@totalreclaw/totalreclaw 3.3.12-rc.9 → 3.3.12

package/auto-pair-on-load.ts

@@ -1,308 +0,0 @@
-/**
- * auto-pair-on-load — autonomously open a relay pair session when the
- * plugin loads without credentials, so the chat agent never has to guess
- * (or hallucinate) a pair URL.
- *
- * Background
- * ----------
- * Through 3.3.12 the plugin's only fallback on a fresh install was a log
- * line telling the user to run `openclaw totalreclaw onboard`. The chat
- * agent then guessed URLs / sessions from training data and shipped users
- * to dead links — Pop-OS QA (2026-05-10) saw an invented session ID,
- * 404/502 in the browser, and no recovery phrase generated.
- *
- * 3.3.13 flips the default: when register() finds no credentials, the
- * plugin opens its OWN relay session (the same one `tr pair --json` opens)
- * and writes URL + PIN + sid + expiry to
- * `~/.totalreclaw/.pair-pending.json`. A separate before_agent_start hook
- * (see `pair-pending-injection.ts`) reads that file and instructs the
- * agent to copy the values verbatim. There is no LLM-side string
- * generation in the path.
- *
- * Phrase safety
- * -------------
- * The recovery phrase is NEVER written to the sentinel. The background
- * WS listener (awaitPhraseUpload) writes the decrypted mnemonic directly
- * to credentials.json — the same code path the `totalreclaw_pair` tool
- * and the `tr pair --json` CLI already use. The sentinel only holds URL,
- * PIN, sid, and expiry — all values the user already needs to see in
- * chat to complete the flow.
- *
- * Idempotency / TTL
- * -----------------
- * - credentials.json present → no-op
- * - valid non-expired sentinel → no-op (reuse existing session)
- * - expired sentinel → delete + open fresh session
- * - no sentinel → open fresh session
- *
- * Scanner scope
- * -------------
- * This file MUST NOT import `node:fs` directly. All disk I/O is delegated
- * to `fs-helpers.ts`. We DO import `pair-remote-client.js`, which opens a
- * WebSocket — but that file already passes the scanner (no readFile*).
- */
-
-import { validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english.js';
-
-import {
-  deletePairPendingFile,
-  defaultPairPendingPath,
-  loadCredentialsJson,
-  loadPairPendingFile,
-  writeCredentialsJson,
-  writePairPendingFile,
-  writeOnboardingState,
-  type PairPendingFile,
-} from './fs-helpers.js';
-import {
-  awaitPhraseUpload,
-  openRemotePairSession,
-  type RemotePairSession,
-} from './pair-remote-client.js';
-import { setRecoveryPhraseOverride } from './config.js';
-
-// ---------------------------------------------------------------------------
-// Types
-// ---------------------------------------------------------------------------
-
-/**
- * Minimal logger surface — matches the slice we use from
- * `OpenClawPluginApi['logger']` without dragging the whole API type in.
- */
-export interface AutoPairLogger {
-  info(msg: string): void;
-  warn(msg: string): void;
-  error(msg: string): void;
-}
-
-/** Dependencies — injected so tests can stub the relay + filesystem. */
-export interface AutoPairDeps {
-  /** Path to credentials.json. */
-  credentialsPath: string;
-  /** Path to the pair-pending sentinel. Defaults to `<credentialsDir>/.pair-pending.json`. */
-  pendingPath?: string;
-  /** Path to onboarding state.json — flipped to `active` when the user completes pairing. */
-  onboardingStatePath: string;
-  /** Relay base URL (`wss://api.totalreclaw.xyz` or staging). */
-  relayBaseUrl: string;
-  /** Plugin version stamped into onboarding state on success. */
-  pluginVersion: string;
-  /** Logger. */
-  logger: AutoPairLogger;
-  /**
-   * Hard timeout for the background `awaitPhraseUpload` task (ms). The
-   * relay-side TTL is 5 min; the gateway-side timer is the deadline the
-   * user is told about in chat. Defaults to 300_000 (5 min) so the
-   * sentinel-advertised expiry and the background listener stay aligned.
-   */
-  awaitTimeoutMs?: number;
-  /** Pair mode to advertise to the relay. Defaults to 'generate'. */
-  mode?: 'generate' | 'import';
-  /**
-   * Test injection — override `Date.now()` so expiry math is deterministic.
-   */
-  now?: () => number;
-  /**
-   * Test injection — replace the relay-session opener.
-   */
-  openSession?: (
-    opts: { relayBaseUrl: string; mode: 'generate' | 'import' },
-  ) => Promise<RemotePairSession>;
-  /**
-   * Test injection — replace the background await loop. Receives the
-   * session + the same completion handler the production path uses.
-   */
-  awaitPhrase?: (
-    session: RemotePairSession,
-    onComplete: (mnemonic: string) => Promise<void>,
-  ) => Promise<void>;
-}
-
-/** Result of `maybeStartAutoPair`. Tests + callers branch on `status`. */
-export type AutoPairResult =
-  | { status: 'creds_exist' }
-  | { status: 'pending_reused'; pending: PairPendingFile }
-  | { status: 'started'; pending: PairPendingFile }
-  | { status: 'failed'; error: string };
-
-// ---------------------------------------------------------------------------
-// Public entrypoint
-// ---------------------------------------------------------------------------
-
-/**
- * Check the credentials + pending-sentinel state and, if needed, open a
- * fresh relay pair session. Idempotent under concurrent calls in the same
- * gateway process — repeated calls within the TTL reuse the existing
- * sentinel (no second session is opened).
- *
- * Returns immediately after writing the sentinel. The background WS
- * listener that drains the encrypted phrase + writes credentials.json is
- * kicked off via `void (async () => ...)()` so register() can finish
- * synchronously.
- */
-export async function maybeStartAutoPair(
-  deps: AutoPairDeps,
-): Promise<AutoPairResult> {
-  const now = deps.now ?? Date.now;
-  const pendingPath = deps.pendingPath ?? defaultPairPendingPath(deps.credentialsPath);
-  const logger = deps.logger;
-
-  // 1. credentials.json present → setup already complete; clean up any
-  //    stale sentinel and return early.
-  const creds = loadCredentialsJson(deps.credentialsPath);
-  if (creds && (typeof creds.mnemonic === 'string' || typeof creds.recovery_phrase === 'string')) {
-    if (deletePairPendingFile(pendingPath)) {
-      logger.info('auto-pair-on-load: credentials present, cleared stale pending sentinel');
-    }
-    return { status: 'creds_exist' };
-  }
-
-  // 2. Valid non-expired sentinel → reuse it. The background WS listener
-  //    from the original call is presumed alive; if the gateway restarted
-  //    we cannot resurrect that listener but we leave the sentinel alone
-  //    so the existing PIN keeps working until the user navigates to the
-  //    URL. (If the listener died, the relay will time out the session;
-  //    on next plugin reload after expiry we open a fresh one.)
-  const existing = loadPairPendingFile(pendingPath);
-  if (existing && existing.expires_at_ms > now()) {
-    logger.info(
-      `auto-pair-on-load: reusing pending pair sentinel (sid=${existing.sid.slice(0, 8)}…, expires in ${Math.round((existing.expires_at_ms - now()) / 1000)}s)`,
-    );
-    return { status: 'pending_reused', pending: existing };
-  }
-
-  // 3. Expired sentinel → drop it before opening a new session so we never
-  //    leave two competing files on disk.
-  if (existing) {
-    deletePairPendingFile(pendingPath);
-    logger.info('auto-pair-on-load: pending sentinel expired, opening fresh session');
-  }
-
-  // 4. Open a new relay session. This is the same call path as
-  //    `tr pair --json` and the `totalreclaw_pair` tool handler.
-  const mode = deps.mode ?? 'generate';
-  let session: RemotePairSession;
-  try {
-    const opener = deps.openSession ?? openRemotePairSession;
-    session = await opener({ relayBaseUrl: deps.relayBaseUrl, mode });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logger.warn(`auto-pair-on-load: failed to open relay session: ${msg}`);
-    return { status: 'failed', error: msg };
-  }
-
-  // ISO-8601 -> ms.  If the relay omits the field we fall back to 5 min.
-  const parsedExpiresMs = Date.parse(session.expiresAt);
-  const expiresAtMs = Number.isFinite(parsedExpiresMs)
-    ? parsedExpiresMs
-    : now() + 5 * 60_000;
-
-  const payload: PairPendingFile = {
-    v: 1,
-    url: session.url,
-    pin: session.pin,
-    sid: session.token,
-    expires_at_ms: expiresAtMs,
-    created_at_ms: now(),
-    mode,
-  };
-
-  if (!writePairPendingFile(pendingPath, payload)) {
-    logger.warn('auto-pair-on-load: failed to write .pair-pending.json sentinel');
-    // Best-effort: try to close the WS so we don't leak it.
-    try {
-      session._ws.close();
-    } catch {
-      /* ignore */
-    }
-    return { status: 'failed', error: 'pending_write_failed' };
-  }
-
-  logger.info(
-    `auto-pair-on-load: opened pair session (sid=${session.token.slice(0, 8)}…, expires in ${Math.round((expiresAtMs - now()) / 1000)}s); sentinel written`,
-  );
-
-  // 5. Kick off the background WS listener. On success it writes
-  //    credentials.json + deletes the sentinel. `void` so register()
-  //    returns immediately.
-  void runBackgroundAwait({
-    session,
-    deps,
-    pendingPath,
-    mode,
-  });
-
-  return { status: 'started', pending: payload };
-}
-
-// ---------------------------------------------------------------------------
-// Background listener
-// ---------------------------------------------------------------------------
-
-interface BackgroundOpts {
-  session: RemotePairSession;
-  deps: AutoPairDeps;
-  pendingPath: string;
-  mode: 'generate' | 'import';
-}
-
-async function runBackgroundAwait(opts: BackgroundOpts): Promise<void> {
-  const { session, deps, pendingPath, mode } = opts;
-  const timeoutMs = deps.awaitTimeoutMs ?? 5 * 60_000;
-  const logger = deps.logger;
-
-  const onComplete = async (mnemonic: string): Promise<void> => {
-    const existingCreds = loadCredentialsJson(deps.credentialsPath) ?? {};
-    const next = { ...existingCreds, mnemonic };
-    if (!writeCredentialsJson(deps.credentialsPath, next)) {
-      throw new Error('credentials_write_failed');
-    }
-    setRecoveryPhraseOverride(mnemonic);
-    writeOnboardingState(deps.onboardingStatePath, {
-      onboardingState: 'active',
-      createdBy: mode === 'generate' ? 'generate' : 'import',
-      credentialsCreatedAt: new Date().toISOString(),
-      version: deps.pluginVersion,
-    });
-    // Sentinel is consumed — drop it so the before_agent_start hook
-    // stops surfacing the URL on the next turn.
-    deletePairPendingFile(pendingPath);
-    logger.info(
-      `auto-pair-on-load: pair completed (sid=${session.token.slice(0, 8)}…); credentials written, sentinel cleared`,
-    );
-  };
-
-  if (deps.awaitPhrase) {
-    try {
-      await deps.awaitPhrase(session, onComplete);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      logger.warn(`auto-pair-on-load: background await failed: ${msg}`);
-    }
-    return;
-  }
-
-  try {
-    await awaitPhraseUpload(session, {
-      phraseValidator: (p: string) => validateMnemonic(p, wordlist),
-      completePairing: async ({ mnemonic }) => {
-        try {
-          await onComplete(mnemonic);
-          return { state: 'active' };
-        } catch (err: unknown) {
-          const msg = err instanceof Error ? err.message : String(err);
-          logger.error(`auto-pair-on-load: completePairing failed: ${msg}`);
-          return { state: 'error', error: msg };
-        }
-      },
-      timeoutMs,
-    });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    // Expected on TTL expiry or user abandon — warn not error.
-    logger.warn(
-      `auto-pair-on-load: background task ended (sid=${session.token.slice(0, 8)}…): ${msg}`,
-    );
-  }
-}

package/dist/auto-pair-on-load.js

@@ -1,197 +0,0 @@
-/**
- * auto-pair-on-load — autonomously open a relay pair session when the
- * plugin loads without credentials, so the chat agent never has to guess
- * (or hallucinate) a pair URL.
- *
- * Background
- * ----------
- * Through 3.3.12 the plugin's only fallback on a fresh install was a log
- * line telling the user to run `openclaw totalreclaw onboard`. The chat
- * agent then guessed URLs / sessions from training data and shipped users
- * to dead links — Pop-OS QA (2026-05-10) saw an invented session ID,
- * 404/502 in the browser, and no recovery phrase generated.
- *
- * 3.3.13 flips the default: when register() finds no credentials, the
- * plugin opens its OWN relay session (the same one `tr pair --json` opens)
- * and writes URL + PIN + sid + expiry to
- * `~/.totalreclaw/.pair-pending.json`. A separate before_agent_start hook
- * (see `pair-pending-injection.ts`) reads that file and instructs the
- * agent to copy the values verbatim. There is no LLM-side string
- * generation in the path.
- *
- * Phrase safety
- * -------------
- * The recovery phrase is NEVER written to the sentinel. The background
- * WS listener (awaitPhraseUpload) writes the decrypted mnemonic directly
- * to credentials.json — the same code path the `totalreclaw_pair` tool
- * and the `tr pair --json` CLI already use. The sentinel only holds URL,
- * PIN, sid, and expiry — all values the user already needs to see in
- * chat to complete the flow.
- *
- * Idempotency / TTL
- * -----------------
- * - credentials.json present → no-op
- * - valid non-expired sentinel → no-op (reuse existing session)
- * - expired sentinel → delete + open fresh session
- * - no sentinel → open fresh session
- *
- * Scanner scope
- * -------------
- * This file MUST NOT import `node:fs` directly. All disk I/O is delegated
- * to `fs-helpers.ts`. We DO import `pair-remote-client.js`, which opens a
- * WebSocket — but that file already passes the scanner (no readFile*).
- */
-import { validateMnemonic } from '@scure/bip39';
-import { wordlist } from '@scure/bip39/wordlists/english.js';
-import { deletePairPendingFile, defaultPairPendingPath, loadCredentialsJson, loadPairPendingFile, writeCredentialsJson, writePairPendingFile, writeOnboardingState, } from './fs-helpers.js';
-import { awaitPhraseUpload, openRemotePairSession, } from './pair-remote-client.js';
-import { setRecoveryPhraseOverride } from './config.js';
-// ---------------------------------------------------------------------------
-// Public entrypoint
-// ---------------------------------------------------------------------------
-/**
- * Check the credentials + pending-sentinel state and, if needed, open a
- * fresh relay pair session. Idempotent under concurrent calls in the same
- * gateway process — repeated calls within the TTL reuse the existing
- * sentinel (no second session is opened).
- *
- * Returns immediately after writing the sentinel. The background WS
- * listener that drains the encrypted phrase + writes credentials.json is
- * kicked off via `void (async () => ...)()` so register() can finish
- * synchronously.
- */
-export async function maybeStartAutoPair(deps) {
-    const now = deps.now ?? Date.now;
-    const pendingPath = deps.pendingPath ?? defaultPairPendingPath(deps.credentialsPath);
-    const logger = deps.logger;
-    // 1. credentials.json present → setup already complete; clean up any
-    //    stale sentinel and return early.
-    const creds = loadCredentialsJson(deps.credentialsPath);
-    if (creds && (typeof creds.mnemonic === 'string' || typeof creds.recovery_phrase === 'string')) {
-        if (deletePairPendingFile(pendingPath)) {
-            logger.info('auto-pair-on-load: credentials present, cleared stale pending sentinel');
-        }
-        return { status: 'creds_exist' };
-    }
-    // 2. Valid non-expired sentinel → reuse it. The background WS listener
-    //    from the original call is presumed alive; if the gateway restarted
-    //    we cannot resurrect that listener but we leave the sentinel alone
-    //    so the existing PIN keeps working until the user navigates to the
-    //    URL. (If the listener died, the relay will time out the session;
-    //    on next plugin reload after expiry we open a fresh one.)
-    const existing = loadPairPendingFile(pendingPath);
-    if (existing && existing.expires_at_ms > now()) {
-        logger.info(`auto-pair-on-load: reusing pending pair sentinel (sid=${existing.sid.slice(0, 8)}…, expires in ${Math.round((existing.expires_at_ms - now()) / 1000)}s)`);
-        return { status: 'pending_reused', pending: existing };
-    }
-    // 3. Expired sentinel → drop it before opening a new session so we never
-    //    leave two competing files on disk.
-    if (existing) {
-        deletePairPendingFile(pendingPath);
-        logger.info('auto-pair-on-load: pending sentinel expired, opening fresh session');
-    }
-    // 4. Open a new relay session. This is the same call path as
-    //    `tr pair --json` and the `totalreclaw_pair` tool handler.
-    const mode = deps.mode ?? 'generate';
-    let session;
-    try {
-        const opener = deps.openSession ?? openRemotePairSession;
-        session = await opener({ relayBaseUrl: deps.relayBaseUrl, mode });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        logger.warn(`auto-pair-on-load: failed to open relay session: ${msg}`);
-        return { status: 'failed', error: msg };
-    }
-    // ISO-8601 -> ms.  If the relay omits the field we fall back to 5 min.
-    const parsedExpiresMs = Date.parse(session.expiresAt);
-    const expiresAtMs = Number.isFinite(parsedExpiresMs)
-        ? parsedExpiresMs
-        : now() + 5 * 60_000;
-    const payload = {
-        v: 1,
-        url: session.url,
-        pin: session.pin,
-        sid: session.token,
-        expires_at_ms: expiresAtMs,
-        created_at_ms: now(),
-        mode,
-    };
-    if (!writePairPendingFile(pendingPath, payload)) {
-        logger.warn('auto-pair-on-load: failed to write .pair-pending.json sentinel');
-        // Best-effort: try to close the WS so we don't leak it.
-        try {
-            session._ws.close();
-        }
-        catch {
-            /* ignore */
-        }
-        return { status: 'failed', error: 'pending_write_failed' };
-    }
-    logger.info(`auto-pair-on-load: opened pair session (sid=${session.token.slice(0, 8)}…, expires in ${Math.round((expiresAtMs - now()) / 1000)}s); sentinel written`);
-    // 5. Kick off the background WS listener. On success it writes
-    //    credentials.json + deletes the sentinel. `void` so register()
-    //    returns immediately.
-    void runBackgroundAwait({
-        session,
-        deps,
-        pendingPath,
-        mode,
-    });
-    return { status: 'started', pending: payload };
-}
-async function runBackgroundAwait(opts) {
-    const { session, deps, pendingPath, mode } = opts;
-    const timeoutMs = deps.awaitTimeoutMs ?? 5 * 60_000;
-    const logger = deps.logger;
-    const onComplete = async (mnemonic) => {
-        const existingCreds = loadCredentialsJson(deps.credentialsPath) ?? {};
-        const next = { ...existingCreds, mnemonic };
-        if (!writeCredentialsJson(deps.credentialsPath, next)) {
-            throw new Error('credentials_write_failed');
-        }
-        setRecoveryPhraseOverride(mnemonic);
-        writeOnboardingState(deps.onboardingStatePath, {
-            onboardingState: 'active',
-            createdBy: mode === 'generate' ? 'generate' : 'import',
-            credentialsCreatedAt: new Date().toISOString(),
-            version: deps.pluginVersion,
-        });
-        // Sentinel is consumed — drop it so the before_agent_start hook
-        // stops surfacing the URL on the next turn.
-        deletePairPendingFile(pendingPath);
-        logger.info(`auto-pair-on-load: pair completed (sid=${session.token.slice(0, 8)}…); credentials written, sentinel cleared`);
-    };
-    if (deps.awaitPhrase) {
-        try {
-            await deps.awaitPhrase(session, onComplete);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            logger.warn(`auto-pair-on-load: background await failed: ${msg}`);
-        }
-        return;
-    }
-    try {
-        await awaitPhraseUpload(session, {
-            phraseValidator: (p) => validateMnemonic(p, wordlist),
-            completePairing: async ({ mnemonic }) => {
-                try {
-                    await onComplete(mnemonic);
-                    return { state: 'active' };
-                }
-                catch (err) {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    logger.error(`auto-pair-on-load: completePairing failed: ${msg}`);
-                    return { state: 'error', error: msg };
-                }
-            },
-            timeoutMs,
-        });
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        // Expected on TTL expiry or user abandon — warn not error.
-        logger.warn(`auto-pair-on-load: background task ended (sid=${session.token.slice(0, 8)}…): ${msg}`);
-    }
-}

package/dist/pair-pending-injection.js

@@ -1,125 +0,0 @@
-/**
- * pair-pending-injection — `before_agent_start` hook that surfaces the
- * pending pair URL + PIN to the chat agent verbatim, so the agent can NOT
- * hallucinate either value.
- *
- * Background
- * ----------
- * Companion to `auto-pair-on-load.ts`. When the plugin loads without
- * credentials, the auto-pair flow writes `~/.totalreclaw/.pair-pending.json`
- * with the exact URL + PIN the user must use. This hook reads that file on
- * every agent start and, when present, prepends a context block that tells
- * the agent EXACTLY what to say.
- *
- * No agent-generated string ever appears in the URL or PIN that reaches
- * the user.
- *
- * Phrase safety
- * -------------
- * The sentinel does NOT contain the recovery phrase. The injected context
- * deliberately warns the agent NOT to attempt to display, generate, or
- * relay any phrase. That instruction is reinforced via the staging-banner
- * hook + the SKILL.md phrase-safety section.
- *
- * Scanner scope
- * -------------
- * Pure-logic file — no `node:fs` imports, no `process.env` reads, no
- * subprocess module usage. Disk I/O is delegated to `fs-helpers.ts`.
- */
-import { defaultPairPendingPath, deletePairPendingFile, loadPairPendingFile, } from './fs-helpers.js';
-import { maybeStartAutoPair } from './auto-pair-on-load.js';
-// ---------------------------------------------------------------------------
-// Hook body (exposed for unit tests)
-// ---------------------------------------------------------------------------
-/**
- * Pure-async body of the hook. Test-callable.
- *
- * - sentinel missing -> no-op (return `undefined`)
- * - sentinel valid + non-expired -> return `{ prependContext: <block> }`
- * - sentinel expired -> delete + try re-create via maybeStartAutoPair; if
- *   re-create returns a fresh `pending`, inject context for the NEW URL/PIN;
- *   else return `undefined`
- */
-export async function runPairPendingInjection(deps, logger) {
-    const now = deps.now ?? Date.now;
-    const pendingPath = deps.pendingPath ?? defaultPairPendingPath(deps.credentialsPath);
-    const existing = loadPairPendingFile(pendingPath);
-    // No sentinel — nothing to inject.
-    if (!existing)
-        return undefined;
-    // Valid + non-expired sentinel — inject context with verbatim values.
-    if (existing.expires_at_ms > now()) {
-        return { prependContext: buildPrependContext(existing) };
-    }
-    // Expired sentinel. Clean it up and optionally re-create.
-    logger.info('pair-pending-injection: sentinel expired, cleaning up');
-    deletePairPendingFile(pendingPath);
-    const apFactory = deps.autoPairDepsFactory;
-    if (!apFactory)
-        return undefined;
-    const apDeps = apFactory();
-    if (!apDeps)
-        return undefined;
-    try {
-        const runner = deps.startAutoPair ?? maybeStartAutoPair;
-        const result = (await runner(apDeps));
-        if (result
-            && typeof result === 'object'
-            && (result.status === 'started' || result.status === 'pending_reused')) {
-            return { prependContext: buildPrependContext(result.pending) };
-        }
-    }
-    catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        logger.warn(`pair-pending-injection: re-create failed: ${msg}`);
-    }
-    return undefined;
-}
-// ---------------------------------------------------------------------------
-// Wire-up
-// ---------------------------------------------------------------------------
-/**
- * Register the before_agent_start hook on the OpenClaw plugin API. Wraps
- * the hook body in try/catch so any error path returns `undefined` (i.e.
- * silently skip the injection — never block session start).
- */
-export function installBeforeAgentStartHook(api, deps) {
-    api.on('before_agent_start', async (_event) => {
-        try {
-            return await runPairPendingInjection(deps, api.logger);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            api.logger.warn(`pair-pending-injection: hook failed: ${msg}`);
-            return undefined;
-        }
-    }, 
-    // Priority chosen lower than the staging-banner / memory-recall hook
-    // (which uses default priority) so the pair-pending block lands BEFORE
-    // those — the URL + PIN is the highest-priority action for a fresh user.
-    { priority: 100 });
-}
-// ---------------------------------------------------------------------------
-// Context-block builder (exported for tests)
-// ---------------------------------------------------------------------------
-/**
- * Build the prepend block. URL + PIN are inlined VERBATIM from the
- * sentinel — there is no template substitution or string manipulation on
- * either value. The agent is told explicitly to read the file as the
- * source of truth.
- */
-export function buildPrependContext(pending) {
-    return ('[TotalReclaw setup pending — read this carefully]\n\n'
-        + 'The user has TotalReclaw installed but no recovery phrase yet. To complete setup, '
-        + 'tell the user EXACTLY these two values (do NOT invent or modify them — read directly '
-        + 'from ~/.totalreclaw/.pair-pending.json):\n\n'
-        + `Open this URL in your browser: ${pending.url}\n`
-        + `Enter this 6-digit PIN: ${pending.pin}\n\n`
-        + 'The browser page lets the user either generate a fresh 12-word recovery phrase or '
-        + 'import an existing one. The phrase is delivered to the gateway end-to-end encrypted; '
-        + 'it never touches you (the agent) or any server in plaintext.\n\n'
-        + 'After the user confirms "done", check ~/.totalreclaw/credentials.json — if present, '
-        + 'setup is complete.\n\n'
-        + 'CRITICAL: do NOT make up these values. The file ~/.totalreclaw/.pair-pending.json IS '
-        + 'the source of truth. If the file is missing, run `tr pair --json` instead.\n\n');
-}