clawdentity 0.0.18 → 0.0.20

package/dist/bin.js

@@ -18656,9 +18656,9 @@ var createConfigCommand = (dependencies = {}) => {
 
 // src/commands/connector.ts
 import { execFile as execFileCallback } from "child_process";
-import { mkdir as mkdir4, readFile as readFile4, rm, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile5, rm, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 
@@ -18681,6 +18681,13 @@ var DEFAULT_CONNECTOR_OUTBOUND_PATH = "/v1/outbound";
 var DEFAULT_CONNECTOR_STATUS_PATH = "/v1/status";
 var DEFAULT_RELAY_DELIVER_TIMEOUT_MS = 15e3;
 var DEFAULT_OPENCLAW_DELIVER_RETRY_BUDGET_MS = DEFAULT_RELAY_DELIVER_TIMEOUT_MS - 1e3;
+var DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_MESSAGES = 1e5;
+var DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_BYTES = 2 * 1024 * 1024 * 1024;
+var DEFAULT_CONNECTOR_INBOUND_REPLAY_INTERVAL_MS = 2e3;
+var DEFAULT_CONNECTOR_INBOUND_REPLAY_BATCH_SIZE = 25;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS = 1e3;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS = 6e4;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR = 2;
 var AGENT_ACCESS_HEADER = "x-claw-agent-access";
 var WS_READY_STATE_OPEN = 1;
 
@@ -18942,6 +18949,7 @@ var ConnectorClient = class {
   fetchImpl;
   logger;
   hooks;
+  inboundDeliverHandler;
   now;
   random;
   ulidFactory;
@@ -18996,6 +19004,7 @@ var ConnectorClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.logger = options.logger ?? createLogger({ service: "connector", module: "client" });
     this.hooks = options.hooks ?? {};
+    this.inboundDeliverHandler = options.inboundDeliverHandler;
     this.now = options.now ?? Date.now;
     this.random = options.random ?? Math.random;
     this.ulidFactory = options.ulidFactory ?? generateUlid;
@@ -19208,6 +19217,44 @@ var ConnectorClient = class {
     this.sendFrame(ackFrame);
   }
   async handleDeliverFrame(frame) {
+    if (this.inboundDeliverHandler !== void 0) {
+      try {
+        const result = await this.inboundDeliverHandler(frame);
+        const ackFrame = {
+          v: CONNECTOR_FRAME_VERSION,
+          type: "deliver_ack",
+          id: this.makeFrameId(),
+          ts: this.makeTimestamp(),
+          ackId: frame.id,
+          accepted: result.accepted,
+          reason: result.reason
+        };
+        this.sendFrame(ackFrame);
+        if (result.accepted) {
+          this.hooks.onDeliverSucceeded?.(frame);
+        } else {
+          this.hooks.onDeliverFailed?.(
+            frame,
+            new Error(
+              result.reason ?? "Inbound delivery was rejected by runtime handler"
+            )
+          );
+        }
+      } catch (error48) {
+        const ackFrame = {
+          v: CONNECTOR_FRAME_VERSION,
+          type: "deliver_ack",
+          id: this.makeFrameId(),
+          ts: this.makeTimestamp(),
+          ackId: frame.id,
+          accepted: false,
+          reason: sanitizeErrorReason(error48)
+        };
+        this.sendFrame(ackFrame);
+        this.hooks.onDeliverFailed?.(frame, error48);
+      }
+      return;
+    }
     try {
       await this.deliverToLocalOpenclawWithRetry(frame);
       const ackFrame = {
@@ -19323,13 +19370,353 @@ var ConnectorClient = class {
   }
 };
 
+// ../../packages/connector/src/inbound-inbox.ts
+import {
+  appendFile,
+  mkdir as mkdir3,
+  readFile as readFile3,
+  rename as rename2,
+  writeFile as writeFile3
+} from "fs/promises";
+import { dirname as dirname2, join as join4 } from "path";
+var INBOUND_INBOX_DIR_NAME = "inbound-inbox";
+var INBOUND_INBOX_INDEX_FILE_NAME = "index.json";
+var INBOUND_INBOX_EVENTS_FILE_NAME = "events.jsonl";
+var INBOUND_INBOX_SCHEMA_VERSION = 1;
+function nowIso2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null;
+}
+function parsePendingItem(value) {
+  if (!isRecord5(value)) {
+    return void 0;
+  }
+  const id = typeof value.id === "string" ? value.id.trim() : "";
+  const requestId = typeof value.requestId === "string" ? value.requestId.trim() : "";
+  const fromAgentDid = typeof value.fromAgentDid === "string" ? value.fromAgentDid.trim() : "";
+  const toAgentDid = typeof value.toAgentDid === "string" ? value.toAgentDid.trim() : "";
+  const receivedAt = typeof value.receivedAt === "string" ? value.receivedAt.trim() : "";
+  const nextAttemptAt = typeof value.nextAttemptAt === "string" ? value.nextAttemptAt.trim() : "";
+  const attemptCount = typeof value.attemptCount === "number" && Number.isInteger(value.attemptCount) ? value.attemptCount : NaN;
+  const payloadBytes = typeof value.payloadBytes === "number" && Number.isInteger(value.payloadBytes) ? value.payloadBytes : NaN;
+  if (id.length === 0 || requestId.length === 0 || fromAgentDid.length === 0 || toAgentDid.length === 0 || receivedAt.length === 0 || nextAttemptAt.length === 0 || !Number.isFinite(attemptCount) || attemptCount < 0 || !Number.isFinite(payloadBytes) || payloadBytes < 0) {
+    return void 0;
+  }
+  const lastError = typeof value.lastError === "string" ? value.lastError : void 0;
+  const lastAttemptAt = typeof value.lastAttemptAt === "string" ? value.lastAttemptAt : void 0;
+  return {
+    id,
+    requestId,
+    fromAgentDid,
+    toAgentDid,
+    payload: value.payload,
+    payloadBytes,
+    receivedAt,
+    nextAttemptAt,
+    attemptCount,
+    lastError,
+    lastAttemptAt
+  };
+}
+function toDefaultIndexFile() {
+  return {
+    version: INBOUND_INBOX_SCHEMA_VERSION,
+    pendingBytes: 0,
+    pendingByRequestId: {},
+    updatedAt: nowIso2()
+  };
+}
+function normalizeIndexFile(raw) {
+  if (!isRecord5(raw)) {
+    throw new Error("Inbound inbox index root must be an object");
+  }
+  const pendingByRequestIdRaw = raw.pendingByRequestId;
+  if (!isRecord5(pendingByRequestIdRaw)) {
+    throw new Error("Inbound inbox index pendingByRequestId must be an object");
+  }
+  const pendingByRequestId = {};
+  let pendingBytes = 0;
+  for (const [requestId, candidate] of Object.entries(pendingByRequestIdRaw)) {
+    const entry = parsePendingItem(candidate);
+    if (entry === void 0 || entry.requestId !== requestId) {
+      continue;
+    }
+    pendingByRequestId[requestId] = entry;
+    pendingBytes += entry.payloadBytes;
+  }
+  return {
+    version: typeof raw.version === "number" && Number.isFinite(raw.version) ? raw.version : INBOUND_INBOX_SCHEMA_VERSION,
+    pendingBytes,
+    pendingByRequestId,
+    updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.trim().length > 0 ? raw.updatedAt : nowIso2()
+  };
+}
+function toComparableTimeMs(value) {
+  const parsed = Date.parse(value);
+  if (Number.isFinite(parsed)) {
+    return parsed;
+  }
+  return Number.MAX_SAFE_INTEGER;
+}
+var ConnectorInboundInbox = class {
+  agentName;
+  eventsPath;
+  indexPath;
+  maxPendingBytes;
+  maxPendingMessages;
+  inboxDir;
+  writeChain = Promise.resolve();
+  constructor(options) {
+    this.agentName = options.agentName;
+    this.inboxDir = join4(
+      options.configDir,
+      "agents",
+      this.agentName,
+      INBOUND_INBOX_DIR_NAME
+    );
+    this.indexPath = join4(this.inboxDir, INBOUND_INBOX_INDEX_FILE_NAME);
+    this.eventsPath = join4(this.inboxDir, INBOUND_INBOX_EVENTS_FILE_NAME);
+    this.maxPendingBytes = options.maxPendingBytes;
+    this.maxPendingMessages = options.maxPendingMessages;
+  }
+  async enqueue(frame) {
+    return await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const existing = index.pendingByRequestId[frame.id];
+      if (existing !== void 0) {
+        await this.appendEvent({
+          type: "inbound_duplicate",
+          requestId: frame.id
+        });
+        return {
+          accepted: true,
+          duplicate: true,
+          pendingCount: Object.keys(index.pendingByRequestId).length
+        };
+      }
+      const payloadBytes = Buffer.byteLength(
+        JSON.stringify(frame.payload ?? null),
+        "utf8"
+      );
+      const pendingCount = Object.keys(index.pendingByRequestId).length;
+      if (pendingCount >= this.maxPendingMessages) {
+        return {
+          accepted: false,
+          duplicate: false,
+          pendingCount,
+          reason: "connector inbound inbox is full (message cap reached)"
+        };
+      }
+      if (index.pendingBytes + payloadBytes > this.maxPendingBytes) {
+        return {
+          accepted: false,
+          duplicate: false,
+          pendingCount,
+          reason: "connector inbound inbox is full (byte cap reached)"
+        };
+      }
+      const pendingItem = {
+        id: frame.id,
+        requestId: frame.id,
+        fromAgentDid: frame.fromAgentDid,
+        toAgentDid: frame.toAgentDid,
+        payload: frame.payload,
+        payloadBytes,
+        receivedAt: nowIso2(),
+        nextAttemptAt: nowIso2(),
+        attemptCount: 0
+      };
+      index.pendingByRequestId[pendingItem.requestId] = pendingItem;
+      index.pendingBytes += pendingItem.payloadBytes;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "inbound_persisted",
+        requestId: pendingItem.requestId,
+        details: {
+          payloadBytes,
+          fromAgentDid: pendingItem.fromAgentDid,
+          toAgentDid: pendingItem.toAgentDid
+        }
+      });
+      return {
+        accepted: true,
+        duplicate: false,
+        pendingCount: Object.keys(index.pendingByRequestId).length
+      };
+    });
+  }
+  async listDuePending(input) {
+    const index = await this.loadIndex();
+    const due = Object.values(index.pendingByRequestId).filter((item) => toComparableTimeMs(item.nextAttemptAt) <= input.nowMs).sort((left, right) => {
+      const leftNext = toComparableTimeMs(left.nextAttemptAt);
+      const rightNext = toComparableTimeMs(right.nextAttemptAt);
+      if (leftNext !== rightNext) {
+        return leftNext - rightNext;
+      }
+      return toComparableTimeMs(left.receivedAt) - toComparableTimeMs(right.receivedAt);
+    });
+    return due.slice(0, Math.max(1, input.limit));
+  }
+  async markDelivered(requestId) {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const entry = index.pendingByRequestId[requestId];
+      if (entry === void 0) {
+        return;
+      }
+      delete index.pendingByRequestId[requestId];
+      index.pendingBytes = Math.max(0, index.pendingBytes - entry.payloadBytes);
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "replay_succeeded",
+        requestId
+      });
+    });
+  }
+  async markReplayFailure(input) {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const entry = index.pendingByRequestId[input.requestId];
+      if (entry === void 0) {
+        return;
+      }
+      entry.attemptCount += 1;
+      entry.lastError = input.errorMessage;
+      entry.lastAttemptAt = nowIso2();
+      entry.nextAttemptAt = input.nextAttemptAt;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "replay_failed",
+        requestId: input.requestId,
+        details: {
+          attemptCount: entry.attemptCount,
+          nextAttemptAt: input.nextAttemptAt,
+          errorMessage: input.errorMessage
+        }
+      });
+    });
+  }
+  async pruneDelivered() {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const beforeCount = Object.keys(index.pendingByRequestId).length;
+      if (beforeCount === 0) {
+        return;
+      }
+      const after = {};
+      let pendingBytes = 0;
+      for (const [requestId, entry] of Object.entries(
+        index.pendingByRequestId
+      )) {
+        if (entry.attemptCount < 0) {
+          continue;
+        }
+        after[requestId] = entry;
+        pendingBytes += entry.payloadBytes;
+      }
+      index.pendingByRequestId = after;
+      index.pendingBytes = pendingBytes;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "inbox_pruned",
+        details: {
+          beforeCount,
+          afterCount: Object.keys(after).length
+        }
+      });
+    });
+  }
+  async getSnapshot() {
+    const index = await this.loadIndex();
+    const entries = Object.values(index.pendingByRequestId);
+    if (entries.length === 0) {
+      return {
+        pendingCount: 0,
+        pendingBytes: index.pendingBytes
+      };
+    }
+    entries.sort((left, right) => {
+      return toComparableTimeMs(left.receivedAt) - toComparableTimeMs(right.receivedAt);
+    });
+    const nextAttemptAt = entries.map((entry) => entry.nextAttemptAt).sort(
+      (left, right) => toComparableTimeMs(left) - toComparableTimeMs(right)
+    )[0];
+    return {
+      pendingCount: entries.length,
+      pendingBytes: index.pendingBytes,
+      oldestPendingAt: entries[0]?.receivedAt,
+      nextAttemptAt
+    };
+  }
+  async withWriteLock(fn) {
+    const previous = this.writeChain;
+    let release;
+    this.writeChain = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    await previous;
+    try {
+      return await fn();
+    } finally {
+      release?.();
+    }
+  }
+  async loadIndex() {
+    await mkdir3(this.inboxDir, { recursive: true });
+    let raw;
+    try {
+      raw = await readFile3(this.indexPath, "utf8");
+    } catch (error48) {
+      if (error48 && typeof error48 === "object" && "code" in error48 && error48.code === "ENOENT") {
+        return toDefaultIndexFile();
+      }
+      throw error48;
+    }
+    if (raw.trim().length === 0) {
+      return toDefaultIndexFile();
+    }
+    const parsed = JSON.parse(raw);
+    return normalizeIndexFile(parsed);
+  }
+  async saveIndex(index) {
+    await mkdir3(dirname2(this.indexPath), { recursive: true });
+    const payload = {
+      ...index,
+      version: INBOUND_INBOX_SCHEMA_VERSION,
+      updatedAt: nowIso2()
+    };
+    const tmpPath = `${this.indexPath}.tmp-${Date.now()}`;
+    await writeFile3(tmpPath, `${JSON.stringify(payload, null, 2)}
+`, "utf8");
+    await rename2(tmpPath, this.indexPath);
+  }
+  async appendEvent(event) {
+    await mkdir3(dirname2(this.eventsPath), { recursive: true });
+    await appendFile(
+      this.eventsPath,
+      `${JSON.stringify({ ...event, at: nowIso2() })}
+`,
+      "utf8"
+    );
+  }
+};
+function createConnectorInboundInbox(options) {
+  return new ConnectorInboundInbox(options);
+}
+
 // ../../packages/connector/src/runtime.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, rename as rename3, writeFile as writeFile4 } from "fs/promises";
 import {
   createServer
 } from "http";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { WebSocket as NodeWebSocket } from "ws";
 var REGISTRY_AUTH_FILENAME = "registry-auth.json";
 var AGENTS_DIR_NAME2 = "agents";
@@ -19337,7 +19724,7 @@ var REFRESH_SINGLE_FLIGHT_PREFIX = "connector-runtime";
 var NONCE_SIZE = 16;
 var MAX_OUTBOUND_BODY_BYTES = 1024 * 1024;
 var ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null;
 }
 function toPathWithQuery2(url2) {
@@ -19405,6 +19792,121 @@ function resolveOpenclawHookToken(input) {
   }
   return value;
 }
+function toOpenclawHookUrl2(baseUrl, hookPath) {
+  const normalizedBase = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  const normalizedHookPath = hookPath.startsWith("/") ? hookPath.slice(1) : hookPath;
+  return new URL(normalizedHookPath, normalizedBase).toString();
+}
+function parsePositiveIntEnv(key, fallback, minimum = 1) {
+  const raw = process.env[key]?.trim();
+  if (!raw) {
+    return fallback;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < minimum) {
+    return fallback;
+  }
+  return parsed;
+}
+function sanitizeErrorReason2(error48) {
+  if (!(error48 instanceof Error)) {
+    return "Unknown error";
+  }
+  return error48.message.trim().slice(0, 240) || "Unknown error";
+}
+var LocalOpenclawDeliveryError2 = class extends Error {
+  retryable;
+  constructor(input) {
+    super(input.message);
+    this.name = "LocalOpenclawDeliveryError";
+    this.retryable = input.retryable;
+  }
+};
+function loadInboundReplayPolicy() {
+  const retryBackoffFactor = Number.parseFloat(
+    process.env.CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR ?? ""
+  );
+  return {
+    inboxMaxMessages: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_INBOX_MAX_MESSAGES",
+      DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_MESSAGES
+    ),
+    inboxMaxBytes: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_INBOX_MAX_BYTES",
+      DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_BYTES
+    ),
+    replayIntervalMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_REPLAY_INTERVAL_MS",
+      DEFAULT_CONNECTOR_INBOUND_REPLAY_INTERVAL_MS
+    ),
+    batchSize: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_REPLAY_BATCH_SIZE",
+      DEFAULT_CONNECTOR_INBOUND_REPLAY_BATCH_SIZE
+    ),
+    retryInitialDelayMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS",
+      DEFAULT_CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS
+    ),
+    retryMaxDelayMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS",
+      DEFAULT_CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS
+    ),
+    retryBackoffFactor: Number.isFinite(retryBackoffFactor) && retryBackoffFactor >= 1 ? retryBackoffFactor : DEFAULT_CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR
+  };
+}
+function computeReplayDelayMs(input) {
+  const exponent = Math.max(0, input.attemptCount - 1);
+  const delay = Math.min(
+    input.policy.retryMaxDelayMs,
+    Math.floor(
+      input.policy.retryInitialDelayMs * input.policy.retryBackoffFactor ** exponent
+    )
+  );
+  return Math.max(1, delay);
+}
+async function deliverToOpenclawHook(input) {
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => {
+    controller.abort();
+  }, DEFAULT_OPENCLAW_DELIVER_TIMEOUT_MS);
+  const headers = {
+    "content-type": "application/json",
+    "x-request-id": input.requestId
+  };
+  if (input.openclawHookToken !== void 0) {
+    headers["x-openclaw-token"] = input.openclawHookToken;
+  }
+  try {
+    const response = await input.fetchImpl(input.openclawHookUrl, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(input.payload),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new LocalOpenclawDeliveryError2({
+        message: `Local OpenClaw hook rejected payload with status ${response.status}`,
+        retryable: response.status >= 500 || response.status === 404 || response.status === 429
+      });
+    }
+  } catch (error48) {
+    if (error48 instanceof Error && error48.name === "AbortError") {
+      throw new LocalOpenclawDeliveryError2({
+        message: "Local OpenClaw hook request timed out",
+        retryable: true
+      });
+    }
+    if (error48 instanceof LocalOpenclawDeliveryError2) {
+      throw error48;
+    }
+    throw new LocalOpenclawDeliveryError2({
+      message: sanitizeErrorReason2(error48),
+      retryable: true
+    });
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
 function toInitialAuthBundle(credentials) {
   return {
     tokenType: "Bearer",
@@ -19432,7 +19934,7 @@ function shouldRefreshAccessToken(auth, nowMs) {
   return expiresAtMs <= nowMs + ACCESS_TOKEN_REFRESH_SKEW_MS;
 }
 function parseOutboundRelayRequest(payload) {
-  if (!isRecord5(payload)) {
+  if (!isRecord6(payload)) {
     throw new AppError({
       code: "CONNECTOR_OUTBOUND_INVALID_REQUEST",
       message: "Outbound relay request must be an object",
@@ -19490,20 +19992,20 @@ function createWebSocketFactory() {
   };
 }
 async function writeRegistryAuthAtomic(input) {
-  const targetPath = join4(
+  const targetPath = join5(
     input.configDir,
     AGENTS_DIR_NAME2,
     input.agentName,
     REGISTRY_AUTH_FILENAME
   );
   const tmpPath = `${targetPath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  await mkdir3(dirname2(targetPath), { recursive: true });
-  await writeFile3(tmpPath, `${JSON.stringify(input.auth, null, 2)}
+  await mkdir4(dirname3(targetPath), { recursive: true });
+  await writeFile4(tmpPath, `${JSON.stringify(input.auth, null, 2)}
 `, "utf8");
-  await rename2(tmpPath, targetPath);
+  await rename3(tmpPath, targetPath);
 }
 function parseRegistryAuthFromDisk(payload) {
-  if (!isRecord5(payload)) {
+  if (!isRecord6(payload)) {
     return void 0;
   }
   const tokenType = payload.tokenType;
@@ -19523,7 +20025,7 @@ function parseRegistryAuthFromDisk(payload) {
   };
 }
 async function readRegistryAuthFromDisk(input) {
-  const authPath = join4(
+  const authPath = join5(
     input.configDir,
     AGENTS_DIR_NAME2,
     input.agentName,
@@ -19531,7 +20033,7 @@ async function readRegistryAuthFromDisk(input) {
   );
   let raw;
   try {
-    raw = await readFile3(authPath, "utf8");
+    raw = await readFile4(authPath, "utf8");
   } catch (error48) {
     if (error48 && typeof error48 === "object" && "code" in error48 && error48.code === "ENOENT") {
       return void 0;
@@ -19660,6 +20162,23 @@ async function startConnectorRuntime(input) {
   await refreshCurrentAuthIfNeeded();
   const wsUrl = normalizeWebSocketUrl(input.proxyWebsocketUrl);
   const wsParsed = new URL(wsUrl);
+  const openclawBaseUrl = resolveOpenclawBaseUrl(input.openclawBaseUrl);
+  const openclawHookPath = resolveOpenclawHookPath(input.openclawHookPath);
+  const openclawHookToken = resolveOpenclawHookToken(input.openclawHookToken);
+  const openclawHookUrl = toOpenclawHookUrl2(openclawBaseUrl, openclawHookPath);
+  const inboundReplayPolicy = loadInboundReplayPolicy();
+  const inboundInbox = createConnectorInboundInbox({
+    configDir: input.configDir,
+    agentName: input.agentName,
+    maxPendingMessages: inboundReplayPolicy.inboxMaxMessages,
+    maxPendingBytes: inboundReplayPolicy.inboxMaxBytes
+  });
+  const inboundReplayStatus = {
+    replayerActive: false
+  };
+  let runtimeStopping = false;
+  let replayInFlight = false;
+  let replayIntervalHandle;
   const resolveUpgradeHeaders = async () => {
     await refreshCurrentAuthIfNeeded();
     return buildUpgradeHeaders({
@@ -19669,14 +20188,108 @@ async function startConnectorRuntime(input) {
       secretKey
     });
   };
+  const replayPendingInboundMessages = async () => {
+    if (runtimeStopping || replayInFlight) {
+      return;
+    }
+    replayInFlight = true;
+    inboundReplayStatus.replayerActive = true;
+    try {
+      const dueItems = await inboundInbox.listDuePending({
+        nowMs: Date.now(),
+        limit: inboundReplayPolicy.batchSize
+      });
+      for (const pending of dueItems) {
+        inboundReplayStatus.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+        try {
+          await deliverToOpenclawHook({
+            fetchImpl,
+            openclawHookUrl,
+            openclawHookToken,
+            requestId: pending.requestId,
+            payload: pending.payload
+          });
+          await inboundInbox.markDelivered(pending.requestId);
+          inboundReplayStatus.lastReplayAt = (/* @__PURE__ */ new Date()).toISOString();
+          inboundReplayStatus.lastReplayError = void 0;
+          inboundReplayStatus.lastAttemptStatus = "ok";
+          logger12.info("connector.inbound.replay_succeeded", {
+            requestId: pending.requestId,
+            attemptCount: pending.attemptCount + 1
+          });
+        } catch (error48) {
+          const reason = sanitizeErrorReason2(error48);
+          const retryable = error48 instanceof LocalOpenclawDeliveryError2 ? error48.retryable : true;
+          const nextAttemptAt = new Date(
+            Date.now() + computeReplayDelayMs({
+              attemptCount: pending.attemptCount + 1,
+              policy: inboundReplayPolicy
+            }) * (retryable ? 1 : 10)
+          ).toISOString();
+          await inboundInbox.markReplayFailure({
+            requestId: pending.requestId,
+            errorMessage: reason,
+            nextAttemptAt
+          });
+          inboundReplayStatus.lastReplayError = reason;
+          inboundReplayStatus.lastAttemptStatus = "failed";
+          logger12.warn("connector.inbound.replay_failed", {
+            requestId: pending.requestId,
+            attemptCount: pending.attemptCount + 1,
+            retryable,
+            nextAttemptAt,
+            reason
+          });
+        }
+      }
+    } finally {
+      replayInFlight = false;
+      inboundReplayStatus.replayerActive = false;
+    }
+  };
+  const readInboundReplayView = async () => {
+    const pending = await inboundInbox.getSnapshot();
+    return {
+      pending,
+      replayerActive: inboundReplayStatus.replayerActive || replayInFlight,
+      lastReplayAt: inboundReplayStatus.lastReplayAt,
+      lastReplayError: inboundReplayStatus.lastReplayError,
+      openclawHook: {
+        url: openclawHookUrl,
+        lastAttemptAt: inboundReplayStatus.lastAttemptAt,
+        lastAttemptStatus: inboundReplayStatus.lastAttemptStatus
+      }
+    };
+  };
   const connectorClient = new ConnectorClient({
     connectorUrl: wsParsed.toString(),
     connectionHeadersProvider: resolveUpgradeHeaders,
-    openclawBaseUrl: resolveOpenclawBaseUrl(input.openclawBaseUrl),
-    openclawHookPath: resolveOpenclawHookPath(input.openclawHookPath),
-    openclawHookToken: resolveOpenclawHookToken(input.openclawHookToken),
+    openclawBaseUrl,
+    openclawHookPath,
+    openclawHookToken,
     fetchImpl,
     logger: logger12,
+    inboundDeliverHandler: async (frame) => {
+      const persisted = await inboundInbox.enqueue(frame);
+      if (!persisted.accepted) {
+        logger12.warn("connector.inbound.persist_rejected", {
+          requestId: frame.id,
+          reason: persisted.reason ?? "inbox limit reached",
+          pendingCount: persisted.pendingCount
+        });
+        return {
+          accepted: false,
+          reason: persisted.reason
+        };
+      }
+      logger12.info("connector.inbound.persisted", {
+        requestId: frame.id,
+        duplicate: persisted.duplicate,
+        pendingCount: persisted.pendingCount
+      });
+      void replayPendingInboundMessages();
+      return { accepted: true };
+    },
     webSocketFactory: createWebSocketFactory()
   });
   const outboundBaseUrl = normalizeOutboundBaseUrl(input.outboundBaseUrl);
@@ -19760,11 +20373,40 @@ async function startConnectorRuntime(input) {
         writeJson(res, 405, { error: "Method Not Allowed" });
         return;
       }
+      let inboundReplayView;
+      try {
+        inboundReplayView = await readInboundReplayView();
+      } catch (error48) {
+        logger12.warn("connector.status.inbound_inbox_unavailable", {
+          reason: sanitizeErrorReason2(error48)
+        });
+        writeJson(res, 500, {
+          status: "error",
+          error: {
+            code: "CONNECTOR_INBOUND_INBOX_UNAVAILABLE",
+            message: "Connector inbound inbox status is unavailable"
+          },
+          outboundUrl,
+          websocketUrl: wsUrl,
+          websocketConnected: connectorClient.isConnected()
+        });
+        return;
+      }
       writeJson(res, 200, {
         status: "ok",
         outboundUrl,
         websocketUrl: wsUrl,
-        websocketConnected: connectorClient.isConnected()
+        websocketConnected: connectorClient.isConnected(),
+        inboundInbox: {
+          pendingCount: inboundReplayView.pending.pendingCount,
+          pendingBytes: inboundReplayView.pending.pendingBytes,
+          oldestPendingAt: inboundReplayView.pending.oldestPendingAt,
+          nextAttemptAt: inboundReplayView.pending.nextAttemptAt,
+          replayerActive: inboundReplayView.replayerActive,
+          lastReplayAt: inboundReplayView.lastReplayAt,
+          lastReplayError: inboundReplayView.lastReplayError
+        },
+        openclawHook: inboundReplayView.openclawHook
       });
       return;
     }
@@ -19814,6 +20456,11 @@ async function startConnectorRuntime(input) {
     stoppedResolve = resolve2;
   });
   const stop = async () => {
+    runtimeStopping = true;
+    if (replayIntervalHandle !== void 0) {
+      clearInterval(replayIntervalHandle);
+      replayIntervalHandle = void 0;
+    }
     connectorClient.disconnect();
     await new Promise((resolve2, reject) => {
       server.close((error48) => {
@@ -19838,6 +20485,11 @@ async function startConnectorRuntime(input) {
     );
   });
   connectorClient.connect();
+  await inboundInbox.pruneDelivered();
+  void replayPendingInboundMessages();
+  replayIntervalHandle = setInterval(() => {
+    void replayPendingInboundMessages();
+  }, inboundReplayPolicy.replayIntervalMs);
   logger12.info("connector.runtime.started", {
     outboundUrl,
     websocketUrl: wsUrl,
@@ -19865,11 +20517,11 @@ var OPENCLAW_CONNECTORS_FILE_NAME = "openclaw-connectors.json";
 var SERVICE_LOG_DIR_NAME = "logs";
 var DEFAULT_CONNECTOR_BASE_URL2 = "http://127.0.0.1:19400";
 var DEFAULT_CONNECTOR_OUTBOUND_PATH2 = "/v1/outbound";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null;
 }
 function getErrorCode(error48) {
-  if (!isRecord6(error48)) {
+  if (!isRecord7(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -20008,7 +20660,7 @@ function resolveConnectorBaseUrlFromEnv() {
   return parseConnectorBaseUrl(value.trim());
 }
 async function readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl) {
-  const assignmentsPath = join5(configDir, OPENCLAW_CONNECTORS_FILE_NAME);
+  const assignmentsPath = join6(configDir, OPENCLAW_CONNECTORS_FILE_NAME);
   let raw;
   try {
     raw = await readFileImpl(assignmentsPath, "utf8");
@@ -20028,11 +20680,11 @@ async function readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl)
       { assignmentsPath }
     );
   }
-  if (!isRecord6(parsed) || !isRecord6(parsed.agents)) {
+  if (!isRecord7(parsed) || !isRecord7(parsed.agents)) {
     return void 0;
   }
   const entry = parsed.agents[agentName];
-  if (!isRecord6(entry) || typeof entry.connectorBaseUrl !== "string") {
+  if (!isRecord7(entry) || typeof entry.connectorBaseUrl !== "string") {
     return void 0;
   }
   return parseConnectorBaseUrl(entry.connectorBaseUrl);
@@ -20072,7 +20724,7 @@ async function readRequiredTrimmedFile(filePath, label, readFileImpl) {
   return trimmed;
 }
 async function readRelayRuntimeConfig(configDir, readFileImpl) {
-  const filePath = join5(configDir, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
+  const filePath = join6(configDir, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
   let raw;
   try {
     raw = await readFileImpl(filePath, "utf8");
@@ -20088,7 +20740,7 @@ async function readRelayRuntimeConfig(configDir, readFileImpl) {
   } catch {
     return void 0;
   }
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     return void 0;
   }
   const openclawHookToken = typeof parsed.openclawHookToken === "string" && parsed.openclawHookToken.trim().length > 0 ? parsed.openclawHookToken.trim() : void 0;
@@ -20106,7 +20758,7 @@ function parseJsonRecord(value, code, message2) {
   } catch {
     throw createCliError4(code, message2);
   }
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     throw createCliError4(code, message2);
   }
   return parsed;
@@ -20146,7 +20798,7 @@ async function loadDefaultConnectorModule() {
   };
 }
 function resolveWaitPromise(runtime) {
-  if (!runtime || !isRecord6(runtime)) {
+  if (!runtime || !isRecord7(runtime)) {
     return void 0;
   }
   if (typeof runtime.waitUntilStopped === "function") {
@@ -20211,7 +20863,7 @@ function buildConnectorStartArgs(agentName, commandOptions) {
 }
 function resolveCliEntryPath(resolveCurrentModulePathImpl) {
   const modulePath = resolveCurrentModulePathImpl?.() ?? fileURLToPath(import.meta.url);
-  return join5(dirname3(modulePath), "..", "bin.js");
+  return join6(dirname4(modulePath), "..", "bin.js");
 }
 function escapeXml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
@@ -20281,7 +20933,7 @@ function resolveServiceDependencies(dependencies) {
     execFileImpl,
     getConfigDirImpl: dependencies.getConfigDirImpl ?? getConfigDir,
     getHomeDirImpl: dependencies.getHomeDirImpl ?? homedir2,
-    mkdirImpl: dependencies.mkdirImpl ?? mkdir4,
+    mkdirImpl: dependencies.mkdirImpl ?? mkdir5,
     removeFileImpl: dependencies.removeFileImpl ?? rm,
     resolveCurrentModulePathImpl: dependencies.resolveCurrentModulePathImpl,
     resolveCurrentPlatformImpl: dependencies.resolveCurrentPlatformImpl ?? (() => process.platform),
@@ -20295,7 +20947,7 @@ function resolveServiceDependencies(dependencies) {
       return process.getuid();
     }),
     resolveNodeExecPathImpl: dependencies.resolveNodeExecPathImpl ?? (() => process.execPath),
-    writeFileImpl: dependencies.writeFileImpl ?? writeFile4
+    writeFileImpl: dependencies.writeFileImpl ?? writeFile5
   };
 }
 async function installConnectorServiceForAgent(agentName, commandOptions = {}, dependencies = {}) {
@@ -20309,7 +20961,7 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
   );
   const configDir = serviceDependencies.getConfigDirImpl();
   const homeDir = serviceDependencies.getHomeDirImpl();
-  const logsDir = join5(configDir, SERVICE_LOG_DIR_NAME);
+  const logsDir = join6(configDir, SERVICE_LOG_DIR_NAME);
   const serviceName = sanitizeServiceSegment(
     `clawdentity-connector-${agentName}`
   );
@@ -20319,12 +20971,12 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
     resolveCliEntryPath(serviceDependencies.resolveCurrentModulePathImpl),
     ...startArgs
   ];
-  const outputLogPath = join5(logsDir, `${serviceName}.out.log`);
-  const errorLogPath = join5(logsDir, `${serviceName}.err.log`);
+  const outputLogPath = join6(logsDir, `${serviceName}.out.log`);
+  const errorLogPath = join6(logsDir, `${serviceName}.err.log`);
   await serviceDependencies.mkdirImpl(logsDir, { recursive: true });
   if (platform === "systemd") {
-    const serviceDir = join5(homeDir, ".config", "systemd", "user");
-    const serviceFilePath2 = join5(serviceDir, `${serviceName}.service`);
+    const serviceDir = join6(homeDir, ".config", "systemd", "user");
+    const serviceFilePath2 = join6(serviceDir, `${serviceName}.service`);
     await serviceDependencies.mkdirImpl(serviceDir, { recursive: true });
     await serviceDependencies.writeFileImpl(
       serviceFilePath2,
@@ -20363,9 +21015,9 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
       serviceFilePath: serviceFilePath2
     };
   }
-  const launchAgentsDir = join5(homeDir, "Library", "LaunchAgents");
+  const launchAgentsDir = join6(homeDir, "Library", "LaunchAgents");
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join5(
+  const serviceFilePath = join6(
     launchAgentsDir,
     `${serviceNameWithDomain}.plist`
   );
@@ -20424,7 +21076,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     `clawdentity-connector-${agentName}`
   );
   if (platform === "systemd") {
-    const serviceFilePath2 = join5(
+    const serviceFilePath2 = join6(
       homeDir,
       ".config",
       "systemd",
@@ -20455,7 +21107,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     };
   }
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join5(
+  const serviceFilePath = join6(
     homeDir,
     "Library",
     "LaunchAgents",
@@ -20479,11 +21131,11 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
 async function startConnectorForAgent(agentName, commandOptions = {}, dependencies = {}) {
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
-  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile4(path, encoding));
+  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile5(path, encoding));
   const fetchImpl = dependencies.fetchImpl ?? globalThis.fetch;
   const loadConnectorModule = dependencies.loadConnectorModule ?? loadDefaultConnectorModule;
   const configDir = getConfigDirImpl();
-  const agentDirectory = join5(configDir, AGENTS_DIR_NAME3, agentName);
+  const agentDirectory = join6(configDir, AGENTS_DIR_NAME3, agentName);
   const [
     rawAit,
     rawSecretKey,
@@ -20495,22 +21147,22 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
     connectorModule
   ] = await Promise.all([
     readRequiredTrimmedFile(
-      join5(agentDirectory, AIT_FILE_NAME2),
+      join6(agentDirectory, AIT_FILE_NAME2),
       AIT_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, SECRET_KEY_FILE_NAME),
+      join6(agentDirectory, SECRET_KEY_FILE_NAME),
       SECRET_KEY_FILE_NAME,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, IDENTITY_FILE_NAME2),
+      join6(agentDirectory, IDENTITY_FILE_NAME2),
       IDENTITY_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
+      join6(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
       REGISTRY_AUTH_FILE_NAME2,
       readFileImpl
     ),
@@ -20557,8 +21209,8 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
       tokenType: registryAuth.tokenType
     }
   });
-  const outboundUrl = runtime && isRecord6(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
-  const proxyWebsocketUrl = runtime && isRecord6(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : resolvedProxyWebsocketUrl : void 0;
+  const outboundUrl = runtime && isRecord7(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
+  const proxyWebsocketUrl = runtime && isRecord7(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : resolvedProxyWebsocketUrl : void 0;
   return {
     outboundUrl,
     proxyWebsocketUrl,
@@ -20689,7 +21341,7 @@ function createConnectorCommand(dependencies = {}) {
 // src/commands/invite.ts
 import { Command as Command6 } from "commander";
 var logger7 = createLogger({ service: "cli", module: "invite" });
-var isRecord7 = (value) => {
+var isRecord8 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function parseNonEmptyString7(value) {
@@ -20733,7 +21385,7 @@ function requireApiKey2(config2) {
   );
 }
 function extractRegistryErrorCode(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20744,7 +21396,7 @@ function extractRegistryErrorCode(payload) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function extractRegistryErrorMessage4(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20818,13 +21470,13 @@ function mapRedeemInviteError(status, payload) {
   return `Invite redeem failed (${status})`;
 }
 function parseInviteRecord(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError5(
       "CLI_INVITE_CREATE_INVALID_RESPONSE",
       "Invite response is invalid"
     );
   }
-  const source = isRecord7(payload.invite) ? payload.invite : payload;
+  const source = isRecord8(payload.invite) ? payload.invite : payload;
   const code = parseNonEmptyString7(source.code);
   if (code.length === 0) {
     throw createCliError5(
@@ -20849,15 +21501,15 @@ function parseInviteRecord(payload) {
   return invite;
 }
 function parseInviteRedeemResponse(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError5(
       "CLI_INVITE_REDEEM_INVALID_RESPONSE",
       "Invite redeem response is invalid"
     );
   }
-  const apiKeySource = isRecord7(payload.apiKey) ? payload.apiKey : payload;
+  const apiKeySource = isRecord8(payload.apiKey) ? payload.apiKey : payload;
   const apiKeyToken = parseNonEmptyString7(
-    isRecord7(payload.apiKey) ? payload.apiKey.token : payload.token
+    isRecord8(payload.apiKey) ? payload.apiKey.token : payload.token
   );
   if (apiKeyToken.length === 0) {
     throw createCliError5(
@@ -20867,7 +21519,7 @@ function parseInviteRedeemResponse(payload) {
   }
   const apiKeyId = parseNonEmptyString7(apiKeySource.id);
   const apiKeyName = parseNonEmptyString7(apiKeySource.name);
-  const humanSource = isRecord7(payload.human) ? payload.human : void 0;
+  const humanSource = isRecord8(payload.human) ? payload.human : void 0;
   const humanName = parseNonEmptyString7(humanSource?.displayName);
   const proxyUrl = parseNonEmptyString7(payload.proxyUrl);
   if (humanName.length === 0) {
@@ -21055,9 +21707,9 @@ var createInviteCommand = (dependencies = {}) => {
 import { spawn } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
 import { existsSync } from "fs";
-import { chmod as chmod3, copyFile, mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { chmod as chmod3, copyFile, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join6, resolve as resolvePath } from "path";
+import { dirname as dirname5, join as join7, resolve as resolvePath } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command7 } from "commander";
 var logger8 = createLogger({ service: "cli", module: "openclaw" });
@@ -21090,7 +21742,6 @@ var HOOK_PATH_SEND_TO_PEER = "send-to-peer";
 var OPENCLAW_SEND_TO_PEER_HOOK_PATH = "hooks/send-to-peer";
 var DEFAULT_OPENCLAW_BASE_URL2 = "http://127.0.0.1:18789";
 var DEFAULT_OPENCLAW_MAIN_SESSION_KEY = "main";
-var DEFAULT_OPENCLAW_AGENT_ID = "main";
 var DEFAULT_CONNECTOR_PORT = 19400;
 var DEFAULT_CONNECTOR_OUTBOUND_PATH3 = "/v1/outbound";
 var DEFAULT_CONNECTOR_STATUS_PATH2 = "/v1/status";
@@ -21107,9 +21758,12 @@ var OPENCLAW_SETUP_COMMAND_HINT = "Run: clawdentity openclaw setup <agentName>";
 var OPENCLAW_SETUP_RESTART_COMMAND_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} and restart OpenClaw`;
 var OPENCLAW_SETUP_WITH_BASE_URL_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} --openclaw-base-url <url>`;
 var OPENCLAW_PAIRING_COMMAND_HINT = "Run QR pairing first: clawdentity pair start <agentName> --qr and clawdentity pair confirm <agentName> --qr-file <path>";
+var OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT = "Run: clawdentity openclaw setup <agentName> (auto-recovers pending OpenClaw gateway device approvals)";
+var OPENCLAW_GATEWAY_APPROVAL_COMMAND = "openclaw";
+var OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS = 1e4;
 var textEncoder2 = new TextEncoder();
 var textDecoder = new TextDecoder();
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null;
 }
 function createCliError6(code, message2, details) {
@@ -21121,7 +21775,7 @@ function createCliError6(code, message2, details) {
   });
 }
 function getErrorCode2(error48) {
-  if (!isRecord8(error48)) {
+  if (!isRecord9(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -21242,12 +21896,12 @@ function resolveOpenclawHomeDir(homeDir) {
   return envOpenclawHome ?? homeDir;
 }
 function resolveDefaultOpenclawStateDir(openclawHomeDir) {
-  const newStateDir = join6(openclawHomeDir, OPENCLAW_DIR_NAME);
+  const newStateDir = join7(openclawHomeDir, OPENCLAW_DIR_NAME);
   if (existsSync(newStateDir)) {
     return newStateDir;
   }
   for (const legacyDirName of LEGACY_OPENCLAW_STATE_DIR_NAMES) {
-    const legacyStateDir = join6(openclawHomeDir, legacyDirName);
+    const legacyStateDir = join7(openclawHomeDir, legacyDirName);
     if (existsSync(legacyStateDir)) {
       return legacyStateDir;
     }
@@ -21270,16 +21924,16 @@ function resolveOpenclawDir(openclawDir, homeDir) {
     homeDir
   );
   if (envConfigPath !== void 0) {
-    return dirname4(envConfigPath);
+    return dirname5(envConfigPath);
   }
   const openclawHomeDir = resolveOpenclawHomeDir(homeDir);
   return resolveDefaultOpenclawStateDir(openclawHomeDir);
 }
 function resolveAgentDirectory(homeDir, agentName) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
 }
 function resolvePeersPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
 }
 function resolveOpenclawConfigPath(openclawDir, homeDir) {
   const envConfigPath = readNonEmptyEnvPath(
@@ -21290,9 +21944,9 @@ function resolveOpenclawConfigPath(openclawDir, homeDir) {
     return envConfigPath;
   }
   const configCandidates = [
-    join6(openclawDir, OPENCLAW_CONFIG_FILE_NAME),
+    join7(openclawDir, OPENCLAW_CONFIG_FILE_NAME),
     ...LEGACY_OPENCLAW_CONFIG_FILE_NAMES.map(
-      (fileName) => join6(openclawDir, fileName)
+      (fileName) => join7(openclawDir, fileName)
     )
   ];
   for (const candidate of configCandidates) {
@@ -21303,81 +21957,219 @@ function resolveOpenclawConfigPath(openclawDir, homeDir) {
   return configCandidates[0];
 }
 function resolveDefaultTransformSource(openclawDir) {
-  return join6(openclawDir, "skills", SKILL_DIR_NAME, RELAY_MODULE_FILE_NAME);
+  return join7(openclawDir, "skills", SKILL_DIR_NAME, RELAY_MODULE_FILE_NAME);
 }
 function resolveTransformTargetPath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
 }
 function resolveOpenclawAgentNamePath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
 }
 function resolveRelayRuntimeConfigPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
 }
 function resolveConnectorAssignmentsPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
 }
 function resolveTransformRuntimePath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
 }
 function resolveTransformPeersPath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_PEERS_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_PEERS_FILE_NAME);
 }
-async function readJsonFile(filePath) {
-  const raw = await readFile5(filePath, "utf8");
+async function readOpenclawGatewayPendingState(openclawDir) {
+  const gatewayDevicePendingPath = join7(openclawDir, "devices", "pending.json");
   try {
-    return JSON.parse(raw);
-  } catch {
-    throw createCliError6("CLI_OPENCLAW_INVALID_JSON", "JSON file is invalid", {
-      filePath
-    });
-  }
-}
-async function ensureLocalAgentCredentials(homeDir, agentName) {
-  const agentDir = resolveAgentDirectory(homeDir, agentName);
-  const requiredFiles = [
-    join6(agentDir, SECRET_KEY_FILE_NAME2),
-    join6(agentDir, AIT_FILE_NAME3)
-  ];
-  for (const filePath of requiredFiles) {
-    let content;
-    try {
-      content = await readFile5(filePath, "utf8");
-    } catch (error48) {
-      if (getErrorCode2(error48) === "ENOENT") {
-        throw createCliError6(
-          "CLI_OPENCLAW_MISSING_AGENT_CREDENTIALS",
-          "Local agent credentials are missing",
-          { agentName, filePath }
-        );
-      }
-      throw error48;
+    const pendingPayload = await readJsonFile(gatewayDevicePendingPath);
+    if (!isRecord9(pendingPayload)) {
+      return {
+        status: "invalid",
+        gatewayDevicePendingPath
+      };
     }
-    if (content.trim().length === 0) {
-      throw createCliError6(
-        "CLI_OPENCLAW_EMPTY_AGENT_CREDENTIALS",
-        "Agent credential file is empty",
-        { filePath }
-      );
+    return {
+      status: "ok",
+      gatewayDevicePendingPath,
+      pendingRequestIds: Object.keys(pendingPayload)
+    };
+  } catch (error48) {
+    if (getErrorCode2(error48) === "ENOENT") {
+      return {
+        status: "missing",
+        gatewayDevicePendingPath
+      };
     }
+    return {
+      status: "unreadable",
+      gatewayDevicePendingPath
+    };
   }
 }
-async function writeSecureFile3(filePath, content) {
-  await mkdir5(dirname4(filePath), { recursive: true });
-  await writeFile5(filePath, content, "utf8");
-  await chmod3(filePath, FILE_MODE3);
+function resolveOpenclawGatewayApprovalCommand() {
+  const envOverride = process.env.OPENCLAW_GATEWAY_APPROVAL_COMMAND?.trim();
+  if (typeof envOverride === "string" && envOverride.length > 0) {
+    return envOverride;
+  }
+  return OPENCLAW_GATEWAY_APPROVAL_COMMAND;
 }
-async function loadPeersConfig(peersPath) {
-  let parsed;
-  try {
-    parsed = await readJsonFile(peersPath);
+async function runOpenclawGatewayApprovalCommand(input) {
+  return await new Promise(
+    (resolve2) => {
+      const child = spawn(input.command, input.args, {
+        env: {
+          ...process.env,
+          OPENCLAW_STATE_DIR: input.openclawDir,
+          OPENCLAW_CONFIG_PATH: input.openclawConfigPath
+        },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let settled = false;
+      let stdout = "";
+      let stderr = "";
+      const finalize2 = (result) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve2({
+          ...result,
+          stdout: stdout.trim(),
+          stderr: stderr.trim()
+        });
+      };
+      const timeout = setTimeout(() => {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        finalize2({
+          ok: false,
+          errorMessage: `command timed out after ${OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS}ms`
+        });
+      }, OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS);
+      child.stdout?.on("data", (chunk) => {
+        stdout += String(chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += String(chunk);
+      });
+      child.once("error", (error48) => {
+        clearTimeout(timeout);
+        const errorCode = getErrorCode2(error48);
+        finalize2({
+          ok: false,
+          unavailable: errorCode === "ENOENT",
+          errorMessage: error48 instanceof Error ? error48.message : "failed to run openclaw command"
+        });
+      });
+      child.once("close", (exitCode) => {
+        clearTimeout(timeout);
+        finalize2({
+          ok: exitCode === 0,
+          exitCode: typeof exitCode === "number" ? exitCode : void 0
+        });
+      });
+    }
+  );
+}
+async function runOpenclawGatewayDeviceApproval(input) {
+  const command = resolveOpenclawGatewayApprovalCommand();
+  return await runOpenclawGatewayApprovalCommand({
+    command,
+    args: ["devices", "approve", input.requestId, "--json"],
+    openclawDir: input.openclawDir,
+    openclawConfigPath: input.openclawConfigPath
+  });
+}
+async function autoApproveOpenclawGatewayDevices(input) {
+  const pendingState = await readOpenclawGatewayPendingState(input.openclawDir);
+  if (pendingState.status !== "ok" || pendingState.pendingRequestIds.length === 0) {
+    return void 0;
+  }
+  const openclawConfigPath = resolveOpenclawConfigPath(
+    input.openclawDir,
+    input.homeDir
+  );
+  const approvalRunner = input.runner ?? runOpenclawGatewayDeviceApproval;
+  const attempts = [];
+  for (const requestId of pendingState.pendingRequestIds) {
+    const execution = await approvalRunner({
+      requestId,
+      openclawDir: input.openclawDir,
+      openclawConfigPath
+    });
+    attempts.push({
+      requestId,
+      ok: execution.ok,
+      unavailable: execution.unavailable === true,
+      reason: execution.errorMessage ?? (execution.stderr && execution.stderr.length > 0 ? execution.stderr : execution.stdout && execution.stdout.length > 0 ? execution.stdout : void 0),
+      exitCode: execution.exitCode
+    });
+    if (execution.unavailable === true) {
+      break;
+    }
+  }
+  return {
+    gatewayDevicePendingPath: pendingState.gatewayDevicePendingPath,
+    pendingRequestIds: pendingState.pendingRequestIds,
+    attempts
+  };
+}
+async function readJsonFile(filePath) {
+  const raw = await readFile6(filePath, "utf8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw createCliError6("CLI_OPENCLAW_INVALID_JSON", "JSON file is invalid", {
+      filePath
+    });
+  }
+}
+async function ensureLocalAgentCredentials(homeDir, agentName) {
+  const agentDir = resolveAgentDirectory(homeDir, agentName);
+  const requiredFiles = [
+    join7(agentDir, SECRET_KEY_FILE_NAME2),
+    join7(agentDir, AIT_FILE_NAME3)
+  ];
+  for (const filePath of requiredFiles) {
+    let content;
+    try {
+      content = await readFile6(filePath, "utf8");
+    } catch (error48) {
+      if (getErrorCode2(error48) === "ENOENT") {
+        throw createCliError6(
+          "CLI_OPENCLAW_MISSING_AGENT_CREDENTIALS",
+          "Local agent credentials are missing",
+          { agentName, filePath }
+        );
+      }
+      throw error48;
+    }
+    if (content.trim().length === 0) {
+      throw createCliError6(
+        "CLI_OPENCLAW_EMPTY_AGENT_CREDENTIALS",
+        "Agent credential file is empty",
+        { filePath }
+      );
+    }
+  }
+}
+async function writeSecureFile3(filePath, content) {
+  await mkdir6(dirname5(filePath), { recursive: true });
+  await writeFile6(filePath, content, "utf8");
+  await chmod3(filePath, FILE_MODE3);
+}
+async function loadPeersConfig(peersPath) {
+  let parsed;
+  try {
+    parsed = await readJsonFile(peersPath);
   } catch (error48) {
     if (getErrorCode2(error48) === "ENOENT") {
       return { peers: {} };
     }
     throw error48;
   }
-  if (!isRecord8(parsed)) {
+  if (!isRecord9(parsed)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config root must be a JSON object",
@@ -21388,7 +22180,7 @@ async function loadPeersConfig(peersPath) {
   if (peersValue === void 0) {
     return { peers: {} };
   }
-  if (!isRecord8(peersValue)) {
+  if (!isRecord9(peersValue)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config peers field must be an object",
@@ -21398,7 +22190,7 @@ async function loadPeersConfig(peersPath) {
   const peers = {};
   for (const [alias, value] of Object.entries(peersValue)) {
     const normalizedAlias = parsePeerAlias(alias);
-    if (!isRecord8(value)) {
+    if (!isRecord9(value)) {
       throw createCliError6(
         "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
         "Peer entry must be an object",
@@ -21429,7 +22221,7 @@ function parseConnectorBaseUrlForAssignment(value, label) {
   });
 }
 function parseConnectorAssignments(value, connectorAssignmentsPath) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
       "Connector assignments config must be an object",
@@ -21437,12 +22229,12 @@ function parseConnectorAssignments(value, connectorAssignmentsPath) {
     );
   }
   const agentsRaw = value.agents;
-  if (!isRecord8(agentsRaw)) {
+  if (!isRecord9(agentsRaw)) {
     return { agents: {} };
   }
   const agents = {};
   for (const [agentName, entryValue] of Object.entries(agentsRaw)) {
-    if (!isRecord8(entryValue)) {
+    if (!isRecord9(entryValue)) {
       throw createCliError6(
         "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
         "Connector assignment entry must be an object",
@@ -21547,14 +22339,28 @@ function resolveConnectorStatusUrl(connectorBaseUrl) {
   ).toString();
 }
 function parseConnectorStatusPayload(payload) {
-  if (!isRecord8(payload) || typeof payload.websocketConnected !== "boolean") {
+  if (!isRecord9(payload) || typeof payload.websocketConnected !== "boolean") {
     throw createCliError6(
       "CLI_OPENCLAW_SETUP_CONNECTOR_STATUS_INVALID",
       "Connector status response is invalid"
     );
   }
   return {
-    websocketConnected: payload.websocketConnected
+    websocketConnected: payload.websocketConnected,
+    inboundInbox: isRecord9(payload.inboundInbox) ? {
+      pendingCount: typeof payload.inboundInbox.pendingCount === "number" ? payload.inboundInbox.pendingCount : void 0,
+      pendingBytes: typeof payload.inboundInbox.pendingBytes === "number" ? payload.inboundInbox.pendingBytes : void 0,
+      oldestPendingAt: typeof payload.inboundInbox.oldestPendingAt === "string" ? payload.inboundInbox.oldestPendingAt : void 0,
+      nextAttemptAt: typeof payload.inboundInbox.nextAttemptAt === "string" ? payload.inboundInbox.nextAttemptAt : void 0,
+      lastReplayAt: typeof payload.inboundInbox.lastReplayAt === "string" ? payload.inboundInbox.lastReplayAt : void 0,
+      lastReplayError: typeof payload.inboundInbox.lastReplayError === "string" ? payload.inboundInbox.lastReplayError : void 0,
+      replayerActive: typeof payload.inboundInbox.replayerActive === "boolean" ? payload.inboundInbox.replayerActive : void 0
+    } : void 0,
+    openclawHook: isRecord9(payload.openclawHook) ? {
+      url: typeof payload.openclawHook.url === "string" ? payload.openclawHook.url : void 0,
+      lastAttemptAt: typeof payload.openclawHook.lastAttemptAt === "string" ? payload.openclawHook.lastAttemptAt : void 0,
+      lastAttemptStatus: payload.openclawHook.lastAttemptStatus === "ok" || payload.openclawHook.lastAttemptStatus === "failed" ? payload.openclawHook.lastAttemptStatus : void 0
+    } : void 0
   };
 }
 async function fetchConnectorHealthStatus(input) {
@@ -21588,6 +22394,8 @@ async function fetchConnectorHealthStatus(input) {
     const parsed = parseConnectorStatusPayload(payload);
     return {
       connected: parsed.websocketConnected,
+      inboundInbox: parsed.inboundInbox,
+      openclawHook: parsed.openclawHook,
       reachable: true,
       statusUrl,
       reason: parsed.websocketConnected ? void 0 : "connector websocket is disconnected"
@@ -21630,14 +22438,14 @@ async function waitForConnectorConnected(input) {
   return latest;
 }
 function resolveConnectorRunDir(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
 }
 function resolveConnectorPidPath(homeDir, agentName) {
-  return join6(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
+  return join7(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
 }
 async function readConnectorPidFile(pidPath) {
   try {
-    const raw = (await readFile5(pidPath, "utf8")).trim();
+    const raw = (await readFile6(pidPath, "utf8")).trim();
     if (raw.length === 0) {
       return void 0;
     }
@@ -21678,7 +22486,7 @@ function resolveCliEntryPathForDetachedStart() {
     return argvEntry;
   }
   const modulePath = fileURLToPath2(import.meta.url);
-  return join6(dirname4(modulePath), "..", "bin.js");
+  return join7(dirname5(modulePath), "..", "bin.js");
 }
 async function startDetachedConnectorRuntime(input) {
   await stopDetachedConnectorIfRunning({
@@ -21686,7 +22494,7 @@ async function startDetachedConnectorRuntime(input) {
     agentName: input.agentName
   });
   const runDir = resolveConnectorRunDir(input.homeDir);
-  await mkdir5(runDir, { recursive: true });
+  await mkdir6(runDir, { recursive: true });
   const cliEntryPath = resolveCliEntryPathForDetachedStart();
   const args = [
     cliEntryPath,
@@ -21764,7 +22572,7 @@ async function startSetupConnectorRuntime(input) {
   };
 }
 function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_RELAY_RUNTIME_CONFIG",
       "Relay runtime config must be an object",
@@ -21773,9 +22581,11 @@ function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
   }
   const updatedAt = typeof value.updatedAt === "string" && value.updatedAt.trim().length > 0 ? value.updatedAt.trim() : void 0;
   const openclawHookToken = typeof value.openclawHookToken === "string" && value.openclawHookToken.trim().length > 0 ? value.openclawHookToken.trim() : void 0;
+  const relayTransformPeersPath = typeof value.relayTransformPeersPath === "string" && value.relayTransformPeersPath.trim().length > 0 ? value.relayTransformPeersPath.trim() : void 0;
   return {
     openclawBaseUrl: parseOpenclawBaseUrl(value.openclawBaseUrl),
     openclawHookToken,
+    relayTransformPeersPath,
     updatedAt
   };
 }
@@ -21791,10 +22601,11 @@ async function loadRelayRuntimeConfig(relayRuntimeConfigPath) {
   }
   return parseRelayRuntimeConfig(parsed, relayRuntimeConfigPath);
 }
-async function saveRelayRuntimeConfig(relayRuntimeConfigPath, openclawBaseUrl, openclawHookToken) {
+async function saveRelayRuntimeConfig(relayRuntimeConfigPath, openclawBaseUrl, openclawHookToken, relayTransformPeersPath) {
   const config2 = {
     openclawBaseUrl,
     ...openclawHookToken ? { openclawHookToken } : {},
+    ...relayTransformPeersPath ? { relayTransformPeersPath } : {},
     updatedAt: nowIso()
   };
   await writeSecureFile3(
@@ -21841,52 +22652,59 @@ function normalizeStringArrayWithValues(value, requiredValues) {
   return Array.from(normalized);
 }
 function resolveHookDefaultSessionKey(config2, hooks) {
+  const session = isRecord9(config2.session) ? config2.session : {};
+  const scope = typeof session.scope === "string" ? session.scope.trim().toLowerCase() : "";
+  const configuredMainSessionKey = resolveConfiguredOpenclawMainSessionKey(session);
   if (typeof hooks.defaultSessionKey === "string" && hooks.defaultSessionKey.trim().length > 0) {
-    return hooks.defaultSessionKey.trim();
+    return normalizeLegacyHookDefaultSessionKey(
+      hooks.defaultSessionKey,
+      configuredMainSessionKey
+    );
   }
-  const session = isRecord8(config2.session) ? config2.session : {};
-  const scope = typeof session.scope === "string" ? session.scope.trim().toLowerCase() : "";
   if (scope === "global") {
     return "global";
   }
-  const agents = isRecord8(config2.agents) ? config2.agents : {};
-  const agentList = Array.isArray(agents.list) ? agents.list : [];
-  const defaultAgentId = resolveDefaultOpenclawAgentId(agentList);
-  return `agent:${defaultAgentId}:${DEFAULT_OPENCLAW_MAIN_SESSION_KEY}`;
+  return configuredMainSessionKey;
 }
-function resolveDefaultOpenclawAgentId(agentList) {
-  const preferred = agentList.find(
-    (agent) => isRecord8(agent) && agent.default === true && typeof agent.id === "string" && agent.id.trim().length > 0
-  ) ?? agentList.find(
-    (agent) => isRecord8(agent) && typeof agent.id === "string" && agent.id.trim().length > 0
-  );
-  if (isRecord8(preferred) && typeof preferred.id === "string" && preferred.id.trim().length > 0) {
-    return normalizeOpenclawIdToken(preferred.id, DEFAULT_OPENCLAW_AGENT_ID);
+function resolveConfiguredOpenclawMainSessionKey(session) {
+  if (typeof session.mainKey === "string" && session.mainKey.trim().length > 0) {
+    return session.mainKey.trim();
   }
-  return DEFAULT_OPENCLAW_AGENT_ID;
+  return DEFAULT_OPENCLAW_MAIN_SESSION_KEY;
 }
-function normalizeOpenclawIdToken(value, fallback) {
-  const normalized = value.trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+/g, "").replace(/-+$/g, "").slice(0, 64);
-  return normalized.length > 0 ? normalized : fallback;
+function normalizeLegacyHookDefaultSessionKey(value, fallbackSessionKey) {
+  const trimmed = value.trim();
+  const legacyMatch = /^agent:[^:]+:(.+)$/i.exec(trimmed);
+  if (!legacyMatch) {
+    return trimmed;
+  }
+  const routedSessionKey = legacyMatch[1]?.trim();
+  if (typeof routedSessionKey === "string" && routedSessionKey.length > 0) {
+    return routedSessionKey;
+  }
+  return fallbackSessionKey;
+}
+function isCanonicalAgentSessionKey(value) {
+  return /^agent:[^:]+:.+/i.test(value.trim());
 }
 function generateOpenclawHookToken() {
   return randomBytes3(OPENCLAW_HOOK_TOKEN_BYTES).toString("hex");
 }
 function upsertRelayHookMapping(mappingsValue) {
-  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord8).map((mapping) => ({ ...mapping })) : [];
+  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord9).map((mapping) => ({ ...mapping })) : [];
   const existingIndex = mappings.findIndex((mapping) => {
     if (mapping.id === HOOK_MAPPING_ID) {
       return true;
     }
-    if (!isRecord8(mapping.match)) {
+    if (!isRecord9(mapping.match)) {
       return false;
     }
     return mapping.match.path === HOOK_PATH_SEND_TO_PEER;
   });
-  const baseMapping = existingIndex >= 0 && isRecord8(mappings[existingIndex]) ? mappings[existingIndex] : {};
-  const nextMatch = isRecord8(baseMapping.match) ? { ...baseMapping.match } : {};
+  const baseMapping = existingIndex >= 0 && isRecord9(mappings[existingIndex]) ? mappings[existingIndex] : {};
+  const nextMatch = isRecord9(baseMapping.match) ? { ...baseMapping.match } : {};
   nextMatch.path = HOOK_PATH_SEND_TO_PEER;
-  const nextTransform = isRecord8(baseMapping.transform) ? { ...baseMapping.transform } : {};
+  const nextTransform = isRecord9(baseMapping.transform) ? { ...baseMapping.transform } : {};
   nextTransform.module = RELAY_MODULE_FILE_NAME;
   const relayMapping = {
     ...baseMapping,
@@ -21917,14 +22735,14 @@ async function patchOpenclawConfig(openclawConfigPath, hookToken) {
     }
     throw error48;
   }
-  if (!isRecord8(config2)) {
+  if (!isRecord9(config2)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_CONFIG",
       "OpenClaw config root must be an object",
       { openclawConfigPath }
     );
   }
-  const hooks = isRecord8(config2.hooks) ? { ...config2.hooks } : {};
+  const hooks = isRecord9(config2.hooks) ? { ...config2.hooks } : {};
   const existingHookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
   const preferredHookToken = typeof hookToken === "string" && hookToken.trim().length > 0 ? hookToken.trim() : void 0;
   const resolvedHookToken = existingHookToken ?? preferredHookToken ?? generateOpenclawHookToken();
@@ -21942,7 +22760,7 @@ async function patchOpenclawConfig(openclawConfigPath, hookToken) {
     ...config2,
     hooks
   };
-  await writeFile5(
+  await writeFile6(
     openclawConfigPath,
     `${JSON.stringify(nextConfig, null, 2)}
 `,
@@ -21963,10 +22781,10 @@ function toDoctorResult(checks) {
   };
 }
 function isRelayHookMapping(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     return false;
   }
-  if (!isRecord8(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
+  if (!isRecord9(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
     return false;
   }
   if (typeof value.id === "string" && value.id !== HOOK_MAPPING_ID) {
@@ -21975,7 +22793,7 @@ function isRelayHookMapping(value) {
   return true;
 }
 function hasRelayTransformModule(value) {
-  if (!isRecord8(value) || !isRecord8(value.transform)) {
+  if (!isRecord9(value) || !isRecord9(value.transform)) {
     return false;
   }
   return value.transform.module === RELAY_MODULE_FILE_NAME;
@@ -22051,108 +22869,110 @@ async function runOpenclawDoctor(options = {}) {
   const openclawDir = resolveOpenclawDir(options.openclawDir, homeDir);
   const peerAlias = parseDoctorPeerAlias(options.peerAlias);
   const checks = [];
-  const resolveConfigImpl = options.resolveConfigImpl ?? resolveConfig;
-  try {
-    const resolvedConfig = await resolveConfigImpl();
-    const envProxyUrl = typeof process.env.CLAWDENTITY_PROXY_URL === "string" ? process.env.CLAWDENTITY_PROXY_URL.trim() : "";
-    if (typeof resolvedConfig.registryUrl !== "string" || resolvedConfig.registryUrl.trim().length === 0) {
-      checks.push(
-        toDoctorCheck({
-          id: "config.registry",
-          label: "CLI config",
-          status: "fail",
-          message: "registryUrl is missing",
-          remediationHint: "Run: clawdentity config set registryUrl <REGISTRY_URL>"
-        })
-      );
-    } else if (typeof resolvedConfig.apiKey !== "string" || resolvedConfig.apiKey.trim().length === 0) {
-      checks.push(
-        toDoctorCheck({
-          id: "config.registry",
-          label: "CLI config",
-          status: "fail",
-          message: "apiKey is missing",
-          remediationHint: "Run: clawdentity config set apiKey <API_KEY>"
-        })
-      );
-    } else if (envProxyUrl.length > 0) {
-      let hasValidEnvProxyUrl = true;
-      try {
-        parseProxyUrl(envProxyUrl);
-      } catch {
-        hasValidEnvProxyUrl = false;
+  if (options.includeConfigCheck !== false) {
+    const resolveConfigImpl = options.resolveConfigImpl ?? resolveConfig;
+    try {
+      const resolvedConfig = await resolveConfigImpl();
+      const envProxyUrl = typeof process.env.CLAWDENTITY_PROXY_URL === "string" ? process.env.CLAWDENTITY_PROXY_URL.trim() : "";
+      if (typeof resolvedConfig.registryUrl !== "string" || resolvedConfig.registryUrl.trim().length === 0) {
         checks.push(
           toDoctorCheck({
             id: "config.registry",
             label: "CLI config",
             status: "fail",
-            message: "CLAWDENTITY_PROXY_URL is invalid",
-            remediationHint: "Set CLAWDENTITY_PROXY_URL to a valid http(s) URL or unset it"
+            message: "registryUrl is missing",
+            remediationHint: "Run: clawdentity config set registryUrl <REGISTRY_URL>"
           })
         );
-      }
-      if (hasValidEnvProxyUrl) {
+      } else if (typeof resolvedConfig.apiKey !== "string" || resolvedConfig.apiKey.trim().length === 0) {
         checks.push(
           toDoctorCheck({
             id: "config.registry",
             label: "CLI config",
-            status: "pass",
-            message: "registryUrl and apiKey are configured (proxy URL override is active via CLAWDENTITY_PROXY_URL)"
+            status: "fail",
+            message: "apiKey is missing",
+            remediationHint: "Run: clawdentity config set apiKey <API_KEY>"
           })
         );
-      }
-    } else if (typeof resolvedConfig.proxyUrl !== "string" || resolvedConfig.proxyUrl.trim().length === 0) {
-      checks.push(
-        toDoctorCheck({
-          id: "config.registry",
-          label: "CLI config",
-          status: "fail",
-          message: "proxyUrl is missing",
-          remediationHint: "Run: clawdentity invite redeem <clw_inv_...> or clawdentity config init"
-        })
-      );
-    } else {
-      let hasValidConfigProxyUrl = true;
-      try {
-        parseProxyUrl(resolvedConfig.proxyUrl);
-      } catch {
-        hasValidConfigProxyUrl = false;
+      } else if (envProxyUrl.length > 0) {
+        let hasValidEnvProxyUrl = true;
+        try {
+          parseProxyUrl(envProxyUrl);
+        } catch {
+          hasValidEnvProxyUrl = false;
+          checks.push(
+            toDoctorCheck({
+              id: "config.registry",
+              label: "CLI config",
+              status: "fail",
+              message: "CLAWDENTITY_PROXY_URL is invalid",
+              remediationHint: "Set CLAWDENTITY_PROXY_URL to a valid http(s) URL or unset it"
+            })
+          );
+        }
+        if (hasValidEnvProxyUrl) {
+          checks.push(
+            toDoctorCheck({
+              id: "config.registry",
+              label: "CLI config",
+              status: "pass",
+              message: "registryUrl and apiKey are configured (proxy URL override is active via CLAWDENTITY_PROXY_URL)"
+            })
+          );
+        }
+      } else if (typeof resolvedConfig.proxyUrl !== "string" || resolvedConfig.proxyUrl.trim().length === 0) {
         checks.push(
           toDoctorCheck({
             id: "config.registry",
             label: "CLI config",
             status: "fail",
-            message: "proxyUrl is invalid",
+            message: "proxyUrl is missing",
             remediationHint: "Run: clawdentity invite redeem <clw_inv_...> or clawdentity config init"
           })
         );
+      } else {
+        let hasValidConfigProxyUrl = true;
+        try {
+          parseProxyUrl(resolvedConfig.proxyUrl);
+        } catch {
+          hasValidConfigProxyUrl = false;
+          checks.push(
+            toDoctorCheck({
+              id: "config.registry",
+              label: "CLI config",
+              status: "fail",
+              message: "proxyUrl is invalid",
+              remediationHint: "Run: clawdentity invite redeem <clw_inv_...> or clawdentity config init"
+            })
+          );
+        }
+        if (hasValidConfigProxyUrl) {
+          checks.push(
+            toDoctorCheck({
+              id: "config.registry",
+              label: "CLI config",
+              status: "pass",
+              message: "registryUrl, apiKey, and proxyUrl are configured"
+            })
+          );
+        }
       }
-      if (hasValidConfigProxyUrl) {
-        checks.push(
-          toDoctorCheck({
-            id: "config.registry",
-            label: "CLI config",
-            status: "pass",
-            message: "registryUrl, apiKey, and proxyUrl are configured"
-          })
-        );
-      }
+    } catch {
+      checks.push(
+        toDoctorCheck({
+          id: "config.registry",
+          label: "CLI config",
+          status: "fail",
+          message: "unable to resolve CLI config",
+          remediationHint: "Fix ~/.clawdentity/config.json or rerun: clawdentity config init"
+        })
+      );
     }
-  } catch {
-    checks.push(
-      toDoctorCheck({
-        id: "config.registry",
-        label: "CLI config",
-        status: "fail",
-        message: "unable to resolve CLI config",
-        remediationHint: "Fix ~/.clawdentity/config.json or rerun: clawdentity config init"
-      })
-    );
   }
   const selectedAgentPath = resolveOpenclawAgentNamePath(homeDir);
   let selectedAgentName;
   try {
-    const selectedAgentRaw = await readFile5(selectedAgentPath, "utf8");
+    const selectedAgentRaw = await readFile6(selectedAgentPath, "utf8");
     selectedAgentName = assertValidAgentName(selectedAgentRaw.trim());
     checks.push(
       toDoctorCheck({
@@ -22275,9 +23095,9 @@ async function runOpenclawDoctor(options = {}) {
   const relayTransformRuntimePath = resolveTransformRuntimePath(openclawDir);
   const relayTransformPeersPath = resolveTransformPeersPath(openclawDir);
   try {
-    const transformContents = await readFile5(transformTargetPath, "utf8");
-    const runtimeContents = await readFile5(relayTransformRuntimePath, "utf8");
-    const peersSnapshotContents = await readFile5(
+    const transformContents = await readFile6(transformTargetPath, "utf8");
+    const runtimeContents = await readFile6(relayTransformRuntimePath, "utf8");
+    const peersSnapshotContents = await readFile6(
       relayTransformPeersPath,
       "utf8"
     );
@@ -22330,13 +23150,22 @@ async function runOpenclawDoctor(options = {}) {
   const openclawConfigPath = resolveOpenclawConfigPath(openclawDir, homeDir);
   try {
     const openclawConfig = await readJsonFile(openclawConfigPath);
-    if (!isRecord8(openclawConfig)) {
+    if (!isRecord9(openclawConfig)) {
       throw new Error("root");
     }
-    const hooks = isRecord8(openclawConfig.hooks) ? openclawConfig.hooks : {};
+    const hooks = isRecord9(openclawConfig.hooks) ? openclawConfig.hooks : {};
     const hooksEnabled = hooks.enabled === true;
     const hookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
-    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord8) : [];
+    const defaultSessionKey = typeof hooks.defaultSessionKey === "string" && hooks.defaultSessionKey.trim().length > 0 ? hooks.defaultSessionKey.trim() : void 0;
+    const allowRequestSessionKey = hooks.allowRequestSessionKey === false;
+    const allowedSessionKeyPrefixes = normalizeStringArrayWithValues(
+      hooks.allowedSessionKeyPrefixes,
+      []
+    );
+    const missingRequiredSessionPrefixes = defaultSessionKey === void 0 ? ["hook:"] : ["hook:", defaultSessionKey].filter(
+      (prefix) => !allowedSessionKeyPrefixes.includes(prefix)
+    );
+    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord9) : [];
     const relayMapping = mappings.find(
       (mapping) => isRelayHookMapping(mapping)
     );
@@ -22395,6 +23224,45 @@ async function runOpenclawDoctor(options = {}) {
         })
       );
     }
+    const sessionRoutingIssues = [];
+    if (defaultSessionKey === void 0) {
+      sessionRoutingIssues.push("hooks.defaultSessionKey is missing");
+    }
+    if (!allowRequestSessionKey) {
+      sessionRoutingIssues.push("hooks.allowRequestSessionKey is not false");
+    }
+    if (missingRequiredSessionPrefixes.length > 0) {
+      sessionRoutingIssues.push(
+        `hooks.allowedSessionKeyPrefixes is missing: ${missingRequiredSessionPrefixes.join(", ")}`
+      );
+    }
+    if (defaultSessionKey !== void 0 && isCanonicalAgentSessionKey(defaultSessionKey)) {
+      sessionRoutingIssues.push(
+        "hooks.defaultSessionKey uses canonical agent format (agent:<id>:...); use OpenClaw request session keys like main, global, or subagent:*"
+      );
+    }
+    if (sessionRoutingIssues.length > 0) {
+      checks.push(
+        toDoctorCheck({
+          id: "state.hookSessionRouting",
+          label: "OpenClaw hook session routing",
+          status: "fail",
+          message: sessionRoutingIssues.join("; "),
+          remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+          details: { openclawConfigPath }
+        })
+      );
+    } else {
+      checks.push(
+        toDoctorCheck({
+          id: "state.hookSessionRouting",
+          label: "OpenClaw hook session routing",
+          status: "pass",
+          message: "hooks default session and allowed session prefixes are configured",
+          details: { openclawConfigPath }
+        })
+      );
+    }
   } catch {
     checks.push(
       toDoctorCheck({
@@ -22416,6 +23284,16 @@ async function runOpenclawDoctor(options = {}) {
         details: { openclawConfigPath }
       })
     );
+    checks.push(
+      toDoctorCheck({
+        id: "state.hookSessionRouting",
+        label: "OpenClaw hook session routing",
+        status: "fail",
+        message: `unable to read ${openclawConfigPath}`,
+        remediationHint: "Ensure the OpenClaw config file exists (OPENCLAW_CONFIG_PATH/CLAWDBOT_CONFIG_PATH, or state dir) and rerun openclaw setup",
+        details: { openclawConfigPath }
+      })
+    );
   }
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath(homeDir);
   try {
@@ -22441,6 +23319,72 @@ async function runOpenclawDoctor(options = {}) {
       })
     );
   }
+  const gatewayPendingState = await readOpenclawGatewayPendingState(openclawDir);
+  if (gatewayPendingState.status === "missing") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "pass",
+        message: "no pending gateway device approvals file was found",
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.status === "invalid") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `invalid pending device approvals file: ${gatewayPendingState.gatewayDevicePendingPath}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.status === "unreadable") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `unable to read pending device approvals at ${gatewayPendingState.gatewayDevicePendingPath}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.pendingRequestIds.length === 0) {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "pass",
+        message: "no pending gateway device approvals",
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `pending gateway device approvals: ${gatewayPendingState.pendingRequestIds.length}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath,
+          pendingRequestIds: gatewayPendingState.pendingRequestIds
+        }
+      })
+    );
+  }
   if (options.includeConnectorRuntimeCheck !== false) {
     if (selectedAgentName === void 0) {
       checks.push(
@@ -22452,6 +23396,24 @@ async function runOpenclawDoctor(options = {}) {
           remediationHint: OPENCLAW_SETUP_COMMAND_HINT
         })
       );
+      checks.push(
+        toDoctorCheck({
+          id: "state.connectorInboundInbox",
+          label: "Connector inbound inbox",
+          status: "fail",
+          message: "cannot validate connector inbound inbox without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+        })
+      );
+      checks.push(
+        toDoctorCheck({
+          id: "state.openclawHookHealth",
+          label: "OpenClaw hook health",
+          status: "fail",
+          message: "cannot validate OpenClaw hook health without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
+        })
+      );
     } else {
       const connectorAssignmentsPath = resolveConnectorAssignmentsPath(homeDir);
       try {
@@ -22470,6 +23432,26 @@ async function runOpenclawDoctor(options = {}) {
               details: { connectorAssignmentsPath, selectedAgentName }
             })
           );
+          checks.push(
+            toDoctorCheck({
+              id: "state.connectorInboundInbox",
+              label: "Connector inbound inbox",
+              status: "fail",
+              message: `no connector assignment found for ${selectedAgentName}`,
+              remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+              details: { connectorAssignmentsPath, selectedAgentName }
+            })
+          );
+          checks.push(
+            toDoctorCheck({
+              id: "state.openclawHookHealth",
+              label: "OpenClaw hook health",
+              status: "fail",
+              message: `no connector assignment found for ${selectedAgentName}`,
+              remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+              details: { connectorAssignmentsPath, selectedAgentName }
+            })
+          );
         } else {
           const fetchImpl = options.fetchImpl ?? globalThis.fetch;
           if (typeof fetchImpl !== "function") {
@@ -22482,6 +23464,24 @@ async function runOpenclawDoctor(options = {}) {
                 remediationHint: "Run doctor in a Node runtime with fetch support, or rerun openclaw setup"
               })
             );
+            checks.push(
+              toDoctorCheck({
+                id: "state.connectorInboundInbox",
+                label: "Connector inbound inbox",
+                status: "fail",
+                message: "fetch implementation is unavailable for connector inbox checks",
+                remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+              })
+            );
+            checks.push(
+              toDoctorCheck({
+                id: "state.openclawHookHealth",
+                label: "OpenClaw hook health",
+                status: "fail",
+                message: "fetch implementation is unavailable for OpenClaw hook health checks",
+                remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
+              })
+            );
           } else {
             const connectorStatus = await fetchConnectorHealthStatus({
               connectorBaseUrl: assignment.connectorBaseUrl,
@@ -22500,6 +23500,36 @@ async function runOpenclawDoctor(options = {}) {
                   }
                 })
               );
+              const inboxPendingCount = connectorStatus.inboundInbox?.pendingCount ?? 0;
+              const replayError = connectorStatus.inboundInbox?.lastReplayError;
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorInboundInbox",
+                  label: "Connector inbound inbox",
+                  status: "pass",
+                  message: inboxPendingCount === 0 ? "connector inbound inbox is empty" : `connector inbound inbox has ${inboxPendingCount} pending message(s)`,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl,
+                    ...connectorStatus.inboundInbox
+                  }
+                })
+              );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.openclawHookHealth",
+                  label: "OpenClaw hook health",
+                  status: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? "fail" : "pass",
+                  message: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? `connector replay to local OpenClaw hook is failing: ${replayError ?? "unknown error"}` : "connector replay to local OpenClaw hook is healthy",
+                  remediationHint: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? OPENCLAW_SETUP_RESTART_COMMAND_HINT : void 0,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl,
+                    ...connectorStatus.openclawHook,
+                    inboxPendingCount
+                  }
+                })
+              );
             } else {
               const reason = connectorStatus.reason ?? "connector runtime is unavailable";
               checks.push(
@@ -22515,6 +23545,32 @@ async function runOpenclawDoctor(options = {}) {
                   }
                 })
               );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorInboundInbox",
+                  label: "Connector inbound inbox",
+                  status: "fail",
+                  message: `unable to read connector inbound inbox status: ${reason}`,
+                  remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.openclawHookHealth",
+                  label: "OpenClaw hook health",
+                  status: "fail",
+                  message: `unable to verify OpenClaw hook health: ${reason}`,
+                  remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
             }
           }
         }
@@ -22529,6 +23585,24 @@ async function runOpenclawDoctor(options = {}) {
             details: { connectorAssignmentsPath }
           })
         );
+        checks.push(
+          toDoctorCheck({
+            id: "state.connectorInboundInbox",
+            label: "Connector inbound inbox",
+            status: "fail",
+            message: "cannot validate connector inbound inbox without connector assignment",
+            remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+          })
+        );
+        checks.push(
+          toDoctorCheck({
+            id: "state.openclawHookHealth",
+            label: "OpenClaw hook health",
+            status: "fail",
+            message: "cannot validate OpenClaw hook health without connector assignment",
+            remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
+          })
+        );
       }
     }
   }
@@ -22556,7 +23630,7 @@ function parseRelayProbeFailure(input) {
   if (input.status === 500) {
     return {
       message: "Relay probe failed inside local relay pipeline",
-      remediationHint: "Check connector runtime and peer pairing; rerun clawdentity openclaw doctor"
+      remediationHint: "Check peer pairing and rerun: clawdentity openclaw setup <agentName>"
     };
   }
   return {
@@ -22734,7 +23808,7 @@ async function setupOpenclawRelay(agentName, options) {
     relayRuntimeConfigPath
   });
   await ensureLocalAgentCredentials(homeDir, normalizedAgentName);
-  await mkdir5(dirname4(transformTargetPath), { recursive: true });
+  await mkdir6(dirname5(transformTargetPath), { recursive: true });
   try {
     await copyFile(transformSource, transformTargetPath);
   } catch (error48) {
@@ -22803,7 +23877,8 @@ async function setupOpenclawRelay(agentName, options) {
   await saveRelayRuntimeConfig(
     relayRuntimeConfigPath,
     openclawBaseUrl,
-    patchedOpenclawConfig.hookToken
+    patchedOpenclawConfig.hookToken,
+    relayTransformPeersPath
   );
   logger8.info("cli.openclaw_setup_completed", {
     agentName: normalizedAgentName,
@@ -22825,9 +23900,88 @@ async function setupOpenclawRelay(agentName, options) {
     relayRuntimeConfigPath
   };
 }
+async function assertSetupChecklistHealthy(input) {
+  let checklist = await runOpenclawDoctor({
+    homeDir: input.homeDir,
+    openclawDir: input.openclawDir,
+    includeConfigCheck: false,
+    includeConnectorRuntimeCheck: input.includeConnectorRuntimeCheck
+  });
+  if (checklist.status === "healthy") {
+    return;
+  }
+  let gatewayApprovalSummary;
+  const gatewayPairingFailure = checklist.checks.find(
+    (check2) => check2.id === "state.gatewayDevicePairing" && check2.status === "fail"
+  );
+  if (gatewayPairingFailure !== void 0) {
+    gatewayApprovalSummary = await autoApproveOpenclawGatewayDevices({
+      homeDir: input.homeDir,
+      openclawDir: input.openclawDir,
+      runner: input.gatewayDeviceApprovalRunner
+    });
+    if (gatewayApprovalSummary !== void 0) {
+      const successfulAttempts = gatewayApprovalSummary.attempts.filter(
+        (attempt) => attempt.ok
+      ).length;
+      const failedAttempts = gatewayApprovalSummary.attempts.filter(
+        (attempt) => !attempt.ok
+      );
+      logger8.info("cli.openclaw_setup_gateway_device_recovery_attempted", {
+        openclawDir: input.openclawDir,
+        pendingCount: gatewayApprovalSummary.pendingRequestIds.length,
+        successfulAttempts,
+        failedAttempts: failedAttempts.length,
+        commandUnavailable: failedAttempts.some(
+          (attempt) => attempt.unavailable
+        )
+      });
+      checklist = await runOpenclawDoctor({
+        homeDir: input.homeDir,
+        openclawDir: input.openclawDir,
+        includeConfigCheck: false,
+        includeConnectorRuntimeCheck: input.includeConnectorRuntimeCheck
+      });
+      if (checklist.status === "healthy") {
+        return;
+      }
+    }
+  }
+  const firstFailure = checklist.checks.find(
+    (check2) => check2.status === "fail"
+  );
+  const unavailableGatewayApprovalAttempt = gatewayApprovalSummary?.attempts.find((attempt) => attempt.unavailable);
+  const remediationHint = unavailableGatewayApprovalAttempt !== void 0 && firstFailure?.id === "state.gatewayDevicePairing" ? `${OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT}. Ensure the \`${resolveOpenclawGatewayApprovalCommand()}\` command is available.` : firstFailure?.remediationHint;
+  throw createCliError6(
+    "CLI_OPENCLAW_SETUP_CHECKLIST_FAILED",
+    "OpenClaw setup checklist failed",
+    {
+      firstFailedCheckId: firstFailure?.id,
+      firstFailedCheckMessage: firstFailure?.message,
+      remediationHint,
+      gatewayDeviceApproval: gatewayApprovalSummary,
+      checks: checklist.checks
+    }
+  );
+}
 async function setupOpenclawSelfReady(agentName, options) {
-  const setup = await setupOpenclawRelay(agentName, options);
+  const resolvedHomeDir = resolveHomeDir(options.homeDir);
+  const resolvedOpenclawDir = resolveOpenclawDir(
+    options.openclawDir,
+    resolvedHomeDir
+  );
+  const setup = await setupOpenclawRelay(agentName, {
+    ...options,
+    homeDir: resolvedHomeDir,
+    openclawDir: resolvedOpenclawDir
+  });
   if (options.noRuntimeStart === true) {
+    await assertSetupChecklistHealthy({
+      homeDir: resolvedHomeDir,
+      openclawDir: resolvedOpenclawDir,
+      includeConnectorRuntimeCheck: false,
+      gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
+    });
     return {
       ...setup,
       runtimeMode: "none",
@@ -22846,7 +24000,6 @@ async function setupOpenclawSelfReady(agentName, options) {
   const waitTimeoutSeconds = parseWaitTimeoutSeconds(
     options.waitTimeoutSeconds
   );
-  const resolvedHomeDir = resolveHomeDir(options.homeDir);
   const runtime = await startSetupConnectorRuntime({
     agentName: assertValidAgentName(agentName),
     homeDir: resolvedHomeDir,
@@ -22856,6 +24009,12 @@ async function setupOpenclawSelfReady(agentName, options) {
     waitTimeoutSeconds,
     fetchImpl
   });
+  await assertSetupChecklistHealthy({
+    homeDir: resolvedHomeDir,
+    openclawDir: resolvedOpenclawDir,
+    includeConnectorRuntimeCheck: true,
+    gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
+  });
   return {
     ...setup,
     ...runtime
@@ -22984,13 +24143,13 @@ var createOpenclawCommand = () => {
 import { randomBytes as randomBytes4 } from "crypto";
 import {
   chmod as chmod4,
-  mkdir as mkdir6,
+  mkdir as mkdir7,
   readdir,
-  readFile as readFile6,
+  readFile as readFile7,
   unlink as unlink2,
-  writeFile as writeFile6
+  writeFile as writeFile7
 } from "fs/promises";
-import { dirname as dirname5, join as join7, resolve } from "path";
+import { dirname as dirname6, join as join8, resolve } from "path";
 import { Command as Command8 } from "commander";
 import jsQR from "jsqr";
 import { PNG } from "pngjs";
@@ -23001,6 +24160,7 @@ var AIT_FILE_NAME4 = "ait.jwt";
 var SECRET_KEY_FILE_NAME3 = "secret.key";
 var PAIRING_QR_DIR_NAME = "pairing";
 var PEERS_FILE_NAME2 = "peers.json";
+var OPENCLAW_RELAY_RUNTIME_FILE_NAME3 = "openclaw-relay.json";
 var PAIR_START_PATH = "/pair/start";
 var PAIR_CONFIRM_PATH = "/pair/confirm";
 var PAIR_STATUS_PATH = "/pair/status";
@@ -23013,7 +24173,7 @@ var PEER_ALIAS_PATTERN2 = /^[a-zA-Z0-9._-]+$/;
 var DEFAULT_STATUS_WAIT_SECONDS = 300;
 var DEFAULT_STATUS_POLL_INTERVAL_SECONDS = 3;
 var MAX_PROFILE_NAME_LENGTH = 64;
-var isRecord9 = (value) => {
+var isRecord10 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function createCliError7(code, message2) {
@@ -23061,7 +24221,7 @@ function parseProfileName(value, label) {
   return candidate;
 }
 function parsePeerProfile(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_PROFILE_INVALID",
       "Pair profile must be an object"
@@ -23108,7 +24268,7 @@ function parsePairingTicketIssuerOrigin(ticket) {
       "Pairing ticket is invalid"
     );
   }
-  if (!isRecord9(payload) || typeof payload.iss !== "string") {
+  if (!isRecord10(payload) || typeof payload.iss !== "string") {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_TICKET_INVALID",
       "Pairing ticket is invalid"
@@ -23157,7 +24317,7 @@ function parseAitAgentDid(ait) {
       "Agent AIT is invalid. Recreate the agent before pairing."
     );
   }
-  if (!isRecord9(payload) || typeof payload.sub !== "string") {
+  if (!isRecord10(payload) || typeof payload.sub !== "string") {
     throw createCliError7(
       "CLI_PAIR_AGENT_NOT_FOUND",
       "Agent AIT is invalid. Recreate the agent before pairing."
@@ -23219,10 +24379,10 @@ function resolvePeerAlias(input) {
   return `${baseAlias}-${index}`;
 }
 function resolvePeersConfigPath(getConfigDirImpl) {
-  return join7(getConfigDirImpl(), PEERS_FILE_NAME2);
+  return join8(getConfigDirImpl(), PEERS_FILE_NAME2);
 }
 function parsePeerEntry(value) {
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer entry must be an object"
@@ -23271,7 +24431,7 @@ async function loadPeersConfig2(input) {
       "Peer config is not valid JSON"
     );
   }
-  if (!isRecord9(parsed)) {
+  if (!isRecord10(parsed)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer config must be a JSON object"
@@ -23280,7 +24440,7 @@ async function loadPeersConfig2(input) {
   if (parsed.peers === void 0) {
     return { peers: {} };
   }
-  if (!isRecord9(parsed.peers)) {
+  if (!isRecord10(parsed.peers)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer config peers field must be an object"
@@ -23294,7 +24454,7 @@ async function loadPeersConfig2(input) {
 }
 async function savePeersConfig2(input) {
   const peersPath = resolvePeersConfigPath(input.getConfigDirImpl);
-  await input.mkdirImpl(dirname5(peersPath), { recursive: true });
+  await input.mkdirImpl(dirname6(peersPath), { recursive: true });
   await input.writeFileImpl(
     peersPath,
     `${JSON.stringify(input.config, null, 2)}
@@ -23303,6 +24463,86 @@ async function savePeersConfig2(input) {
   );
   await input.chmodImpl(peersPath, FILE_MODE4);
 }
+function resolveRelayRuntimeConfigPath2(getConfigDirImpl) {
+  return join8(getConfigDirImpl(), OPENCLAW_RELAY_RUNTIME_FILE_NAME3);
+}
+async function loadRelayTransformPeersPath(input) {
+  const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath2(
+    input.getConfigDirImpl
+  );
+  let raw;
+  try {
+    raw = await input.readFileImpl(relayRuntimeConfigPath, "utf8");
+  } catch (error48) {
+    const nodeError = error48;
+    if (nodeError.code === "ENOENT") {
+      return void 0;
+    }
+    logger9.warn("cli.pair.relay_runtime_read_failed", {
+      relayRuntimeConfigPath,
+      reason: error48 instanceof Error && error48.message.length > 0 ? error48.message : "unknown"
+    });
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    logger9.warn("cli.pair.relay_runtime_invalid_json", {
+      relayRuntimeConfigPath
+    });
+    return void 0;
+  }
+  if (!isRecord10(parsed)) {
+    return void 0;
+  }
+  const relayTransformPeersPath = parseNonEmptyString9(
+    parsed.relayTransformPeersPath
+  );
+  if (relayTransformPeersPath.length === 0) {
+    return void 0;
+  }
+  return resolve(relayTransformPeersPath);
+}
+async function syncOpenclawRelayPeersSnapshot(input) {
+  const relayTransformPeersPath = await loadRelayTransformPeersPath({
+    getConfigDirImpl: input.getConfigDirImpl,
+    readFileImpl: input.readFileImpl
+  });
+  if (relayTransformPeersPath === void 0) {
+    return;
+  }
+  try {
+    await input.readFileImpl(relayTransformPeersPath, "utf8");
+  } catch (error48) {
+    const nodeError = error48;
+    if (nodeError.code === "ENOENT") {
+      return;
+    }
+    logger9.warn("cli.pair.relay_peers_snapshot_probe_failed", {
+      relayTransformPeersPath,
+      reason: error48 instanceof Error && error48.message.length > 0 ? error48.message : "unknown"
+    });
+    return;
+  }
+  try {
+    await input.mkdirImpl(dirname6(relayTransformPeersPath), {
+      recursive: true
+    });
+    await input.writeFileImpl(
+      relayTransformPeersPath,
+      `${JSON.stringify(input.config, null, 2)}
+`,
+      "utf8"
+    );
+    await input.chmodImpl(relayTransformPeersPath, FILE_MODE4);
+  } catch (error48) {
+    logger9.warn("cli.pair.relay_peers_snapshot_write_failed", {
+      relayTransformPeersPath,
+      reason: error48 instanceof Error && error48.message.length > 0 ? error48.message : "unknown"
+    });
+  }
+}
 function parseTtlSeconds(value) {
   const raw = parseNonEmptyString9(value);
   if (raw.length === 0) {
@@ -23386,7 +24626,7 @@ function toPathWithQuery3(url2) {
   return `${parsed.pathname}${parsed.search}`;
 }
 function extractErrorCode(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -23397,7 +24637,7 @@ function extractErrorCode(payload) {
   return code.length > 0 ? code : void 0;
 }
 function extractErrorMessage(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -23485,7 +24725,7 @@ function mapStatusPairError(status, payload) {
   return `Pair status failed (${status})`;
 }
 function parsePairStartResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_START_INVALID_RESPONSE",
       "Pair start response is invalid"
@@ -23517,7 +24757,7 @@ function parsePairStartResponse(payload) {
   };
 }
 function parsePairConfirmResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_INVALID_RESPONSE",
       "Pair confirm response is invalid"
@@ -23552,7 +24792,7 @@ function parsePairConfirmResponse(payload) {
   };
 }
 function parsePairStatusResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_STATUS_INVALID_RESPONSE",
       "Pair status response is invalid"
@@ -23618,16 +24858,16 @@ function parsePairStatusResponse(payload) {
   };
 }
 async function readAgentProofMaterial(agentName, dependencies) {
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const readFileImpl = dependencies.readFileImpl ?? readFile7;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
   const normalizedAgentName = assertValidAgentName(agentName);
-  const agentDir = join7(
+  const agentDir = join8(
     getConfigDirImpl(),
     AGENTS_DIR_NAME5,
     normalizedAgentName
   );
-  const aitPath = join7(agentDir, AIT_FILE_NAME4);
-  const secretKeyPath = join7(agentDir, SECRET_KEY_FILE_NAME3);
+  const aitPath = join8(agentDir, AIT_FILE_NAME4);
+  const secretKeyPath = join8(agentDir, SECRET_KEY_FILE_NAME3);
   let ait;
   try {
     ait = (await readFileImpl(aitPath, "utf-8")).trim();
@@ -23725,14 +24965,14 @@ function decodeTicketFromPng(imageBytes) {
   return parsePairingTicket(decoded.data);
 }
 async function persistPairingQr(input) {
-  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir6;
+  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir7;
   const readdirImpl = input.dependencies.readdirImpl ?? readdir;
   const unlinkImpl = input.dependencies.unlinkImpl ?? unlink2;
-  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile6;
+  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile7;
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
   const qrEncodeImpl = input.dependencies.qrEncodeImpl ?? encodeTicketQrPng;
-  const baseDir = join7(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
-  const outputPath = parseNonEmptyString9(input.qrOutput) ? resolve(input.qrOutput ?? "") : join7(
+  const baseDir = join8(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
+  const outputPath = parseNonEmptyString9(input.qrOutput) ? resolve(input.qrOutput ?? "") : join8(
     baseDir,
     `${assertValidAgentName(input.agentName)}-pair-${input.nowSeconds}.png`
   );
@@ -23758,7 +24998,7 @@ async function persistPairingQr(input) {
     if (issuedAtSeconds + PAIRING_QR_MAX_AGE_SECONDS > input.nowSeconds) {
       continue;
     }
-    const stalePath = join7(baseDir, fileName);
+    const stalePath = join8(baseDir, fileName);
     await unlinkImpl(stalePath).catch((error48) => {
       const nodeError = error48;
       if (nodeError.code === "ENOENT") {
@@ -23767,7 +25007,7 @@ async function persistPairingQr(input) {
       throw error48;
     });
   }
-  await mkdirImpl(dirname5(outputPath), { recursive: true });
+  await mkdirImpl(dirname6(outputPath), { recursive: true });
   const imageBytes = await qrEncodeImpl(input.ticket);
   await writeFileImpl(outputPath, imageBytes);
   return outputPath;
@@ -23801,9 +25041,9 @@ function resolveConfirmTicketSource(options) {
 }
 async function persistPairedPeer(input) {
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
-  const readFileImpl = input.dependencies.readFileImpl ?? readFile6;
-  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir6;
-  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile6;
+  const readFileImpl = input.dependencies.readFileImpl ?? readFile7;
+  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir7;
+  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile7;
   const chmodImpl = input.dependencies.chmodImpl ?? chmod4;
   const issuerOrigin = parsePairingTicketIssuerOrigin(input.ticket);
   const peerProxyUrl = new URL("/hooks/agent", `${issuerOrigin}/`).toString();
@@ -23828,6 +25068,14 @@ async function persistPairedPeer(input) {
     writeFileImpl,
     chmodImpl
   });
+  await syncOpenclawRelayPeersSnapshot({
+    config: peersConfig,
+    getConfigDirImpl,
+    readFileImpl,
+    mkdirImpl,
+    writeFileImpl,
+    chmodImpl
+  });
   return alias;
 }
 async function startPairing(agentName, options, dependencies = {}) {
@@ -23907,7 +25155,7 @@ async function confirmPairing(agentName, options, dependencies = {}) {
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
   const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const readFileImpl = dependencies.readFileImpl ?? readFile7;
   const qrDecodeImpl = dependencies.qrDecodeImpl ?? decodeTicketFromPng;
   const config2 = await resolveConfigImpl();
   const normalizedAgentName = assertValidAgentName(agentName);
@@ -24336,16 +25584,16 @@ import { Command as Command9 } from "commander";
 
 // src/install-skill-mode.ts
 import { constants, existsSync as existsSync2 } from "fs";
-import { access as access3, copyFile as copyFile2, mkdir as mkdir7, readdir as readdir2, readFile as readFile7 } from "fs/promises";
+import { access as access3, copyFile as copyFile2, mkdir as mkdir8, readdir as readdir2, readFile as readFile8 } from "fs/promises";
 import { createRequire } from "module";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname6, join as join8, relative } from "path";
+import { dirname as dirname7, join as join9, relative } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var OPENCLAW_DIR_NAME2 = ".openclaw";
 var SKILL_PACKAGE_NAME = "@clawdentity/openclaw-skill";
 var SKILL_DIR_NAME2 = "clawdentity-openclaw-relay";
 var RELAY_MODULE_FILE_NAME2 = "relay-to-peer.mjs";
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null;
 }
 var SkillInstallError = class extends Error {
@@ -24359,7 +25607,7 @@ var SkillInstallError = class extends Error {
   }
 };
 function getErrorCode3(error48) {
-  if (!isRecord10(error48)) {
+  if (!isRecord11(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -24374,7 +25622,7 @@ function resolveOpenclawDir2(homeDir, inputOpenclawDir) {
   if (typeof inputOpenclawDir === "string" && inputOpenclawDir.trim().length > 0) {
     return inputOpenclawDir.trim();
   }
-  return join8(homeDir, OPENCLAW_DIR_NAME2);
+  return join9(homeDir, OPENCLAW_DIR_NAME2);
 }
 function resolveSkillPackageRoot(input) {
   if (typeof input.skillPackageRoot === "string" && input.skillPackageRoot.trim().length > 0) {
@@ -24384,8 +25632,8 @@ function resolveSkillPackageRoot(input) {
   if (typeof overriddenRoot === "string" && overriddenRoot.trim().length > 0) {
     return overriddenRoot.trim();
   }
-  const bundledSkillRoot = join8(
-    dirname6(fileURLToPath3(import.meta.url)),
+  const bundledSkillRoot = join9(
+    dirname7(fileURLToPath3(import.meta.url)),
     "..",
     "skill-bundle",
     "openclaw-skill"
@@ -24397,10 +25645,10 @@ function resolveSkillPackageRoot(input) {
   let packageJsonPath;
   try {
     packageJsonPath = require3.resolve(`${SKILL_PACKAGE_NAME}/package.json`);
-    return dirname6(packageJsonPath);
+    return dirname7(packageJsonPath);
   } catch {
-    const workspaceFallbackRoot = join8(
-      dirname6(fileURLToPath3(import.meta.url)),
+    const workspaceFallbackRoot = join9(
+      dirname7(fileURLToPath3(import.meta.url)),
       "..",
       "..",
       "openclaw-skill"
@@ -24442,7 +25690,7 @@ async function listFilesRecursively(directoryPath) {
   for (const entry of entries.sort(
     (left, right) => left.name.localeCompare(right.name)
   )) {
-    const entryPath = join8(directoryPath, entry.name);
+    const entryPath = join9(directoryPath, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursively(entryPath));
       continue;
@@ -24454,10 +25702,10 @@ async function listFilesRecursively(directoryPath) {
   return files;
 }
 async function resolveArtifacts(input) {
-  const skillRoot = join8(input.skillPackageRoot, "skill");
-  const skillDocSource = join8(skillRoot, "SKILL.md");
-  const referencesRoot = join8(skillRoot, "references");
-  const relaySource = join8(
+  const skillRoot = join9(input.skillPackageRoot, "skill");
+  const skillDocSource = join9(skillRoot, "SKILL.md");
+  const referencesRoot = join9(skillRoot, "references");
+  const relaySource = join9(
     input.skillPackageRoot,
     "dist",
     RELAY_MODULE_FILE_NAME2
@@ -24493,19 +25741,19 @@ async function resolveArtifacts(input) {
       }
     });
   }
-  const targetSkillRoot = join8(input.openclawDir, "skills", SKILL_DIR_NAME2);
+  const targetSkillRoot = join9(input.openclawDir, "skills", SKILL_DIR_NAME2);
   const artifacts = [
     {
       sourcePath: skillDocSource,
-      targetPath: join8(targetSkillRoot, "SKILL.md")
+      targetPath: join9(targetSkillRoot, "SKILL.md")
     },
     {
       sourcePath: relaySource,
-      targetPath: join8(targetSkillRoot, RELAY_MODULE_FILE_NAME2)
+      targetPath: join9(targetSkillRoot, RELAY_MODULE_FILE_NAME2)
     },
     {
       sourcePath: relaySource,
-      targetPath: join8(
+      targetPath: join9(
         input.openclawDir,
         "hooks",
         "transforms",
@@ -24517,7 +25765,7 @@ async function resolveArtifacts(input) {
     const relativePath = relative(referencesRoot, referenceFile);
     artifacts.push({
       sourcePath: referenceFile,
-      targetPath: join8(targetSkillRoot, "references", relativePath)
+      targetPath: join9(targetSkillRoot, "references", relativePath)
     });
   }
   return artifacts.sort(
@@ -24525,10 +25773,10 @@ async function resolveArtifacts(input) {
   );
 }
 async function copyArtifact(input) {
-  const sourceContent = await readFile7(input.sourcePath);
+  const sourceContent = await readFile8(input.sourcePath);
   let existingContent;
   try {
-    existingContent = await readFile7(input.targetPath);
+    existingContent = await readFile8(input.targetPath);
   } catch (error48) {
     if (getErrorCode3(error48) !== "ENOENT") {
       throw error48;
@@ -24537,7 +25785,7 @@ async function copyArtifact(input) {
   if (existingContent !== void 0 && sourceContent.equals(existingContent)) {
     return "unchanged";
   }
-  await mkdir7(dirname6(input.targetPath), { recursive: true });
+  await mkdir8(dirname7(input.targetPath), { recursive: true });
   await copyFile2(input.sourcePath, input.targetPath);
   if (existingContent !== void 0) {
     return "updated";
@@ -24569,7 +25817,7 @@ async function installOpenclawSkillArtifacts(options = {}) {
     homeDir,
     openclawDir,
     skillPackageRoot,
-    targetSkillDirectory: join8(openclawDir, "skills", SKILL_DIR_NAME2),
+    targetSkillDirectory: join9(openclawDir, "skills", SKILL_DIR_NAME2),
     records
   };
 }
@@ -24660,7 +25908,7 @@ var createSkillCommand = () => {
 };
 
 // src/commands/verify.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import { Command as Command10 } from "commander";
 var logger10 = createLogger({ service: "cli", module: "verify" });
 var REGISTRY_KEYS_CACHE_FILE = "registry-keys.json";
@@ -24673,7 +25921,7 @@ var VerifyCommandError = class extends Error {
     this.name = "VerifyCommandError";
   }
 };
-var isRecord11 = (value) => {
+var isRecord12 = (value) => {
   return typeof value === "object" && value !== null;
 };
 var normalizeRegistryUrl2 = (registryUrl) => {
@@ -24709,7 +25957,7 @@ var resolveToken = async (tokenOrFile) => {
     throw new VerifyCommandError("invalid token (value is empty)");
   }
   try {
-    const fileContents = await readFile8(input, "utf-8");
+    const fileContents = await readFile9(input, "utf-8");
     const token = fileContents.trim();
     if (token.length === 0) {
       throw new VerifyCommandError(`invalid token (${input} is empty)`);
@@ -24741,7 +25989,7 @@ var parseResponseJson = async (response) => {
   }
 };
 var parseSigningKeys = (payload) => {
-  if (!isRecord11(payload) || !Array.isArray(payload.keys)) {
+  if (!isRecord12(payload) || !Array.isArray(payload.keys)) {
     throw new VerifyCommandError(
       "verification keys unavailable (response payload is invalid)"
     );
@@ -24760,7 +26008,7 @@ var parseSigningKeys = (payload) => {
 };
 var parseRegistryKeysCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord11(parsed)) {
+  if (!isRecord12(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, keys } = parsed;
@@ -24786,7 +26034,7 @@ var parseRegistryKeysCache = (rawCache) => {
 };
 var parseCrlCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord11(parsed)) {
+  if (!isRecord12(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, claims } = parsed;
@@ -24884,7 +26132,7 @@ var fetchCrlClaims = async (input) => {
     );
   }
   const payload = await parseResponseJson(response);
-  if (!isRecord11(payload) || typeof payload.crl !== "string") {
+  if (!isRecord12(payload) || typeof payload.crl !== "string") {
     throw new VerifyCommandError(
       "revocation check unavailable (response payload is invalid)"
     );
@@ -24929,7 +26177,7 @@ var loadCrlClaims = async (input) => {
   return claims;
 };
 var toInvalidTokenReason = (error48) => {
-  if (isRecord11(error48) && typeof error48.message === "string") {
+  if (isRecord12(error48) && typeof error48.message === "string") {
     return `invalid token (${error48.message})`;
   }
   if (error48 instanceof Error && error48.message.length > 0) {