@synap-core/cli 1.0.0 → 1.2.0

package/dist/commands/openclaw.js

@@ -11,12 +11,16 @@
  *   synap openclaw restart    — restart the container
  */
 import chalk from "chalk";
+import ora from "ora";
 import { execSync } from "child_process";
 import prompts from "prompts";
+import crypto from "node:crypto";
 import fs from "node:fs";
+import path from "node:path";
 import { log, banner } from "../utils/logger.js";
 import { detectOpenClaw } from "../lib/openclaw.js";
-import { findSynapDeployDir } from "../lib/pod.js";
+import { findSynapDeployDir, getLocalPodConfig } from "../lib/pod.js";
+import { getStoredToken } from "../lib/auth.js";
 // ─── Overview ────────────────────────────────────────────────────────────────
 export async function openclawOverview() {
     banner();
@@ -46,10 +50,18 @@ export async function openclawOverview() {
         log.dim(`Version: ${oc.version}`);
     // ── AI provider ─────────────────────────────────────────────────────────
     log.heading("AI Provider");
-    const apiKeyStatus = getAiKeyStatus();
-    if (apiKeyStatus.configured) {
-        log.success(`${apiKeyStatus.provider} key configured`);
-        log.dim(`Model: ${apiKeyStatus.model ?? "default"}`);
+    const aiConfig = readOpenClawAiConfig(oc);
+    const hasAnyKey = !!(aiConfig.anthropicKey || aiConfig.openaiKey || aiConfig.geminiKey);
+    const apiKeyStatus = { configured: hasAnyKey };
+    if (hasAnyKey) {
+        if (aiConfig.anthropicKey)
+            log.success(`Anthropic: ${maskKey(aiConfig.anthropicKey)}`);
+        if (aiConfig.openaiKey)
+            log.success(`OpenAI:    ${maskKey(aiConfig.openaiKey)}`);
+        if (aiConfig.geminiKey)
+            log.success(`Google:    ${maskKey(aiConfig.geminiKey)}`);
+        if (aiConfig.primaryModel)
+            log.dim(`Model:     ${aiConfig.primaryModel}`);
     }
     else {
         log.warn("No AI API key configured — OpenClaw cannot process requests");
@@ -78,16 +90,20 @@ export async function openclawOverview() {
     }
     // ── Dashboard ────────────────────────────────────────────────────────────
     log.heading("Dashboard");
-    if (oc.runtime === "docker") {
-        const containerName = oc.containerName ?? "openclaw";
-        log.info(`Web UI: ${chalk.cyan(`http://localhost:${oc.gatewayPort ?? 18789}`)}`);
-        log.dim("If on a remote server, tunnel first:");
-        log.dim(`  ssh -N -L 18789:localhost:18789 user@your-server`);
-        log.dim(`  Then open: http://localhost:18789`);
+    const publicUrl = getOpenClawPublicUrl();
+    if (publicUrl) {
+        log.success(`Public: ${chalk.cyan(publicUrl)}`);
+        log.dim(`Local:  http://localhost:${oc.gatewayPort ?? 18789}`);
+        log.dim("Open:   synap openclaw dashboard");
+    }
+    else if (oc.runtime === "docker") {
+        log.info(`Local: ${chalk.cyan(`http://localhost:${oc.gatewayPort ?? 18789}`)}`);
+        log.dim("Expose via domain:  synap openclaw setup-domain");
+        log.dim("SSH tunnel (remote): synap openclaw dashboard");
     }
     else {
         log.info(`Web UI: ${chalk.cyan(`http://localhost:${oc.gatewayPort ?? 18789}`)}`);
-        log.dim("Open: openclaw dashboard  — or just open the URL above");
+        log.dim("Open: openclaw dashboard  — or: synap openclaw dashboard");
     }
     // ── How to connect ───────────────────────────────────────────────────────
     log.heading("AI Client (MCP)");
@@ -126,37 +142,49 @@ export async function openclawConnect(opts) {
     const gatewayPort = oc.gatewayPort ?? 18789;
     const isDocker = oc.runtime === "docker";
     // OpenClaw MCP is stdio-based — clients run `openclaw mcp serve` as a local process
-    // which connects to the gateway over WebSocket.
-    // For Docker/remote setups the gateway is at ws://localhost:<port> after SSH tunnel.
+    // which connects to the gateway over WebSocket. The gateway token authenticates
+    // the connection — we fetch it from the container so the config is ready to paste.
+    const token = readGatewayToken(oc) ?? undefined;
+    if (!token) {
+        log.warn("Could not read gateway token from OpenClaw.");
+        log.dim("The MCP configs below will require you to add --token manually.");
+        log.dim("Run: synap openclaw token");
+        log.blank();
+    }
     const client = opts.client?.toLowerCase();
     if (!client || client === "claude") {
-        printMcpConfig("Claude Desktop", gatewayPort, isDocker, "claude");
+        printMcpConfig("Claude Desktop", gatewayPort, isDocker, "claude", token);
     }
     if (!client || client === "cursor") {
-        printMcpConfig("Cursor", gatewayPort, isDocker, "cursor");
+        printMcpConfig("Cursor", gatewayPort, isDocker, "cursor", token);
     }
     if (!client || client === "windsurf") {
-        printMcpConfig("Windsurf", gatewayPort, isDocker, "windsurf");
+        printMcpConfig("Windsurf", gatewayPort, isDocker, "windsurf", token);
     }
     if (client && !["claude", "cursor", "windsurf"].includes(client)) {
         log.warn(`Unknown client "${client}". Showing generic config.`);
-        printMcpConfig("MCP Client", gatewayPort, isDocker, "generic");
+        printMcpConfig("MCP Client", gatewayPort, isDocker, "generic", token);
     }
     if (isDocker) {
         log.blank();
         log.info("Remote server? Tunnel the gateway port first:");
-        log.dim("  ssh -N -L 18789:localhost:18789 user@your-server");
-        log.dim("  Then use the configs above (they point to localhost:18789)");
+        log.dim(`  ssh -N -L ${gatewayPort}:localhost:${gatewayPort} user@your-server`);
+        log.dim("  Then use the configs above (they point to localhost)");
         log.blank();
-        log.dim("openclaw must be installed locally: npm i -g openclaw");
+        log.dim("openclaw must be installed locally on the client machine:");
+        log.dim("  npm i -g openclaw");
     }
 }
-function printMcpConfig(label, gatewayPort, isRemote, client) {
+function printMcpConfig(label, gatewayPort, isRemote, client, token) {
     log.heading(label);
     // MCP config: stdio command that connects to the local (or tunneled) gateway
-    const args = isRemote
-        ? ["mcp", "serve", "--url", `ws://localhost:${gatewayPort}`]
-        : ["mcp", "serve"];
+    const args = ["mcp", "serve"];
+    if (isRemote) {
+        args.push("--url", `ws://localhost:${gatewayPort}`);
+    }
+    if (token) {
+        args.push("--token", token);
+    }
     const config = JSON.stringify({ mcpServers: { openclaw: { command: "openclaw", args } } }, null, 2);
     const paths = {
         claude: "macOS: ~/Library/Application Support/Claude/claude_desktop_config.json",
@@ -181,95 +209,269 @@ function printMcpConfig(label, gatewayPort, isRemote, client) {
 export function openclawDashboard() {
     const oc = detectOpenClaw();
     const port = oc.gatewayPort ?? 18789;
-    const url = `http://localhost:${port}`;
+    const localUrl = `http://localhost:${port}`;
+    // Check if a public domain is configured via Caddy
+    const publicUrl = getOpenClawPublicUrl();
+    if (publicUrl) {
+        log.info(`Dashboard: ${chalk.cyan(publicUrl)}`);
+        log.blank();
+        try {
+            const open = process.platform === "darwin" ? "open" : "xdg-open";
+            execSync(`${open} ${publicUrl}`, { stdio: "ignore" });
+        }
+        catch {
+            log.dim("Open the URL above in your browser.");
+        }
+        return;
+    }
     if (oc.runtime === "docker") {
-        // On a remote server the browser can't open — give SSH tunnel instructions
         const isRemoteServer = !process.env.DISPLAY && process.platform === "linux";
         if (isRemoteServer) {
-            log.info(`OpenClaw dashboard: ${chalk.cyan(url)}`);
+            log.info(`Dashboard: ${chalk.cyan(localUrl)}`);
+            log.blank();
+            log.info("You're on a remote server — tunnel the port to your laptop:");
             log.blank();
-            log.info("You're on a remote server. Tunnel the port to your laptop:");
+            console.log(chalk.cyan(`  ssh -N -L ${port}:localhost:${port} user@$(hostname -I | awk '{print $1}')`));
             log.blank();
-            console.log(chalk.cyan(`  ssh -N -L ${port}:localhost:${port} user@$(hostname)`));
+            log.dim(`Then open ${chalk.cyan(localUrl)} in your browser.`);
             log.blank();
-            log.dim(`Then open ${url} in your browser.`);
+            log.info("Or expose it permanently via your domain:");
+            log.dim("  synap openclaw setup-domain");
         }
         else {
-            // Local Docker — just open it
-            log.info(`Opening ${chalk.cyan(url)} ...`);
+            log.info(`Opening ${chalk.cyan(localUrl)} ...`);
             try {
                 const open = process.platform === "darwin" ? "open" : "xdg-open";
-                execSync(`${open} ${url}`, { stdio: "ignore" });
+                execSync(`${open} ${localUrl}`, { stdio: "ignore" });
             }
             catch {
-                log.dim(`Open manually: ${url}`);
+                log.dim(`Open manually: ${localUrl}`);
             }
         }
     }
     else {
-        // Local install — use openclaw's own command
-        log.info(`Opening dashboard...`);
+        log.info("Opening dashboard...");
         try {
             execSync("openclaw dashboard", { stdio: "inherit", timeout: 5000 });
         }
         catch {
-            // Fallback: open URL directly
             try {
                 const open = process.platform === "darwin" ? "open" : "xdg-open";
-                execSync(`${open} ${url}`, { stdio: "ignore" });
+                execSync(`${open} ${localUrl}`, { stdio: "ignore" });
             }
             catch {
-                log.info(`Dashboard: ${chalk.cyan(url)}`);
+                log.info(`Dashboard: ${chalk.cyan(localUrl)}`);
             }
         }
     }
 }
-// ─── Configure: set AI provider key ──────────────────────────────────────────
-export async function openclawConfigure() {
+export async function openclawSetupDomain() {
     banner();
-    log.heading("Configure AI Provider");
+    log.heading("Expose OpenClaw Dashboard");
+    log.blank();
     const deployDir = findSynapDeployDir();
-    // Show current status
-    const current = getAiKeyStatus();
-    if (current.configured) {
-        log.success(`Currently using: ${current.provider}`);
-        log.dim(`Model: ${current.model ?? "default"}`);
+    if (!deployDir) {
+        log.error("Couldn't find the Synap deploy directory.");
+        log.dim("Run this command on the server where your pod is deployed.");
+        return;
+    }
+    const envDomain = readEnvVar(deployDir, "DOMAIN");
+    if (!envDomain) {
+        log.error("DOMAIN is not set in .env — can't determine pod domain.");
+        return;
+    }
+    // Detect pod type: managed (*.synap.live) vs self-hosted (custom domain)
+    const isManaged = envDomain.endsWith(".synap.live") || envDomain === "synap.live";
+    const localConfig = getLocalPodConfig();
+    const creds = getStoredToken();
+    log.info(`Pod domain: ${chalk.cyan(envDomain)}`);
+    log.dim(`Type: ${isManaged ? "managed (synap.live)" : "self-hosted"}`);
+    log.blank();
+    let publicDomain;
+    let authMode;
+    let basicAuthPassword;
+    if (isManaged) {
+        // ── Managed pod flow: CP creates DNS + CP OAuth ───────────────────────
+        if (!creds) {
+            log.error("Not logged in to Synap.");
+            log.dim("Run: synap login  (or: synap login --token <token>)");
+            return;
+        }
+        if (!localConfig?.podId) {
+            log.error("Pod ID not found in local config.");
+            log.dim("Run: synap init  (to set up the pod connection)");
+            return;
+        }
+        const { confirm } = await prompts({
+            type: "confirm",
+            name: "confirm",
+            message: `Create DNS record openclaw.${envDomain}? (CP will provision it)`,
+            initial: true,
+        });
+        if (!confirm)
+            return;
+        const spinner = ora("Asking Control Plane to create DNS record...").start();
+        try {
+            const result = await requestDashboardDomainFromCp(creds.token, localConfig.podId);
+            publicDomain = result.domain;
+            authMode = result.authMode;
+            spinner.succeed(`Domain created: ${chalk.cyan(publicDomain)}`);
+        }
+        catch (err) {
+            spinner.fail(err instanceof Error ? err.message : String(err));
+            log.dim("If this is a custom-domain or self-hosted pod, run again — it will fall back to manual mode.");
+            return;
+        }
+    }
+    else {
+        // ── Self-hosted flow: user sets DNS, we use basic auth ────────────────
+        log.info("Self-hosted pod — you'll need to add a DNS record yourself.");
         log.blank();
+        const { subdomain } = await prompts({
+            type: "text",
+            name: "subdomain",
+            message: "Public subdomain for OpenClaw:",
+            initial: `openclaw.${envDomain}`,
+        });
+        if (!subdomain)
+            return;
+        publicDomain = subdomain;
+        authMode = "basic";
+        log.blank();
+        log.info("Add this DNS A record:");
+        log.dim(`  Type:   A`);
+        log.dim(`  Name:   ${publicDomain}`);
+        log.dim(`  Value:  <this server's public IP>`);
+        log.blank();
+        const { dnsReady } = await prompts({
+            type: "confirm",
+            name: "dnsReady",
+            message: "DNS record added?",
+            initial: true,
+        });
+        if (!dnsReady) {
+            log.dim("Run this command again once DNS is set up.");
+            return;
+        }
+        // Generate a strong random password for basic auth
+        basicAuthPassword = generatePassword(32);
     }
-    const { provider } = await prompts({
-        type: "select",
-        name: "provider",
-        message: "Which AI provider?",
-        choices: [
-            {
-                title: "Anthropic (Claude)",
-                description: "claude-sonnet-4-6 — best quality, recommended",
-                value: "anthropic",
-            },
-            {
-                title: "OpenAI (GPT-4o)",
-                value: "openai",
-            },
-            {
-                title: "Google (Gemini)",
-                value: "google",
-            },
-            {
-                title: "Synap IS (via pod)",
-                description: "Uses your pod AI — no external key needed",
-                value: "synap",
-            },
-        ],
-    });
-    if (!provider)
+    // ── Write the Caddy auth snippet ──────────────────────────────────────────
+    const snippetPath = path.join(deployDir, "openclaw_auth.snippet");
+    if (authMode === "cp-oauth") {
+        fs.writeFileSync(snippetPath, generateCpOAuthSnippet(), { mode: 0o644 });
+        log.success("Wrote CP OAuth auth snippet");
+    }
+    else {
+        const hash = await bcryptHashViaCaddy(basicAuthPassword);
+        fs.writeFileSync(snippetPath, generateBasicAuthSnippet("openclaw", hash), { mode: 0o644 });
+        log.success("Wrote basic auth snippet");
+    }
+    // ── Update .env ───────────────────────────────────────────────────────────
+    const envFile = path.join(deployDir, ".env");
+    writeEnvVar(envFile, "OPENCLAW_DOMAIN", publicDomain);
+    log.success(`Set OPENCLAW_DOMAIN=${publicDomain} in .env`);
+    // ── Restart Caddy ────────────────────────────────────────────────────────
+    log.blank();
+    log.info("Restarting Caddy to apply changes...");
+    try {
+        execSync("docker compose restart caddy", {
+            cwd: deployDir,
+            stdio: "pipe",
+            timeout: 30000,
+        });
+        log.success("Caddy restarted");
+    }
+    catch {
+        log.warn("Caddy restart failed — run manually:");
+        log.dim(`  cd ${deployDir} && docker compose restart caddy`);
+    }
+    // ── Summary ──────────────────────────────────────────────────────────────
+    log.blank();
+    console.log(chalk.green("═══════════════════════════════════════════"));
+    console.log(chalk.green.bold("  OpenClaw Dashboard Ready"));
+    console.log(chalk.green("═══════════════════════════════════════════"));
+    log.blank();
+    log.info(`URL: ${chalk.cyan(`https://${publicDomain}`)}`);
+    log.blank();
+    if (authMode === "cp-oauth") {
+        log.info("Auth: Synap session (you're already logged in to synap.live)");
+        log.dim("Open the URL — if you're not signed in, you'll be redirected to login.");
+    }
+    else {
+        log.info("Auth: basic auth");
+        log.dim(`  Username: openclaw`);
+        log.dim(`  Password: ${chalk.cyan(basicAuthPassword)}`);
+        log.blank();
+        log.warn("Save this password — it won't be shown again.");
+    }
+    log.blank();
+    log.dim("TLS: Caddy will provision a Let's Encrypt certificate on first visit.");
+    log.dim("This takes ~30s the first time.");
+    log.blank();
+}
+export async function openclawConfigure(opts = {}) {
+    const oc = detectOpenClaw();
+    if (!oc.found) {
+        log.error("OpenClaw is not running.");
+        return;
+    }
+    // ── Show current config ─────────────────────────────────────────────────
+    if (opts.show) {
+        log.heading("OpenClaw AI Config");
+        const current = readOpenClawAiConfig(oc);
+        if (current.anthropicKey)
+            log.success(`Anthropic: ${maskKey(current.anthropicKey)}`);
+        if (current.openaiKey)
+            log.success(`OpenAI:    ${maskKey(current.openaiKey)}`);
+        if (current.geminiKey)
+            log.success(`Google:    ${maskKey(current.geminiKey)}`);
+        if (current.primaryModel)
+            log.info(`Model:     ${current.primaryModel}`);
+        if (!current.anthropicKey && !current.openaiKey && !current.geminiKey) {
+            log.warn("No AI provider key configured");
+        }
         return;
-    if (provider === "synap") {
+    }
+    // ── Interactive (delegate to OpenClaw's own wizard) ──────────────────────
+    if (opts.interactive && oc.runtime === "docker") {
+        const containerName = oc.containerName ?? "openclaw";
+        log.heading("Handing off to OpenClaw");
+        log.dim(`Running: docker exec -it ${containerName} openclaw configure`);
         log.blank();
-        log.info("Synap IS uses your pod's AI subscription.");
-        log.dim("Make sure IS is provisioned: synap finish");
-        log.dim("Then OpenClaw will use your pod URL as the AI endpoint.");
+        try {
+            execSync(`docker exec -it ${containerName} openclaw configure`, { stdio: "inherit" });
+        }
+        catch (err) {
+            log.error(`openclaw configure failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         return;
     }
+    banner();
+    log.heading("Configure AI Provider");
+    // ── Scripted path (--provider + --key) ───────────────────────────────────
+    let provider = opts.provider;
+    let apiKey = opts.key;
+    let model = opts.model;
+    if (!provider) {
+        const pick = await prompts({
+            type: "select",
+            name: "provider",
+            message: "Which AI provider?",
+            choices: [
+                { title: "Anthropic (Claude)", description: "recommended", value: "anthropic" },
+                { title: "OpenAI (GPT-4o)", value: "openai" },
+                { title: "Google (Gemini)", value: "google" },
+                { title: "Run OpenClaw's own wizard", description: "interactive", value: "wizard" },
+            ],
+        });
+        if (!pick.provider)
+            return;
+        if (pick.provider === "wizard") {
+            return openclawConfigure({ interactive: true });
+        }
+        provider = pick.provider;
+    }
     const envKey = provider === "anthropic"
         ? "ANTHROPIC_API_KEY"
         : provider === "openai"
@@ -280,64 +482,47 @@ export async function openclawConfigure() {
         : provider === "openai"
             ? "openai/gpt-4o"
             : "google/gemini-2.0-flash";
-    const { apiKey } = await prompts({
-        type: "password",
-        name: "apiKey",
-        message: `${envKey}:`,
-    });
-    if (!apiKey)
-        return;
-    const { model } = await prompts({
-        type: "text",
-        name: "model",
-        message: "Model (leave blank for default):",
-        initial: modelDefault,
-    });
-    if (deployDir) {
-        // Write to .env file
-        const envFile = `${deployDir}/.env`;
-        writeEnvVar(envFile, envKey, apiKey);
-        if (model && model !== modelDefault) {
-            writeEnvVar(envFile, "OPENCLAW_MODEL", model);
-        }
-        else {
-            writeEnvVar(envFile, "OPENCLAW_MODEL", modelDefault);
-        }
-        log.blank();
-        log.success(`${envKey} written to ${deployDir}/.env`);
-        // Restart container to pick up new env vars
-        const oc = detectOpenClaw();
-        const containerName = oc.containerName ?? "openclaw";
-        const { doRestart } = await prompts({
-            type: "confirm",
-            name: "doRestart",
-            message: `Restart ${containerName} to apply?`,
-            initial: true,
+    if (!apiKey) {
+        const res = await prompts({ type: "password", name: "apiKey", message: `${envKey}:` });
+        if (!res.apiKey)
+            return;
+        apiKey = res.apiKey;
+    }
+    if (!model) {
+        const res = await prompts({
+            type: "text",
+            name: "model",
+            message: "Model:",
+            initial: modelDefault,
         });
-        if (doRestart) {
-            try {
-                log.info(`Restarting ${containerName}...`);
-                execSync(`docker restart ${containerName}`, { stdio: "pipe", timeout: 30000 });
-                log.success("Restarted. Give it 30s to come back up.");
-                log.dim(`Check: synap openclaw`);
-            }
-            catch {
-                log.warn("Restart failed — restart manually:");
-                log.dim(`  docker restart ${containerName}`);
-            }
-        }
+        if (!res.model)
+            return;
+        model = res.model;
     }
-    else {
-        // No deploy dir — show env export instructions
-        log.blank();
-        log.warn("Could not find deploy directory. Set the key manually:");
-        log.blank();
-        console.log(chalk.cyan(`  export ${envKey}="${apiKey}"`));
-        if (model) {
-            console.log(chalk.cyan(`  export OPENCLAW_MODEL="${model}"`));
-        }
-        log.blank();
-        log.dim("Or add to your pod .env file, then: docker restart openclaw");
+    // ── Write via OpenClaw's own config system ──────────────────────────────
+    const containerName = oc.containerName ?? "openclaw";
+    const spinner = ora("Writing OpenClaw config...").start();
+    try {
+        // Set the API key inside OpenClaw's env block
+        execSync(`docker exec ${containerName} openclaw config set env.${envKey} ${JSON.stringify(apiKey)}`, { stdio: "pipe", timeout: 15000 });
+        // Set the primary model
+        execSync(`docker exec ${containerName} openclaw config set agents.defaults.model.primary ${JSON.stringify(model)}`, { stdio: "pipe", timeout: 15000 });
+        spinner.succeed("Config written");
+    }
+    catch (err) {
+        spinner.fail(`openclaw config set failed: ${err instanceof Error ? err.message : String(err)}`);
+        log.dim("Make sure OpenClaw is running: synap openclaw");
+        return;
+    }
+    // ── Restart to apply ─────────────────────────────────────────────────────
+    log.info("Restarting OpenClaw to apply...");
+    try {
+        execSync(`docker restart ${containerName}`, { stdio: "pipe", timeout: 30000 });
+        log.success("Restarted — give it ~30s to come back up");
+        log.dim("Check: synap openclaw");
+    }
+    catch {
+        log.warn("Restart failed — run manually: docker restart openclaw");
     }
     log.blank();
 }
@@ -362,6 +547,138 @@ export function openclawLogs(opts) {
         log.dim(`Try: docker logs ${containerName} --tail 50`);
     }
 }
+// ─── Token: print the gateway token ──────────────────────────────────────────
+export function openclawToken(opts) {
+    const oc = detectOpenClaw();
+    if (!oc.found) {
+        log.error("OpenClaw is not running.");
+        return;
+    }
+    const token = readGatewayToken(oc);
+    if (!token) {
+        log.error("Could not read gateway token from OpenClaw.");
+        log.dim("Try: synap openclaw doctor");
+        return;
+    }
+    if (opts.for) {
+        // Print a pre-filled MCP client config with the token embedded
+        const client = opts.for.toLowerCase();
+        const gatewayPort = oc.gatewayPort ?? 18789;
+        const config = {
+            mcpServers: {
+                openclaw: {
+                    command: "openclaw",
+                    args: [
+                        "mcp",
+                        "serve",
+                        "--url",
+                        `ws://localhost:${gatewayPort}`,
+                        "--token",
+                        token,
+                    ],
+                },
+            },
+        };
+        const paths = {
+            claude: "~/Library/Application Support/Claude/claude_desktop_config.json",
+            cursor: "~/.cursor/mcp.json",
+            windsurf: "~/.windsurf/mcp.json",
+        };
+        log.heading(client.charAt(0).toUpperCase() + client.slice(1));
+        if (paths[client])
+            log.dim(`Config file: ${paths[client]}`);
+        log.blank();
+        console.log(chalk.cyan(JSON.stringify(config, null, 2)));
+        log.blank();
+        return;
+    }
+    if (opts.copy) {
+        try {
+            const pbcopy = process.platform === "darwin"
+                ? "pbcopy"
+                : process.platform === "linux"
+                    ? "xclip -selection clipboard"
+                    : null;
+            if (pbcopy) {
+                execSync(`echo -n ${JSON.stringify(token)} | ${pbcopy}`, { stdio: "pipe" });
+                log.success("Token copied to clipboard");
+                return;
+            }
+        }
+        catch {
+            // fall through to print
+        }
+    }
+    // Plain print
+    console.log(token);
+}
+function readGatewayToken(oc) {
+    if (!oc.found)
+        return null;
+    if (oc.runtime === "docker") {
+        const containerName = oc.containerName ?? "openclaw";
+        // Try OpenClaw's own config first — works even if token file path changes
+        try {
+            const raw = execSync(`docker exec ${containerName} openclaw config get gateway.token 2>/dev/null`, { encoding: "utf-8", timeout: 5000 }).trim();
+            if (raw && raw !== "undefined" && raw !== "null") {
+                return raw.replace(/^["']|["']$/g, "");
+            }
+        }
+        catch {
+            // fall through
+        }
+        // Fallback: read the token file directly
+        try {
+            const raw = execSync(`docker exec ${containerName} cat /root/.openclaw/gateway.token 2>/dev/null`, { encoding: "utf-8", timeout: 5000 }).trim();
+            return raw || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    // Local install — read from host filesystem
+    try {
+        const tokenPath = `${process.env.HOME}/.openclaw/gateway.token`;
+        if (fs.existsSync(tokenPath)) {
+            return fs.readFileSync(tokenPath, "utf-8").trim();
+        }
+    }
+    catch {
+        // ignore
+    }
+    return null;
+}
+// ─── Doctor: run OpenClaw's own diagnostic ───────────────────────────────────
+export function openclawDoctor(opts) {
+    const oc = detectOpenClaw();
+    if (!oc.found) {
+        log.error("OpenClaw is not running.");
+        return;
+    }
+    const fixFlag = opts.fix ? " --fix" : "";
+    if (oc.runtime === "docker") {
+        const containerName = oc.containerName ?? "openclaw";
+        log.dim(`Running: docker exec ${containerName} openclaw doctor${fixFlag}`);
+        log.blank();
+        try {
+            execSync(`docker exec ${containerName} openclaw doctor${fixFlag}`, {
+                stdio: "inherit",
+                timeout: 60000,
+            });
+        }
+        catch {
+            log.warn("openclaw doctor reported issues or failed");
+        }
+    }
+    else {
+        try {
+            execSync(`openclaw doctor${fixFlag}`, { stdio: "inherit", timeout: 60000 });
+        }
+        catch {
+            log.warn("openclaw doctor reported issues or failed");
+        }
+    }
+}
 // ─── Restart ─────────────────────────────────────────────────────────────────
 export async function openclawRestart() {
     const oc = detectOpenClaw();
@@ -388,53 +705,22 @@ export async function openclawRestart() {
         log.dim(`Try: docker restart ${containerName}`);
     }
 }
-function getAiKeyStatus() {
-    // Check deploy dir .env first (most accurate for Docker deployments)
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function getOpenClawPublicUrl() {
     const deployDir = findSynapDeployDir();
-    if (deployDir) {
-        const envFile = `${deployDir}/.env`;
-        try {
-            const envContent = fs.readFileSync(envFile, "utf-8");
-            const vars = parseEnvFile(envContent);
-            if (vars.ANTHROPIC_API_KEY) {
-                return { configured: true, provider: "Anthropic", model: vars.OPENCLAW_MODEL };
-            }
-            if (vars.OPENAI_API_KEY) {
-                return { configured: true, provider: "OpenAI", model: vars.OPENCLAW_MODEL };
-            }
-            if (vars.GEMINI_API_KEY) {
-                return { configured: true, provider: "Google", model: vars.OPENCLAW_MODEL };
-            }
-        }
-        catch {
-            // unreadable
-        }
+    if (!deployDir)
+        return null;
+    try {
+        const content = fs.readFileSync(`${deployDir}/.env`, "utf-8");
+        const match = content.match(/^OPENCLAW_DOMAIN=(.+)$/m);
+        const domain = match?.[1]?.trim();
+        if (!domain || domain === "disabled.invalid" || domain === "")
+            return null;
+        return `https://${domain}`;
     }
-    // Fallback: check live container env (via docker inspect)
-    const oc = detectOpenClaw();
-    if (oc.runtime === "docker") {
-        try {
-            const containerName = oc.containerName ?? "openclaw";
-            const raw = execSync(`docker inspect --format '{{range .Config.Env}}{{.}}\\n{{end}}' ${containerName} 2>/dev/null`, { encoding: "utf-8", timeout: 5000 });
-            const envLines = raw.split("\\n").filter(Boolean);
-            const env = {};
-            for (const line of envLines) {
-                const idx = line.indexOf("=");
-                if (idx > 0)
-                    env[line.slice(0, idx)] = line.slice(idx + 1);
-            }
-            if (env.ANTHROPIC_API_KEY)
-                return { configured: true, provider: "Anthropic", model: env.OPENCLAW_MODEL };
-            if (env.OPENAI_API_KEY)
-                return { configured: true, provider: "OpenAI", model: env.OPENCLAW_MODEL };
-            if (env.GEMINI_API_KEY)
-                return { configured: true, provider: "Google", model: env.OPENCLAW_MODEL };
-        }
-        catch {
-            // docker not available
-        }
+    catch {
+        return null;
     }
-    return { configured: false };
 }
 function checkSkillInstalled(oc) {
     if (!oc.found)
@@ -469,19 +755,117 @@ function writeEnvVar(envFile, key, value) {
             : content + "\n" + line + "\n";
     fs.writeFileSync(envFile, content, { mode: 0o600 });
 }
-function parseEnvFile(content) {
-    const result = {};
-    for (const line of content.split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#"))
-            continue;
-        const idx = trimmed.indexOf("=");
-        if (idx > 0) {
-            const key = trimmed.slice(0, idx);
-            const val = trimmed.slice(idx + 1).replace(/^["']|["']$/g, "");
-            result[key] = val;
-        }
-    }
-    return result;
+// ─── Domain setup helpers ────────────────────────────────────────────────────
+function readEnvVar(deployDir, key) {
+    try {
+        const content = fs.readFileSync(path.join(deployDir, ".env"), "utf-8");
+        const match = content.match(new RegExp(`^${key}=(.+)$`, "m"));
+        return match?.[1]?.trim() ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function generatePassword(length) {
+    // URL-safe random password
+    return crypto
+        .randomBytes(length)
+        .toString("base64url")
+        .slice(0, length);
+}
+async function bcryptHashViaCaddy(plaintext) {
+    // Caddy ships `caddy hash-password` which outputs a bcrypt hash.
+    // Run it via the running caddy container so we don't need a bcrypt dep in Node.
+    try {
+        const hash = execSync(`docker exec -i caddy caddy hash-password --plaintext ${JSON.stringify(plaintext)}`, { encoding: "utf-8", timeout: 10000 }).trim();
+        return hash;
+    }
+    catch (err) {
+        // Fallback: try without container (if caddy is in PATH)
+        try {
+            return execSync(`caddy hash-password --plaintext ${JSON.stringify(plaintext)}`, { encoding: "utf-8", timeout: 10000 }).trim();
+        }
+        catch {
+            throw new Error(`Could not hash password via caddy: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
+function generateCpOAuthSnippet() {
+    return `# OpenClaw dashboard auth — CP OAuth (generated by synap openclaw setup-domain)
+#
+# Validates the Better Auth session cookie against the Synap Control Plane.
+# Because the CP cookie is set with Domain=.synap.live (crossSubDomainCookies),
+# the browser sends it automatically to this subdomain.
+#
+# 200 → authenticated, pass through to openclaw
+# 401 → redirect to synap.live login
+
+forward_auth https://api.synap.live {
+    uri /api/auth/me
+    copy_headers X-Authenticated-User
+
+    @unauthorized status 401
+    handle_response @unauthorized {
+        redir https://synap.live/login?redirect=https://{host}{uri} temporary
+    }
+}
+`;
+}
+function generateBasicAuthSnippet(username, bcryptHash) {
+    return `# OpenClaw dashboard auth — basic auth (generated by synap openclaw setup-domain)
+#
+# Single credential protects the dashboard. The password hash below was
+# generated with \`caddy hash-password\`. To rotate, run:
+#   synap openclaw setup-domain
+
+basicauth {
+    ${username} ${bcryptHash}
+}
+`;
+}
+function readOpenClawAiConfig(oc) {
+    if (!oc.found || oc.runtime !== "docker")
+        return {};
+    const containerName = oc.containerName ?? "openclaw";
+    const read = (key) => {
+        try {
+            const out = execSync(`docker exec ${containerName} openclaw config get ${key} 2>/dev/null`, { encoding: "utf-8", timeout: 5000 }).trim();
+            if (!out || out === "undefined" || out === "null")
+                return undefined;
+            return out.replace(/^["']|["']$/g, "");
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        anthropicKey: read("env.ANTHROPIC_API_KEY"),
+        openaiKey: read("env.OPENAI_API_KEY"),
+        geminiKey: read("env.GEMINI_API_KEY"),
+        primaryModel: read("agents.defaults.model.primary"),
+    };
+}
+function maskKey(key) {
+    if (key.length <= 8)
+        return "•".repeat(key.length);
+    return `${key.slice(0, 4)}...${key.slice(-4)}`;
+}
+async function requestDashboardDomainFromCp(cpToken, podId) {
+    const cpUrl = process.env.SYNAP_CP_URL ?? "https://api.synap.live";
+    const res = await fetch(`${cpUrl}/openclaw/expose-dashboard`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${cpToken}`,
+        },
+        body: JSON.stringify({ podId }),
+        signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok) {
+        const body = (await res.json().catch(() => null));
+        throw new Error(`CP request failed (HTTP ${res.status}): ${body?.error ?? "unknown error"}`);
+    }
+    const data = (await res.json());
+    return { domain: data.domain, authMode: data.authMode };
 }
 //# sourceMappingURL=openclaw.js.map