agent-relay 3.1.5 → 3.1.7

package/dist/index.cjs

@@ -9455,7 +9455,8 @@ function isExplicitPath(binaryPath) {
 function detectPlatformSuffix() {
   const platformMap = {
     darwin: { arm64: "darwin-arm64", x64: "darwin-x64" },
-    linux: { arm64: "linux-arm64", x64: "linux-x64" }
+    linux: { arm64: "linux-arm64", x64: "linux-x64" },
+    win32: { x64: "win32-x64" }
   };
   return platformMap[process.platform]?.[process.arch] ?? null;
 }
@@ -9527,15 +9528,12 @@ function resolveDefaultBinaryPath() {
   const binDir = import_node_path.default.resolve(moduleDir, "..", "bin");
   const suffix = detectPlatformSuffix();
   if (suffix) {
-    const platformBinary = import_node_path.default.join(binDir, `agent-relay-broker-${suffix}`);
+    const ext = process.platform === "win32" ? ".exe" : "";
+    const platformBinary = import_node_path.default.join(binDir, `agent-relay-broker-${suffix}${ext}`);
     if (import_node_fs.default.existsSync(platformBinary)) {
       return platformBinary;
     }
   }
-  const bundled = import_node_path.default.join(binDir, brokerExe);
-  if (import_node_fs.default.existsSync(bundled)) {
-    return bundled;
-  }
   const homeDir = process.env.HOME || process.env.USERPROFILE || "";
   const standaloneBroker = import_node_path.default.join(homeDir, ".agent-relay", "bin", brokerExe);
   if (import_node_fs.default.existsSync(standaloneBroker)) {
@@ -47575,6 +47573,7 @@ var WorkflowRunner = class _WorkflowRunner {
   relayOptions;
   cwd;
   summaryDir;
+  executor;
   /** @internal exposed for CLI signal-handler shutdown only */
   relay;
   relaycast;
@@ -47618,6 +47617,7 @@ var WorkflowRunner = class _WorkflowRunner {
     this.cwd = options.cwd ?? process.cwd();
     this.summaryDir = options.summaryDir ?? import_node_path8.default.join(this.cwd, ".relay", "summaries");
     this.workersPath = import_node_path8.default.join(this.cwd, ".agent-relay", "team", "workers.json");
+    this.executor = options.executor;
   }
   // ── Progress logging ────────────────────────────────────────────────────
   /** Log a progress message with elapsed time since run start. */
@@ -48351,109 +48351,111 @@ ${err.suggestion}`);
         config3.swarm.channel = channel;
         await this.db.updateRun(runId, { config: config3 });
       }
-      this.log("Resolving Relaycast API key...");
-      await this.ensureRelaycastApiKey(channel);
-      this.log("API key resolved");
-      if (this.relayApiKeyAutoCreated && this.relayApiKey) {
-        this.log(`Workspace created \u2014 follow this run in Relaycast:`);
-        this.log(`  Observer: https://observer.relaycast.dev/?key=${this.relayApiKey}`);
-        this.log(`  Channel: ${channel}`);
-      }
-      this.log("Starting broker...");
-      const brokerBaseName = import_node_path8.default.basename(this.cwd) || "workflow";
-      const brokerName = `${brokerBaseName}-${runId.slice(0, 8)}`;
-      this.relay = new AgentRelay({
-        ...this.relayOptions,
-        brokerName,
-        channels: [channel],
-        env: this.getRelayEnv(),
-        // Workflows spawn agents across multiple waves; each spawn requires a PTY +
-        // Relaycast registration. 60s is too tight when the broker is saturated with
-        // long-running PTY processes from earlier steps. 120s gives room to breathe.
-        requestTimeoutMs: this.relayOptions.requestTimeoutMs ?? 12e4
-      });
-      this.relay.onWorkerOutput = ({ name, chunk }) => {
-        const listener = this.ptyListeners.get(name);
-        if (listener)
-          listener(chunk);
-        const stripped = _WorkflowRunner.stripAnsi(chunk);
-        const shortName = name.replace(/-[a-f0-9]{6,}$/, "");
-        let activity;
-        if (/Read\(/.test(stripped)) {
-          const m = stripped.match(/Read\(\s*~?([^\s)"']{8,})/);
-          if (m) {
-            const base = import_node_path8.default.basename(m[1]);
-            activity = base.length >= 3 ? `Reading ${base}` : "Reading file...";
-          } else {
-            activity = "Reading file...";
+      if (!this.executor) {
+        this.log("Resolving Relaycast API key...");
+        await this.ensureRelaycastApiKey(channel);
+        this.log("API key resolved");
+        if (this.relayApiKeyAutoCreated && this.relayApiKey) {
+          this.log(`Workspace created \u2014 follow this run in Relaycast:`);
+          this.log(`  Observer: https://observer.relaycast.dev/?key=${this.relayApiKey}`);
+          this.log(`  Channel: ${channel}`);
+        }
+        this.log("Starting broker...");
+        const brokerBaseName = import_node_path8.default.basename(this.cwd) || "workflow";
+        const brokerName = `${brokerBaseName}-${runId.slice(0, 8)}`;
+        this.relay = new AgentRelay({
+          ...this.relayOptions,
+          brokerName,
+          channels: [channel],
+          env: this.getRelayEnv(),
+          // Workflows spawn agents across multiple waves; each spawn requires a PTY +
+          // Relaycast registration. 60s is too tight when the broker is saturated with
+          // long-running PTY processes from earlier steps. 120s gives room to breathe.
+          requestTimeoutMs: this.relayOptions.requestTimeoutMs ?? 12e4
+        });
+        this.relay.onWorkerOutput = ({ name, chunk }) => {
+          const listener = this.ptyListeners.get(name);
+          if (listener)
+            listener(chunk);
+          const stripped = _WorkflowRunner.stripAnsi(chunk);
+          const shortName = name.replace(/-[a-f0-9]{6,}$/, "");
+          let activity;
+          if (/Read\(/.test(stripped)) {
+            const m = stripped.match(/Read\(\s*~?([^\s)"']{8,})/);
+            if (m) {
+              const base = import_node_path8.default.basename(m[1]);
+              activity = base.length >= 3 ? `Reading ${base}` : "Reading file...";
+            } else {
+              activity = "Reading file...";
+            }
+          } else if (/Edit\(/.test(stripped)) {
+            const m = stripped.match(/Edit\(\s*~?([^\s)"']{8,})/);
+            if (m) {
+              const base = import_node_path8.default.basename(m[1]);
+              activity = base.length >= 3 ? `Editing ${base}` : "Editing file...";
+            } else {
+              activity = "Editing file...";
+            }
+          } else if (/Bash\(/.test(stripped)) {
+            const m = stripped.match(/Bash\(\s*(.{1,40})/);
+            activity = m ? `Running: ${m[1].trim()}...` : "Running command...";
+          } else if (/Explore\(/.test(stripped)) {
+            const m = stripped.match(/Explore\(\s*(.{1,50})/);
+            activity = m ? `Exploring: ${m[1].replace(/\).*/, "").trim()}` : "Exploring codebase...";
+          } else if (/Task\(/.test(stripped)) {
+            activity = "Running sub-agent...";
+          } else if (/Sublimating|Thinking|Coalescing|Cultivating/.test(stripped)) {
+            const m = stripped.match(/(\d+)s/);
+            activity = m ? `Thinking... (${m[1]}s)` : "Thinking...";
           }
-        } else if (/Edit\(/.test(stripped)) {
-          const m = stripped.match(/Edit\(\s*~?([^\s)"']{8,})/);
-          if (m) {
-            const base = import_node_path8.default.basename(m[1]);
-            activity = base.length >= 3 ? `Editing ${base}` : "Editing file...";
-          } else {
-            activity = "Editing file...";
+          if (activity && this.lastActivity.get(name) !== activity) {
+            this.lastActivity.set(name, activity);
+            this.log(`[${shortName}] ${activity}`);
           }
-        } else if (/Bash\(/.test(stripped)) {
-          const m = stripped.match(/Bash\(\s*(.{1,40})/);
-          activity = m ? `Running: ${m[1].trim()}...` : "Running command...";
-        } else if (/Explore\(/.test(stripped)) {
-          const m = stripped.match(/Explore\(\s*(.{1,50})/);
-          activity = m ? `Exploring: ${m[1].replace(/\).*/, "").trim()}` : "Exploring codebase...";
-        } else if (/Task\(/.test(stripped)) {
-          activity = "Running sub-agent...";
-        } else if (/Sublimating|Thinking|Coalescing|Cultivating/.test(stripped)) {
-          const m = stripped.match(/(\d+)s/);
-          activity = m ? `Thinking... (${m[1]}s)` : "Thinking...";
-        }
-        if (activity && this.lastActivity.get(name) !== activity) {
-          this.lastActivity.set(name, activity);
-          this.log(`[${shortName}] ${activity}`);
-        }
-      };
-      this.relay.onMessageReceived = (msg) => {
-        const body = msg.text.length > 120 ? msg.text.slice(0, 117) + "..." : msg.text;
-        const fromShort = msg.from.replace(/-[a-f0-9]{6,}$/, "");
-        const toShort = msg.to.replace(/-[a-f0-9]{6,}$/, "");
-        this.log(`[msg] ${fromShort} \u2192 ${toShort}: ${body}`);
-      };
-      this.relay.onAgentSpawned = (agent) => {
-        if (!this.activeAgentHandles.has(agent.name)) {
-          this.log(`[spawned] ${agent.name} (${agent.runtime})`);
-        }
-      };
-      this.relay.onAgentExited = (agent) => {
-        this.lastActivity.delete(agent.name);
-        this.lastIdleLog.delete(agent.name);
-        if (!this.activeAgentHandles.has(agent.name)) {
-          this.log(`[exited] ${agent.name} (code: ${agent.exitCode ?? "?"})`);
+        };
+        this.relay.onMessageReceived = (msg) => {
+          const body = msg.text.length > 120 ? msg.text.slice(0, 117) + "..." : msg.text;
+          const fromShort = msg.from.replace(/-[a-f0-9]{6,}$/, "");
+          const toShort = msg.to.replace(/-[a-f0-9]{6,}$/, "");
+          this.log(`[msg] ${fromShort} \u2192 ${toShort}: ${body}`);
+        };
+        this.relay.onAgentSpawned = (agent) => {
+          if (!this.activeAgentHandles.has(agent.name)) {
+            this.log(`[spawned] ${agent.name} (${agent.runtime})`);
+          }
+        };
+        this.relay.onAgentExited = (agent) => {
+          this.lastActivity.delete(agent.name);
+          this.lastIdleLog.delete(agent.name);
+          if (!this.activeAgentHandles.has(agent.name)) {
+            this.log(`[exited] ${agent.name} (code: ${agent.exitCode ?? "?"})`);
+          }
+        };
+        this.relay.onAgentIdle = ({ name, idleSecs }) => {
+          const bucket = Math.floor(idleSecs / 30) * 30;
+          if (bucket >= 30 && this.lastIdleLog.get(name) !== bucket) {
+            this.lastIdleLog.set(name, bucket);
+            const shortName = name.replace(/-[a-f0-9]{6,}$/, "");
+            this.log(`[idle] ${shortName} silent for ${bucket}s`);
+          }
+        };
+        this.relaycast = void 0;
+        this.relaycastAgent = void 0;
+        this.unsubBrokerStderr = this.relay.onBrokerStderr((line) => {
+          console.log(`[broker] ${line}`);
+        });
+        this.log(`Creating channel: ${channel}...`);
+        if (isResume) {
+          await this.createAndJoinRelaycastChannel(channel);
+        } else {
+          await this.createAndJoinRelaycastChannel(channel, workflow2.description);
         }
-      };
-      this.relay.onAgentIdle = ({ name, idleSecs }) => {
-        const bucket = Math.floor(idleSecs / 30) * 30;
-        if (bucket >= 30 && this.lastIdleLog.get(name) !== bucket) {
-          this.lastIdleLog.set(name, bucket);
-          const shortName = name.replace(/-[a-f0-9]{6,}$/, "");
-          this.log(`[idle] ${shortName} silent for ${bucket}s`);
+        this.log("Channel ready");
+        if (isResume) {
+          this.postToChannel(`Workflow **${workflow2.name}** resumed \u2014 ${pendingCount} pending steps`);
+        } else {
+          this.postToChannel(`Workflow **${workflow2.name}** started \u2014 ${workflow2.steps.length} steps, pattern: ${config3.swarm.pattern}`);
         }
-      };
-      this.relaycast = void 0;
-      this.relaycastAgent = void 0;
-      this.unsubBrokerStderr = this.relay.onBrokerStderr((line) => {
-        console.log(`[broker] ${line}`);
-      });
-      this.log(`Creating channel: ${channel}...`);
-      if (isResume) {
-        await this.createAndJoinRelaycastChannel(channel);
-      } else {
-        await this.createAndJoinRelaycastChannel(channel, workflow2.description);
-      }
-      this.log("Channel ready");
-      if (isResume) {
-        this.postToChannel(`Workflow **${workflow2.name}** resumed \u2014 ${pendingCount} pending steps`);
-      } else {
-        this.postToChannel(`Workflow **${workflow2.name}** started \u2014 ${workflow2.steps.length} steps, pattern: ${config3.swarm.pattern}`);
       }
       const agentMap = /* @__PURE__ */ new Map();
       for (const agent of config3.agents) {
@@ -48768,6 +48770,26 @@ ${trimmedOutput.slice(0, 200)}`);
       return value !== void 0 ? String(value) : _match;
     });
     try {
+      if (this.executor?.executeDeterministicStep) {
+        const result = await this.executor.executeDeterministicStep(step, resolvedCommand, this.cwd);
+        const failOnError = step.failOnError !== false;
+        if (failOnError && result.exitCode !== 0) {
+          throw new Error(`Command failed with exit code ${result.exitCode}: ${result.output.slice(0, 500)}`);
+        }
+        const output2 = step.captureOutput !== false ? result.output : `Command completed (exit code ${result.exitCode})`;
+        state.row.status = "completed";
+        state.row.output = output2;
+        state.row.completedAt = (/* @__PURE__ */ new Date()).toISOString();
+        await this.db.updateStep(state.row.id, {
+          status: "completed",
+          output: output2,
+          completedAt: state.row.completedAt,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        await this.persistStepOutput(runId, step.name, output2);
+        this.emit({ type: "step:completed", runId, stepName: step.name, output: output2 });
+        return;
+      }
       const output = await new Promise((resolve3, reject) => {
         const child = (0, import_node_child_process3.spawn)("sh", ["-c", resolvedCommand], {
           stdio: "pipe",
@@ -49041,7 +49063,7 @@ ${trimmedOutput.slice(0, 200)}`);
         }
         this.log(`[${step.name}] Spawning agent "${agentDef.name}" (cli: ${agentDef.cli})`);
         const resolvedStep = { ...step, task: resolvedTask };
-        const output = await this.spawnAndWait(agentDef, resolvedStep, timeoutMs);
+        const output = this.executor ? await this.executor.executeAgentStep(resolvedStep, agentDef, resolvedTask, timeoutMs) : await this.spawnAndWait(agentDef, resolvedStep, timeoutMs);
         this.log(`[${step.name}] Agent "${agentDef.name}" exited`);
         if (step.verification) {
           this.runVerification(step.verification, output, step.name, resolvedTask);
@@ -50334,7 +50356,8 @@ var WorkflowBuilder = class {
     const config3 = this.toConfig();
     const runner = new WorkflowRunner({
       cwd: options.cwd,
-      relay: options.relay
+      relay: options.relay,
+      executor: options.executor
     });
     const isDryRun = options.dryRun ?? !!process.env.DRY_RUN;
     if (isDryRun) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "description": "Real-time agent-to-agent communication system",
   "type": "module",
   "main": "dist/index.cjs",
@@ -174,13 +174,13 @@
   },
   "homepage": "https://github.com/AgentWorkforce/relay#readme",
   "dependencies": {
-    "@agent-relay/config": "3.1.5",
-    "@agent-relay/hooks": "3.1.5",
-    "@agent-relay/sdk": "3.1.5",
-    "@agent-relay/telemetry": "3.1.5",
-    "@agent-relay/trajectory": "3.1.5",
-    "@agent-relay/user-directory": "3.1.5",
-    "@agent-relay/utils": "3.1.5",
+    "@agent-relay/config": "3.1.7",
+    "@agent-relay/hooks": "3.1.7",
+    "@agent-relay/sdk": "3.1.7",
+    "@agent-relay/telemetry": "3.1.7",
+    "@agent-relay/trajectory": "3.1.7",
+    "@agent-relay/user-directory": "3.1.7",
+    "@agent-relay/utils": "3.1.7",
     "@modelcontextprotocol/sdk": "^1.0.0",
     "@relaycast/sdk": "^0.4.0",
     "chokidar": "^5.0.0",

package/packages/acp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/acp-bridge",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "description": "ACP (Agent Client Protocol) bridge for Agent Relay - expose relay agents to ACP-compatible editors like Zed",
   "type": "module",
   "main": "dist/index.js",
@@ -46,7 +46,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agent-relay/sdk": "3.1.5",
+    "@agent-relay/sdk": "3.1.7",
     "@agentclientprotocol/sdk": "^0.12.0"
   },
   "devDependencies": {

package/packages/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/config",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "description": "Shared configuration schemas and loaders for Agent Relay",
   "type": "module",
   "main": "dist/index.js",

package/packages/hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/hooks",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "description": "Hook emitter, registry, and trajectory hooks for Agent Relay",
   "type": "module",
   "main": "dist/index.js",
@@ -37,9 +37,9 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/config": "3.1.5",
-    "@agent-relay/trajectory": "3.1.5",
-    "@agent-relay/sdk": "3.1.5"
+    "@agent-relay/config": "3.1.7",
+    "@agent-relay/trajectory": "3.1.7",
+    "@agent-relay/sdk": "3.1.7"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/memory",
-  "version": "3.1.5",
+  "version": "3.1.7",
   "description": "Semantic memory storage and retrieval system for agent-relay with multiple backend support",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/hooks": "3.1.5"
+    "@agent-relay/hooks": "3.1.7"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/openclaw/dist/gateway.d.ts

@@ -1,3 +1,4 @@
+import { type KeyObject } from 'node:crypto';
 import type { SendMessageInput } from '@agent-relay/sdk';
 import { type GatewayConfig } from './types.js';
 /**
@@ -21,6 +22,11 @@ export interface GatewayOptions {
      */
     relaySender?: RelaySender;
 }
+interface DeviceIdentity {
+    publicKeyB64: string;
+    privateKeyObj: KeyObject;
+    deviceId: string;
+}
 /** @internal */
 export declare class OpenClawGatewayClient {
     private ws;
@@ -43,7 +49,15 @@ export declare class OpenClawGatewayClient {
     private static readonly MAX_CONSECUTIVE_FAILURES;
     private static readonly BASE_RECONNECT_MS;
     private static readonly MAX_RECONNECT_MS;
-    constructor(token: string, port: number);
+    /** Slow retry interval after pairing rejection or max failures (60s). */
+    private static readonly PAIRING_RETRY_MS;
+    constructor(token: string, port: number, device?: DeviceIdentity);
+    /**
+     * Create a client with a persisted device identity (loaded from disk or
+     * freshly generated and saved). This ensures the same device ID is reused
+     * across restarts so the OpenClaw gateway can pair it once.
+     */
+    static create(token: string, port: number): Promise<OpenClawGatewayClient>;
     /** Connect and authenticate. Resolves when chat.send is ready, rejects on timeout or error. */
     connect(): Promise<void>;
     private clearConnectTimeout;
@@ -99,4 +113,5 @@ export declare class InboundGateway {
     private startControlServer;
     private handleControlRequest;
 }
+export {};
 //# sourceMappingURL=gateway.d.ts.map

package/packages/openclaw/dist/gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAazD,OAAO,EAAiC,KAAK,aAAa,EAA4C,MAAM,YAAY,CAAC;AAIzH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,cAAc;IAC7B,6BAA6B;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AA8ED,gBAAgB;AAChB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,mBAAmB,CAAK;IAEhC,2DAA2D;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAK;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;gBAEtC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IAMvC,+FAA+F;IACzF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC9B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,SAAS;IA+DjB,OAAO,CAAC,aAAa;IA4HrB,sDAAsD;IAChD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyC9E,OAAO,CAAC,iBAAiB;IAsBnB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAqBlC;AAMD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,mBAAmB,CAAyB;IACpD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAsC;IAE5D,6FAA6F;IAC7F,OAAO,CAAC,YAAY,CAAe;IACnC,2DAA2D;IAC3D,OAAO,CAAC,aAAa,CAA2B;IAChD,0CAA0C;IAC1C,WAAW,SAAK;IAEhB,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,SAAS;gBAEjC,OAAO,EAAE,cAAc;IAoBnC,4EAA4E;IACtE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkH5B,+DAA+D;IACzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,QAAQ;YAMF,uBAAuB;YAiBvB,qBAAqB;YAkBrB,yBAAyB;YAmBzB,gBAAgB;YAiBhB,qBAAqB;YAiBrB,qBAAqB;YAyBrB,sBAAsB;YAwBtB,aAAa;IAyB3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAe1B,2CAA2C;YAC7B,SAAS;IAwBvB,oEAAoE;YACtD,qBAAqB;YA0BrB,kBAAkB;YAqBlB,oBAAoB;CA0GnC"}
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAKtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAczD,OAAO,EAAiC,KAAK,aAAa,EAA4C,MAAM,YAAY,CAAC;AAIzH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,cAAc;IAC7B,6BAA6B;IAC7B,MAAM,EAAE,aAAa,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAUD,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,SAAS,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkID,gBAAgB;AAChB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAA8B;IACpD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,aAAa,CAAyC;IAC9D,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,mBAAmB,CAAK;IAEhC,2DAA2D;IAC3D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAK;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAClD,yEAAyE;IACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;gBAEtC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,cAAc;IAMhE;;;;OAIG;WACU,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAKhF,+FAA+F;IACzF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC9B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,SAAS;IAgEjB,OAAO,CAAC,aAAa;IAkIrB,sDAAsD;IAChD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAyC9E,OAAO,CAAC,iBAAiB;IAiCnB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAqBlC;AAMD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,gBAAgB,CAA4B;IACpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,mBAAmB,CAAyB;IACpD,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,oBAAoB,CAAqB;IAEjD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAsC;IAE5D,6FAA6F;IAC7F,OAAO,CAAC,YAAY,CAAe;IACnC,2DAA2D;IAC3D,OAAO,CAAC,aAAa,CAA2B;IAChD,0CAA0C;IAC1C,WAAW,SAAK;IAEhB,wDAAwD;IACxD,MAAM,CAAC,QAAQ,CAAC,oBAAoB,SAAS;gBAEjC,OAAO,EAAE,cAAc;IAoBnC,4EAA4E;IACtE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkH5B,+DAA+D;IACzD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAqC3B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,QAAQ;YAMF,uBAAuB;YAiBvB,qBAAqB;YAkBrB,yBAAyB;YAmBzB,gBAAgB;YAiBhB,qBAAqB;YAiBrB,qBAAqB;YAyBrB,sBAAsB;YAwBtB,aAAa;IAyB3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAe1B,2CAA2C;YAC7B,SAAS;IAwBvB,oEAAoE;YACtD,qBAAqB;YA0BrB,kBAAkB;YAqBlB,oBAAoB;CA0GnC"}

package/packages/openclaw/dist/gateway.js

@@ -1,7 +1,10 @@
-import { createHash, generateKeyPairSync, sign } from 'node:crypto';
+import { createHash, createPrivateKey, generateKeyPairSync, sign } from 'node:crypto';
+import { chmod, readFile, rename, writeFile, mkdir } from 'node:fs/promises';
 import { createServer } from 'node:http';
+import { join } from 'node:path';
 import { RelayCast } from '@relaycast/sdk';
 import WebSocket from 'ws';
+import { openclawHome } from './config.js';
 import { DEFAULT_OPENCLAW_GATEWAY_PORT } from './types.js';
 import { SpawnManager } from './spawn/manager.js';
 function normalizeChannelName(channel) {
@@ -19,6 +22,62 @@ function generateDeviceIdentity() {
         deviceId,
     };
 }
+/** Path to persisted device identity file. */
+function deviceIdentityPath() {
+    return join(openclawHome(), 'workspace', 'relaycast', 'device.json');
+}
+/**
+ * Load a persisted device identity from disk, or generate and persist a new one.
+ * This ensures the same device ID survives restarts so the OpenClaw gateway
+ * can pair it once and recognize it on subsequent connections.
+ */
+async function loadOrCreateDeviceIdentity() {
+    const filePath = deviceIdentityPath();
+    // Attempt to load existing identity (no existsSync — just try the read)
+    try {
+        const raw = await readFile(filePath, 'utf-8');
+        const persisted = JSON.parse(raw);
+        const privateKeyObj = createPrivateKey({
+            key: Buffer.from(persisted.privateKeyPkcs8B64, 'base64'),
+            format: 'der',
+            type: 'pkcs8',
+        });
+        // Ensure permissions are tight even if file was created with looser perms
+        await chmod(filePath, 0o600).catch(() => { });
+        console.log(`[openclaw-ws] Loaded persisted device identity (deviceId=${persisted.deviceId.slice(0, 12)}...)`);
+        return {
+            publicKeyB64: persisted.publicKeyB64,
+            privateKeyObj,
+            deviceId: persisted.deviceId,
+        };
+    }
+    catch (err) {
+        // ENOENT is expected on first run; other errors mean corruption
+        if (err.code !== 'ENOENT') {
+            console.warn(`[openclaw-ws] Failed to load device identity, generating new: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // Generate fresh and persist via atomic write-then-rename
+    const identity = generateDeviceIdentity();
+    const pkcs8Der = identity.privateKeyObj.export({ type: 'pkcs8', format: 'der' });
+    const persisted = {
+        publicKeyB64: identity.publicKeyB64,
+        privateKeyPkcs8B64: Buffer.from(pkcs8Der).toString('base64'),
+        deviceId: identity.deviceId,
+    };
+    try {
+        const dir = join(openclawHome(), 'workspace', 'relaycast');
+        await mkdir(dir, { recursive: true });
+        const tmpPath = filePath + '.tmp';
+        await writeFile(tmpPath, JSON.stringify(persisted, null, 2) + '\n', { mode: 0o600 });
+        await rename(tmpPath, filePath);
+        console.log(`[openclaw-ws] Persisted new device identity (deviceId=${identity.deviceId.slice(0, 12)}...)`);
+    }
+    catch (err) {
+        console.warn(`[openclaw-ws] Could not persist device identity: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return identity;
+}
 function signConnectPayload(device, params) {
     // v3 payload format: v3|deviceId|clientId|clientMode|role|scopes|signedAtMs|token|nonce|platform|deviceFamily
     const payload = [
@@ -61,10 +120,21 @@ export class OpenClawGatewayClient {
     static MAX_CONSECUTIVE_FAILURES = 5;
     static BASE_RECONNECT_MS = 3_000;
     static MAX_RECONNECT_MS = 30_000;
-    constructor(token, port) {
+    /** Slow retry interval after pairing rejection or max failures (60s). */
+    static PAIRING_RETRY_MS = 60_000;
+    constructor(token, port, device) {
         this.token = token;
         this.port = port;
-        this.device = generateDeviceIdentity();
+        this.device = device ?? generateDeviceIdentity();
+    }
+    /**
+     * Create a client with a persisted device identity (loaded from disk or
+     * freshly generated and saved). This ensures the same device ID is reused
+     * across restarts so the OpenClaw gateway can pair it once.
+     */
+    static async create(token, port) {
+        const device = await loadOrCreateDeviceIdentity();
+        return new OpenClawGatewayClient(token, port, device);
     }
     /** Connect and authenticate. Resolves when chat.send is ready, rejects on timeout or error. */
     async connect() {
@@ -123,10 +193,11 @@ export class OpenClawGatewayClient {
             console.warn(`[openclaw-ws] Disconnected: ${code} ${reasonStr}`);
             const wasAuthenticated = this.authenticated;
             this.authenticated = false;
-            // Detect pairing rejection via close code 1008 (Policy Violation)
-            if (code === 1008 || /pairing|not.paired/i.test(reasonStr)) {
+            // Detect pairing rejection: code 1008 (Policy Violation) with pairing reason
+            if (code === 1008 && /pairing|not.paired/i.test(reasonStr)) {
                 console.error('[openclaw-ws] Connection closed due to pairing policy. Device is not paired.');
-                console.error('[openclaw-ws] Ensure OPENCLAW_GATEWAY_TOKEN matches ~/.openclaw/openclaw.json gateway.auth.token');
+                console.error(`[openclaw-ws] Device ID: ${this.device.deviceId.slice(0, 16)}...`);
+                console.error('[openclaw-ws] Run: openclaw devices approve <requestId> (check gateway logs for requestId)');
                 this.pairingRejected = true;
             }
             // Reject all pending RPCs
@@ -143,7 +214,7 @@ export class OpenClawGatewayClient {
                 this.connectReject = null;
                 this.connectResolve = null;
             }
-            if (!this.stopped && !this.pairingRejected) {
+            if (!this.stopped) {
                 this.scheduleReconnect();
             }
         });
@@ -240,7 +311,13 @@ export class OpenClawGatewayClient {
                 const errStr = msg.error ? JSON.stringify(msg.error) : 'Authentication rejected';
                 const isPairing = /pairing.required|not.paired/i.test(errStr);
                 if (isPairing) {
+                    const errObj = msg.error;
+                    const requestId = errObj?.requestId ?? errObj?.request_id ?? '';
                     console.error('[openclaw-ws] Pairing rejected — device is not paired with the OpenClaw gateway.');
+                    if (requestId) {
+                        console.error(`[openclaw-ws] Approve this device:  openclaw devices approve ${requestId}`);
+                    }
+                    console.error(`[openclaw-ws] Device ID: ${this.device.deviceId.slice(0, 16)}...`);
                     console.error('[openclaw-ws] Ensure OPENCLAW_GATEWAY_TOKEN matches ~/.openclaw/openclaw.json gateway.auth.token');
                     this.pairingRejected = true;
                 }
@@ -315,14 +392,25 @@ export class OpenClawGatewayClient {
         });
     }
     scheduleReconnect() {
-        if (this.stopped || this.pairingRejected || this.reconnectTimer)
+        if (this.stopped || this.reconnectTimer)
             return;
-        this.consecutiveFailures++;
-        if (this.consecutiveFailures >= OpenClawGatewayClient.MAX_CONSECUTIVE_FAILURES) {
-            console.warn(`[openclaw-ws] ${this.consecutiveFailures} consecutive connection failures — stopping reconnect.`);
-            console.warn('[openclaw-ws] Check that the OpenClaw gateway is running and OPENCLAW_GATEWAY_TOKEN is correct.');
+        // After pairing rejection or max failures, switch to slow periodic retry
+        // so the gateway can self-heal once pairing is approved externally.
+        if (this.pairingRejected || this.consecutiveFailures >= OpenClawGatewayClient.MAX_CONSECUTIVE_FAILURES) {
+            if (this.consecutiveFailures === OpenClawGatewayClient.MAX_CONSECUTIVE_FAILURES) {
+                console.warn(`[openclaw-ws] ${this.consecutiveFailures} consecutive failures — switching to slow retry (every 60s).`);
+                console.warn('[openclaw-ws] Check that the OpenClaw gateway is running and OPENCLAW_GATEWAY_TOKEN is correct.');
+            }
+            this.consecutiveFailures++;
+            console.log(`[openclaw-ws] Slow retry in ${OpenClawGatewayClient.PAIRING_RETRY_MS / 1000}s...`);
+            this.reconnectTimer = setTimeout(() => {
+                this.reconnectTimer = null;
+                this.pairingRejected = false; // Clear flag so connect attempt proceeds
+                this.doConnect();
+            }, OpenClawGatewayClient.PAIRING_RETRY_MS);
             return;
         }
+        this.consecutiveFailures++;
         const delay = Math.min(OpenClawGatewayClient.BASE_RECONNECT_MS * Math.pow(2, this.consecutiveFailures - 1), OpenClawGatewayClient.MAX_RECONNECT_MS);
         console.log(`[openclaw-ws] Reconnecting in ${delay / 1000}s (attempt ${this.consecutiveFailures})...`);
         this.reconnectTimer = setTimeout(() => {
@@ -404,7 +492,7 @@ export class InboundGateway {
         const token = this.config.openclawGatewayToken ?? process.env.OPENCLAW_GATEWAY_TOKEN;
         const port = this.config.openclawGatewayPort ?? DEFAULT_OPENCLAW_GATEWAY_PORT;
         if (token) {
-            this.openclawClient = new OpenClawGatewayClient(token, port);
+            this.openclawClient = await OpenClawGatewayClient.create(token, port);
             try {
                 await this.openclawClient.connect();
                 console.log('[gateway] OpenClaw gateway WebSocket client ready');