clawdentity 0.0.13 → 0.0.14

package/dist/bin.js

@@ -22471,6 +22471,7 @@ var PAIRING_QR_DIR_NAME = "pairing";
 var PEERS_FILE_NAME2 = "peers.json";
 var PAIR_START_PATH = "/pair/start";
 var PAIR_CONFIRM_PATH = "/pair/confirm";
+var PAIR_STATUS_PATH = "/pair/status";
 var OWNER_PAT_HEADER = "x-claw-owner-pat";
 var NONCE_SIZE2 = 24;
 var PAIRING_TICKET_PREFIX = "clwpair1_";
@@ -22478,6 +22479,8 @@ var PAIRING_QR_MAX_AGE_SECONDS = 900;
 var PAIRING_QR_FILENAME_PATTERN = /-pair-(\d+)\.png$/;
 var FILE_MODE4 = 384;
 var PEER_ALIAS_PATTERN2 = /^[a-zA-Z0-9._-]+$/;
+var DEFAULT_STATUS_WAIT_SECONDS = 300;
+var DEFAULT_STATUS_POLL_INTERVAL_SECONDS = 3;
 var isRecord9 = (value) => {
   return typeof value === "object" && value !== null;
 };
@@ -22553,6 +22556,52 @@ function parsePairingTicketIssuerOrigin(ticket) {
   }
   return issuerUrl.origin;
 }
+function parseAitAgentDid(ait) {
+  const parts = ait.split(".");
+  if (parts.length < 2) {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payloadRaw;
+  try {
+    payloadRaw = new TextDecoder().decode(decodeBase64url(parts[1] ?? ""));
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadRaw);
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  if (!isRecord9(payload) || typeof payload.sub !== "string") {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  const candidate = payload.sub.trim();
+  try {
+    const parsed = parseDid(candidate);
+    if (parsed.kind !== "agent") {
+      throw new Error("invalid kind");
+    }
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  return candidate;
+}
 function parsePeerAlias2(value) {
   if (value.length === 0 || value.length > 128) {
     throw createCliError7(
@@ -22684,6 +22733,20 @@ function parseTtlSeconds(value) {
   }
   return parsed;
 }
+function parsePositiveIntegerOption(input) {
+  const raw = parseNonEmptyString9(input.value);
+  if (raw.length === 0) {
+    return input.defaultValue;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_WAIT_INVALID",
+      `${input.optionName} must be a positive integer`
+    );
+  }
+  return parsed;
+}
 function parseProxyUrl2(candidate) {
   try {
     const parsed = new URL(candidate);
@@ -22804,6 +22867,29 @@ function mapConfirmPairError(status, payload) {
   }
   return `Pair confirm failed (${status})`;
 }
+function mapStatusPairError(status, payload) {
+  const code = extractErrorCode(payload);
+  const message2 = extractErrorMessage(payload);
+  if (code === "PROXY_PAIR_TICKET_NOT_FOUND" || status === 404) {
+    return "Pairing ticket not found";
+  }
+  if (code === "PROXY_PAIR_TICKET_EXPIRED" || status === 410) {
+    return "Pairing ticket has expired";
+  }
+  if (code === "PROXY_PAIR_STATUS_FORBIDDEN" || status === 403) {
+    return message2 ? `Pair status request is forbidden (403): ${message2}` : "Pair status request is forbidden (403).";
+  }
+  if (status === 400) {
+    return message2 ? `Pair status request is invalid (400): ${message2}` : "Pair status request is invalid (400).";
+  }
+  if (status >= 500) {
+    return `Proxy pairing service is unavailable (${status}).`;
+  }
+  if (message2) {
+    return `Pair status failed (${status}): ${message2}`;
+  }
+  return `Pair status failed (${status})`;
+}
 function parsePairStartResponse(payload) {
   if (!isRecord9(payload)) {
     throw createCliError7(
@@ -22848,6 +22934,44 @@ function parsePairConfirmResponse(payload) {
     responderAgentDid
   };
 }
+function parsePairStatusResponse(payload) {
+  if (!isRecord9(payload)) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const statusRaw = parseNonEmptyString9(payload.status);
+  if (statusRaw !== "pending" && statusRaw !== "confirmed") {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
+  const responderAgentDid = parseNonEmptyString9(payload.responderAgentDid);
+  const expiresAt = parseNonEmptyString9(payload.expiresAt);
+  const confirmedAt = parseNonEmptyString9(payload.confirmedAt);
+  if (initiatorAgentDid.length === 0 || expiresAt.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  if (statusRaw === "confirmed" && responderAgentDid.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  return {
+    status: statusRaw,
+    initiatorAgentDid,
+    responderAgentDid: responderAgentDid.length > 0 ? responderAgentDid : void 0,
+    expiresAt,
+    confirmedAt: confirmedAt.length > 0 ? confirmedAt : void 0
+  };
+}
 async function readAgentProofMaterial(agentName, dependencies) {
   const readFileImpl = dependencies.readFileImpl ?? readFile5;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
@@ -23238,6 +23362,147 @@ async function confirmPairing(agentName, options, dependencies = {}) {
     peerAlias
   };
 }
+async function getPairingStatusOnce(agentName, options, dependencies = {}) {
+  const fetchImpl = dependencies.fetchImpl ?? fetch;
+  const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
+  const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
+  const config2 = await resolveConfigImpl();
+  const proxyUrl = await resolveProxyUrl({
+    config: config2,
+    fetchImpl
+  });
+  const ticket = parsePairingTicket(options.ticket);
+  const { ait, secretKey } = await readAgentProofMaterial(
+    agentName,
+    dependencies
+  );
+  const callerAgentDid = parseAitAgentDid(ait);
+  const requestUrl = toProxyRequestUrl(proxyUrl, PAIR_STATUS_PATH);
+  const requestBody = JSON.stringify({ ticket });
+  const bodyBytes = new TextEncoder().encode(requestBody);
+  const timestampSeconds = nowSecondsImpl();
+  const nonce = nonceFactoryImpl();
+  const signedHeaders = await buildSignedHeaders({
+    method: "POST",
+    requestUrl,
+    bodyBytes,
+    secretKey,
+    timestampSeconds,
+    nonce
+  });
+  const response = await executePairRequest({
+    fetchImpl,
+    url: requestUrl,
+    init: {
+      method: "POST",
+      headers: {
+        authorization: `Claw ${ait}`,
+        "content-type": "application/json",
+        ...signedHeaders
+      },
+      body: requestBody
+    }
+  });
+  const responseBody = await parseJsonResponse6(response);
+  if (!response.ok) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_FAILED",
+      mapStatusPairError(response.status, responseBody)
+    );
+  }
+  const parsed = parsePairStatusResponse(responseBody);
+  let peerAlias;
+  if (parsed.status === "confirmed") {
+    const responderAgentDid = parsed.responderAgentDid;
+    if (!responderAgentDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_INVALID_RESPONSE",
+        "Pair status response is invalid"
+      );
+    }
+    const peerDid = callerAgentDid === parsed.initiatorAgentDid ? responderAgentDid : callerAgentDid === responderAgentDid ? parsed.initiatorAgentDid : void 0;
+    if (!peerDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_FORBIDDEN",
+        "Local agent is not a participant in the pairing ticket"
+      );
+    }
+    peerAlias = await persistPairedPeer({
+      ticket,
+      peerDid,
+      dependencies
+    });
+  }
+  return {
+    ...parsed,
+    proxyUrl,
+    peerAlias
+  };
+}
+async function waitForPairingStatus(input) {
+  const nowSecondsImpl = input.dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const sleepImpl = input.dependencies.sleepImpl ?? (async (ms) => {
+    await new Promise((resolve2) => {
+      setTimeout(resolve2, ms);
+    });
+  });
+  const deadlineSeconds = nowSecondsImpl() + input.waitSeconds;
+  while (true) {
+    const status = await getPairingStatusOnce(
+      input.agentName,
+      { ticket: input.ticket },
+      input.dependencies
+    );
+    if (status.status === "confirmed") {
+      return status;
+    }
+    const nowSeconds = nowSecondsImpl();
+    if (nowSeconds >= deadlineSeconds) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_WAIT_TIMEOUT",
+        `Pairing is still pending after ${input.waitSeconds} seconds`
+      );
+    }
+    const remainingSeconds = Math.max(0, deadlineSeconds - nowSeconds);
+    const sleepSeconds = Math.min(input.pollIntervalSeconds, remainingSeconds);
+    await sleepImpl(sleepSeconds * 1e3);
+  }
+}
+async function getPairingStatus(agentName, options, dependencies = {}) {
+  const ticketRaw = parseNonEmptyString9(options.ticket);
+  if (ticketRaw.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_TICKET_REQUIRED",
+      "Pair status requires --ticket <clwpair1_...>"
+    );
+  }
+  const ticket = parsePairingTicket(ticketRaw);
+  if (options.wait !== true) {
+    return getPairingStatusOnce(
+      agentName,
+      { ticket },
+      dependencies
+    );
+  }
+  const waitSeconds = parsePositiveIntegerOption({
+    value: options.waitSeconds,
+    optionName: "waitSeconds",
+    defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+  });
+  const pollIntervalSeconds = parsePositiveIntegerOption({
+    value: options.pollIntervalSeconds,
+    optionName: "pollIntervalSeconds",
+    defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+  });
+  return waitForPairingStatus({
+    agentName,
+    ticket,
+    waitSeconds,
+    pollIntervalSeconds,
+    dependencies
+  });
+}
 var createPairCommand = (dependencies = {}) => {
   const pairCommand = new Command8("pair").description(
     "Manage proxy trust pairing between agents"
@@ -23245,7 +23510,16 @@ var createPairCommand = (dependencies = {}) => {
   pairCommand.command("start <agentName>").description("Start pairing and issue one-time pairing ticket").option(
     "--owner-pat <token>",
     "Owner PAT override (defaults to configured API key)"
-  ).option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").action(
+  ).option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").option(
+    "--wait",
+    "Wait for responder confirmation and auto-save peer on initiator"
+  ).option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
     withErrorHandling(
       "pair start",
       async (agentName, options) => {
@@ -23263,6 +23537,44 @@ var createPairCommand = (dependencies = {}) => {
         if (result.qrPath) {
           writeStdoutLine(`QR File: ${result.qrPath}`);
         }
+        if (options.wait === true) {
+          const waitSeconds = parsePositiveIntegerOption({
+            value: options.waitSeconds,
+            optionName: "waitSeconds",
+            defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+          });
+          const pollIntervalSeconds = parsePositiveIntegerOption({
+            value: options.pollIntervalSeconds,
+            optionName: "pollIntervalSeconds",
+            defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+          });
+          writeStdoutLine(
+            `Waiting for confirmation (timeout=${waitSeconds}s, interval=${pollIntervalSeconds}s) ...`
+          );
+          const status = await waitForPairingStatus({
+            agentName,
+            ticket: result.ticket,
+            waitSeconds,
+            pollIntervalSeconds,
+            dependencies
+          });
+          logger9.info("cli.pair_status_confirmed_after_start", {
+            initiatorAgentDid: status.initiatorAgentDid,
+            responderAgentDid: status.responderAgentDid,
+            peerAlias: status.peerAlias
+          });
+          writeStdoutLine("Pairing confirmed");
+          writeStdoutLine(`Status: ${status.status}`);
+          if (status.initiatorAgentDid) {
+            writeStdoutLine(`Initiator Agent DID: ${status.initiatorAgentDid}`);
+          }
+          if (status.responderAgentDid) {
+            writeStdoutLine(`Responder Agent DID: ${status.responderAgentDid}`);
+          }
+          if (status.peerAlias) {
+            writeStdoutLine(`Peer alias saved: ${status.peerAlias}`);
+          }
+        }
       }
     )
   );
@@ -23287,6 +23599,39 @@ var createPairCommand = (dependencies = {}) => {
       }
     )
   );
+  pairCommand.command("status <agentName>").description("Check pairing ticket status and sync local peer on confirm").option("--ticket <ticket>", "One-time pairing ticket (clwpair1_...)").option("--wait", "Poll until ticket is confirmed or timeout is reached").option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
+    withErrorHandling(
+      "pair status",
+      async (agentName, options) => {
+        const result = await getPairingStatus(agentName, options, dependencies);
+        logger9.info("cli.pair_status", {
+          initiatorAgentDid: result.initiatorAgentDid,
+          responderAgentDid: result.responderAgentDid,
+          status: result.status,
+          proxyUrl: result.proxyUrl,
+          peerAlias: result.peerAlias
+        });
+        writeStdoutLine(`Status: ${result.status}`);
+        writeStdoutLine(`Initiator Agent DID: ${result.initiatorAgentDid}`);
+        if (result.responderAgentDid) {
+          writeStdoutLine(`Responder Agent DID: ${result.responderAgentDid}`);
+        }
+        writeStdoutLine(`Expires At: ${result.expiresAt}`);
+        if (result.confirmedAt) {
+          writeStdoutLine(`Confirmed At: ${result.confirmedAt}`);
+        }
+        if (result.peerAlias) {
+          writeStdoutLine(`Peer alias saved: ${result.peerAlias}`);
+        }
+      }
+    )
+  );
   return pairCommand;
 };
 

package/dist/index.js

@@ -22471,6 +22471,7 @@ var PAIRING_QR_DIR_NAME = "pairing";
 var PEERS_FILE_NAME2 = "peers.json";
 var PAIR_START_PATH = "/pair/start";
 var PAIR_CONFIRM_PATH = "/pair/confirm";
+var PAIR_STATUS_PATH = "/pair/status";
 var OWNER_PAT_HEADER = "x-claw-owner-pat";
 var NONCE_SIZE2 = 24;
 var PAIRING_TICKET_PREFIX = "clwpair1_";
@@ -22478,6 +22479,8 @@ var PAIRING_QR_MAX_AGE_SECONDS = 900;
 var PAIRING_QR_FILENAME_PATTERN = /-pair-(\d+)\.png$/;
 var FILE_MODE4 = 384;
 var PEER_ALIAS_PATTERN2 = /^[a-zA-Z0-9._-]+$/;
+var DEFAULT_STATUS_WAIT_SECONDS = 300;
+var DEFAULT_STATUS_POLL_INTERVAL_SECONDS = 3;
 var isRecord9 = (value) => {
   return typeof value === "object" && value !== null;
 };
@@ -22553,6 +22556,52 @@ function parsePairingTicketIssuerOrigin(ticket) {
   }
   return issuerUrl.origin;
 }
+function parseAitAgentDid(ait) {
+  const parts = ait.split(".");
+  if (parts.length < 2) {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payloadRaw;
+  try {
+    payloadRaw = new TextDecoder().decode(decodeBase64url(parts[1] ?? ""));
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadRaw);
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  if (!isRecord9(payload) || typeof payload.sub !== "string") {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  const candidate = payload.sub.trim();
+  try {
+    const parsed = parseDid(candidate);
+    if (parsed.kind !== "agent") {
+      throw new Error("invalid kind");
+    }
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  return candidate;
+}
 function parsePeerAlias2(value) {
   if (value.length === 0 || value.length > 128) {
     throw createCliError7(
@@ -22684,6 +22733,20 @@ function parseTtlSeconds(value) {
   }
   return parsed;
 }
+function parsePositiveIntegerOption(input) {
+  const raw = parseNonEmptyString9(input.value);
+  if (raw.length === 0) {
+    return input.defaultValue;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_WAIT_INVALID",
+      `${input.optionName} must be a positive integer`
+    );
+  }
+  return parsed;
+}
 function parseProxyUrl2(candidate) {
   try {
     const parsed = new URL(candidate);
@@ -22804,6 +22867,29 @@ function mapConfirmPairError(status, payload) {
   }
   return `Pair confirm failed (${status})`;
 }
+function mapStatusPairError(status, payload) {
+  const code = extractErrorCode(payload);
+  const message2 = extractErrorMessage(payload);
+  if (code === "PROXY_PAIR_TICKET_NOT_FOUND" || status === 404) {
+    return "Pairing ticket not found";
+  }
+  if (code === "PROXY_PAIR_TICKET_EXPIRED" || status === 410) {
+    return "Pairing ticket has expired";
+  }
+  if (code === "PROXY_PAIR_STATUS_FORBIDDEN" || status === 403) {
+    return message2 ? `Pair status request is forbidden (403): ${message2}` : "Pair status request is forbidden (403).";
+  }
+  if (status === 400) {
+    return message2 ? `Pair status request is invalid (400): ${message2}` : "Pair status request is invalid (400).";
+  }
+  if (status >= 500) {
+    return `Proxy pairing service is unavailable (${status}).`;
+  }
+  if (message2) {
+    return `Pair status failed (${status}): ${message2}`;
+  }
+  return `Pair status failed (${status})`;
+}
 function parsePairStartResponse(payload) {
   if (!isRecord9(payload)) {
     throw createCliError7(
@@ -22848,6 +22934,44 @@ function parsePairConfirmResponse(payload) {
     responderAgentDid
   };
 }
+function parsePairStatusResponse(payload) {
+  if (!isRecord9(payload)) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const statusRaw = parseNonEmptyString9(payload.status);
+  if (statusRaw !== "pending" && statusRaw !== "confirmed") {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
+  const responderAgentDid = parseNonEmptyString9(payload.responderAgentDid);
+  const expiresAt = parseNonEmptyString9(payload.expiresAt);
+  const confirmedAt = parseNonEmptyString9(payload.confirmedAt);
+  if (initiatorAgentDid.length === 0 || expiresAt.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  if (statusRaw === "confirmed" && responderAgentDid.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  return {
+    status: statusRaw,
+    initiatorAgentDid,
+    responderAgentDid: responderAgentDid.length > 0 ? responderAgentDid : void 0,
+    expiresAt,
+    confirmedAt: confirmedAt.length > 0 ? confirmedAt : void 0
+  };
+}
 async function readAgentProofMaterial(agentName, dependencies) {
   const readFileImpl = dependencies.readFileImpl ?? readFile5;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
@@ -23238,6 +23362,147 @@ async function confirmPairing(agentName, options, dependencies = {}) {
     peerAlias
   };
 }
+async function getPairingStatusOnce(agentName, options, dependencies = {}) {
+  const fetchImpl = dependencies.fetchImpl ?? fetch;
+  const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
+  const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
+  const config2 = await resolveConfigImpl();
+  const proxyUrl = await resolveProxyUrl({
+    config: config2,
+    fetchImpl
+  });
+  const ticket = parsePairingTicket(options.ticket);
+  const { ait, secretKey } = await readAgentProofMaterial(
+    agentName,
+    dependencies
+  );
+  const callerAgentDid = parseAitAgentDid(ait);
+  const requestUrl = toProxyRequestUrl(proxyUrl, PAIR_STATUS_PATH);
+  const requestBody = JSON.stringify({ ticket });
+  const bodyBytes = new TextEncoder().encode(requestBody);
+  const timestampSeconds = nowSecondsImpl();
+  const nonce = nonceFactoryImpl();
+  const signedHeaders = await buildSignedHeaders({
+    method: "POST",
+    requestUrl,
+    bodyBytes,
+    secretKey,
+    timestampSeconds,
+    nonce
+  });
+  const response = await executePairRequest({
+    fetchImpl,
+    url: requestUrl,
+    init: {
+      method: "POST",
+      headers: {
+        authorization: `Claw ${ait}`,
+        "content-type": "application/json",
+        ...signedHeaders
+      },
+      body: requestBody
+    }
+  });
+  const responseBody = await parseJsonResponse6(response);
+  if (!response.ok) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_FAILED",
+      mapStatusPairError(response.status, responseBody)
+    );
+  }
+  const parsed = parsePairStatusResponse(responseBody);
+  let peerAlias;
+  if (parsed.status === "confirmed") {
+    const responderAgentDid = parsed.responderAgentDid;
+    if (!responderAgentDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_INVALID_RESPONSE",
+        "Pair status response is invalid"
+      );
+    }
+    const peerDid = callerAgentDid === parsed.initiatorAgentDid ? responderAgentDid : callerAgentDid === responderAgentDid ? parsed.initiatorAgentDid : void 0;
+    if (!peerDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_FORBIDDEN",
+        "Local agent is not a participant in the pairing ticket"
+      );
+    }
+    peerAlias = await persistPairedPeer({
+      ticket,
+      peerDid,
+      dependencies
+    });
+  }
+  return {
+    ...parsed,
+    proxyUrl,
+    peerAlias
+  };
+}
+async function waitForPairingStatus(input) {
+  const nowSecondsImpl = input.dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const sleepImpl = input.dependencies.sleepImpl ?? (async (ms) => {
+    await new Promise((resolve2) => {
+      setTimeout(resolve2, ms);
+    });
+  });
+  const deadlineSeconds = nowSecondsImpl() + input.waitSeconds;
+  while (true) {
+    const status = await getPairingStatusOnce(
+      input.agentName,
+      { ticket: input.ticket },
+      input.dependencies
+    );
+    if (status.status === "confirmed") {
+      return status;
+    }
+    const nowSeconds = nowSecondsImpl();
+    if (nowSeconds >= deadlineSeconds) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_WAIT_TIMEOUT",
+        `Pairing is still pending after ${input.waitSeconds} seconds`
+      );
+    }
+    const remainingSeconds = Math.max(0, deadlineSeconds - nowSeconds);
+    const sleepSeconds = Math.min(input.pollIntervalSeconds, remainingSeconds);
+    await sleepImpl(sleepSeconds * 1e3);
+  }
+}
+async function getPairingStatus(agentName, options, dependencies = {}) {
+  const ticketRaw = parseNonEmptyString9(options.ticket);
+  if (ticketRaw.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_TICKET_REQUIRED",
+      "Pair status requires --ticket <clwpair1_...>"
+    );
+  }
+  const ticket = parsePairingTicket(ticketRaw);
+  if (options.wait !== true) {
+    return getPairingStatusOnce(
+      agentName,
+      { ticket },
+      dependencies
+    );
+  }
+  const waitSeconds = parsePositiveIntegerOption({
+    value: options.waitSeconds,
+    optionName: "waitSeconds",
+    defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+  });
+  const pollIntervalSeconds = parsePositiveIntegerOption({
+    value: options.pollIntervalSeconds,
+    optionName: "pollIntervalSeconds",
+    defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+  });
+  return waitForPairingStatus({
+    agentName,
+    ticket,
+    waitSeconds,
+    pollIntervalSeconds,
+    dependencies
+  });
+}
 var createPairCommand = (dependencies = {}) => {
   const pairCommand = new Command8("pair").description(
     "Manage proxy trust pairing between agents"
@@ -23245,7 +23510,16 @@ var createPairCommand = (dependencies = {}) => {
   pairCommand.command("start <agentName>").description("Start pairing and issue one-time pairing ticket").option(
     "--owner-pat <token>",
     "Owner PAT override (defaults to configured API key)"
-  ).option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").action(
+  ).option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").option(
+    "--wait",
+    "Wait for responder confirmation and auto-save peer on initiator"
+  ).option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
     withErrorHandling(
       "pair start",
       async (agentName, options) => {
@@ -23263,6 +23537,44 @@ var createPairCommand = (dependencies = {}) => {
         if (result.qrPath) {
           writeStdoutLine(`QR File: ${result.qrPath}`);
         }
+        if (options.wait === true) {
+          const waitSeconds = parsePositiveIntegerOption({
+            value: options.waitSeconds,
+            optionName: "waitSeconds",
+            defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+          });
+          const pollIntervalSeconds = parsePositiveIntegerOption({
+            value: options.pollIntervalSeconds,
+            optionName: "pollIntervalSeconds",
+            defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+          });
+          writeStdoutLine(
+            `Waiting for confirmation (timeout=${waitSeconds}s, interval=${pollIntervalSeconds}s) ...`
+          );
+          const status = await waitForPairingStatus({
+            agentName,
+            ticket: result.ticket,
+            waitSeconds,
+            pollIntervalSeconds,
+            dependencies
+          });
+          logger9.info("cli.pair_status_confirmed_after_start", {
+            initiatorAgentDid: status.initiatorAgentDid,
+            responderAgentDid: status.responderAgentDid,
+            peerAlias: status.peerAlias
+          });
+          writeStdoutLine("Pairing confirmed");
+          writeStdoutLine(`Status: ${status.status}`);
+          if (status.initiatorAgentDid) {
+            writeStdoutLine(`Initiator Agent DID: ${status.initiatorAgentDid}`);
+          }
+          if (status.responderAgentDid) {
+            writeStdoutLine(`Responder Agent DID: ${status.responderAgentDid}`);
+          }
+          if (status.peerAlias) {
+            writeStdoutLine(`Peer alias saved: ${status.peerAlias}`);
+          }
+        }
       }
     )
   );
@@ -23287,6 +23599,39 @@ var createPairCommand = (dependencies = {}) => {
       }
     )
   );
+  pairCommand.command("status <agentName>").description("Check pairing ticket status and sync local peer on confirm").option("--ticket <ticket>", "One-time pairing ticket (clwpair1_...)").option("--wait", "Poll until ticket is confirmed or timeout is reached").option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
+    withErrorHandling(
+      "pair status",
+      async (agentName, options) => {
+        const result = await getPairingStatus(agentName, options, dependencies);
+        logger9.info("cli.pair_status", {
+          initiatorAgentDid: result.initiatorAgentDid,
+          responderAgentDid: result.responderAgentDid,
+          status: result.status,
+          proxyUrl: result.proxyUrl,
+          peerAlias: result.peerAlias
+        });
+        writeStdoutLine(`Status: ${result.status}`);
+        writeStdoutLine(`Initiator Agent DID: ${result.initiatorAgentDid}`);
+        if (result.responderAgentDid) {
+          writeStdoutLine(`Responder Agent DID: ${result.responderAgentDid}`);
+        }
+        writeStdoutLine(`Expires At: ${result.expiresAt}`);
+        if (result.confirmedAt) {
+          writeStdoutLine(`Confirmed At: ${result.confirmedAt}`);
+        }
+        if (result.peerAlias) {
+          writeStdoutLine(`Peer alias saved: ${result.peerAlias}`);
+        }
+      }
+    )
+  );
   return pairCommand;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawdentity",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -21,6 +21,17 @@
     "postinstall.mjs",
     "skill-bundle"
   ],
+  "scripts": {
+    "build": "pnpm -F @clawdentity/openclaw-skill build && pnpm run sync:skill-bundle && pnpm run verify:skill-bundle && tsup",
+    "format": "biome format .",
+    "lint": "biome lint .",
+    "prepack": "pnpm run build",
+    "postinstall": "node ./postinstall.mjs",
+    "sync:skill-bundle": "node ./scripts/sync-skill-bundle.mjs",
+    "verify:skill-bundle": "node ./scripts/verify-skill-bundle.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
   "dependencies": {
     "commander": "^13.1.0",
     "jsqr": "^1.4.0",
@@ -29,21 +40,11 @@
     "ws": "^8.19.0"
   },
   "devDependencies": {
+    "@clawdentity/connector": "workspace:*",
+    "@clawdentity/protocol": "workspace:*",
+    "@clawdentity/sdk": "workspace:*",
     "@types/node": "^22.18.11",
     "@types/pngjs": "^6.0.5",
-    "@types/qrcode": "^1.5.6",
-    "@clawdentity/connector": "0.0.0",
-    "@clawdentity/protocol": "0.0.0",
-    "@clawdentity/sdk": "0.0.0"
-  },
-  "scripts": {
-    "build": "pnpm -F @clawdentity/openclaw-skill build && pnpm run sync:skill-bundle && pnpm run verify:skill-bundle && tsup",
-    "format": "biome format .",
-    "lint": "biome lint .",
-    "postinstall": "node ./postinstall.mjs",
-    "sync:skill-bundle": "node ./scripts/sync-skill-bundle.mjs",
-    "verify:skill-bundle": "node ./scripts/verify-skill-bundle.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit"
+    "@types/qrcode": "^1.5.6"
   }
-}
+}