@winmatrix/daemon 1.0.5 → 1.0.7

package/dist/core/DaemonDeviceCredentialStore.js

@@ -0,0 +1,316 @@
+import { generateKeyPairSync, createHash, createPublicKey } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+function assertBindingId(bindingId) {
+    if (!/^[A-Za-z0-9._-]+$/.test(bindingId)) {
+        throw new Error('OpenClaw bindingId contains unsupported characters');
+    }
+}
+function deriveOrigin(gatewayUrl) {
+    const url = new URL(gatewayUrl);
+    return `${url.protocol === 'wss:' ? 'https:' : 'http:'}//${url.host}`;
+}
+function run(command, args, input) {
+    const result = spawnSync(command, args, {
+        input,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'ignore'],
+        windowsHide: true,
+    });
+    return { ok: result.status === 0, stdout: result.stdout?.trim() ?? '' };
+}
+function atomicWrite(path, content) {
+    const parent = dirname(path);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(parent, 0o700);
+    }
+    catch {
+        // Windows ACL 由当前用户 profile 目录承担；POSIX 权限已在 mkdir 设置。
+    }
+    const tempPath = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(tempPath, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    try {
+        chmodSync(tempPath, 0o600);
+        renameSync(tempPath, path);
+        chmodSync(path, 0o600);
+    }
+    finally {
+        if (existsSync(tempPath))
+            rmSync(tempPath, { force: true });
+    }
+}
+class WindowsDpapiBackend {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    path(bindingId) {
+        return join(this.root, 'openclaw-device-bindings-dpapi', `${bindingId}.bin`);
+    }
+    available() {
+        return process.platform === 'win32'
+            && run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', '$PSVersionTable.PSVersion.Major']).ok;
+    }
+    load(bindingId) {
+        const path = this.path(bindingId);
+        if (!existsSync(path))
+            return null;
+        const encrypted = readFileSync(path, 'utf8');
+        const script = [
+            'Add-Type -AssemblyName System.Security',
+            '$value=[Console]::In.ReadToEnd()',
+            '$bytes=[Convert]::FromBase64String($value)',
+            '$plain=[Security.Cryptography.ProtectedData]::Unprotect($bytes,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)',
+            '[Console]::Out.Write([Text.Encoding]::UTF8.GetString($plain))',
+        ].join(';');
+        const result = run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], encrypted);
+        if (!result.ok)
+            throw new Error('OpenClaw DPAPI credential decrypt failed');
+        return result.stdout;
+    }
+    store(bindingId, value) {
+        const script = [
+            'Add-Type -AssemblyName System.Security',
+            '$value=[Console]::In.ReadToEnd()',
+            '$bytes=[Text.Encoding]::UTF8.GetBytes($value)',
+            '$encrypted=[Security.Cryptography.ProtectedData]::Protect($bytes,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser)',
+            '[Console]::Out.Write([Convert]::ToBase64String($encrypted))',
+        ].join(';');
+        const result = run('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], value);
+        if (!result.ok || !result.stdout)
+            throw new Error('OpenClaw DPAPI credential encrypt failed');
+        atomicWrite(this.path(bindingId), result.stdout);
+    }
+    remove(bindingId) {
+        rmSync(this.path(bindingId), { force: true });
+    }
+}
+class MacKeychainBackend {
+    available() {
+        return process.platform === 'darwin' && run('security', ['help']).ok;
+    }
+    load(bindingId) {
+        const result = run('security', [
+            'find-generic-password', '-s', 'WinMatrix OpenClaw', '-a', bindingId, '-w',
+        ]);
+        return result.ok ? result.stdout : null;
+    }
+    store(bindingId, value) {
+        // -w 不跟参数，从 stdin 读取密码，避免 secret 出现在 argv（ps 可见）。
+        const result = run('security', [
+            'add-generic-password', '-U', '-s', 'WinMatrix OpenClaw', '-a', bindingId, '-w',
+        ], value);
+        if (!result.ok)
+            throw new Error('OpenClaw macOS Keychain credential write failed');
+    }
+    remove(bindingId) {
+        run('security', ['delete-generic-password', '-s', 'WinMatrix OpenClaw', '-a', bindingId]);
+    }
+}
+class LinuxSecretServiceBackend {
+    available() {
+        return process.platform === 'linux' && run('secret-tool', ['--version']).ok;
+    }
+    load(bindingId) {
+        const result = run('secret-tool', ['lookup', 'service', 'winmatrix-openclaw', 'binding', bindingId]);
+        return result.ok ? result.stdout : null;
+    }
+    store(bindingId, value) {
+        const result = run('secret-tool', [
+            'store', '--label=WinMatrix OpenClaw', 'service', 'winmatrix-openclaw', 'binding', bindingId,
+        ], value);
+        if (!result.ok)
+            throw new Error('OpenClaw Linux Secret Service credential write failed');
+    }
+    remove(bindingId) {
+        run('secret-tool', ['clear', 'service', 'winmatrix-openclaw', 'binding', bindingId]);
+    }
+}
+function defaultBackend(stateDir) {
+    if (process.platform === 'win32')
+        return new WindowsDpapiBackend(stateDir);
+    if (process.platform === 'darwin')
+        return new MacKeychainBackend();
+    return new LinuxSecretServiceBackend();
+}
+function parseRecord(raw, bindingId) {
+    if (!raw)
+        return null;
+    const value = JSON.parse(raw);
+    if (value.version !== 1 || value.bindingId !== bindingId || !value.deviceId
+        || !value.privateKeyPem || !value.publicKeyPem || !value.gatewayOrigin || !value.role) {
+        throw new Error('OpenClaw device binding record is invalid');
+    }
+    return value;
+}
+export class DaemonDeviceCredentialStore {
+    bindingId;
+    gatewayOrigin;
+    stateDir;
+    backend;
+    plaintextFallback;
+    constructor(options) {
+        assertBindingId(options.bindingId);
+        this.bindingId = options.bindingId;
+        this.gatewayOrigin = options.gatewayOrigin ?? deriveOrigin(options.gatewayUrl);
+        this.stateDir = options.stateDir ?? join(homedir(), '.winmatrix');
+        this.backend = options.secretBackend ?? defaultBackend(this.stateDir);
+        const backendAvailable = this.backend.available();
+        this.plaintextFallback = !backendAvailable
+            && process.env.WIN_OPENCLAW_ALLOW_PLAINTEXT_DEVICE_STORE === '1';
+        if (!backendAvailable && !this.plaintextFallback) {
+            throw new Error('OpenClaw secure credential store is unavailable');
+        }
+    }
+    plaintextPath() {
+        return join(this.stateDir, 'openclaw-device-bindings', `${this.bindingId}.json`);
+    }
+    loadRecord() {
+        if (this.plaintextFallback) {
+            const path = this.plaintextPath();
+            return parseRecord(existsSync(path) ? readFileSync(path, 'utf8') : null, this.bindingId);
+        }
+        return parseRecord(this.backend.load(this.bindingId), this.bindingId);
+    }
+    saveRecord(record) {
+        const serialized = JSON.stringify(record, null, 2);
+        if (this.plaintextFallback)
+            atomicWrite(this.plaintextPath(), serialized);
+        else
+            this.backend.store(this.bindingId, serialized);
+    }
+    loadOrCreateIdentity() {
+        const existing = this.loadRecord();
+        if (existing) {
+            return {
+                deviceId: existing.deviceId,
+                privateKeyPem: existing.privateKeyPem,
+                publicKeyPem: existing.publicKeyPem,
+            };
+        }
+        const pair = generateKeyPairSync('ed25519');
+        const privateKeyPem = pair.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+        const publicKeyPem = pair.publicKey.export({ type: 'spki', format: 'pem' }).toString();
+        const publicDer = createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
+        const deviceId = createHash('sha256').update(publicDer.subarray(publicDer.length - 32)).digest('hex');
+        const record = {
+            version: 1,
+            bindingId: this.bindingId,
+            gatewayOrigin: this.gatewayOrigin,
+            deviceId,
+            role: 'operator',
+            scopes: [],
+            status: 'unpaired',
+            privateKeyPem,
+            publicKeyPem,
+        };
+        this.saveRecord(record);
+        return { deviceId, privateKeyPem, publicKeyPem };
+    }
+    getStatus() {
+        this.loadOrCreateIdentity();
+        const record = this.loadRecord();
+        if (!record)
+            throw new Error('OpenClaw device binding record is unavailable');
+        return {
+            bindingId: record.bindingId,
+            gatewayOrigin: record.gatewayOrigin,
+            deviceId: record.deviceId,
+            role: record.role,
+            scopes: [...record.scopes],
+            status: record.status,
+            ...(record.requestId ? { requestId: record.requestId } : {}),
+            ...(record.reasonCode ? { reasonCode: record.reasonCode } : {}),
+        };
+    }
+    markBootstrapping() {
+        const identity = this.loadOrCreateIdentity();
+        const record = this.loadRecord();
+        if (!record || record.deviceId !== identity.deviceId)
+            return;
+        this.saveRecord({
+            ...record,
+            status: 'bootstrapping',
+            scopes: [],
+            requestId: undefined,
+            reasonCode: undefined,
+            deviceToken: undefined,
+        });
+    }
+    markPairingPending(requestId, reasonCode) {
+        const record = this.loadRecord();
+        if (!record)
+            throw new Error('OpenClaw device identity must exist before pairing');
+        this.saveRecord({
+            ...record,
+            status: 'pairing_pending',
+            scopes: [],
+            requestId,
+            ...(reasonCode ? { reasonCode } : { reasonCode: undefined }),
+            deviceToken: undefined,
+        });
+    }
+    markError(reasonCode) {
+        const record = this.loadRecord();
+        if (!record)
+            throw new Error('OpenClaw device identity must exist before recording an error');
+        this.saveRecord({
+            ...record,
+            status: 'error',
+            scopes: [],
+            reasonCode,
+            deviceToken: undefined,
+        });
+    }
+    loadToken(input) {
+        const record = this.loadRecord();
+        if (!record || record.status !== 'paired' || !record.deviceToken)
+            return null;
+        if (record.gatewayOrigin !== input.gatewayOrigin || record.deviceId !== input.deviceId || record.role !== input.role) {
+            return null;
+        }
+        return { token: record.deviceToken, scopes: [...record.scopes] };
+    }
+    storeToken(input) {
+        const record = this.loadRecord();
+        if (!record || record.gatewayOrigin !== input.gatewayOrigin || record.deviceId !== input.deviceId) {
+            throw new Error('OpenClaw DeviceToken does not match the local binding identity');
+        }
+        this.saveRecord({
+            ...record,
+            role: input.role,
+            scopes: [...input.scopes],
+            status: 'paired',
+            deviceToken: input.token,
+            requestId: undefined,
+            reasonCode: undefined,
+        });
+    }
+    clearToken(input) {
+        const record = this.loadRecord();
+        if (!record)
+            return;
+        if (record.gatewayOrigin !== input.gatewayOrigin || record.deviceId !== input.deviceId || record.role !== input.role) {
+            return;
+        }
+        const { deviceToken: _removed, ...withoutToken } = record;
+        this.saveRecord({ ...withoutToken, status: 'token_stale', scopes: [] });
+    }
+    markRevoked() {
+        const record = this.loadRecord();
+        if (!record)
+            return;
+        const { deviceToken: _removed, ...withoutToken } = record;
+        this.saveRecord({
+            ...withoutToken,
+            status: 'revoked',
+            scopes: [],
+            requestId: undefined,
+            reasonCode: 'DEVICE_TOKEN_REVOKED',
+        });
+    }
+}
+//# sourceMappingURL=DaemonDeviceCredentialStore.js.map

package/dist/core/DaemonDeviceCredentialStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DaemonDeviceCredentialStore.js","sourceRoot":"","sources":["../../src/core/DaemonDeviceCredentialStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AA0D/C,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB;IACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,KAAc;IAC1D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtC,KAAK;QACL,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;IAC5D,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3B,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB;IACM;IAA7B,YAA6B,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAI,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gCAAgC,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED,SAAS;QACP,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;eAC9B,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,iCAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG;YACb,wCAAwC;YACxC,kCAAkC;YAClC,4CAA4C;YAC5C,gIAAgI;YAChI,+DAA+D;SAChE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QACvG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,KAAa;QACpC,MAAM,MAAM,GAAG;YACb,wCAAwC;YACxC,kCAAkC;YAClC,+CAA+C;YAC/C,kIAAkI;YAClI,6DAA6D;SAC9D,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9F,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;CACF;AAED,MAAM,kBAAkB;IACtB,SAAS;QACP,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE;YAC7B,uBAAuB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;SAC3E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,KAAa;QACpC,kDAAkD;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,EAAE;YAC7B,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;SAChF,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC5F,CAAC;CACF;AAED,MAAM,yBAAyB;IAC7B,SAAS;QACP,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,CAAC,SAAiB;QACpB,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QACrG,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAiB,EAAE,KAAa;QACpC,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,EAAE;YAChC,OAAO,EAAE,4BAA4B,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS;SAC7F,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;CACF;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,kBAAkB,EAAE,CAAC;IACnE,OAAO,IAAI,yBAAyB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAkB,EAAE,SAAiB;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,QAAQ;WACtE,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAsB,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,2BAA2B;IAC7B,SAAS,CAAS;IACV,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,OAAO,CAAsB;IAC7B,iBAAiB,CAAU;IAE5C,YAAY,OAA2C;QACrD,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,CAAC,gBAAgB;eACrC,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,GAAG,CAAC;QACnE,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,EAAE,GAAG,IAAI,CAAC,SAAS,OAAO,CAAC,CAAC;IACnF,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,OAAO,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAEO,UAAU,CAAC,MAAqB;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,iBAAiB;YAAE,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,UAAU,CAAC,CAAC;;YACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED,oBAAoB;QAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,QAAQ,CAAC,YAAY;aACpC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvF,MAAM,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtG,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ;YACR,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU;YAClB,aAAa;YACb,YAAY;SACb,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;IAED,SAAS;QACP,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC9E,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;YAAE,OAAO;QAC7D,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,MAAM;YACT,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB,CAAC,SAAiB,EAAE,UAAmB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,MAAM;YACT,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,EAAE;YACV,SAAS;YACT,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;YAC5D,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,UAAkB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QAC9F,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,MAAM;YACT,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,EAAE;YACV,UAAU;YACV,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,KAIT;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9E,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACrH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,KAMV;QACC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClG,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,MAAM;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,KAAgE;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;YACrH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW;QACT,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC;YACd,GAAG,YAAY;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,EAAE;YACV,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/core/DaemonLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DaemonLifecycle.d.ts","sourceRoot":"","sources":["../../src/core/DaemonLifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsCH;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAOzC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC;AAqBD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAsBlD;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCrE;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CA2BxD"}
+{"version":3,"file":"DaemonLifecycle.d.ts","sourceRoot":"","sources":["../../src/core/DaemonLifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsCH;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAOzC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAWzC;AAqBD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAsBlD;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCrE;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAgCxD"}

package/dist/core/DaemonLifecycle.js

@@ -134,6 +134,11 @@ Usage:
   winmatrix-daemon setup [options]    Create ~/.winmatrix + write/merge daemon.json
   winmatrix-daemon restart [options]  SIGTERM old daemon (from pid file), start again with options
   winmatrix-daemon doctor claude      Resolve, verify, and persist Claude Code runtime
+  winmatrix-agent doctor openclaw --mode cli [--cli-path <path>]
+  winmatrix-agent doctor openclaw --mode gateway --binding <id> --gateway <wss-url>
+                                      Verify OpenClaw runtime or paired gateway connection
+  winmatrix-agent openclaw pair --binding <id> --gateway <url> --bootstrap-token-stdin
+                                      Pair a Host-owned OpenClaw DeviceToken
   winmatrix-daemon help               This help
 
 Options (setup / run / restart):

package/dist/core/DaemonLifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"DaemonLifecycle.js","sourceRoot":"","sources":["../../src/core/DaemonLifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,aAAa,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAmB;IAC1C,yBAAyB,EAAE,CAAC;IAC5B,IAAI,gBAAgB,EAAE,CAAC;IACvB,kBAAkB,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CACxC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAC3D,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,4BAA4B,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,WAAqB;IACpD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;YAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,wCAAwC,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE;QAC7D,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,mDAAmD,KAAK,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,aAAa,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;oDAsBsC,8BAA8B;;CAEjF,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"DaemonLifecycle.js","sourceRoot":"","sources":["../../src/core/DaemonLifecycle.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,YAAY,EACZ,cAAc,GACf,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACvD,MAAM,YAAY,GAAG,YAAY,CAAC;AAElC,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,aAAa,CAAC,cAAc,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,SAAS,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,UAAU,CAAC,cAAc,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,sBAAsB;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAmB;IAC1C,yBAAyB,EAAE,CAAC;IAC5B,IAAI,gBAAgB,EAAE,CAAC;IACvB,kBAAkB,EAAE,CAAC;IAErB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,wBAAwB,CACxC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAC3D,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEzE,4BAA4B,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,qHAAqH,CAAC,CAAC;IACrI,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,WAAqB;IACpD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;YAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM;gBACR,CAAC;gBACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,wCAAwC,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,sCAAsC,KAAK,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAC5F,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE;QAC7D,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,mDAAmD,KAAK,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,aAAqB;IAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,aAAa,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;oDA2BsC,8BAA8B;;CAEjF,CAAC,CAAC;AACH,CAAC"}

package/dist/core/OpenClawPairing.d.ts

@@ -0,0 +1,12 @@
+import { provisionGatewayDevice } from '@winmatrix/agent-sdk';
+import { DaemonDeviceCredentialStore, type DaemonDeviceCredentialStoreOptions } from './DaemonDeviceCredentialStore.js';
+type PairingStore = DaemonDeviceCredentialStore;
+export interface OpenClawPairCommandDependencies {
+    readBootstrapFromStdin?: () => Promise<string>;
+    createStore?: (options: DaemonDeviceCredentialStoreOptions) => PairingStore;
+    provision?: typeof provisionGatewayDevice;
+    writeLine?: (line: string) => void;
+}
+export declare function runOpenClawPairCommand(argv: string[], dependencies?: OpenClawPairCommandDependencies): Promise<number>;
+export {};
+//# sourceMappingURL=OpenClawPairing.d.ts.map

package/dist/core/OpenClawPairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenClawPairing.d.ts","sourceRoot":"","sources":["../../src/core/OpenClawPairing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EAGvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,kCAAkC,EACxC,MAAM,kCAAkC,CAAC;AAS1C,KAAK,YAAY,GAAG,2BAA2B,CAAC;AAEhD,MAAM,WAAW,+BAA+B;IAC9C,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,kCAAkC,KAAK,YAAY,CAAC;IAC5E,SAAS,CAAC,EAAE,OAAO,sBAAsB,CAAC;IAC1C,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AA+DD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,GAAE,+BAAoC,GACjD,OAAO,CAAC,MAAM,CAAC,CAkDjB"}

package/dist/core/OpenClawPairing.js

@@ -0,0 +1,114 @@
+import { provisionGatewayDevice, } from '@winmatrix/agent-sdk';
+import { DaemonDeviceCredentialStore, } from './DaemonDeviceCredentialStore.js';
+function readOption(argv, name) {
+    const index = argv.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = argv[index + 1];
+    return value && !value.startsWith('--') ? value : undefined;
+}
+function parsePairOptions(argv) {
+    if (argv.includes('--bootstrap-token') || !argv.includes('--bootstrap-token-stdin'))
+        return undefined;
+    const bindingId = readOption(argv, '--binding');
+    const gatewayUrl = readOption(argv, '--gateway');
+    if (!bindingId || !gatewayUrl)
+        return undefined;
+    return {
+        bindingId,
+        gatewayUrl,
+        ...(readOption(argv, '--origin') ? { gatewayOrigin: readOption(argv, '--origin') } : {}),
+        ...(readOption(argv, '--tls-fingerprint')
+            ? { tlsFingerprint: readOption(argv, '--tls-fingerprint') }
+            : {}),
+    };
+}
+function isLoopback(hostname) {
+    return hostname === '127.0.0.1' || hostname === 'localhost' || hostname === '::1';
+}
+function validatePairingUrl(value) {
+    const url = new URL(value);
+    if (!isLoopback(url.hostname) && url.protocol !== 'wss:') {
+        throw new Error('non-loopback OpenClaw pairing requires wss://');
+    }
+    if (url.protocol !== 'ws:' && url.protocol !== 'wss:') {
+        throw new Error('OpenClaw pairing Gateway URL must use ws:// or wss://');
+    }
+    return url;
+}
+async function readStdinSecret() {
+    process.stdin.setEncoding('utf8');
+    let value = '';
+    for await (const chunk of process.stdin) {
+        value += chunk;
+        if (value.length > 16_384)
+            throw new Error('bootstrap credential exceeds 16 KiB');
+    }
+    return value.trim();
+}
+function printResult(result, writeLine) {
+    if (result.status === 'paired') {
+        writeLine(`[daemon] OpenClaw device paired: deviceId=${result.deviceId} role=${result.role} scopes=${result.scopes.join(',')}`);
+        return 0;
+    }
+    if (result.status === 'pairing_pending') {
+        writeLine(`[daemon] OpenClaw pairing pending: requestId=${result.requestId} deviceId=${result.deviceId}`);
+        writeLine('[daemon] Approve this exact request on the Gateway host, then rerun the same command.');
+        return 2;
+    }
+    writeLine(`[daemon] OpenClaw pairing failed: ${result.reasonCode}`);
+    return 1;
+}
+export async function runOpenClawPairCommand(argv, dependencies = {}) {
+    const writeLine = dependencies.writeLine ?? ((line) => console.log(line));
+    const parsed = parsePairOptions(argv);
+    if (!parsed) {
+        writeLine('[daemon] Usage: winmatrix-agent openclaw pair --binding <id> --gateway <url> --bootstrap-token-stdin [--origin <origin>] [--tls-fingerprint <sha256>]');
+        return 1;
+    }
+    try {
+        validatePairingUrl(parsed.gatewayUrl);
+        let bootstrap = await (dependencies.readBootstrapFromStdin ?? readStdinSecret)();
+        if (!bootstrap) {
+            writeLine('[daemon] OpenClaw pairing failed: bootstrap credential missing on stdin');
+            return 1;
+        }
+        const store = (dependencies.createStore ?? ((options) => new DaemonDeviceCredentialStore(options)))({
+            bindingId: parsed.bindingId,
+            gatewayUrl: parsed.gatewayUrl,
+            ...(parsed.gatewayOrigin ? { gatewayOrigin: parsed.gatewayOrigin } : {}),
+        });
+        store.markBootstrapping();
+        const provider = {
+            readOnce: async () => {
+                const value = bootstrap;
+                bootstrap = '';
+                return value;
+            },
+            clear: async () => {
+                bootstrap = '';
+            },
+        };
+        const result = await (dependencies.provision ?? provisionGatewayDevice)({
+            gatewayUrl: parsed.gatewayUrl,
+            gatewayOrigin: parsed.gatewayOrigin
+                ?? `${new URL(parsed.gatewayUrl).protocol === 'wss:' ? 'https:' : 'http:'}//${new URL(parsed.gatewayUrl).host}`,
+            ...(parsed.tlsFingerprint ? { gatewayTlsFingerprint: parsed.tlsFingerprint } : {}),
+            deviceAuthStore: store,
+            bootstrapProvider: provider,
+        });
+        if (result.status === 'pairing_pending') {
+            store.markPairingPending(result.requestId, result.reason);
+        }
+        else if (result.status === 'error') {
+            store.markError(result.reasonCode);
+        }
+        return printResult(result, writeLine);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'unknown error';
+        writeLine(`[daemon] OpenClaw pairing failed: ${message.replace(/token\s*[=:]\s*\S+/gi, 'token=[REDACTED]')}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=OpenClawPairing.js.map

package/dist/core/OpenClawPairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenClawPairing.js","sourceRoot":"","sources":["../../src/core/OpenClawPairing.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,GAGvB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,2BAA2B,GAE5B,MAAM,kCAAkC,CAAC;AAkB1C,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,SAAS,CAAC;IACtG,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO;QACL,SAAS;QACT,UAAU;QACV,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC;YACvC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAAC;AACpF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACxC,KAAK,IAAI,KAAK,CAAC;QACf,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,MAAiC,EAAE,SAAiC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,SAAS,CAAC,6CAA6C,MAAM,CAAC,QAAQ,SAAS,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChI,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,SAAS,CAAC,gDAAgD,MAAM,CAAC,SAAS,aAAa,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1G,SAAS,CAAC,uFAAuF,CAAC,CAAC;QACnG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,SAAS,CAAC,qCAAqC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAc,EACd,eAAgD,EAAE;IAElD,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,SAAS,CAAC,uJAAuJ,CAAC,CAAC;QACnK,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC;QACH,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACtC,IAAI,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,sBAAsB,IAAI,eAAe,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,SAAS,CAAC,yEAAyE,CAAC,CAAC;YACrF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,WAAW,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClG,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QACH,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAoC;YAChD,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,KAAK,GAAG,SAAS,CAAC;gBACxB,SAAS,GAAG,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,EAAE,KAAK,IAAI,EAAE;gBAChB,SAAS,GAAG,EAAE,CAAC;YACjB,CAAC;SACF,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,IAAI,sBAAsB,CAAC,CAAC;YACtE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;mBAC9B,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;YACjH,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,eAAe,EAAE,KAAK;YACtB,iBAAiB,EAAE,QAAQ;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACrC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,SAAS,CAAC,qCAAqC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/core/RuntimeDoctor.d.ts

@@ -1,13 +1,27 @@
-import { type ClaudeRuntimeDoctorResult, type Runtime } from '@winmatrix/agent-sdk';
+import { OpenClawAdapter, type ClaudeRuntimeDoctorResult, type GatewayDeviceAuthStore, type Runtime } from '@winmatrix/agent-sdk';
 import { type DaemonRuntimeEntry } from './ConfigLoader.js';
+import { type DaemonDeviceCredentialStoreOptions } from './DaemonDeviceCredentialStore.js';
 export interface RuntimeDoctorSummary {
     runtimes: Runtime[];
     claude: ClaudeRuntimeDoctorResult;
 }
+export interface OpenClawRuntimeDoctorResult {
+    mode: 'cli' | 'gateway';
+    available: boolean;
+    version?: string;
+    error?: string;
+}
+interface OpenClawRuntimeDoctorDependencies {
+    createStore?: (options: DaemonDeviceCredentialStoreOptions) => GatewayDeviceAuthStore;
+    createAdapter?: (config: Record<string, unknown>) => Pick<OpenClawAdapter, 'healthCheck'>;
+}
+export declare function runOpenClawRuntimeDoctor(argv: string[], dependencies?: OpenClawRuntimeDoctorDependencies): Promise<OpenClawRuntimeDoctorResult>;
+export declare function formatOpenClawDoctorLines(result: OpenClawRuntimeDoctorResult): string[];
 export declare function daemonRuntimeEntryFromClaudeDoctor(result: ClaudeRuntimeDoctorResult): DaemonRuntimeEntry;
 export declare function adapterClaudePathFromRuntimeEntry(runtime: Pick<DaemonRuntimeEntry, 'available' | 'resolvedPath' | 'command'> | undefined): string | undefined;
 export declare function runDaemonRuntimeDoctor(options?: {
     persist?: boolean;
 }): Promise<RuntimeDoctorSummary>;
 export declare function formatClaudeDoctorLines(result: ClaudeRuntimeDoctorResult): string[];
+export {};
 //# sourceMappingURL=RuntimeDoctor.d.ts.map

package/dist/core/RuntimeDoctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RuntimeDoctor.d.ts","sourceRoot":"","sources":["../../src/core/RuntimeDoctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,yBAAyB,EAC9B,KAAK,OAAO,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,yBAAyB,CAAC;CACnC;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,yBAAyB,GAChC,kBAAkB,CAYpB;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAAC,GAAG,SAAS,GACtF,MAAM,GAAG,SAAS,CAKpB;AAsBD,wBAAsB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6B3G;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAqBnF"}
+{"version":3,"file":"RuntimeDoctor.d.ts","sourceRoot":"","sources":["../../src/core/RuntimeDoctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,eAAe,EACf,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,OAAO,EACb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,kCAAkC,EACxC,MAAM,kCAAkC,CAAC;AAE1C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,yBAAyB,CAAC;CACnC;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,iCAAiC;IACzC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,kCAAkC,KAAK,sBAAsB,CAAC;IACtF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;CAC3F;AASD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EAAE,EACd,YAAY,GAAE,iCAAsC,GACnD,OAAO,CAAC,2BAA2B,CAAC,CAiDtC;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,2BAA2B,GAAG,MAAM,EAAE,CAMvF;AAED,wBAAgB,kCAAkC,CAChD,MAAM,EAAE,yBAAyB,GAChC,kBAAkB,CAYpB;AAED,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAAC,GAAG,SAAS,GACtF,MAAM,GAAG,SAAS,CAKpB;AAsBD,wBAAsB,sBAAsB,CAAC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6B3G;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,EAAE,CAqBnF"}

package/dist/core/RuntimeDoctor.js

@@ -1,5 +1,72 @@
 import { detectRuntimes, runClaudeRuntimeDoctor, OpenClawAdapter, } from '@winmatrix/agent-sdk';
 import { persistDaemonRuntimeToDisk, } from './ConfigLoader.js';
+import { DaemonDeviceCredentialStore, } from './DaemonDeviceCredentialStore.js';
+function readOption(argv, name) {
+    const index = argv.indexOf(name);
+    if (index < 0)
+        return undefined;
+    const value = argv[index + 1];
+    return value && !value.startsWith('--') ? value : undefined;
+}
+export async function runOpenClawRuntimeDoctor(argv, dependencies = {}) {
+    const mode = readOption(argv, '--mode') === 'gateway' ? 'gateway' : 'cli';
+    const createAdapter = dependencies.createAdapter ?? ((config) => new OpenClawAdapter(config));
+    try {
+        let config;
+        if (mode === 'gateway') {
+            const bindingId = readOption(argv, '--binding');
+            const gatewayUrl = readOption(argv, '--gateway');
+            if (!bindingId || !gatewayUrl) {
+                return { mode, available: false, error: 'gateway doctor requires --binding and --gateway' };
+            }
+            const gatewayOrigin = readOption(argv, '--origin');
+            const createStore = dependencies.createStore
+                ?? ((options) => new DaemonDeviceCredentialStore(options));
+            const deviceAuthStore = createStore({
+                bindingId,
+                gatewayUrl,
+                ...(gatewayOrigin ? { gatewayOrigin } : {}),
+            });
+            config = {
+                mode,
+                hostKind: 'external_computer',
+                gatewayUrl,
+                ...(gatewayOrigin ? { gatewayOrigin } : {}),
+                ...(readOption(argv, '--tls-fingerprint')
+                    ? { gatewayTlsFingerprint: readOption(argv, '--tls-fingerprint') }
+                    : {}),
+                deviceAuthStore,
+            };
+        }
+        else {
+            config = {
+                mode,
+                ...(readOption(argv, '--cli-path') ? { openclawPath: readOption(argv, '--cli-path') } : {}),
+            };
+        }
+        const health = await createAdapter(config).healthCheck();
+        return {
+            mode,
+            available: health.available,
+            ...(health.version ? { version: health.version } : {}),
+            ...(health.error ? { error: health.error } : {}),
+        };
+    }
+    catch (error) {
+        return {
+            mode,
+            available: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
+export function formatOpenClawDoctorLines(result) {
+    return [
+        `[daemon] doctor openclaw (${result.mode}): ${result.available ? 'available' : 'unavailable'}`,
+        ...(result.version ? [`[daemon]   version: ${result.version}`] : []),
+        ...(result.error ? [`[daemon]   error: ${result.error}`] : []),
+    ];
+}
 export function daemonRuntimeEntryFromClaudeDoctor(result) {
     return {
         available: result.available,