clawdentity 0.0.13 → 0.0.15

package/dist/bin.js

@@ -15643,6 +15643,7 @@ var runtimeEnvironmentValues = [
 // ../../packages/sdk/src/config.ts
 var environmentSchema = external_exports.enum(runtimeEnvironmentValues);
 var registrySigningKeyStatusSchema = external_exports.enum(["active", "revoked"]);
+var registryEventBusBackendSchema = external_exports.enum(["memory", "queue"]);
 var ED25519_PUBLIC_KEY_LENGTH2 = 32;
 var registrySigningPublicKeySchema = external_exports.object({
   kid: external_exports.string().min(1),
@@ -15712,6 +15713,7 @@ var registryConfigSchema = external_exports.object({
   ENVIRONMENT: environmentSchema,
   APP_VERSION: external_exports.string().min(1).optional(),
   PROXY_URL: external_exports.string().url().optional(),
+  EVENT_BUS_BACKEND: registryEventBusBackendSchema.optional(),
   BOOTSTRAP_SECRET: external_exports.string().min(1).optional(),
   REGISTRY_SIGNING_KEY: external_exports.string().min(1).optional(),
   REGISTRY_SIGNING_KEYS: registrySigningKeysEnvSchema.optional()
@@ -18671,6 +18673,7 @@ var DEFAULT_RECONNECT_BACKOFF_FACTOR = 2;
 var DEFAULT_RECONNECT_JITTER_RATIO = 0.2;
 var DEFAULT_CONNECTOR_BASE_URL = "http://127.0.0.1:19400";
 var DEFAULT_CONNECTOR_OUTBOUND_PATH = "/v1/outbound";
+var DEFAULT_CONNECTOR_STATUS_PATH = "/v1/status";
 var DEFAULT_RELAY_DELIVER_TIMEOUT_MS = 15e3;
 var DEFAULT_OPENCLAW_DELIVER_RETRY_BUDGET_MS = DEFAULT_RELAY_DELIVER_TIMEOUT_MS - 1e3;
 var AGENT_ACCESS_HEADER = "x-claw-agent-access";
@@ -19598,6 +19601,7 @@ async function startConnectorRuntime(input) {
   });
   const outboundBaseUrl = normalizeOutboundBaseUrl(input.outboundBaseUrl);
   const outboundPath = normalizeOutboundPath(input.outboundPath);
+  const statusPath = DEFAULT_CONNECTOR_STATUS_PATH;
   const outboundUrl = new URL(outboundPath, outboundBaseUrl).toString();
   const relayToPeer = async (request) => {
     const peerUrl = new URL(request.peerProxyUrl);
@@ -19665,6 +19669,21 @@ async function startConnectorRuntime(input) {
   };
   const server = createServer(async (req, res) => {
     const requestPath = req.url ? new URL(req.url, outboundBaseUrl).pathname : "/";
+    if (requestPath === statusPath) {
+      if (req.method !== "GET") {
+        res.statusCode = 405;
+        res.setHeader("allow", "GET");
+        writeJson(res, 405, { error: "Method Not Allowed" });
+        return;
+      }
+      writeJson(res, 200, {
+        status: "ok",
+        outboundUrl,
+        websocketUrl: wsUrl,
+        websocketConnected: connectorClient.isConnected()
+      });
+      return;
+    }
     if (requestPath !== outboundPath) {
       writeJson(res, 404, { error: "Not Found" });
       return;
@@ -20921,11 +20940,13 @@ var createInviteCommand = (dependencies = {}) => {
 };
 
 // src/commands/openclaw.ts
+import { spawn } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
 import { existsSync } from "fs";
 import { chmod as chmod3, copyFile, mkdir as mkdir5, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname4, join as join6, resolve as resolvePath } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command7 } from "commander";
 var logger8 = createLogger({ service: "cli", module: "openclaw" });
 var CLAWDENTITY_DIR_NAME = ".clawdentity";
@@ -20960,10 +20981,13 @@ var DEFAULT_OPENCLAW_MAIN_SESSION_KEY = "main";
 var DEFAULT_OPENCLAW_AGENT_ID = "main";
 var DEFAULT_CONNECTOR_PORT = 19400;
 var DEFAULT_CONNECTOR_OUTBOUND_PATH3 = "/v1/outbound";
+var DEFAULT_CONNECTOR_STATUS_PATH2 = "/v1/status";
+var DEFAULT_SETUP_WAIT_TIMEOUT_SECONDS = 30;
 var CONNECTOR_HOST_LOOPBACK = "127.0.0.1";
 var CONNECTOR_HOST_DOCKER = "host.docker.internal";
 var CONNECTOR_HOST_DOCKER_GATEWAY = "gateway.docker.internal";
 var CONNECTOR_HOST_LINUX_BRIDGE = "172.17.0.1";
+var CONNECTOR_RUN_DIR_NAME = "run";
 var PEER_ALIAS_PATTERN = /^[a-zA-Z0-9._-]+$/;
 var FILE_MODE3 = 384;
 var OPENCLAW_HOOK_TOKEN_BYTES = 32;
@@ -21376,6 +21400,256 @@ function buildRelayConnectorBaseUrls(port) {
     buildConnectorBaseUrl(CONNECTOR_HOST_LOOPBACK, port)
   ];
 }
+function parseOpenclawRuntimeMode(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return "auto";
+  }
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "auto" || normalized === "service" || normalized === "detached") {
+    return normalized;
+  }
+  throw createCliError6(
+    "CLI_OPENCLAW_SETUP_RUNTIME_MODE_INVALID",
+    "runtimeMode must be one of: auto, service, detached"
+  );
+}
+function parseWaitTimeoutSeconds(value) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return DEFAULT_SETUP_WAIT_TIMEOUT_SECONDS;
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw createCliError6(
+      "CLI_OPENCLAW_SETUP_TIMEOUT_INVALID",
+      "waitTimeoutSeconds must be a positive integer"
+    );
+  }
+  return parsed;
+}
+function resolveConnectorStatusUrl(connectorBaseUrl) {
+  const normalizedBase = connectorBaseUrl.endsWith("/") ? connectorBaseUrl : `${connectorBaseUrl}/`;
+  return new URL(
+    DEFAULT_CONNECTOR_STATUS_PATH2.slice(1),
+    normalizedBase
+  ).toString();
+}
+function parseConnectorStatusPayload(payload) {
+  if (!isRecord8(payload) || typeof payload.websocketConnected !== "boolean") {
+    throw createCliError6(
+      "CLI_OPENCLAW_SETUP_CONNECTOR_STATUS_INVALID",
+      "Connector status response is invalid"
+    );
+  }
+  return {
+    websocketConnected: payload.websocketConnected
+  };
+}
+async function fetchConnectorHealthStatus(input) {
+  const statusUrl = resolveConnectorStatusUrl(input.connectorBaseUrl);
+  try {
+    const response = await input.fetchImpl(statusUrl, {
+      method: "GET",
+      headers: {
+        accept: "application/json"
+      }
+    });
+    if (!response.ok) {
+      return {
+        connected: false,
+        reachable: false,
+        statusUrl,
+        reason: `HTTP ${response.status}`
+      };
+    }
+    let payload;
+    try {
+      payload = await response.json();
+    } catch {
+      return {
+        connected: false,
+        reachable: false,
+        statusUrl,
+        reason: "invalid JSON payload"
+      };
+    }
+    const parsed = parseConnectorStatusPayload(payload);
+    return {
+      connected: parsed.websocketConnected,
+      reachable: true,
+      statusUrl,
+      reason: parsed.websocketConnected ? void 0 : "connector websocket is disconnected"
+    };
+  } catch {
+    return {
+      connected: false,
+      reachable: false,
+      statusUrl,
+      reason: "connector status endpoint is unreachable"
+    };
+  }
+}
+async function waitForConnectorConnected(input) {
+  const deadline = Date.now() + input.waitTimeoutSeconds * 1e3;
+  let latest = await fetchConnectorHealthStatus({
+    connectorBaseUrl: input.connectorBaseUrl,
+    fetchImpl: input.fetchImpl
+  });
+  while (!latest.connected && Date.now() < deadline) {
+    await new Promise((resolve2) => {
+      setTimeout(resolve2, 1e3);
+    });
+    latest = await fetchConnectorHealthStatus({
+      connectorBaseUrl: input.connectorBaseUrl,
+      fetchImpl: input.fetchImpl
+    });
+  }
+  if (!latest.connected) {
+    throw createCliError6(
+      "CLI_OPENCLAW_SETUP_CONNECTOR_NOT_READY",
+      `Connector runtime is not websocket-connected after ${input.waitTimeoutSeconds} seconds`,
+      {
+        connectorBaseUrl: input.connectorBaseUrl,
+        connectorStatusUrl: latest.statusUrl,
+        reason: latest.reason
+      }
+    );
+  }
+  return latest;
+}
+function resolveConnectorRunDir(homeDir) {
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
+}
+function resolveConnectorPidPath(homeDir, agentName) {
+  return join6(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
+}
+async function readConnectorPidFile(pidPath) {
+  try {
+    const raw = (await readFile4(pidPath, "utf8")).trim();
+    if (raw.length === 0) {
+      return void 0;
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isInteger(parsed) || parsed <= 0) {
+      return void 0;
+    }
+    return parsed;
+  } catch (error48) {
+    if (getErrorCode2(error48) === "ENOENT") {
+      return void 0;
+    }
+    throw error48;
+  }
+}
+function isPidRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function stopDetachedConnectorIfRunning(input) {
+  const pidPath = resolveConnectorPidPath(input.homeDir, input.agentName);
+  const pid = await readConnectorPidFile(pidPath);
+  if (pid === void 0 || !isPidRunning(pid)) {
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+  }
+}
+function resolveCliEntryPathForDetachedStart() {
+  const argvEntry = typeof process.argv[1] === "string" ? process.argv[1] : "";
+  if (argvEntry.length > 0 && existsSync(argvEntry)) {
+    return argvEntry;
+  }
+  const modulePath = fileURLToPath2(import.meta.url);
+  return join6(dirname4(modulePath), "..", "bin.js");
+}
+async function startDetachedConnectorRuntime(input) {
+  await stopDetachedConnectorIfRunning({
+    homeDir: input.homeDir,
+    agentName: input.agentName
+  });
+  const runDir = resolveConnectorRunDir(input.homeDir);
+  await mkdir5(runDir, { recursive: true });
+  const cliEntryPath = resolveCliEntryPathForDetachedStart();
+  const args = [
+    cliEntryPath,
+    "connector",
+    "start",
+    input.agentName,
+    "--openclaw-base-url",
+    input.openclawBaseUrl
+  ];
+  const child = spawn(process.execPath, args, {
+    detached: true,
+    stdio: "ignore",
+    env: process.env
+  });
+  child.unref();
+  await writeSecureFile3(
+    resolveConnectorPidPath(input.homeDir, input.agentName),
+    `${child.pid}
+`
+  );
+}
+async function startSetupConnectorRuntime(input) {
+  if (input.mode !== "service") {
+    const existingStatus = await fetchConnectorHealthStatus({
+      connectorBaseUrl: input.connectorBaseUrl,
+      fetchImpl: input.fetchImpl
+    });
+    if (existingStatus.connected) {
+      return {
+        runtimeMode: "existing",
+        runtimeStatus: "running",
+        websocketStatus: "connected",
+        connectorStatusUrl: existingStatus.statusUrl
+      };
+    }
+  }
+  let runtimeMode = "service";
+  if (input.mode === "detached") {
+    runtimeMode = "detached";
+  } else {
+    try {
+      await installConnectorServiceForAgent(input.agentName, {
+        platform: "auto",
+        openclawBaseUrl: input.openclawBaseUrl
+      });
+      runtimeMode = "service";
+    } catch (error48) {
+      if (input.mode === "service") {
+        throw error48;
+      }
+      runtimeMode = "detached";
+      logger8.warn("cli.openclaw.setup.service_fallback_detached", {
+        agentName: input.agentName,
+        reason: error48 instanceof Error ? error48.message : "unknown"
+      });
+    }
+  }
+  if (runtimeMode === "detached") {
+    await startDetachedConnectorRuntime({
+      agentName: input.agentName,
+      homeDir: input.homeDir,
+      openclawBaseUrl: input.openclawBaseUrl
+    });
+  }
+  const connectedStatus = await waitForConnectorConnected({
+    connectorBaseUrl: input.connectorBaseUrl,
+    fetchImpl: input.fetchImpl,
+    waitTimeoutSeconds: input.waitTimeoutSeconds
+  });
+  return {
+    runtimeMode,
+    runtimeStatus: "running",
+    websocketStatus: "connected",
+    connectorStatusUrl: connectedStatus.statusUrl
+  };
+}
 function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
   if (!isRecord8(value)) {
     throw createCliError6(
@@ -22054,6 +22328,97 @@ async function runOpenclawDoctor(options = {}) {
       })
     );
   }
+  if (options.includeConnectorRuntimeCheck !== false) {
+    if (selectedAgentName === void 0) {
+      checks.push(
+        toDoctorCheck({
+          id: "state.connectorRuntime",
+          label: "Connector runtime",
+          status: "fail",
+          message: "cannot validate connector runtime without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+        })
+      );
+    } else {
+      const connectorAssignmentsPath = resolveConnectorAssignmentsPath(homeDir);
+      try {
+        const connectorAssignments = await loadConnectorAssignments(
+          connectorAssignmentsPath
+        );
+        const assignment = connectorAssignments.agents[selectedAgentName];
+        if (assignment === void 0) {
+          checks.push(
+            toDoctorCheck({
+              id: "state.connectorRuntime",
+              label: "Connector runtime",
+              status: "fail",
+              message: `no connector assignment found for ${selectedAgentName}`,
+              remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+              details: { connectorAssignmentsPath, selectedAgentName }
+            })
+          );
+        } else {
+          const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+          if (typeof fetchImpl !== "function") {
+            checks.push(
+              toDoctorCheck({
+                id: "state.connectorRuntime",
+                label: "Connector runtime",
+                status: "fail",
+                message: "fetch implementation is unavailable for connector checks",
+                remediationHint: "Run doctor in a Node runtime with fetch support, or rerun openclaw setup"
+              })
+            );
+          } else {
+            const connectorStatus = await fetchConnectorHealthStatus({
+              connectorBaseUrl: assignment.connectorBaseUrl,
+              fetchImpl
+            });
+            if (connectorStatus.connected) {
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorRuntime",
+                  label: "Connector runtime",
+                  status: "pass",
+                  message: `connector websocket is connected (${assignment.connectorBaseUrl})`,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
+            } else {
+              const reason = connectorStatus.reason ?? "connector runtime is unavailable";
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorRuntime",
+                  label: "Connector runtime",
+                  status: "fail",
+                  message: `connector runtime is not ready: ${reason}`,
+                  remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
+            }
+          }
+        }
+      } catch {
+        checks.push(
+          toDoctorCheck({
+            id: "state.connectorRuntime",
+            label: "Connector runtime",
+            status: "fail",
+            message: `unable to read connector assignments at ${connectorAssignmentsPath}`,
+            remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+            details: { connectorAssignmentsPath }
+          })
+        );
+      }
+    }
+  }
   return toDoctorResult(checks);
 }
 function parseRelayProbeFailure(input) {
@@ -22135,7 +22500,8 @@ async function runOpenclawRelayTest(options) {
     homeDir,
     openclawDir,
     peerAlias,
-    resolveConfigImpl: options.resolveConfigImpl
+    resolveConfigImpl: options.resolveConfigImpl,
+    includeConnectorRuntimeCheck: false
   });
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath(homeDir);
   let openclawBaseUrl = DEFAULT_OPENCLAW_BASE_URL2;
@@ -22346,6 +22712,42 @@ async function setupOpenclawRelay(agentName, options) {
     relayRuntimeConfigPath
   };
 }
+async function setupOpenclawSelfReady(agentName, options) {
+  const setup = await setupOpenclawRelay(agentName, options);
+  if (options.noRuntimeStart === true) {
+    return {
+      ...setup,
+      runtimeMode: "none",
+      runtimeStatus: "skipped",
+      websocketStatus: "skipped"
+    };
+  }
+  const fetchImpl = globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw createCliError6(
+      "CLI_OPENCLAW_SETUP_FETCH_UNAVAILABLE",
+      "Runtime fetch is unavailable for connector readiness checks"
+    );
+  }
+  const resolvedMode = parseOpenclawRuntimeMode(options.runtimeMode);
+  const waitTimeoutSeconds = parseWaitTimeoutSeconds(
+    options.waitTimeoutSeconds
+  );
+  const resolvedHomeDir = resolveHomeDir(options.homeDir);
+  const runtime = await startSetupConnectorRuntime({
+    agentName: assertValidAgentName(agentName),
+    homeDir: resolvedHomeDir,
+    openclawBaseUrl: setup.openclawBaseUrl,
+    connectorBaseUrl: setup.connectorBaseUrl,
+    mode: resolvedMode,
+    waitTimeoutSeconds,
+    fetchImpl
+  });
+  return {
+    ...setup,
+    ...runtime
+  };
+}
 var createOpenclawCommand = () => {
   const openclawCommand = new Command7("openclaw").description(
     "Manage OpenClaw relay setup"
@@ -22359,11 +22761,20 @@ var createOpenclawCommand = () => {
   ).option(
     "--openclaw-base-url <url>",
     "Base URL for local OpenClaw hook API (default http://127.0.0.1:18789)"
+  ).option(
+    "--runtime-mode <mode>",
+    "Connector runtime mode: auto | service | detached (default auto)"
+  ).option(
+    "--wait-timeout-seconds <seconds>",
+    "Seconds to wait for connector websocket readiness (default 30)"
+  ).option(
+    "--no-runtime-start",
+    "Skip connector runtime startup (advanced/manual mode)"
   ).action(
     withErrorHandling(
       "openclaw setup",
       async (agentName, options) => {
-        const result = await setupOpenclawRelay(agentName, options);
+        const result = await setupOpenclawSelfReady(agentName, options);
         writeStdoutLine("Self setup complete");
         writeStdoutLine(
           `Updated OpenClaw config: ${result.openclawConfigPath}`
@@ -22380,6 +22791,14 @@ var createOpenclawCommand = () => {
         writeStdoutLine(
           `Relay runtime config: ${result.relayRuntimeConfigPath}`
         );
+        writeStdoutLine(`Runtime mode: ${result.runtimeMode}`);
+        writeStdoutLine(`Runtime status: ${result.runtimeStatus}`);
+        writeStdoutLine(`WebSocket status: ${result.websocketStatus}`);
+        if (result.connectorStatusUrl) {
+          writeStdoutLine(
+            `Connector status URL: ${result.connectorStatusUrl}`
+          );
+        }
       }
     )
   );
@@ -22471,13 +22890,15 @@ var PAIRING_QR_DIR_NAME = "pairing";
 var PEERS_FILE_NAME2 = "peers.json";
 var PAIR_START_PATH = "/pair/start";
 var PAIR_CONFIRM_PATH = "/pair/confirm";
-var OWNER_PAT_HEADER = "x-claw-owner-pat";
+var PAIR_STATUS_PATH = "/pair/status";
 var NONCE_SIZE2 = 24;
 var PAIRING_TICKET_PREFIX = "clwpair1_";
 var PAIRING_QR_MAX_AGE_SECONDS = 900;
 var PAIRING_QR_FILENAME_PATTERN = /-pair-(\d+)\.png$/;
 var FILE_MODE4 = 384;
 var PEER_ALIAS_PATTERN2 = /^[a-zA-Z0-9._-]+$/;
+var DEFAULT_STATUS_WAIT_SECONDS = 300;
+var DEFAULT_STATUS_POLL_INTERVAL_SECONDS = 3;
 var isRecord9 = (value) => {
   return typeof value === "object" && value !== null;
 };
@@ -22553,6 +22974,52 @@ function parsePairingTicketIssuerOrigin(ticket) {
   }
   return issuerUrl.origin;
 }
+function parseAitAgentDid(ait) {
+  const parts = ait.split(".");
+  if (parts.length < 2) {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payloadRaw;
+  try {
+    payloadRaw = new TextDecoder().decode(decodeBase64url(parts[1] ?? ""));
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadRaw);
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  if (!isRecord9(payload) || typeof payload.sub !== "string") {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  const candidate = payload.sub.trim();
+  try {
+    const parsed = parseDid(candidate);
+    if (parsed.kind !== "agent") {
+      throw new Error("invalid kind");
+    }
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_AGENT_NOT_FOUND",
+      "Agent AIT is invalid. Recreate the agent before pairing."
+    );
+  }
+  return candidate;
+}
 function parsePeerAlias2(value) {
   if (value.length === 0 || value.length > 128) {
     throw createCliError7(
@@ -22684,6 +23151,20 @@ function parseTtlSeconds(value) {
   }
   return parsed;
 }
+function parsePositiveIntegerOption(input) {
+  const raw = parseNonEmptyString9(input.value);
+  if (raw.length === 0) {
+    return input.defaultValue;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isInteger(parsed) || parsed < 1) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_WAIT_INVALID",
+      `${input.optionName} must be a positive integer`
+    );
+  }
+  return parsed;
+}
 function parseProxyUrl2(candidate) {
   try {
     const parsed = new URL(candidate);
@@ -22767,11 +23248,8 @@ async function executePairRequest(input) {
 function mapStartPairError(status, payload) {
   const code = extractErrorCode(payload);
   const message2 = extractErrorMessage(payload);
-  if (code === "PROXY_PAIR_OWNER_PAT_INVALID" || status === 401) {
-    return message2 ? `Owner PAT is invalid (401): ${message2}` : "Owner PAT is invalid or expired (401).";
-  }
-  if (code === "PROXY_PAIR_OWNER_PAT_FORBIDDEN" || status === 403) {
-    return message2 ? `Owner PAT does not control initiator agent DID (403): ${message2}` : "Owner PAT does not control initiator agent DID (403).";
+  if (code === "PROXY_PAIR_OWNERSHIP_FORBIDDEN" || status === 403) {
+    return message2 ? `Initiator agent ownership check failed (403): ${message2}` : "Initiator agent ownership check failed (403).";
   }
   if (status === 400) {
     return message2 ? `Pair start request is invalid (400): ${message2}` : "Pair start request is invalid (400).";
@@ -22804,6 +23282,29 @@ function mapConfirmPairError(status, payload) {
   }
   return `Pair confirm failed (${status})`;
 }
+function mapStatusPairError(status, payload) {
+  const code = extractErrorCode(payload);
+  const message2 = extractErrorMessage(payload);
+  if (code === "PROXY_PAIR_TICKET_NOT_FOUND" || status === 404) {
+    return "Pairing ticket not found";
+  }
+  if (code === "PROXY_PAIR_TICKET_EXPIRED" || status === 410) {
+    return "Pairing ticket has expired";
+  }
+  if (code === "PROXY_PAIR_STATUS_FORBIDDEN" || status === 403) {
+    return message2 ? `Pair status request is forbidden (403): ${message2}` : "Pair status request is forbidden (403).";
+  }
+  if (status === 400) {
+    return message2 ? `Pair status request is invalid (400): ${message2}` : "Pair status request is invalid (400).";
+  }
+  if (status >= 500) {
+    return `Proxy pairing service is unavailable (${status}).`;
+  }
+  if (message2) {
+    return `Pair status failed (${status}): ${message2}`;
+  }
+  return `Pair status failed (${status})`;
+}
 function parsePairStartResponse(payload) {
   if (!isRecord9(payload)) {
     throw createCliError7(
@@ -22848,6 +23349,44 @@ function parsePairConfirmResponse(payload) {
     responderAgentDid
   };
 }
+function parsePairStatusResponse(payload) {
+  if (!isRecord9(payload)) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const statusRaw = parseNonEmptyString9(payload.status);
+  if (statusRaw !== "pending" && statusRaw !== "confirmed") {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
+  const responderAgentDid = parseNonEmptyString9(payload.responderAgentDid);
+  const expiresAt = parseNonEmptyString9(payload.expiresAt);
+  const confirmedAt = parseNonEmptyString9(payload.confirmedAt);
+  if (initiatorAgentDid.length === 0 || expiresAt.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  if (statusRaw === "confirmed" && responderAgentDid.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_INVALID_RESPONSE",
+      "Pair status response is invalid"
+    );
+  }
+  return {
+    status: statusRaw,
+    initiatorAgentDid,
+    responderAgentDid: responderAgentDid.length > 0 ? responderAgentDid : void 0,
+    expiresAt,
+    confirmedAt: confirmedAt.length > 0 ? confirmedAt : void 0
+  };
+}
 async function readAgentProofMaterial(agentName, dependencies) {
   const readFileImpl = dependencies.readFileImpl ?? readFile5;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
@@ -22911,16 +23450,6 @@ async function readAgentProofMaterial(agentName, dependencies) {
     secretKey
   };
 }
-function resolveOwnerPat(options) {
-  const ownerPat = parseNonEmptyString9(options.explicitOwnerPat) || parseNonEmptyString9(options.config.apiKey);
-  if (ownerPat.length > 0) {
-    return ownerPat;
-  }
-  throw createCliError7(
-    "CLI_PAIR_START_OWNER_PAT_REQUIRED",
-    "Owner PAT is required. Pass --owner-pat <token> or configure API key with `clawdentity invite redeem` / `clawdentity config set apiKey <token>`."
-  );
-}
 async function buildSignedHeaders(input) {
   const signed = await signHttpRequest({
     method: input.method,
@@ -23076,10 +23605,6 @@ async function startPairing(agentName, options, dependencies = {}) {
   const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
   const ttlSeconds = parseTtlSeconds(options.ttlSeconds);
   const config2 = await resolveConfigImpl();
-  const ownerPat = resolveOwnerPat({
-    explicitOwnerPat: options.ownerPat,
-    config: config2
-  });
   const proxyUrl = await resolveProxyUrl({
     config: config2,
     fetchImpl
@@ -23111,7 +23636,6 @@ async function startPairing(agentName, options, dependencies = {}) {
       headers: {
         authorization: `Claw ${ait}`,
         "content-type": "application/json",
-        [OWNER_PAT_HEADER]: ownerPat,
         ...signedHeaders
       },
       body: requestBody
@@ -23238,14 +23762,157 @@ async function confirmPairing(agentName, options, dependencies = {}) {
     peerAlias
   };
 }
+async function getPairingStatusOnce(agentName, options, dependencies = {}) {
+  const fetchImpl = dependencies.fetchImpl ?? fetch;
+  const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
+  const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
+  const config2 = await resolveConfigImpl();
+  const proxyUrl = await resolveProxyUrl({
+    config: config2,
+    fetchImpl
+  });
+  const ticket = parsePairingTicket(options.ticket);
+  const { ait, secretKey } = await readAgentProofMaterial(
+    agentName,
+    dependencies
+  );
+  const callerAgentDid = parseAitAgentDid(ait);
+  const requestUrl = toProxyRequestUrl(proxyUrl, PAIR_STATUS_PATH);
+  const requestBody = JSON.stringify({ ticket });
+  const bodyBytes = new TextEncoder().encode(requestBody);
+  const timestampSeconds = nowSecondsImpl();
+  const nonce = nonceFactoryImpl();
+  const signedHeaders = await buildSignedHeaders({
+    method: "POST",
+    requestUrl,
+    bodyBytes,
+    secretKey,
+    timestampSeconds,
+    nonce
+  });
+  const response = await executePairRequest({
+    fetchImpl,
+    url: requestUrl,
+    init: {
+      method: "POST",
+      headers: {
+        authorization: `Claw ${ait}`,
+        "content-type": "application/json",
+        ...signedHeaders
+      },
+      body: requestBody
+    }
+  });
+  const responseBody = await parseJsonResponse6(response);
+  if (!response.ok) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_FAILED",
+      mapStatusPairError(response.status, responseBody)
+    );
+  }
+  const parsed = parsePairStatusResponse(responseBody);
+  let peerAlias;
+  if (parsed.status === "confirmed") {
+    const responderAgentDid = parsed.responderAgentDid;
+    if (!responderAgentDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_INVALID_RESPONSE",
+        "Pair status response is invalid"
+      );
+    }
+    const peerDid = callerAgentDid === parsed.initiatorAgentDid ? responderAgentDid : callerAgentDid === responderAgentDid ? parsed.initiatorAgentDid : void 0;
+    if (!peerDid) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_FORBIDDEN",
+        "Local agent is not a participant in the pairing ticket"
+      );
+    }
+    peerAlias = await persistPairedPeer({
+      ticket,
+      peerDid,
+      dependencies
+    });
+  }
+  return {
+    ...parsed,
+    proxyUrl,
+    peerAlias
+  };
+}
+async function waitForPairingStatus(input) {
+  const nowSecondsImpl = input.dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
+  const sleepImpl = input.dependencies.sleepImpl ?? (async (ms) => {
+    await new Promise((resolve2) => {
+      setTimeout(resolve2, ms);
+    });
+  });
+  const deadlineSeconds = nowSecondsImpl() + input.waitSeconds;
+  while (true) {
+    const status = await getPairingStatusOnce(
+      input.agentName,
+      { ticket: input.ticket },
+      input.dependencies
+    );
+    if (status.status === "confirmed") {
+      return status;
+    }
+    const nowSeconds = nowSecondsImpl();
+    if (nowSeconds >= deadlineSeconds) {
+      throw createCliError7(
+        "CLI_PAIR_STATUS_WAIT_TIMEOUT",
+        `Pairing is still pending after ${input.waitSeconds} seconds`
+      );
+    }
+    const remainingSeconds = Math.max(0, deadlineSeconds - nowSeconds);
+    const sleepSeconds = Math.min(input.pollIntervalSeconds, remainingSeconds);
+    await sleepImpl(sleepSeconds * 1e3);
+  }
+}
+async function getPairingStatus(agentName, options, dependencies = {}) {
+  const ticketRaw = parseNonEmptyString9(options.ticket);
+  if (ticketRaw.length === 0) {
+    throw createCliError7(
+      "CLI_PAIR_STATUS_TICKET_REQUIRED",
+      "Pair status requires --ticket <clwpair1_...>"
+    );
+  }
+  const ticket = parsePairingTicket(ticketRaw);
+  if (options.wait !== true) {
+    return getPairingStatusOnce(agentName, { ticket }, dependencies);
+  }
+  const waitSeconds = parsePositiveIntegerOption({
+    value: options.waitSeconds,
+    optionName: "waitSeconds",
+    defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+  });
+  const pollIntervalSeconds = parsePositiveIntegerOption({
+    value: options.pollIntervalSeconds,
+    optionName: "pollIntervalSeconds",
+    defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+  });
+  return waitForPairingStatus({
+    agentName,
+    ticket,
+    waitSeconds,
+    pollIntervalSeconds,
+    dependencies
+  });
+}
 var createPairCommand = (dependencies = {}) => {
   const pairCommand = new Command8("pair").description(
     "Manage proxy trust pairing between agents"
   );
-  pairCommand.command("start <agentName>").description("Start pairing and issue one-time pairing ticket").option(
-    "--owner-pat <token>",
-    "Owner PAT override (defaults to configured API key)"
-  ).option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").action(
+  pairCommand.command("start <agentName>").description("Start pairing and issue one-time pairing ticket").option("--ttl-seconds <seconds>", "Pairing ticket expiry in seconds").option("--qr", "Generate a local QR file for sharing").option("--qr-output <path>", "Write QR PNG to a specific file path").option(
+    "--wait",
+    "Wait for responder confirmation and auto-save peer on initiator"
+  ).option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
     withErrorHandling(
       "pair start",
       async (agentName, options) => {
@@ -23263,6 +23930,48 @@ var createPairCommand = (dependencies = {}) => {
         if (result.qrPath) {
           writeStdoutLine(`QR File: ${result.qrPath}`);
         }
+        if (options.wait === true) {
+          const waitSeconds = parsePositiveIntegerOption({
+            value: options.waitSeconds,
+            optionName: "waitSeconds",
+            defaultValue: DEFAULT_STATUS_WAIT_SECONDS
+          });
+          const pollIntervalSeconds = parsePositiveIntegerOption({
+            value: options.pollIntervalSeconds,
+            optionName: "pollIntervalSeconds",
+            defaultValue: DEFAULT_STATUS_POLL_INTERVAL_SECONDS
+          });
+          writeStdoutLine(
+            `Waiting for confirmation (timeout=${waitSeconds}s, interval=${pollIntervalSeconds}s) ...`
+          );
+          const status = await waitForPairingStatus({
+            agentName,
+            ticket: result.ticket,
+            waitSeconds,
+            pollIntervalSeconds,
+            dependencies
+          });
+          logger9.info("cli.pair_status_confirmed_after_start", {
+            initiatorAgentDid: status.initiatorAgentDid,
+            responderAgentDid: status.responderAgentDid,
+            peerAlias: status.peerAlias
+          });
+          writeStdoutLine("Pairing confirmed");
+          writeStdoutLine(`Status: ${status.status}`);
+          if (status.initiatorAgentDid) {
+            writeStdoutLine(
+              `Initiator Agent DID: ${status.initiatorAgentDid}`
+            );
+          }
+          if (status.responderAgentDid) {
+            writeStdoutLine(
+              `Responder Agent DID: ${status.responderAgentDid}`
+            );
+          }
+          if (status.peerAlias) {
+            writeStdoutLine(`Peer alias saved: ${status.peerAlias}`);
+          }
+        }
       }
     )
   );
@@ -23287,6 +23996,43 @@ var createPairCommand = (dependencies = {}) => {
       }
     )
   );
+  pairCommand.command("status <agentName>").description("Check pairing ticket status and sync local peer on confirm").option("--ticket <ticket>", "One-time pairing ticket (clwpair1_...)").option("--wait", "Poll until ticket is confirmed or timeout is reached").option(
+    "--wait-seconds <seconds>",
+    "Max seconds to poll for confirmation (default: 300)"
+  ).option(
+    "--poll-interval-seconds <seconds>",
+    "Polling interval in seconds while waiting (default: 3)"
+  ).action(
+    withErrorHandling(
+      "pair status",
+      async (agentName, options) => {
+        const result = await getPairingStatus(
+          agentName,
+          options,
+          dependencies
+        );
+        logger9.info("cli.pair_status", {
+          initiatorAgentDid: result.initiatorAgentDid,
+          responderAgentDid: result.responderAgentDid,
+          status: result.status,
+          proxyUrl: result.proxyUrl,
+          peerAlias: result.peerAlias
+        });
+        writeStdoutLine(`Status: ${result.status}`);
+        writeStdoutLine(`Initiator Agent DID: ${result.initiatorAgentDid}`);
+        if (result.responderAgentDid) {
+          writeStdoutLine(`Responder Agent DID: ${result.responderAgentDid}`);
+        }
+        writeStdoutLine(`Expires At: ${result.expiresAt}`);
+        if (result.confirmedAt) {
+          writeStdoutLine(`Confirmed At: ${result.confirmedAt}`);
+        }
+        if (result.peerAlias) {
+          writeStdoutLine(`Peer alias saved: ${result.peerAlias}`);
+        }
+      }
+    )
+  );
   return pairCommand;
 };
 
@@ -23299,7 +24045,7 @@ import { access as access3, copyFile as copyFile2, mkdir as mkdir7, readdir as r
 import { createRequire } from "module";
 import { homedir as homedir4 } from "os";
 import { dirname as dirname6, join as join8, relative } from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import { fileURLToPath as fileURLToPath3 } from "url";
 var OPENCLAW_DIR_NAME2 = ".openclaw";
 var SKILL_PACKAGE_NAME = "@clawdentity/openclaw-skill";
 var SKILL_DIR_NAME2 = "clawdentity-openclaw-relay";
@@ -23344,7 +24090,7 @@ function resolveSkillPackageRoot(input) {
     return overriddenRoot.trim();
   }
   const bundledSkillRoot = join8(
-    dirname6(fileURLToPath2(import.meta.url)),
+    dirname6(fileURLToPath3(import.meta.url)),
     "..",
     "skill-bundle",
     "openclaw-skill"
@@ -23359,7 +24105,7 @@ function resolveSkillPackageRoot(input) {
     return dirname6(packageJsonPath);
   } catch {
     const workspaceFallbackRoot = join8(
-      dirname6(fileURLToPath2(import.meta.url)),
+      dirname6(fileURLToPath3(import.meta.url)),
       "..",
       "..",
       "openclaw-skill"
@@ -23452,11 +24198,7 @@ async function resolveArtifacts(input) {
       }
     });
   }
-  const targetSkillRoot = join8(
-    input.openclawDir,
-    "skills",
-    SKILL_DIR_NAME2
-  );
+  const targetSkillRoot = join8(input.openclawDir, "skills", SKILL_DIR_NAME2);
   const artifacts = [
     {
       sourcePath: skillDocSource,