes list failed: ${err instanceof Error ? err.message : String(err)}`);
-        res.statusCode = 502;
-        res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ error: "Failed to list nodes from gateway", detail: stderr || undefined }));
-        return true;
-    }
+    const { listNodePairing, approveNodePairing } = loadNodePairingModule();
     let listData;
     try {
-        listData = JSON.parse(listStdout);
+        listData = await listNodePairing();
     }
-    catch {
-        log.error(`nodes list returned invalid JSON: ${listStdout.slice(0, 200)}`);
+    catch (err) {
+        log.error(`listNodePairing failed: ${err instanceof Error ? err.message : String(err)}`);
         res.statusCode = 502;
         res.setHeader("Content-Type", "application/json");
-        res.end(JSON.stringify({ error: "Unexpected response from gateway node list" }));
+        res.end(JSON.stringify({ error: "Failed to list nodes from gateway" }));
         return true;
     }
     const pending = listData.pending ?? [];
@@ -78,31 +49,30 @@ export async function handleNodesApprove(req, res) {
     if (pendingMatch) {
         const requestId = pendingMatch.requestId;
         log.info(`approving nodeId=${normalizedNodeId} requestId=${requestId}`);
-        let approveStdout;
+        let approved;
         try {
-            const result = await execAsync(`openclaw nodes approve ${requestId} --json`, 15000);
-            approveStdout = result.stdout;
+            approved = await approveNodePairing(requestId, {});
         }
         catch (err) {
-            const stderr = err?.stderr?.trim();
-            log.error(`nodes approve failed: ${err instanceof Error ? err.message : String(err)}`);
+            log.error(`approveNodePairing failed: ${err instanceof Error ? err.message : String(err)}`);
             res.statusCode = 502;
             res.setHeader("Content-Type", "application/json");
             res.end(JSON.stringify({
-                error: "Node approval command failed",
-                detail: stderr || (err instanceof Error ? err.message : "Unknown error"),
+                error: "Node approval failed",
+                detail: err instanceof Error ? err.message : "Unknown error",
             }));
             return true;
         }
-        let approveData;
-        try {
-            approveData = JSON.parse(approveStdout);
+        if (!approved) {
+            res.statusCode = 404;
+            res.setHeader("Content-Type", "application/json");
+            res.end(JSON.stringify({ error: "Pending node request not found" }));
+            return true;
         }
-        catch {
-            log.error(`nodes approve returned non-JSON: ${approveStdout.slice(0, 200)}`);
-            res.statusCode = 502;
+        if ("status" in approved && approved.status === "forbidden") {
+            res.statusCode = 403;
             res.setHeader("Content-Type", "application/json");
-            res.end(JSON.stringify({ error: "Unexpected response from node approval" }));
+            res.end(JSON.stringify({ error: `Node approval forbidden: ${approved.missingScope ?? "unknown"}` }));
             return true;
         }
         res.statusCode = 200;
@@ -110,12 +80,12 @@ export async function handleNodesApprove(req, res) {
         res.end(JSON.stringify({
             ok: true,
             nodeId: normalizedNodeId,
-            requestId: approveData.requestId,
-            approvedAtMs: approveData.node?.approvedAtMs,
+            requestId: approved.requestId,
+            approvedAtMs: approved.node?.approvedAtMs,
         }));
         return true;
     }
-    // Not in pending — check if already paired with non-empty caps/commands
+    // Check if already paired with non-empty caps/commands
     const paired = listData.paired ?? [];
     const pairedMatch = paired.find((entry) => entry.nodeId.trim().toUpperCase() === normalizedNodeId);
     if (pairedMatch) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syengup/friday-channel-next",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "OpenClaw Friday Next Apple channel plugin",
   "type": "module",
   "files": [

package/src/agent/node-pairing-bridge.ts

@@ -0,0 +1,29 @@
+import { createRequire } from "node:module";
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+
+const OPENCLAW_DIST = "/opt/homebrew/lib/node_modules/openclaw/dist";
+
+let cache: { listNodePairing: Function; approveNodePairing: Function } | null = null;
+
+export function loadNodePairingModule(): {
+  listNodePairing: Function;
+  approveNodePairing: Function;
+} {
+  if (cache) return cache;
+  const file = readdirSync(OPENCLAW_DIST).find(
+    (f) => f.startsWith("node-pairing-") && f.endsWith(".js") && !f.includes("authz"),
+  );
+  if (!file) throw new Error("node-pairing module not found in OpenClaw dist");
+  const gatewayRequire = createRequire(join(OPENCLAW_DIST, "_"));
+  cache = gatewayRequire(`./${file.replace(/\.js$/, "")}`);
+  return cache!;
+}
+
+/** Vitest-only: inject mock pairing functions. */
+export function __setMockNodePairingForTests(mock: {
+  listNodePairing: Function;
+  approveNodePairing: Function;
+}): void {
+  cache = mock;
+}

package/src/http/handlers/device-approve.test.ts

@@ -4,9 +4,14 @@ import { PassThrough } from "node:stream";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { setMockRuntime } from "../../test-support/mock-runtime.js";
 
-const mockExecImpl = vi.hoisted(() => vi.fn());
-vi.mock("node:child_process", () => ({
-  exec: mockExecImpl,
+const { mockList, mockApprove } = vi.hoisted(() => ({
+  mockList: vi.fn(),
+  mockApprove: vi.fn(),
+}));
+
+vi.mock("openclaw/plugin-sdk/device-bootstrap", () => ({
+  listDevicePairing: mockList,
+  approveDevicePairing: mockApprove,
 }));
 
 import { handleDeviceApprove } from "./device-approve.js";
@@ -30,45 +35,13 @@ function mockReq(method: string, headers: Record<string, string> = {}): PassThro
   return stream;
 }
 
-function mockExecSuccess(stdout: string) {
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: null, stdout: string, stderr: string) => void) => {
-    cb(null, stdout, "");
-    return child;
-  });
-}
-
-function mockExecError(message: string, stderr?: string) {
-  const err = new Error(message) as Error & { stderr: string };
-  err.stderr = stderr ?? "";
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: Error) => void) => {
-    cb(err);
-    return child;
-  });
-}
-
-function mockExecErrorWithStderr(err: Error & { stderr?: string }) {
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: Error) => void) => {
-    cb(err);
-    return child;
-  });
-}
-
 const DEVICE_ID = "a80b8c4b305fb02c5772c409c6dfcbacde691b61557f7779511ad1a5be8fdf06";
 const REQUEST_ID = "12f150e8-b1bc-4688-be23-e3a7fa8b9e51";
 
 describe("handleDeviceApprove", () => {
   beforeEach(() => {
     setMockRuntime();
-    mockExecImpl.mockReset();
+    vi.clearAllMocks();
   });
 
   it("returns 405 on non-POST", async () => {
@@ -106,8 +79,8 @@ describe("handleDeviceApprove", () => {
     expect(JSON.parse((res as unknown as MockRes).body).error).toContain("deviceId");
   });
 
-  it("returns 502 when devices list CLI fails", async () => {
-    mockExecError("ENOENT");
+  it("returns 502 when listDevicePairing fails", async () => {
+    mockList.mockRejectedValueOnce(new Error("ENOENT"));
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -118,23 +91,22 @@ describe("handleDeviceApprove", () => {
     expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Failed to list devices");
   });
 
-  it("returns 502 when devices list returns invalid JSON", async () => {
-    mockExecSuccess("not valid json {{{");
+  it("returns 404 when listDevicePairing returns data without matching device", async () => {
+    mockList.mockResolvedValueOnce({ pending: [{ requestId: "x", deviceId: "UNMATCHED" }], paired: [] });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
     const p = handleDeviceApprove(req as unknown as IncomingMessage, res);
     req.end(JSON.stringify({ deviceId: DEVICE_ID }));
     await p;
-    expect((res as unknown as MockRes).statusCode).toBe(502);
-    expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Unexpected response");
+    expect((res as unknown as MockRes).statusCode).toBe(404);
   });
 
   it("returns 404 when deviceId not in pending list", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: "uuid-1", deviceId: "OTHER_DEVICE" }],
       paired: [],
-    }));
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -148,7 +120,7 @@ describe("handleDeviceApprove", () => {
   });
 
   it("returns 404 when pending array is empty", async () => {
-    mockExecSuccess(JSON.stringify({ pending: [], paired: [] }));
+    mockList.mockResolvedValueOnce({ pending: [], paired: [] });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -158,14 +130,12 @@ describe("handleDeviceApprove", () => {
     expect((res as unknown as MockRes).statusCode).toBe(404);
   });
 
-  it("returns 502 when approve command fails", async () => {
-    mockExecSuccess(JSON.stringify({
+  it("returns 502 when approveDevicePairing fails", async () => {
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, deviceId: DEVICE_ID }],
       paired: [],
-    }));
-    const approveErr = new Error("Command failed") as Error & { stderr: string };
-    approveErr.stderr = "unknown requestId";
-    mockExecErrorWithStderr(approveErr);
+    });
+    mockApprove.mockRejectedValueOnce(new Error("unknown requestId"));
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -174,35 +144,36 @@ describe("handleDeviceApprove", () => {
     await p;
     expect((res as unknown as MockRes).statusCode).toBe(502);
     const body = JSON.parse((res as unknown as MockRes).body);
-    expect(body.error).toContain("Device approval command failed");
+    expect(body.error).toContain("Device approval failed");
     expect(body.detail).toBe("unknown requestId");
   });
 
-  it("returns 502 when approve returns non-JSON", async () => {
-    mockExecSuccess(JSON.stringify({
+  it("returns 404 when approveDevicePairing returns null", async () => {
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, deviceId: DEVICE_ID }],
       paired: [],
-    }));
-    mockExecSuccess("No pending device pairing requests to approve");
+    });
+    mockApprove.mockResolvedValueOnce(null);
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
     const p = handleDeviceApprove(req as unknown as IncomingMessage, res);
     req.end(JSON.stringify({ deviceId: DEVICE_ID }));
     await p;
-    expect((res as unknown as MockRes).statusCode).toBe(502);
-    expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Unexpected response from device approval");
+    expect((res as unknown as MockRes).statusCode).toBe(404);
+    expect(JSON.parse((res as unknown as MockRes).body).error).toContain("not found");
   });
 
   it("succeeds with complete flow", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, deviceId: DEVICE_ID }],
       paired: [],
-    }));
-    mockExecSuccess(JSON.stringify({
+    });
+    mockApprove.mockResolvedValueOnce({
+      status: "approved",
       requestId: REQUEST_ID,
       device: { deviceId: DEVICE_ID, approvedAtMs: 1778571972361 },
-    }));
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -216,18 +187,20 @@ describe("handleDeviceApprove", () => {
     expect(body.deviceId).toBe(DEVICE_ID.toUpperCase());
     expect(body.requestId).toBe(REQUEST_ID);
     expect(body.approvedAtMs).toBe(1778571972361);
-    expect(mockExecImpl).toHaveBeenCalledTimes(2);
+    expect(mockList).toHaveBeenCalledTimes(1);
+    expect(mockApprove).toHaveBeenCalledTimes(1);
   });
 
   it("normalizes deviceId case-insensitively", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, deviceId: DEVICE_ID }],
       paired: [],
-    }));
-    mockExecSuccess(JSON.stringify({
+    });
+    mockApprove.mockResolvedValueOnce({
+      status: "approved",
       requestId: REQUEST_ID,
       device: { deviceId: DEVICE_ID, approvedAtMs: 1 },
-    }));
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;

package/src/http/handlers/device-approve.ts

@@ -1,41 +1,9 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { exec } from "node:child_process";
+import { listDevicePairing, approveDevicePairing } from "openclaw/plugin-sdk/device-bootstrap";
 import { readJsonBody } from "../middleware/body.js";
 import { extractBearerToken } from "../middleware/auth.js";
 import { createFridayNextLogger } from "../../logging.js";
 
-const EXEC_ENV = process.platform === "win32"
-  ? process.env
-  : { ...process.env, PATH: `/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:${process.env.PATH ?? ""}` };
-
-interface PendingDevice {
-  requestId: string;
-  deviceId: string;
-}
-
-interface DeviceListJson {
-  pending?: PendingDevice[];
-}
-
-interface ApproveJson {
-  requestId: string;
-  device?: { deviceId: string; approvedAtMs?: number };
-}
-
-function execAsync(command: string, timeoutMs: number): Promise<{ stdout: string; stderr: string }> {
-  return new Promise((resolve, reject) => {
-    const child = exec(command, { encoding: "utf-8", timeout: timeoutMs, maxBuffer: 1024 * 1024, env: EXEC_ENV }, (error, stdout, stderr) => {
-      if (error) {
-        reject(error);
-      } else {
-        resolve({ stdout, stderr });
-      }
-    });
-    child.stdout?.on("data", () => { /* drain */ });
-    child.stderr?.on("data", () => { /* drain */ });
-  });
-}
-
 export async function handleDeviceApprove(
   req: IncomingMessage,
   res: ServerResponse,
@@ -75,32 +43,18 @@ export async function handleDeviceApprove(
 
   const normalizedDeviceId = rawDeviceId.trim().toUpperCase();
 
-  let listStdout: string;
+  let pairing;
   try {
-    const result = await execAsync("openclaw devices list --json", 15000);
-    listStdout = result.stdout;
+    pairing = await listDevicePairing();
   } catch (err) {
-    const stderr = (err as { stderr?: string })?.stderr?.trim();
-    log.error(`devices list failed: ${err instanceof Error ? err.message : String(err)}`);
-    res.statusCode = 502;
-    res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error: "Failed to list devices from gateway", detail: stderr || undefined }));
-    return true;
-  }
-
-  let listData: DeviceListJson;
-  try {
-    listData = JSON.parse(listStdout) as DeviceListJson;
-  } catch {
-    log.error(`devices list returned invalid JSON: ${listStdout.slice(0, 200)}`);
+    log.error(`listDevicePairing failed: ${err instanceof Error ? err.message : String(err)}`);
     res.statusCode = 502;
     res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error: "Unexpected response from gateway device list" }));
+    res.end(JSON.stringify({ error: "Failed to list devices from gateway" }));
     return true;
   }
 
-  const pending = listData.pending ?? [];
-  const match = pending.find(
+  const match = pairing.pending.find(
     (entry) => entry.deviceId.trim().toUpperCase() === normalizedDeviceId,
   );
 
@@ -117,30 +71,31 @@ export async function handleDeviceApprove(
   const requestId = match.requestId;
   log.info(`approving deviceId=${normalizedDeviceId} requestId=${requestId}`);
 
-  let approveStdout: string;
+  let approved;
   try {
-    const result = await execAsync(`openclaw devices approve ${requestId} --json`, 15000);
-    approveStdout = result.stdout;
+    approved = await approveDevicePairing(requestId);
   } catch (err) {
-    const stderr = (err as { stderr?: string })?.stderr?.trim();
-    log.error(`devices approve failed: ${err instanceof Error ? err.message : String(err)}`);
+    log.error(`approveDevicePairing failed: ${err instanceof Error ? err.message : String(err)}`);
     res.statusCode = 502;
     res.setHeader("Content-Type", "application/json");
     res.end(JSON.stringify({
-      error: "Device approval command failed",
-      detail: stderr || (err instanceof Error ? err.message : "Unknown error"),
+      error: "Device approval failed",
+      detail: err instanceof Error ? err.message : "Unknown error",
     }));
     return true;
   }
 
-  let approveData: ApproveJson;
-  try {
-    approveData = JSON.parse(approveStdout) as ApproveJson;
-  } catch {
-    log.error(`devices approve returned non-JSON: ${approveStdout.slice(0, 200)}`);
-    res.statusCode = 502;
+  if (!approved) {
+    res.statusCode = 404;
+    res.setHeader("Content-Type", "application/json");
+    res.end(JSON.stringify({ error: "Pending device request not found" }));
+    return true;
+  }
+
+  if (approved.status === "forbidden") {
+    res.statusCode = 403;
     res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error: "Unexpected response from device approval" }));
+    res.end(JSON.stringify({ error: `Device approval forbidden: ${(approved as any).reason ?? "unknown"}` }));
     return true;
   }
 
@@ -149,8 +104,8 @@ export async function handleDeviceApprove(
   res.end(JSON.stringify({
     ok: true,
     deviceId: normalizedDeviceId,
-    requestId: approveData.requestId,
-    approvedAtMs: approveData.device?.approvedAtMs,
+    requestId: approved.requestId,
+    approvedAtMs: (approved as any).device?.approvedAtMs,
   }));
   return true;
 }

package/src/http/handlers/nodes-approve.test.ts

@@ -3,10 +3,11 @@ import { EventEmitter } from "node:events";
 import { PassThrough } from "node:stream";
 import type { IncomingMessage, ServerResponse } from "node:http";
 import { setMockRuntime } from "../../test-support/mock-runtime.js";
+import { __setMockNodePairingForTests } from "../../agent/node-pairing-bridge.js";
 
-const mockExecImpl = vi.hoisted(() => vi.fn());
-vi.mock("node:child_process", () => ({
-  exec: mockExecImpl,
+const { mockList, mockApprove } = vi.hoisted(() => ({
+  mockList: vi.fn(),
+  mockApprove: vi.fn(),
 }));
 
 import { handleNodesApprove } from "./nodes-approve.js";
@@ -30,45 +31,17 @@ function mockReq(method: string, headers: Record<string, string> = {}): PassThro
   return stream;
 }
 
-function mockExecSuccess(stdout: string) {
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: null, stdout: string, stderr: string) => void) => {
-    cb(null, stdout, "");
-    return child;
-  });
-}
-
-function mockExecError(message: string, stderr?: string) {
-  const err = new Error(message) as Error & { stderr: string };
-  err.stderr = stderr ?? "";
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: Error) => void) => {
-    cb(err);
-    return child;
-  });
-}
-
-function mockExecErrorWithStderr(err: Error & { stderr?: string }) {
-  const child = new EventEmitter() as EventEmitter & { stdout: EventEmitter; stderr: EventEmitter };
-  child.stdout = new EventEmitter();
-  child.stderr = new EventEmitter();
-  mockExecImpl.mockImplementationOnce((_cmd: string, _opts: unknown, cb: (error: Error) => void) => {
-    cb(err);
-    return child;
-  });
-}
-
 const NODE_ID = "a80b8c4b305fb02c5772c409c6dfcbacde691b61557f7779511ad1a5be8fdf06";
-const REQUEST_ID = "12f150e8-b1bc-4688-be23-e3a7fa8b9e51";
+const REQUEST_ID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
 
 describe("handleNodesApprove", () => {
   beforeEach(() => {
     setMockRuntime();
-    mockExecImpl.mockReset();
+    vi.clearAllMocks();
+    __setMockNodePairingForTests({
+      listNodePairing: mockList,
+      approveNodePairing: mockApprove,
+    });
   });
 
   it("returns 405 on non-POST", async () => {
@@ -106,8 +79,8 @@ describe("handleNodesApprove", () => {
     expect(JSON.parse((res as unknown as MockRes).body).error).toContain("nodeId");
   });
 
-  it("returns 502 when nodes list CLI fails", async () => {
-    mockExecError("ENOENT");
+  it("returns 502 when listNodePairing fails", async () => {
+    mockList.mockRejectedValueOnce(new Error("ENOENT"));
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -118,23 +91,22 @@ describe("handleNodesApprove", () => {
     expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Failed to list nodes");
   });
 
-  it("returns 502 when nodes list returns invalid JSON", async () => {
-    mockExecSuccess("not valid json {{{");
+  it("returns 404 when listNodePairing returns data without matching node", async () => {
+    mockList.mockResolvedValueOnce({ pending: [{ requestId: "x", nodeId: "UNMATCHED" }], paired: [] });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
     const p = handleNodesApprove(req as unknown as IncomingMessage, res);
     req.end(JSON.stringify({ nodeId: NODE_ID }));
     await p;
-    expect((res as unknown as MockRes).statusCode).toBe(502);
-    expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Unexpected response");
+    expect((res as unknown as MockRes).statusCode).toBe(404);
   });
 
   it("returns 404 when nodeId not in pending or paired with caps", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: "uuid-1", nodeId: "OTHER_NODE" }],
-      paired: [{ nodeId: "ANOTHER", caps: ["canvas"], commands: ["canvas.navigate"] }],
-    }));
+      paired: [{ nodeId: "OTHER_NODE", approvedAtMs: 1, caps: ["canvas"], commands: [] }],
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -144,14 +116,13 @@ describe("handleNodesApprove", () => {
     expect((res as unknown as MockRes).statusCode).toBe(404);
     const body = JSON.parse((res as unknown as MockRes).body);
     expect(body.error).toContain("No pending node found");
-    expect(body.nodeId).toBe(NODE_ID.toUpperCase());
   });
 
   it("returns 404 when pending is empty and paired has empty caps/commands", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [],
       paired: [{ nodeId: NODE_ID, approvedAtMs: 1, caps: [], commands: [] }],
-    }));
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -162,10 +133,10 @@ describe("handleNodesApprove", () => {
   });
 
   it("returns 200 with alreadyApproved when node in paired with caps", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [],
-      paired: [{ nodeId: NODE_ID, approvedAtMs: 1778571972361, caps: ["location", "canvas"], commands: ["canvas.navigate"] }],
-    }));
+      paired: [{ nodeId: NODE_ID, approvedAtMs: 100, caps: ["canvas"], commands: ["canvas.present"] }],
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -177,21 +148,16 @@ describe("handleNodesApprove", () => {
     const body = JSON.parse((res as unknown as MockRes).body);
     expect(body.ok).toBe(true);
     expect(body.alreadyApproved).toBe(true);
-    expect(body.nodeId).toBe(NODE_ID.toUpperCase());
-    expect(body.approvedAtMs).toBe(1778571972361);
-    expect(body.caps).toEqual(["location", "canvas"]);
-    expect(body.commands).toEqual(["canvas.navigate"]);
-    expect(mockExecImpl).toHaveBeenCalledTimes(1); // no approve call
+    expect(body.caps).toEqual(["canvas"]);
+    expect(body.commands).toEqual(["canvas.present"]);
   });
 
-  it("returns 502 when approve command fails", async () => {
-    mockExecSuccess(JSON.stringify({
+  it("returns 502 when approveNodePairing fails", async () => {
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, nodeId: NODE_ID }],
       paired: [],
-    }));
-    const approveErr = new Error("Command failed") as Error & { stderr: string };
-    approveErr.stderr = "unknown requestId";
-    mockExecErrorWithStderr(approveErr);
+    });
+    mockApprove.mockRejectedValueOnce(new Error("unknown requestId"));
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -200,35 +166,34 @@ describe("handleNodesApprove", () => {
     await p;
     expect((res as unknown as MockRes).statusCode).toBe(502);
     const body = JSON.parse((res as unknown as MockRes).body);
-    expect(body.error).toContain("Node approval command failed");
+    expect(body.error).toContain("Node approval failed");
     expect(body.detail).toBe("unknown requestId");
   });
 
-  it("returns 502 when approve returns non-JSON", async () => {
-    mockExecSuccess(JSON.stringify({
+  it("returns 404 when approveNodePairing returns null", async () => {
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, nodeId: NODE_ID }],
       paired: [],
-    }));
-    mockExecSuccess("No pending node pairing requests to approve");
+    });
+    mockApprove.mockResolvedValueOnce(null);
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
     const p = handleNodesApprove(req as unknown as IncomingMessage, res);
     req.end(JSON.stringify({ nodeId: NODE_ID }));
     await p;
-    expect((res as unknown as MockRes).statusCode).toBe(502);
-    expect(JSON.parse((res as unknown as MockRes).body).error).toContain("Unexpected response from node approval");
+    expect((res as unknown as MockRes).statusCode).toBe(404);
   });
 
   it("succeeds with complete flow", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [{ requestId: REQUEST_ID, nodeId: NODE_ID }],
       paired: [],
-    }));
-    mockExecSuccess(JSON.stringify({
+    });
+    mockApprove.mockResolvedValueOnce({
       requestId: REQUEST_ID,
       node: { nodeId: NODE_ID, approvedAtMs: 1778571972361 },
-    }));
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -239,22 +204,19 @@ describe("handleNodesApprove", () => {
     expect((res as unknown as MockRes).statusCode).toBe(200);
     const body = JSON.parse((res as unknown as MockRes).body);
     expect(body.ok).toBe(true);
-    expect(body.alreadyApproved).toBeUndefined();
     expect(body.nodeId).toBe(NODE_ID.toUpperCase());
     expect(body.requestId).toBe(REQUEST_ID);
-    expect(body.approvedAtMs).toBe(1778571972361);
-    expect(mockExecImpl).toHaveBeenCalledTimes(2);
   });
 
   it("normalizes nodeId case-insensitively in pending", async () => {
-    mockExecSuccess(JSON.stringify({
-      pending: [{ requestId: REQUEST_ID, nodeId: NODE_ID }],
+    mockList.mockResolvedValueOnce({
+      pending: [{ requestId: REQUEST_ID, nodeId: NODE_ID.toUpperCase() }],
       paired: [],
-    }));
-    mockExecSuccess(JSON.stringify({
+    });
+    mockApprove.mockResolvedValueOnce({
       requestId: REQUEST_ID,
-      node: { nodeId: NODE_ID, approvedAtMs: 1 },
-    }));
+      node: { nodeId: NODE_ID.toUpperCase(), approvedAtMs: 1 },
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;
@@ -265,14 +227,13 @@ describe("handleNodesApprove", () => {
     expect((res as unknown as MockRes).statusCode).toBe(200);
     const body = JSON.parse((res as unknown as MockRes).body);
     expect(body.ok).toBe(true);
-    expect(body.nodeId).toBe(NODE_ID.toUpperCase());
   });
 
   it("normalizes nodeId case-insensitively in paired", async () => {
-    mockExecSuccess(JSON.stringify({
+    mockList.mockResolvedValueOnce({
       pending: [],
-      paired: [{ nodeId: NODE_ID, approvedAtMs: 1, caps: ["canvas"], commands: [] }],
-    }));
+      paired: [{ nodeId: NODE_ID.toUpperCase(), approvedAtMs: 1, caps: ["canvas"], commands: [] }],
+    });
 
     const req = mockReq("POST", { authorization: "Bearer test-token" });
     const res = new MockRes() as unknown as ServerResponse;

package/src/http/handlers/nodes-approve.ts

@@ -1,48 +1,27 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { exec } from "node:child_process";
 import { readJsonBody } from "../middleware/body.js";
 import { extractBearerToken } from "../middleware/auth.js";
 import { createFridayNextLogger } from "../../logging.js";
+import { loadNodePairingModule } from "../../agent/node-pairing-bridge.js";
 
-const EXEC_ENV = process.platform === "win32"
-  ? process.env
-  : { ...process.env, PATH: `/opt/homebrew/bin:/usr/local/bin:/home/linuxbrew/.linuxbrew/bin:${process.env.PATH ?? ""}` };
-
-interface PendingNode {
+interface PendingNodeEntry {
   requestId: string;
   nodeId: string;
 }
-
-interface PairedNode {
+interface PairedNodeEntry {
   nodeId: string;
-  approvedAtMs?: number;
+  approvedAtMs: number;
   caps?: string[];
   commands?: string[];
 }
-
-interface NodeListJson {
-  pending?: PendingNode[];
-  paired?: PairedNode[];
-}
-
-interface ApproveJson {
-  requestId: string;
-  node?: { nodeId: string; approvedAtMs?: number };
-}
-
-function execAsync(command: string, timeoutMs: number): Promise<{ stdout: string; stderr: string }> {
-  return new Promise((resolve, reject) => {
-    const child = exec(command, { encoding: "utf-8", timeout: timeoutMs, maxBuffer: 1024 * 1024, env: EXEC_ENV }, (error, stdout, stderr) => {
-      if (error) {
-        reject(error);
-      } else {
-        resolve({ stdout, stderr });
-      }
-    });
-    child.stdout?.on("data", () => { /* drain */ });
-    child.stderr?.on("data", () => { /* drain */ });
-  });
+interface NodePairingList {
+  pending: PendingNodeEntry[];
+  paired: PairedNodeEntry[];
 }
+type ApproveNodePairingResult =
+  | { requestId: string; node: PairedNodeEntry }
+  | { status: "forbidden"; missingScope: string }
+  | null;
 
 export async function handleNodesApprove(
   req: IncomingMessage,
@@ -83,63 +62,53 @@ export async function handleNodesApprove(
 
   const normalizedNodeId = rawNodeId.trim().toUpperCase();
 
-  let listStdout: string;
-  try {
-    const result = await execAsync("openclaw nodes list --json", 15000);
-    listStdout = result.stdout;
-  } catch (err) {
-    const stderr = (err as { stderr?: string })?.stderr?.trim();
-    log.error(`nodes list failed: ${err instanceof Error ? err.message : String(err)}`);
-    res.statusCode = 502;
-    res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error: "Failed to list nodes from gateway", detail: stderr || undefined }));
-    return true;
-  }
+const { listNodePairing, approveNodePairing } = loadNodePairingModule();
 
-  let listData: NodeListJson;
+  let listData;
   try {
-    listData = JSON.parse(listStdout) as NodeListJson;
-  } catch {
-    log.error(`nodes list returned invalid JSON: ${listStdout.slice(0, 200)}`);
+    listData = await listNodePairing();
+  } catch (err) {
+    log.error(`listNodePairing failed: ${err instanceof Error ? err.message : String(err)}`);
     res.statusCode = 502;
     res.setHeader("Content-Type", "application/json");
-    res.end(JSON.stringify({ error: "Unexpected response from gateway node list" }));
+    res.end(JSON.stringify({ error: "Failed to list nodes from gateway" }));
     return true;
   }
 
   const pending = listData.pending ?? [];
   const pendingMatch = pending.find(
-    (entry) => entry.nodeId.trim().toUpperCase() === normalizedNodeId,
+    (entry: PendingNodeEntry) => entry.nodeId.trim().toUpperCase() === normalizedNodeId,
   );
 
   if (pendingMatch) {
     const requestId = pendingMatch.requestId;
     log.info(`approving nodeId=${normalizedNodeId} requestId=${requestId}`);
 
-    let approveStdout: string;
+    let approved;
     try {
-      const result = await execAsync(`openclaw nodes approve ${requestId} --json`, 15000);
-      approveStdout = result.stdout;
+      approved = await approveNodePairing(requestId, {});
     } catch (err) {
-      const stderr = (err as { stderr?: string })?.stderr?.trim();
-      log.error(`nodes approve failed: ${err instanceof Error ? err.message : String(err)}`);
+      log.error(`approveNodePairing failed: ${err instanceof Error ? err.message : String(err)}`);
       res.statusCode = 502;
       res.setHeader("Content-Type", "application/json");
       res.end(JSON.stringify({
-        error: "Node approval command failed",
-        detail: stderr || (err instanceof Error ? err.message : "Unknown error"),
+        error: "Node approval failed",
+        detail: err instanceof Error ? err.message : "Unknown error",
       }));
       return true;
     }
 
-    let approveData: ApproveJson;
-    try {
-      approveData = JSON.parse(approveStdout) as ApproveJson;
-    } catch {
-      log.error(`nodes approve returned non-JSON: ${approveStdout.slice(0, 200)}`);
-      res.statusCode = 502;
+    if (!approved) {
+      res.statusCode = 404;
+      res.setHeader("Content-Type", "application/json");
+      res.end(JSON.stringify({ error: "Pending node request not found" }));
+      return true;
+    }
+
+    if ("status" in approved && approved.status === "forbidden") {
+      res.statusCode = 403;
       res.setHeader("Content-Type", "application/json");
-      res.end(JSON.stringify({ error: "Unexpected response from node approval" }));
+      res.end(JSON.stringify({ error: `Node approval forbidden: ${(approved as any).missingScope ?? "unknown"}` }));
       return true;
     }
 
@@ -148,16 +117,16 @@ export async function handleNodesApprove(
     res.end(JSON.stringify({
       ok: true,
       nodeId: normalizedNodeId,
-      requestId: approveData.requestId,
-      approvedAtMs: approveData.node?.approvedAtMs,
+      requestId: (approved as any).requestId,
+      approvedAtMs: (approved as any).node?.approvedAtMs,
     }));
     return true;
   }
 
-  // Not in pending — check if already paired with non-empty caps/commands
+  // Check if already paired with non-empty caps/commands
   const paired = listData.paired ?? [];
   const pairedMatch = paired.find(
-    (entry) => entry.nodeId.trim().toUpperCase() === normalizedNodeId,
+    (entry: PairedNodeEntry) => entry.nodeId.trim().toUpperCase() === normalizedNodeId,
   );
 
   if (pairedMatch) {

package/src/openclaw.d.ts

@@ -3,6 +3,36 @@ declare module "openclaw/plugin-sdk/agent-harness" {
   export const runAgentHarness: (...args: any[]) => any;
 }
 
+declare module "openclaw/plugin-sdk/device-bootstrap" {
+  export const listDevicePairing: (baseDir?: string) => Promise<DevicePairingList>;
+  export const approveDevicePairing: (requestId: string, options?: { callerScopes?: readonly string[] }, baseDir?: string) => Promise<ApproveDevicePairingResult>;
+
+  interface DevicePairingPendingRequest {
+    requestId: string;
+    deviceId: string;
+    publicKey: string;
+    displayName?: string;
+    platform?: string;
+    ts: number;
+  }
+  interface PairedDevice {
+    deviceId: string;
+    approvedAtMs: number;
+  }
+  interface DevicePairingList {
+    pending: DevicePairingPendingRequest[];
+    paired: PairedDevice[];
+  }
+  type ApproveDevicePairingResult = {
+    status: "approved";
+    requestId: string;
+    device: PairedDevice;
+  } | {
+    status: "forbidden";
+    reason: string;
+  } | null;
+}
+
 declare module "openclaw/plugin-sdk/core" {
   export const defineChannelPluginEntry: (...args: any[]) => any;
   export const createChatChannelPlugin: (...args: any[]) => any;

package/src/test-support/mock-device-bootstrap.ts

@@ -0,0 +1,10 @@
+// Mock module for openclaw/plugin-sdk/device-bootstrap in tests.
+// Tests replace these via vi.mock + vi.fn() in hoisted blocks.
+
+export function listDevicePairing(): Promise<any> {
+  throw new Error("listDevicePairing not mocked");
+}
+
+export function approveDevicePairing(): Promise<any> {
+  throw new Error("approveDevicePairing not mocked");
+}