clawdentity 0.0.19 → 0.0.20

package/dist/bin.js

@@ -18656,9 +18656,9 @@ var createConfigCommand = (dependencies = {}) => {
 
 // src/commands/connector.ts
 import { execFile as execFileCallback } from "child_process";
-import { mkdir as mkdir4, readFile as readFile4, rm, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readFile as readFile5, rm, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 
@@ -18681,6 +18681,13 @@ var DEFAULT_CONNECTOR_OUTBOUND_PATH = "/v1/outbound";
 var DEFAULT_CONNECTOR_STATUS_PATH = "/v1/status";
 var DEFAULT_RELAY_DELIVER_TIMEOUT_MS = 15e3;
 var DEFAULT_OPENCLAW_DELIVER_RETRY_BUDGET_MS = DEFAULT_RELAY_DELIVER_TIMEOUT_MS - 1e3;
+var DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_MESSAGES = 1e5;
+var DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_BYTES = 2 * 1024 * 1024 * 1024;
+var DEFAULT_CONNECTOR_INBOUND_REPLAY_INTERVAL_MS = 2e3;
+var DEFAULT_CONNECTOR_INBOUND_REPLAY_BATCH_SIZE = 25;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS = 1e3;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS = 6e4;
+var DEFAULT_CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR = 2;
 var AGENT_ACCESS_HEADER = "x-claw-agent-access";
 var WS_READY_STATE_OPEN = 1;
 
@@ -18942,6 +18949,7 @@ var ConnectorClient = class {
   fetchImpl;
   logger;
   hooks;
+  inboundDeliverHandler;
   now;
   random;
   ulidFactory;
@@ -18996,6 +19004,7 @@ var ConnectorClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
     this.logger = options.logger ?? createLogger({ service: "connector", module: "client" });
     this.hooks = options.hooks ?? {};
+    this.inboundDeliverHandler = options.inboundDeliverHandler;
     this.now = options.now ?? Date.now;
     this.random = options.random ?? Math.random;
     this.ulidFactory = options.ulidFactory ?? generateUlid;
@@ -19208,6 +19217,44 @@ var ConnectorClient = class {
     this.sendFrame(ackFrame);
   }
   async handleDeliverFrame(frame) {
+    if (this.inboundDeliverHandler !== void 0) {
+      try {
+        const result = await this.inboundDeliverHandler(frame);
+        const ackFrame = {
+          v: CONNECTOR_FRAME_VERSION,
+          type: "deliver_ack",
+          id: this.makeFrameId(),
+          ts: this.makeTimestamp(),
+          ackId: frame.id,
+          accepted: result.accepted,
+          reason: result.reason
+        };
+        this.sendFrame(ackFrame);
+        if (result.accepted) {
+          this.hooks.onDeliverSucceeded?.(frame);
+        } else {
+          this.hooks.onDeliverFailed?.(
+            frame,
+            new Error(
+              result.reason ?? "Inbound delivery was rejected by runtime handler"
+            )
+          );
+        }
+      } catch (error48) {
+        const ackFrame = {
+          v: CONNECTOR_FRAME_VERSION,
+          type: "deliver_ack",
+          id: this.makeFrameId(),
+          ts: this.makeTimestamp(),
+          ackId: frame.id,
+          accepted: false,
+          reason: sanitizeErrorReason(error48)
+        };
+        this.sendFrame(ackFrame);
+        this.hooks.onDeliverFailed?.(frame, error48);
+      }
+      return;
+    }
     try {
       await this.deliverToLocalOpenclawWithRetry(frame);
       const ackFrame = {
@@ -19323,13 +19370,353 @@ var ConnectorClient = class {
   }
 };
 
+// ../../packages/connector/src/inbound-inbox.ts
+import {
+  appendFile,
+  mkdir as mkdir3,
+  readFile as readFile3,
+  rename as rename2,
+  writeFile as writeFile3
+} from "fs/promises";
+import { dirname as dirname2, join as join4 } from "path";
+var INBOUND_INBOX_DIR_NAME = "inbound-inbox";
+var INBOUND_INBOX_INDEX_FILE_NAME = "index.json";
+var INBOUND_INBOX_EVENTS_FILE_NAME = "events.jsonl";
+var INBOUND_INBOX_SCHEMA_VERSION = 1;
+function nowIso2() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function isRecord5(value) {
+  return typeof value === "object" && value !== null;
+}
+function parsePendingItem(value) {
+  if (!isRecord5(value)) {
+    return void 0;
+  }
+  const id = typeof value.id === "string" ? value.id.trim() : "";
+  const requestId = typeof value.requestId === "string" ? value.requestId.trim() : "";
+  const fromAgentDid = typeof value.fromAgentDid === "string" ? value.fromAgentDid.trim() : "";
+  const toAgentDid = typeof value.toAgentDid === "string" ? value.toAgentDid.trim() : "";
+  const receivedAt = typeof value.receivedAt === "string" ? value.receivedAt.trim() : "";
+  const nextAttemptAt = typeof value.nextAttemptAt === "string" ? value.nextAttemptAt.trim() : "";
+  const attemptCount = typeof value.attemptCount === "number" && Number.isInteger(value.attemptCount) ? value.attemptCount : NaN;
+  const payloadBytes = typeof value.payloadBytes === "number" && Number.isInteger(value.payloadBytes) ? value.payloadBytes : NaN;
+  if (id.length === 0 || requestId.length === 0 || fromAgentDid.length === 0 || toAgentDid.length === 0 || receivedAt.length === 0 || nextAttemptAt.length === 0 || !Number.isFinite(attemptCount) || attemptCount < 0 || !Number.isFinite(payloadBytes) || payloadBytes < 0) {
+    return void 0;
+  }
+  const lastError = typeof value.lastError === "string" ? value.lastError : void 0;
+  const lastAttemptAt = typeof value.lastAttemptAt === "string" ? value.lastAttemptAt : void 0;
+  return {
+    id,
+    requestId,
+    fromAgentDid,
+    toAgentDid,
+    payload: value.payload,
+    payloadBytes,
+    receivedAt,
+    nextAttemptAt,
+    attemptCount,
+    lastError,
+    lastAttemptAt
+  };
+}
+function toDefaultIndexFile() {
+  return {
+    version: INBOUND_INBOX_SCHEMA_VERSION,
+    pendingBytes: 0,
+    pendingByRequestId: {},
+    updatedAt: nowIso2()
+  };
+}
+function normalizeIndexFile(raw) {
+  if (!isRecord5(raw)) {
+    throw new Error("Inbound inbox index root must be an object");
+  }
+  const pendingByRequestIdRaw = raw.pendingByRequestId;
+  if (!isRecord5(pendingByRequestIdRaw)) {
+    throw new Error("Inbound inbox index pendingByRequestId must be an object");
+  }
+  const pendingByRequestId = {};
+  let pendingBytes = 0;
+  for (const [requestId, candidate] of Object.entries(pendingByRequestIdRaw)) {
+    const entry = parsePendingItem(candidate);
+    if (entry === void 0 || entry.requestId !== requestId) {
+      continue;
+    }
+    pendingByRequestId[requestId] = entry;
+    pendingBytes += entry.payloadBytes;
+  }
+  return {
+    version: typeof raw.version === "number" && Number.isFinite(raw.version) ? raw.version : INBOUND_INBOX_SCHEMA_VERSION,
+    pendingBytes,
+    pendingByRequestId,
+    updatedAt: typeof raw.updatedAt === "string" && raw.updatedAt.trim().length > 0 ? raw.updatedAt : nowIso2()
+  };
+}
+function toComparableTimeMs(value) {
+  const parsed = Date.parse(value);
+  if (Number.isFinite(parsed)) {
+    return parsed;
+  }
+  return Number.MAX_SAFE_INTEGER;
+}
+var ConnectorInboundInbox = class {
+  agentName;
+  eventsPath;
+  indexPath;
+  maxPendingBytes;
+  maxPendingMessages;
+  inboxDir;
+  writeChain = Promise.resolve();
+  constructor(options) {
+    this.agentName = options.agentName;
+    this.inboxDir = join4(
+      options.configDir,
+      "agents",
+      this.agentName,
+      INBOUND_INBOX_DIR_NAME
+    );
+    this.indexPath = join4(this.inboxDir, INBOUND_INBOX_INDEX_FILE_NAME);
+    this.eventsPath = join4(this.inboxDir, INBOUND_INBOX_EVENTS_FILE_NAME);
+    this.maxPendingBytes = options.maxPendingBytes;
+    this.maxPendingMessages = options.maxPendingMessages;
+  }
+  async enqueue(frame) {
+    return await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const existing = index.pendingByRequestId[frame.id];
+      if (existing !== void 0) {
+        await this.appendEvent({
+          type: "inbound_duplicate",
+          requestId: frame.id
+        });
+        return {
+          accepted: true,
+          duplicate: true,
+          pendingCount: Object.keys(index.pendingByRequestId).length
+        };
+      }
+      const payloadBytes = Buffer.byteLength(
+        JSON.stringify(frame.payload ?? null),
+        "utf8"
+      );
+      const pendingCount = Object.keys(index.pendingByRequestId).length;
+      if (pendingCount >= this.maxPendingMessages) {
+        return {
+          accepted: false,
+          duplicate: false,
+          pendingCount,
+          reason: "connector inbound inbox is full (message cap reached)"
+        };
+      }
+      if (index.pendingBytes + payloadBytes > this.maxPendingBytes) {
+        return {
+          accepted: false,
+          duplicate: false,
+          pendingCount,
+          reason: "connector inbound inbox is full (byte cap reached)"
+        };
+      }
+      const pendingItem = {
+        id: frame.id,
+        requestId: frame.id,
+        fromAgentDid: frame.fromAgentDid,
+        toAgentDid: frame.toAgentDid,
+        payload: frame.payload,
+        payloadBytes,
+        receivedAt: nowIso2(),
+        nextAttemptAt: nowIso2(),
+        attemptCount: 0
+      };
+      index.pendingByRequestId[pendingItem.requestId] = pendingItem;
+      index.pendingBytes += pendingItem.payloadBytes;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "inbound_persisted",
+        requestId: pendingItem.requestId,
+        details: {
+          payloadBytes,
+          fromAgentDid: pendingItem.fromAgentDid,
+          toAgentDid: pendingItem.toAgentDid
+        }
+      });
+      return {
+        accepted: true,
+        duplicate: false,
+        pendingCount: Object.keys(index.pendingByRequestId).length
+      };
+    });
+  }
+  async listDuePending(input) {
+    const index = await this.loadIndex();
+    const due = Object.values(index.pendingByRequestId).filter((item) => toComparableTimeMs(item.nextAttemptAt) <= input.nowMs).sort((left, right) => {
+      const leftNext = toComparableTimeMs(left.nextAttemptAt);
+      const rightNext = toComparableTimeMs(right.nextAttemptAt);
+      if (leftNext !== rightNext) {
+        return leftNext - rightNext;
+      }
+      return toComparableTimeMs(left.receivedAt) - toComparableTimeMs(right.receivedAt);
+    });
+    return due.slice(0, Math.max(1, input.limit));
+  }
+  async markDelivered(requestId) {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const entry = index.pendingByRequestId[requestId];
+      if (entry === void 0) {
+        return;
+      }
+      delete index.pendingByRequestId[requestId];
+      index.pendingBytes = Math.max(0, index.pendingBytes - entry.payloadBytes);
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "replay_succeeded",
+        requestId
+      });
+    });
+  }
+  async markReplayFailure(input) {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const entry = index.pendingByRequestId[input.requestId];
+      if (entry === void 0) {
+        return;
+      }
+      entry.attemptCount += 1;
+      entry.lastError = input.errorMessage;
+      entry.lastAttemptAt = nowIso2();
+      entry.nextAttemptAt = input.nextAttemptAt;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "replay_failed",
+        requestId: input.requestId,
+        details: {
+          attemptCount: entry.attemptCount,
+          nextAttemptAt: input.nextAttemptAt,
+          errorMessage: input.errorMessage
+        }
+      });
+    });
+  }
+  async pruneDelivered() {
+    await this.withWriteLock(async () => {
+      const index = await this.loadIndex();
+      const beforeCount = Object.keys(index.pendingByRequestId).length;
+      if (beforeCount === 0) {
+        return;
+      }
+      const after = {};
+      let pendingBytes = 0;
+      for (const [requestId, entry] of Object.entries(
+        index.pendingByRequestId
+      )) {
+        if (entry.attemptCount < 0) {
+          continue;
+        }
+        after[requestId] = entry;
+        pendingBytes += entry.payloadBytes;
+      }
+      index.pendingByRequestId = after;
+      index.pendingBytes = pendingBytes;
+      index.updatedAt = nowIso2();
+      await this.saveIndex(index);
+      await this.appendEvent({
+        type: "inbox_pruned",
+        details: {
+          beforeCount,
+          afterCount: Object.keys(after).length
+        }
+      });
+    });
+  }
+  async getSnapshot() {
+    const index = await this.loadIndex();
+    const entries = Object.values(index.pendingByRequestId);
+    if (entries.length === 0) {
+      return {
+        pendingCount: 0,
+        pendingBytes: index.pendingBytes
+      };
+    }
+    entries.sort((left, right) => {
+      return toComparableTimeMs(left.receivedAt) - toComparableTimeMs(right.receivedAt);
+    });
+    const nextAttemptAt = entries.map((entry) => entry.nextAttemptAt).sort(
+      (left, right) => toComparableTimeMs(left) - toComparableTimeMs(right)
+    )[0];
+    return {
+      pendingCount: entries.length,
+      pendingBytes: index.pendingBytes,
+      oldestPendingAt: entries[0]?.receivedAt,
+      nextAttemptAt
+    };
+  }
+  async withWriteLock(fn) {
+    const previous = this.writeChain;
+    let release;
+    this.writeChain = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    await previous;
+    try {
+      return await fn();
+    } finally {
+      release?.();
+    }
+  }
+  async loadIndex() {
+    await mkdir3(this.inboxDir, { recursive: true });
+    let raw;
+    try {
+      raw = await readFile3(this.indexPath, "utf8");
+    } catch (error48) {
+      if (error48 && typeof error48 === "object" && "code" in error48 && error48.code === "ENOENT") {
+        return toDefaultIndexFile();
+      }
+      throw error48;
+    }
+    if (raw.trim().length === 0) {
+      return toDefaultIndexFile();
+    }
+    const parsed = JSON.parse(raw);
+    return normalizeIndexFile(parsed);
+  }
+  async saveIndex(index) {
+    await mkdir3(dirname2(this.indexPath), { recursive: true });
+    const payload = {
+      ...index,
+      version: INBOUND_INBOX_SCHEMA_VERSION,
+      updatedAt: nowIso2()
+    };
+    const tmpPath = `${this.indexPath}.tmp-${Date.now()}`;
+    await writeFile3(tmpPath, `${JSON.stringify(payload, null, 2)}
+`, "utf8");
+    await rename2(tmpPath, this.indexPath);
+  }
+  async appendEvent(event) {
+    await mkdir3(dirname2(this.eventsPath), { recursive: true });
+    await appendFile(
+      this.eventsPath,
+      `${JSON.stringify({ ...event, at: nowIso2() })}
+`,
+      "utf8"
+    );
+  }
+};
+function createConnectorInboundInbox(options) {
+  return new ConnectorInboundInbox(options);
+}
+
 // ../../packages/connector/src/runtime.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile3 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, rename as rename3, writeFile as writeFile4 } from "fs/promises";
 import {
   createServer
 } from "http";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { WebSocket as NodeWebSocket } from "ws";
 var REGISTRY_AUTH_FILENAME = "registry-auth.json";
 var AGENTS_DIR_NAME2 = "agents";
@@ -19337,7 +19724,7 @@ var REFRESH_SINGLE_FLIGHT_PREFIX = "connector-runtime";
 var NONCE_SIZE = 16;
 var MAX_OUTBOUND_BODY_BYTES = 1024 * 1024;
 var ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null;
 }
 function toPathWithQuery2(url2) {
@@ -19405,6 +19792,121 @@ function resolveOpenclawHookToken(input) {
   }
   return value;
 }
+function toOpenclawHookUrl2(baseUrl, hookPath) {
+  const normalizedBase = baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`;
+  const normalizedHookPath = hookPath.startsWith("/") ? hookPath.slice(1) : hookPath;
+  return new URL(normalizedHookPath, normalizedBase).toString();
+}
+function parsePositiveIntEnv(key, fallback, minimum = 1) {
+  const raw = process.env[key]?.trim();
+  if (!raw) {
+    return fallback;
+  }
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < minimum) {
+    return fallback;
+  }
+  return parsed;
+}
+function sanitizeErrorReason2(error48) {
+  if (!(error48 instanceof Error)) {
+    return "Unknown error";
+  }
+  return error48.message.trim().slice(0, 240) || "Unknown error";
+}
+var LocalOpenclawDeliveryError2 = class extends Error {
+  retryable;
+  constructor(input) {
+    super(input.message);
+    this.name = "LocalOpenclawDeliveryError";
+    this.retryable = input.retryable;
+  }
+};
+function loadInboundReplayPolicy() {
+  const retryBackoffFactor = Number.parseFloat(
+    process.env.CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR ?? ""
+  );
+  return {
+    inboxMaxMessages: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_INBOX_MAX_MESSAGES",
+      DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_MESSAGES
+    ),
+    inboxMaxBytes: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_INBOX_MAX_BYTES",
+      DEFAULT_CONNECTOR_INBOUND_INBOX_MAX_BYTES
+    ),
+    replayIntervalMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_REPLAY_INTERVAL_MS",
+      DEFAULT_CONNECTOR_INBOUND_REPLAY_INTERVAL_MS
+    ),
+    batchSize: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_REPLAY_BATCH_SIZE",
+      DEFAULT_CONNECTOR_INBOUND_REPLAY_BATCH_SIZE
+    ),
+    retryInitialDelayMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS",
+      DEFAULT_CONNECTOR_INBOUND_RETRY_INITIAL_DELAY_MS
+    ),
+    retryMaxDelayMs: parsePositiveIntEnv(
+      "CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS",
+      DEFAULT_CONNECTOR_INBOUND_RETRY_MAX_DELAY_MS
+    ),
+    retryBackoffFactor: Number.isFinite(retryBackoffFactor) && retryBackoffFactor >= 1 ? retryBackoffFactor : DEFAULT_CONNECTOR_INBOUND_RETRY_BACKOFF_FACTOR
+  };
+}
+function computeReplayDelayMs(input) {
+  const exponent = Math.max(0, input.attemptCount - 1);
+  const delay = Math.min(
+    input.policy.retryMaxDelayMs,
+    Math.floor(
+      input.policy.retryInitialDelayMs * input.policy.retryBackoffFactor ** exponent
+    )
+  );
+  return Math.max(1, delay);
+}
+async function deliverToOpenclawHook(input) {
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => {
+    controller.abort();
+  }, DEFAULT_OPENCLAW_DELIVER_TIMEOUT_MS);
+  const headers = {
+    "content-type": "application/json",
+    "x-request-id": input.requestId
+  };
+  if (input.openclawHookToken !== void 0) {
+    headers["x-openclaw-token"] = input.openclawHookToken;
+  }
+  try {
+    const response = await input.fetchImpl(input.openclawHookUrl, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(input.payload),
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      throw new LocalOpenclawDeliveryError2({
+        message: `Local OpenClaw hook rejected payload with status ${response.status}`,
+        retryable: response.status >= 500 || response.status === 404 || response.status === 429
+      });
+    }
+  } catch (error48) {
+    if (error48 instanceof Error && error48.name === "AbortError") {
+      throw new LocalOpenclawDeliveryError2({
+        message: "Local OpenClaw hook request timed out",
+        retryable: true
+      });
+    }
+    if (error48 instanceof LocalOpenclawDeliveryError2) {
+      throw error48;
+    }
+    throw new LocalOpenclawDeliveryError2({
+      message: sanitizeErrorReason2(error48),
+      retryable: true
+    });
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
 function toInitialAuthBundle(credentials) {
   return {
     tokenType: "Bearer",
@@ -19432,7 +19934,7 @@ function shouldRefreshAccessToken(auth, nowMs) {
   return expiresAtMs <= nowMs + ACCESS_TOKEN_REFRESH_SKEW_MS;
 }
 function parseOutboundRelayRequest(payload) {
-  if (!isRecord5(payload)) {
+  if (!isRecord6(payload)) {
     throw new AppError({
       code: "CONNECTOR_OUTBOUND_INVALID_REQUEST",
       message: "Outbound relay request must be an object",
@@ -19490,20 +19992,20 @@ function createWebSocketFactory() {
   };
 }
 async function writeRegistryAuthAtomic(input) {
-  const targetPath = join4(
+  const targetPath = join5(
     input.configDir,
     AGENTS_DIR_NAME2,
     input.agentName,
     REGISTRY_AUTH_FILENAME
   );
   const tmpPath = `${targetPath}.tmp-${Date.now()}-${Math.random().toString(16).slice(2)}`;
-  await mkdir3(dirname2(targetPath), { recursive: true });
-  await writeFile3(tmpPath, `${JSON.stringify(input.auth, null, 2)}
+  await mkdir4(dirname3(targetPath), { recursive: true });
+  await writeFile4(tmpPath, `${JSON.stringify(input.auth, null, 2)}
 `, "utf8");
-  await rename2(tmpPath, targetPath);
+  await rename3(tmpPath, targetPath);
 }
 function parseRegistryAuthFromDisk(payload) {
-  if (!isRecord5(payload)) {
+  if (!isRecord6(payload)) {
     return void 0;
   }
   const tokenType = payload.tokenType;
@@ -19523,7 +20025,7 @@ function parseRegistryAuthFromDisk(payload) {
   };
 }
 async function readRegistryAuthFromDisk(input) {
-  const authPath = join4(
+  const authPath = join5(
     input.configDir,
     AGENTS_DIR_NAME2,
     input.agentName,
@@ -19531,7 +20033,7 @@ async function readRegistryAuthFromDisk(input) {
   );
   let raw;
   try {
-    raw = await readFile3(authPath, "utf8");
+    raw = await readFile4(authPath, "utf8");
   } catch (error48) {
     if (error48 && typeof error48 === "object" && "code" in error48 && error48.code === "ENOENT") {
       return void 0;
@@ -19660,6 +20162,23 @@ async function startConnectorRuntime(input) {
   await refreshCurrentAuthIfNeeded();
   const wsUrl = normalizeWebSocketUrl(input.proxyWebsocketUrl);
   const wsParsed = new URL(wsUrl);
+  const openclawBaseUrl = resolveOpenclawBaseUrl(input.openclawBaseUrl);
+  const openclawHookPath = resolveOpenclawHookPath(input.openclawHookPath);
+  const openclawHookToken = resolveOpenclawHookToken(input.openclawHookToken);
+  const openclawHookUrl = toOpenclawHookUrl2(openclawBaseUrl, openclawHookPath);
+  const inboundReplayPolicy = loadInboundReplayPolicy();
+  const inboundInbox = createConnectorInboundInbox({
+    configDir: input.configDir,
+    agentName: input.agentName,
+    maxPendingMessages: inboundReplayPolicy.inboxMaxMessages,
+    maxPendingBytes: inboundReplayPolicy.inboxMaxBytes
+  });
+  const inboundReplayStatus = {
+    replayerActive: false
+  };
+  let runtimeStopping = false;
+  let replayInFlight = false;
+  let replayIntervalHandle;
   const resolveUpgradeHeaders = async () => {
     await refreshCurrentAuthIfNeeded();
     return buildUpgradeHeaders({
@@ -19669,14 +20188,108 @@ async function startConnectorRuntime(input) {
       secretKey
     });
   };
+  const replayPendingInboundMessages = async () => {
+    if (runtimeStopping || replayInFlight) {
+      return;
+    }
+    replayInFlight = true;
+    inboundReplayStatus.replayerActive = true;
+    try {
+      const dueItems = await inboundInbox.listDuePending({
+        nowMs: Date.now(),
+        limit: inboundReplayPolicy.batchSize
+      });
+      for (const pending of dueItems) {
+        inboundReplayStatus.lastAttemptAt = (/* @__PURE__ */ new Date()).toISOString();
+        try {
+          await deliverToOpenclawHook({
+            fetchImpl,
+            openclawHookUrl,
+            openclawHookToken,
+            requestId: pending.requestId,
+            payload: pending.payload
+          });
+          await inboundInbox.markDelivered(pending.requestId);
+          inboundReplayStatus.lastReplayAt = (/* @__PURE__ */ new Date()).toISOString();
+          inboundReplayStatus.lastReplayError = void 0;
+          inboundReplayStatus.lastAttemptStatus = "ok";
+          logger12.info("connector.inbound.replay_succeeded", {
+            requestId: pending.requestId,
+            attemptCount: pending.attemptCount + 1
+          });
+        } catch (error48) {
+          const reason = sanitizeErrorReason2(error48);
+          const retryable = error48 instanceof LocalOpenclawDeliveryError2 ? error48.retryable : true;
+          const nextAttemptAt = new Date(
+            Date.now() + computeReplayDelayMs({
+              attemptCount: pending.attemptCount + 1,
+              policy: inboundReplayPolicy
+            }) * (retryable ? 1 : 10)
+          ).toISOString();
+          await inboundInbox.markReplayFailure({
+            requestId: pending.requestId,
+            errorMessage: reason,
+            nextAttemptAt
+          });
+          inboundReplayStatus.lastReplayError = reason;
+          inboundReplayStatus.lastAttemptStatus = "failed";
+          logger12.warn("connector.inbound.replay_failed", {
+            requestId: pending.requestId,
+            attemptCount: pending.attemptCount + 1,
+            retryable,
+            nextAttemptAt,
+            reason
+          });
+        }
+      }
+    } finally {
+      replayInFlight = false;
+      inboundReplayStatus.replayerActive = false;
+    }
+  };
+  const readInboundReplayView = async () => {
+    const pending = await inboundInbox.getSnapshot();
+    return {
+      pending,
+      replayerActive: inboundReplayStatus.replayerActive || replayInFlight,
+      lastReplayAt: inboundReplayStatus.lastReplayAt,
+      lastReplayError: inboundReplayStatus.lastReplayError,
+      openclawHook: {
+        url: openclawHookUrl,
+        lastAttemptAt: inboundReplayStatus.lastAttemptAt,
+        lastAttemptStatus: inboundReplayStatus.lastAttemptStatus
+      }
+    };
+  };
   const connectorClient = new ConnectorClient({
     connectorUrl: wsParsed.toString(),
     connectionHeadersProvider: resolveUpgradeHeaders,
-    openclawBaseUrl: resolveOpenclawBaseUrl(input.openclawBaseUrl),
-    openclawHookPath: resolveOpenclawHookPath(input.openclawHookPath),
-    openclawHookToken: resolveOpenclawHookToken(input.openclawHookToken),
+    openclawBaseUrl,
+    openclawHookPath,
+    openclawHookToken,
     fetchImpl,
     logger: logger12,
+    inboundDeliverHandler: async (frame) => {
+      const persisted = await inboundInbox.enqueue(frame);
+      if (!persisted.accepted) {
+        logger12.warn("connector.inbound.persist_rejected", {
+          requestId: frame.id,
+          reason: persisted.reason ?? "inbox limit reached",
+          pendingCount: persisted.pendingCount
+        });
+        return {
+          accepted: false,
+          reason: persisted.reason
+        };
+      }
+      logger12.info("connector.inbound.persisted", {
+        requestId: frame.id,
+        duplicate: persisted.duplicate,
+        pendingCount: persisted.pendingCount
+      });
+      void replayPendingInboundMessages();
+      return { accepted: true };
+    },
     webSocketFactory: createWebSocketFactory()
   });
   const outboundBaseUrl = normalizeOutboundBaseUrl(input.outboundBaseUrl);
@@ -19760,11 +20373,40 @@ async function startConnectorRuntime(input) {
         writeJson(res, 405, { error: "Method Not Allowed" });
         return;
       }
+      let inboundReplayView;
+      try {
+        inboundReplayView = await readInboundReplayView();
+      } catch (error48) {
+        logger12.warn("connector.status.inbound_inbox_unavailable", {
+          reason: sanitizeErrorReason2(error48)
+        });
+        writeJson(res, 500, {
+          status: "error",
+          error: {
+            code: "CONNECTOR_INBOUND_INBOX_UNAVAILABLE",
+            message: "Connector inbound inbox status is unavailable"
+          },
+          outboundUrl,
+          websocketUrl: wsUrl,
+          websocketConnected: connectorClient.isConnected()
+        });
+        return;
+      }
       writeJson(res, 200, {
         status: "ok",
         outboundUrl,
         websocketUrl: wsUrl,
-        websocketConnected: connectorClient.isConnected()
+        websocketConnected: connectorClient.isConnected(),
+        inboundInbox: {
+          pendingCount: inboundReplayView.pending.pendingCount,
+          pendingBytes: inboundReplayView.pending.pendingBytes,
+          oldestPendingAt: inboundReplayView.pending.oldestPendingAt,
+          nextAttemptAt: inboundReplayView.pending.nextAttemptAt,
+          replayerActive: inboundReplayView.replayerActive,
+          lastReplayAt: inboundReplayView.lastReplayAt,
+          lastReplayError: inboundReplayView.lastReplayError
+        },
+        openclawHook: inboundReplayView.openclawHook
       });
       return;
     }
@@ -19814,6 +20456,11 @@ async function startConnectorRuntime(input) {
     stoppedResolve = resolve2;
   });
   const stop = async () => {
+    runtimeStopping = true;
+    if (replayIntervalHandle !== void 0) {
+      clearInterval(replayIntervalHandle);
+      replayIntervalHandle = void 0;
+    }
     connectorClient.disconnect();
     await new Promise((resolve2, reject) => {
       server.close((error48) => {
@@ -19838,6 +20485,11 @@ async function startConnectorRuntime(input) {
     );
   });
   connectorClient.connect();
+  await inboundInbox.pruneDelivered();
+  void replayPendingInboundMessages();
+  replayIntervalHandle = setInterval(() => {
+    void replayPendingInboundMessages();
+  }, inboundReplayPolicy.replayIntervalMs);
   logger12.info("connector.runtime.started", {
     outboundUrl,
     websocketUrl: wsUrl,
@@ -19865,11 +20517,11 @@ var OPENCLAW_CONNECTORS_FILE_NAME = "openclaw-connectors.json";
 var SERVICE_LOG_DIR_NAME = "logs";
 var DEFAULT_CONNECTOR_BASE_URL2 = "http://127.0.0.1:19400";
 var DEFAULT_CONNECTOR_OUTBOUND_PATH2 = "/v1/outbound";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null;
 }
 function getErrorCode(error48) {
-  if (!isRecord6(error48)) {
+  if (!isRecord7(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -20008,7 +20660,7 @@ function resolveConnectorBaseUrlFromEnv() {
   return parseConnectorBaseUrl(value.trim());
 }
 async function readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl) {
-  const assignmentsPath = join5(configDir, OPENCLAW_CONNECTORS_FILE_NAME);
+  const assignmentsPath = join6(configDir, OPENCLAW_CONNECTORS_FILE_NAME);
   let raw;
   try {
     raw = await readFileImpl(assignmentsPath, "utf8");
@@ -20028,11 +20680,11 @@ async function readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl)
       { assignmentsPath }
     );
   }
-  if (!isRecord6(parsed) || !isRecord6(parsed.agents)) {
+  if (!isRecord7(parsed) || !isRecord7(parsed.agents)) {
     return void 0;
   }
   const entry = parsed.agents[agentName];
-  if (!isRecord6(entry) || typeof entry.connectorBaseUrl !== "string") {
+  if (!isRecord7(entry) || typeof entry.connectorBaseUrl !== "string") {
     return void 0;
   }
   return parseConnectorBaseUrl(entry.connectorBaseUrl);
@@ -20072,7 +20724,7 @@ async function readRequiredTrimmedFile(filePath, label, readFileImpl) {
   return trimmed;
 }
 async function readRelayRuntimeConfig(configDir, readFileImpl) {
-  const filePath = join5(configDir, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
+  const filePath = join6(configDir, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
   let raw;
   try {
     raw = await readFileImpl(filePath, "utf8");
@@ -20088,7 +20740,7 @@ async function readRelayRuntimeConfig(configDir, readFileImpl) {
   } catch {
     return void 0;
   }
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     return void 0;
   }
   const openclawHookToken = typeof parsed.openclawHookToken === "string" && parsed.openclawHookToken.trim().length > 0 ? parsed.openclawHookToken.trim() : void 0;
@@ -20106,7 +20758,7 @@ function parseJsonRecord(value, code, message2) {
   } catch {
     throw createCliError4(code, message2);
   }
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     throw createCliError4(code, message2);
   }
   return parsed;
@@ -20146,7 +20798,7 @@ async function loadDefaultConnectorModule() {
   };
 }
 function resolveWaitPromise(runtime) {
-  if (!runtime || !isRecord6(runtime)) {
+  if (!runtime || !isRecord7(runtime)) {
     return void 0;
   }
   if (typeof runtime.waitUntilStopped === "function") {
@@ -20211,7 +20863,7 @@ function buildConnectorStartArgs(agentName, commandOptions) {
 }
 function resolveCliEntryPath(resolveCurrentModulePathImpl) {
   const modulePath = resolveCurrentModulePathImpl?.() ?? fileURLToPath(import.meta.url);
-  return join5(dirname3(modulePath), "..", "bin.js");
+  return join6(dirname4(modulePath), "..", "bin.js");
 }
 function escapeXml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
@@ -20281,7 +20933,7 @@ function resolveServiceDependencies(dependencies) {
     execFileImpl,
     getConfigDirImpl: dependencies.getConfigDirImpl ?? getConfigDir,
     getHomeDirImpl: dependencies.getHomeDirImpl ?? homedir2,
-    mkdirImpl: dependencies.mkdirImpl ?? mkdir4,
+    mkdirImpl: dependencies.mkdirImpl ?? mkdir5,
     removeFileImpl: dependencies.removeFileImpl ?? rm,
     resolveCurrentModulePathImpl: dependencies.resolveCurrentModulePathImpl,
     resolveCurrentPlatformImpl: dependencies.resolveCurrentPlatformImpl ?? (() => process.platform),
@@ -20295,7 +20947,7 @@ function resolveServiceDependencies(dependencies) {
       return process.getuid();
     }),
     resolveNodeExecPathImpl: dependencies.resolveNodeExecPathImpl ?? (() => process.execPath),
-    writeFileImpl: dependencies.writeFileImpl ?? writeFile4
+    writeFileImpl: dependencies.writeFileImpl ?? writeFile5
   };
 }
 async function installConnectorServiceForAgent(agentName, commandOptions = {}, dependencies = {}) {
@@ -20309,7 +20961,7 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
   );
   const configDir = serviceDependencies.getConfigDirImpl();
   const homeDir = serviceDependencies.getHomeDirImpl();
-  const logsDir = join5(configDir, SERVICE_LOG_DIR_NAME);
+  const logsDir = join6(configDir, SERVICE_LOG_DIR_NAME);
   const serviceName = sanitizeServiceSegment(
     `clawdentity-connector-${agentName}`
   );
@@ -20319,12 +20971,12 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
     resolveCliEntryPath(serviceDependencies.resolveCurrentModulePathImpl),
     ...startArgs
   ];
-  const outputLogPath = join5(logsDir, `${serviceName}.out.log`);
-  const errorLogPath = join5(logsDir, `${serviceName}.err.log`);
+  const outputLogPath = join6(logsDir, `${serviceName}.out.log`);
+  const errorLogPath = join6(logsDir, `${serviceName}.err.log`);
   await serviceDependencies.mkdirImpl(logsDir, { recursive: true });
   if (platform === "systemd") {
-    const serviceDir = join5(homeDir, ".config", "systemd", "user");
-    const serviceFilePath2 = join5(serviceDir, `${serviceName}.service`);
+    const serviceDir = join6(homeDir, ".config", "systemd", "user");
+    const serviceFilePath2 = join6(serviceDir, `${serviceName}.service`);
     await serviceDependencies.mkdirImpl(serviceDir, { recursive: true });
     await serviceDependencies.writeFileImpl(
       serviceFilePath2,
@@ -20363,9 +21015,9 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
       serviceFilePath: serviceFilePath2
     };
   }
-  const launchAgentsDir = join5(homeDir, "Library", "LaunchAgents");
+  const launchAgentsDir = join6(homeDir, "Library", "LaunchAgents");
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join5(
+  const serviceFilePath = join6(
     launchAgentsDir,
     `${serviceNameWithDomain}.plist`
   );
@@ -20424,7 +21076,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     `clawdentity-connector-${agentName}`
   );
   if (platform === "systemd") {
-    const serviceFilePath2 = join5(
+    const serviceFilePath2 = join6(
       homeDir,
       ".config",
       "systemd",
@@ -20455,7 +21107,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     };
   }
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join5(
+  const serviceFilePath = join6(
     homeDir,
     "Library",
     "LaunchAgents",
@@ -20479,11 +21131,11 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
 async function startConnectorForAgent(agentName, commandOptions = {}, dependencies = {}) {
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
-  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile4(path, encoding));
+  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile5(path, encoding));
   const fetchImpl = dependencies.fetchImpl ?? globalThis.fetch;
   const loadConnectorModule = dependencies.loadConnectorModule ?? loadDefaultConnectorModule;
   const configDir = getConfigDirImpl();
-  const agentDirectory = join5(configDir, AGENTS_DIR_NAME3, agentName);
+  const agentDirectory = join6(configDir, AGENTS_DIR_NAME3, agentName);
   const [
     rawAit,
     rawSecretKey,
@@ -20495,22 +21147,22 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
     connectorModule
   ] = await Promise.all([
     readRequiredTrimmedFile(
-      join5(agentDirectory, AIT_FILE_NAME2),
+      join6(agentDirectory, AIT_FILE_NAME2),
       AIT_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, SECRET_KEY_FILE_NAME),
+      join6(agentDirectory, SECRET_KEY_FILE_NAME),
       SECRET_KEY_FILE_NAME,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, IDENTITY_FILE_NAME2),
+      join6(agentDirectory, IDENTITY_FILE_NAME2),
       IDENTITY_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join5(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
+      join6(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
       REGISTRY_AUTH_FILE_NAME2,
       readFileImpl
     ),
@@ -20557,8 +21209,8 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
       tokenType: registryAuth.tokenType
     }
   });
-  const outboundUrl = runtime && isRecord6(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
-  const proxyWebsocketUrl = runtime && isRecord6(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : resolvedProxyWebsocketUrl : void 0;
+  const outboundUrl = runtime && isRecord7(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
+  const proxyWebsocketUrl = runtime && isRecord7(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : resolvedProxyWebsocketUrl : void 0;
   return {
     outboundUrl,
     proxyWebsocketUrl,
@@ -20689,7 +21341,7 @@ function createConnectorCommand(dependencies = {}) {
 // src/commands/invite.ts
 import { Command as Command6 } from "commander";
 var logger7 = createLogger({ service: "cli", module: "invite" });
-var isRecord7 = (value) => {
+var isRecord8 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function parseNonEmptyString7(value) {
@@ -20733,7 +21385,7 @@ function requireApiKey2(config2) {
   );
 }
 function extractRegistryErrorCode(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20744,7 +21396,7 @@ function extractRegistryErrorCode(payload) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function extractRegistryErrorMessage4(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20818,13 +21470,13 @@ function mapRedeemInviteError(status, payload) {
   return `Invite redeem failed (${status})`;
 }
 function parseInviteRecord(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError5(
       "CLI_INVITE_CREATE_INVALID_RESPONSE",
       "Invite response is invalid"
     );
   }
-  const source = isRecord7(payload.invite) ? payload.invite : payload;
+  const source = isRecord8(payload.invite) ? payload.invite : payload;
   const code = parseNonEmptyString7(source.code);
   if (code.length === 0) {
     throw createCliError5(
@@ -20849,15 +21501,15 @@ function parseInviteRecord(payload) {
   return invite;
 }
 function parseInviteRedeemResponse(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError5(
       "CLI_INVITE_REDEEM_INVALID_RESPONSE",
       "Invite redeem response is invalid"
     );
   }
-  const apiKeySource = isRecord7(payload.apiKey) ? payload.apiKey : payload;
+  const apiKeySource = isRecord8(payload.apiKey) ? payload.apiKey : payload;
   const apiKeyToken = parseNonEmptyString7(
-    isRecord7(payload.apiKey) ? payload.apiKey.token : payload.token
+    isRecord8(payload.apiKey) ? payload.apiKey.token : payload.token
   );
   if (apiKeyToken.length === 0) {
     throw createCliError5(
@@ -20867,7 +21519,7 @@ function parseInviteRedeemResponse(payload) {
   }
   const apiKeyId = parseNonEmptyString7(apiKeySource.id);
   const apiKeyName = parseNonEmptyString7(apiKeySource.name);
-  const humanSource = isRecord7(payload.human) ? payload.human : void 0;
+  const humanSource = isRecord8(payload.human) ? payload.human : void 0;
   const humanName = parseNonEmptyString7(humanSource?.displayName);
   const proxyUrl = parseNonEmptyString7(payload.proxyUrl);
   if (humanName.length === 0) {
@@ -21055,9 +21707,9 @@ var createInviteCommand = (dependencies = {}) => {
 import { spawn } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
 import { existsSync } from "fs";
-import { chmod as chmod3, copyFile, mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { chmod as chmod3, copyFile, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join6, resolve as resolvePath } from "path";
+import { dirname as dirname5, join as join7, resolve as resolvePath } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command7 } from "commander";
 var logger8 = createLogger({ service: "cli", module: "openclaw" });
@@ -21106,10 +21758,12 @@ var OPENCLAW_SETUP_COMMAND_HINT = "Run: clawdentity openclaw setup <agentName>";
 var OPENCLAW_SETUP_RESTART_COMMAND_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} and restart OpenClaw`;
 var OPENCLAW_SETUP_WITH_BASE_URL_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} --openclaw-base-url <url>`;
 var OPENCLAW_PAIRING_COMMAND_HINT = "Run QR pairing first: clawdentity pair start <agentName> --qr and clawdentity pair confirm <agentName> --qr-file <path>";
-var OPENCLAW_DEVICE_APPROVAL_COMMAND_HINT = "Run: openclaw devices list and openclaw devices approve <requestId>";
+var OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT = "Run: clawdentity openclaw setup <agentName> (auto-recovers pending OpenClaw gateway device approvals)";
+var OPENCLAW_GATEWAY_APPROVAL_COMMAND = "openclaw";
+var OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS = 1e4;
 var textEncoder2 = new TextEncoder();
 var textDecoder = new TextDecoder();
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null;
 }
 function createCliError6(code, message2, details) {
@@ -21121,7 +21775,7 @@ function createCliError6(code, message2, details) {
   });
 }
 function getErrorCode2(error48) {
-  if (!isRecord8(error48)) {
+  if (!isRecord9(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -21242,12 +21896,12 @@ function resolveOpenclawHomeDir(homeDir) {
   return envOpenclawHome ?? homeDir;
 }
 function resolveDefaultOpenclawStateDir(openclawHomeDir) {
-  const newStateDir = join6(openclawHomeDir, OPENCLAW_DIR_NAME);
+  const newStateDir = join7(openclawHomeDir, OPENCLAW_DIR_NAME);
   if (existsSync(newStateDir)) {
     return newStateDir;
   }
   for (const legacyDirName of LEGACY_OPENCLAW_STATE_DIR_NAMES) {
-    const legacyStateDir = join6(openclawHomeDir, legacyDirName);
+    const legacyStateDir = join7(openclawHomeDir, legacyDirName);
     if (existsSync(legacyStateDir)) {
       return legacyStateDir;
     }
@@ -21270,16 +21924,16 @@ function resolveOpenclawDir(openclawDir, homeDir) {
     homeDir
   );
   if (envConfigPath !== void 0) {
-    return dirname4(envConfigPath);
+    return dirname5(envConfigPath);
   }
   const openclawHomeDir = resolveOpenclawHomeDir(homeDir);
   return resolveDefaultOpenclawStateDir(openclawHomeDir);
 }
 function resolveAgentDirectory(homeDir, agentName) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
 }
 function resolvePeersPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
 }
 function resolveOpenclawConfigPath(openclawDir, homeDir) {
   const envConfigPath = readNonEmptyEnvPath(
@@ -21290,9 +21944,9 @@ function resolveOpenclawConfigPath(openclawDir, homeDir) {
     return envConfigPath;
   }
   const configCandidates = [
-    join6(openclawDir, OPENCLAW_CONFIG_FILE_NAME),
+    join7(openclawDir, OPENCLAW_CONFIG_FILE_NAME),
     ...LEGACY_OPENCLAW_CONFIG_FILE_NAMES.map(
-      (fileName) => join6(openclawDir, fileName)
+      (fileName) => join7(openclawDir, fileName)
     )
   ];
   for (const candidate of configCandidates) {
@@ -21303,28 +21957,166 @@ function resolveOpenclawConfigPath(openclawDir, homeDir) {
   return configCandidates[0];
 }
 function resolveDefaultTransformSource(openclawDir) {
-  return join6(openclawDir, "skills", SKILL_DIR_NAME, RELAY_MODULE_FILE_NAME);
+  return join7(openclawDir, "skills", SKILL_DIR_NAME, RELAY_MODULE_FILE_NAME);
 }
 function resolveTransformTargetPath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
 }
 function resolveOpenclawAgentNamePath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
 }
 function resolveRelayRuntimeConfigPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
 }
 function resolveConnectorAssignmentsPath(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
 }
 function resolveTransformRuntimePath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
 }
 function resolveTransformPeersPath(openclawDir) {
-  return join6(openclawDir, "hooks", "transforms", RELAY_PEERS_FILE_NAME);
+  return join7(openclawDir, "hooks", "transforms", RELAY_PEERS_FILE_NAME);
+}
+async function readOpenclawGatewayPendingState(openclawDir) {
+  const gatewayDevicePendingPath = join7(openclawDir, "devices", "pending.json");
+  try {
+    const pendingPayload = await readJsonFile(gatewayDevicePendingPath);
+    if (!isRecord9(pendingPayload)) {
+      return {
+        status: "invalid",
+        gatewayDevicePendingPath
+      };
+    }
+    return {
+      status: "ok",
+      gatewayDevicePendingPath,
+      pendingRequestIds: Object.keys(pendingPayload)
+    };
+  } catch (error48) {
+    if (getErrorCode2(error48) === "ENOENT") {
+      return {
+        status: "missing",
+        gatewayDevicePendingPath
+      };
+    }
+    return {
+      status: "unreadable",
+      gatewayDevicePendingPath
+    };
+  }
+}
+function resolveOpenclawGatewayApprovalCommand() {
+  const envOverride = process.env.OPENCLAW_GATEWAY_APPROVAL_COMMAND?.trim();
+  if (typeof envOverride === "string" && envOverride.length > 0) {
+    return envOverride;
+  }
+  return OPENCLAW_GATEWAY_APPROVAL_COMMAND;
+}
+async function runOpenclawGatewayApprovalCommand(input) {
+  return await new Promise(
+    (resolve2) => {
+      const child = spawn(input.command, input.args, {
+        env: {
+          ...process.env,
+          OPENCLAW_STATE_DIR: input.openclawDir,
+          OPENCLAW_CONFIG_PATH: input.openclawConfigPath
+        },
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      let settled = false;
+      let stdout = "";
+      let stderr = "";
+      const finalize2 = (result) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve2({
+          ...result,
+          stdout: stdout.trim(),
+          stderr: stderr.trim()
+        });
+      };
+      const timeout = setTimeout(() => {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        finalize2({
+          ok: false,
+          errorMessage: `command timed out after ${OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS}ms`
+        });
+      }, OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS);
+      child.stdout?.on("data", (chunk) => {
+        stdout += String(chunk);
+      });
+      child.stderr?.on("data", (chunk) => {
+        stderr += String(chunk);
+      });
+      child.once("error", (error48) => {
+        clearTimeout(timeout);
+        const errorCode = getErrorCode2(error48);
+        finalize2({
+          ok: false,
+          unavailable: errorCode === "ENOENT",
+          errorMessage: error48 instanceof Error ? error48.message : "failed to run openclaw command"
+        });
+      });
+      child.once("close", (exitCode) => {
+        clearTimeout(timeout);
+        finalize2({
+          ok: exitCode === 0,
+          exitCode: typeof exitCode === "number" ? exitCode : void 0
+        });
+      });
+    }
+  );
+}
+async function runOpenclawGatewayDeviceApproval(input) {
+  const command = resolveOpenclawGatewayApprovalCommand();
+  return await runOpenclawGatewayApprovalCommand({
+    command,
+    args: ["devices", "approve", input.requestId, "--json"],
+    openclawDir: input.openclawDir,
+    openclawConfigPath: input.openclawConfigPath
+  });
+}
+async function autoApproveOpenclawGatewayDevices(input) {
+  const pendingState = await readOpenclawGatewayPendingState(input.openclawDir);
+  if (pendingState.status !== "ok" || pendingState.pendingRequestIds.length === 0) {
+    return void 0;
+  }
+  const openclawConfigPath = resolveOpenclawConfigPath(
+    input.openclawDir,
+    input.homeDir
+  );
+  const approvalRunner = input.runner ?? runOpenclawGatewayDeviceApproval;
+  const attempts = [];
+  for (const requestId of pendingState.pendingRequestIds) {
+    const execution = await approvalRunner({
+      requestId,
+      openclawDir: input.openclawDir,
+      openclawConfigPath
+    });
+    attempts.push({
+      requestId,
+      ok: execution.ok,
+      unavailable: execution.unavailable === true,
+      reason: execution.errorMessage ?? (execution.stderr && execution.stderr.length > 0 ? execution.stderr : execution.stdout && execution.stdout.length > 0 ? execution.stdout : void 0),
+      exitCode: execution.exitCode
+    });
+    if (execution.unavailable === true) {
+      break;
+    }
+  }
+  return {
+    gatewayDevicePendingPath: pendingState.gatewayDevicePendingPath,
+    pendingRequestIds: pendingState.pendingRequestIds,
+    attempts
+  };
 }
 async function readJsonFile(filePath) {
-  const raw = await readFile5(filePath, "utf8");
+  const raw = await readFile6(filePath, "utf8");
   try {
     return JSON.parse(raw);
   } catch {
@@ -21336,13 +22128,13 @@ async function readJsonFile(filePath) {
 async function ensureLocalAgentCredentials(homeDir, agentName) {
   const agentDir = resolveAgentDirectory(homeDir, agentName);
   const requiredFiles = [
-    join6(agentDir, SECRET_KEY_FILE_NAME2),
-    join6(agentDir, AIT_FILE_NAME3)
+    join7(agentDir, SECRET_KEY_FILE_NAME2),
+    join7(agentDir, AIT_FILE_NAME3)
   ];
   for (const filePath of requiredFiles) {
     let content;
     try {
-      content = await readFile5(filePath, "utf8");
+      content = await readFile6(filePath, "utf8");
     } catch (error48) {
       if (getErrorCode2(error48) === "ENOENT") {
         throw createCliError6(
@@ -21363,8 +22155,8 @@ async function ensureLocalAgentCredentials(homeDir, agentName) {
   }
 }
 async function writeSecureFile3(filePath, content) {
-  await mkdir5(dirname4(filePath), { recursive: true });
-  await writeFile5(filePath, content, "utf8");
+  await mkdir6(dirname5(filePath), { recursive: true });
+  await writeFile6(filePath, content, "utf8");
   await chmod3(filePath, FILE_MODE3);
 }
 async function loadPeersConfig(peersPath) {
@@ -21377,7 +22169,7 @@ async function loadPeersConfig(peersPath) {
     }
     throw error48;
   }
-  if (!isRecord8(parsed)) {
+  if (!isRecord9(parsed)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config root must be a JSON object",
@@ -21388,7 +22180,7 @@ async function loadPeersConfig(peersPath) {
   if (peersValue === void 0) {
     return { peers: {} };
   }
-  if (!isRecord8(peersValue)) {
+  if (!isRecord9(peersValue)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config peers field must be an object",
@@ -21398,7 +22190,7 @@ async function loadPeersConfig(peersPath) {
   const peers = {};
   for (const [alias, value] of Object.entries(peersValue)) {
     const normalizedAlias = parsePeerAlias(alias);
-    if (!isRecord8(value)) {
+    if (!isRecord9(value)) {
       throw createCliError6(
         "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
         "Peer entry must be an object",
@@ -21429,7 +22221,7 @@ function parseConnectorBaseUrlForAssignment(value, label) {
   });
 }
 function parseConnectorAssignments(value, connectorAssignmentsPath) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
       "Connector assignments config must be an object",
@@ -21437,12 +22229,12 @@ function parseConnectorAssignments(value, connectorAssignmentsPath) {
     );
   }
   const agentsRaw = value.agents;
-  if (!isRecord8(agentsRaw)) {
+  if (!isRecord9(agentsRaw)) {
     return { agents: {} };
   }
   const agents = {};
   for (const [agentName, entryValue] of Object.entries(agentsRaw)) {
-    if (!isRecord8(entryValue)) {
+    if (!isRecord9(entryValue)) {
       throw createCliError6(
         "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
         "Connector assignment entry must be an object",
@@ -21547,14 +22339,28 @@ function resolveConnectorStatusUrl(connectorBaseUrl) {
   ).toString();
 }
 function parseConnectorStatusPayload(payload) {
-  if (!isRecord8(payload) || typeof payload.websocketConnected !== "boolean") {
+  if (!isRecord9(payload) || typeof payload.websocketConnected !== "boolean") {
     throw createCliError6(
       "CLI_OPENCLAW_SETUP_CONNECTOR_STATUS_INVALID",
       "Connector status response is invalid"
     );
   }
   return {
-    websocketConnected: payload.websocketConnected
+    websocketConnected: payload.websocketConnected,
+    inboundInbox: isRecord9(payload.inboundInbox) ? {
+      pendingCount: typeof payload.inboundInbox.pendingCount === "number" ? payload.inboundInbox.pendingCount : void 0,
+      pendingBytes: typeof payload.inboundInbox.pendingBytes === "number" ? payload.inboundInbox.pendingBytes : void 0,
+      oldestPendingAt: typeof payload.inboundInbox.oldestPendingAt === "string" ? payload.inboundInbox.oldestPendingAt : void 0,
+      nextAttemptAt: typeof payload.inboundInbox.nextAttemptAt === "string" ? payload.inboundInbox.nextAttemptAt : void 0,
+      lastReplayAt: typeof payload.inboundInbox.lastReplayAt === "string" ? payload.inboundInbox.lastReplayAt : void 0,
+      lastReplayError: typeof payload.inboundInbox.lastReplayError === "string" ? payload.inboundInbox.lastReplayError : void 0,
+      replayerActive: typeof payload.inboundInbox.replayerActive === "boolean" ? payload.inboundInbox.replayerActive : void 0
+    } : void 0,
+    openclawHook: isRecord9(payload.openclawHook) ? {
+      url: typeof payload.openclawHook.url === "string" ? payload.openclawHook.url : void 0,
+      lastAttemptAt: typeof payload.openclawHook.lastAttemptAt === "string" ? payload.openclawHook.lastAttemptAt : void 0,
+      lastAttemptStatus: payload.openclawHook.lastAttemptStatus === "ok" || payload.openclawHook.lastAttemptStatus === "failed" ? payload.openclawHook.lastAttemptStatus : void 0
+    } : void 0
   };
 }
 async function fetchConnectorHealthStatus(input) {
@@ -21588,6 +22394,8 @@ async function fetchConnectorHealthStatus(input) {
     const parsed = parseConnectorStatusPayload(payload);
     return {
       connected: parsed.websocketConnected,
+      inboundInbox: parsed.inboundInbox,
+      openclawHook: parsed.openclawHook,
       reachable: true,
       statusUrl,
       reason: parsed.websocketConnected ? void 0 : "connector websocket is disconnected"
@@ -21630,14 +22438,14 @@ async function waitForConnectorConnected(input) {
   return latest;
 }
 function resolveConnectorRunDir(homeDir) {
-  return join6(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
+  return join7(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
 }
 function resolveConnectorPidPath(homeDir, agentName) {
-  return join6(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
+  return join7(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
 }
 async function readConnectorPidFile(pidPath) {
   try {
-    const raw = (await readFile5(pidPath, "utf8")).trim();
+    const raw = (await readFile6(pidPath, "utf8")).trim();
     if (raw.length === 0) {
       return void 0;
     }
@@ -21678,7 +22486,7 @@ function resolveCliEntryPathForDetachedStart() {
     return argvEntry;
   }
   const modulePath = fileURLToPath2(import.meta.url);
-  return join6(dirname4(modulePath), "..", "bin.js");
+  return join7(dirname5(modulePath), "..", "bin.js");
 }
 async function startDetachedConnectorRuntime(input) {
   await stopDetachedConnectorIfRunning({
@@ -21686,7 +22494,7 @@ async function startDetachedConnectorRuntime(input) {
     agentName: input.agentName
   });
   const runDir = resolveConnectorRunDir(input.homeDir);
-  await mkdir5(runDir, { recursive: true });
+  await mkdir6(runDir, { recursive: true });
   const cliEntryPath = resolveCliEntryPathForDetachedStart();
   const args = [
     cliEntryPath,
@@ -21764,7 +22572,7 @@ async function startSetupConnectorRuntime(input) {
   };
 }
 function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_RELAY_RUNTIME_CONFIG",
       "Relay runtime config must be an object",
@@ -21844,7 +22652,7 @@ function normalizeStringArrayWithValues(value, requiredValues) {
   return Array.from(normalized);
 }
 function resolveHookDefaultSessionKey(config2, hooks) {
-  const session = isRecord8(config2.session) ? config2.session : {};
+  const session = isRecord9(config2.session) ? config2.session : {};
   const scope = typeof session.scope === "string" ? session.scope.trim().toLowerCase() : "";
   const configuredMainSessionKey = resolveConfiguredOpenclawMainSessionKey(session);
   if (typeof hooks.defaultSessionKey === "string" && hooks.defaultSessionKey.trim().length > 0) {
@@ -21883,20 +22691,20 @@ function generateOpenclawHookToken() {
   return randomBytes3(OPENCLAW_HOOK_TOKEN_BYTES).toString("hex");
 }
 function upsertRelayHookMapping(mappingsValue) {
-  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord8).map((mapping) => ({ ...mapping })) : [];
+  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord9).map((mapping) => ({ ...mapping })) : [];
   const existingIndex = mappings.findIndex((mapping) => {
     if (mapping.id === HOOK_MAPPING_ID) {
       return true;
     }
-    if (!isRecord8(mapping.match)) {
+    if (!isRecord9(mapping.match)) {
       return false;
     }
     return mapping.match.path === HOOK_PATH_SEND_TO_PEER;
   });
-  const baseMapping = existingIndex >= 0 && isRecord8(mappings[existingIndex]) ? mappings[existingIndex] : {};
-  const nextMatch = isRecord8(baseMapping.match) ? { ...baseMapping.match } : {};
+  const baseMapping = existingIndex >= 0 && isRecord9(mappings[existingIndex]) ? mappings[existingIndex] : {};
+  const nextMatch = isRecord9(baseMapping.match) ? { ...baseMapping.match } : {};
   nextMatch.path = HOOK_PATH_SEND_TO_PEER;
-  const nextTransform = isRecord8(baseMapping.transform) ? { ...baseMapping.transform } : {};
+  const nextTransform = isRecord9(baseMapping.transform) ? { ...baseMapping.transform } : {};
   nextTransform.module = RELAY_MODULE_FILE_NAME;
   const relayMapping = {
     ...baseMapping,
@@ -21927,14 +22735,14 @@ async function patchOpenclawConfig(openclawConfigPath, hookToken) {
     }
     throw error48;
   }
-  if (!isRecord8(config2)) {
+  if (!isRecord9(config2)) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_CONFIG",
       "OpenClaw config root must be an object",
       { openclawConfigPath }
     );
   }
-  const hooks = isRecord8(config2.hooks) ? { ...config2.hooks } : {};
+  const hooks = isRecord9(config2.hooks) ? { ...config2.hooks } : {};
   const existingHookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
   const preferredHookToken = typeof hookToken === "string" && hookToken.trim().length > 0 ? hookToken.trim() : void 0;
   const resolvedHookToken = existingHookToken ?? preferredHookToken ?? generateOpenclawHookToken();
@@ -21952,7 +22760,7 @@ async function patchOpenclawConfig(openclawConfigPath, hookToken) {
     ...config2,
     hooks
   };
-  await writeFile5(
+  await writeFile6(
     openclawConfigPath,
     `${JSON.stringify(nextConfig, null, 2)}
 `,
@@ -21973,10 +22781,10 @@ function toDoctorResult(checks) {
   };
 }
 function isRelayHookMapping(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord9(value)) {
     return false;
   }
-  if (!isRecord8(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
+  if (!isRecord9(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
     return false;
   }
   if (typeof value.id === "string" && value.id !== HOOK_MAPPING_ID) {
@@ -21985,7 +22793,7 @@ function isRelayHookMapping(value) {
   return true;
 }
 function hasRelayTransformModule(value) {
-  if (!isRecord8(value) || !isRecord8(value.transform)) {
+  if (!isRecord9(value) || !isRecord9(value.transform)) {
     return false;
   }
   return value.transform.module === RELAY_MODULE_FILE_NAME;
@@ -22164,7 +22972,7 @@ async function runOpenclawDoctor(options = {}) {
   const selectedAgentPath = resolveOpenclawAgentNamePath(homeDir);
   let selectedAgentName;
   try {
-    const selectedAgentRaw = await readFile5(selectedAgentPath, "utf8");
+    const selectedAgentRaw = await readFile6(selectedAgentPath, "utf8");
     selectedAgentName = assertValidAgentName(selectedAgentRaw.trim());
     checks.push(
       toDoctorCheck({
@@ -22287,9 +23095,9 @@ async function runOpenclawDoctor(options = {}) {
   const relayTransformRuntimePath = resolveTransformRuntimePath(openclawDir);
   const relayTransformPeersPath = resolveTransformPeersPath(openclawDir);
   try {
-    const transformContents = await readFile5(transformTargetPath, "utf8");
-    const runtimeContents = await readFile5(relayTransformRuntimePath, "utf8");
-    const peersSnapshotContents = await readFile5(
+    const transformContents = await readFile6(transformTargetPath, "utf8");
+    const runtimeContents = await readFile6(relayTransformRuntimePath, "utf8");
+    const peersSnapshotContents = await readFile6(
       relayTransformPeersPath,
       "utf8"
     );
@@ -22342,10 +23150,10 @@ async function runOpenclawDoctor(options = {}) {
   const openclawConfigPath = resolveOpenclawConfigPath(openclawDir, homeDir);
   try {
     const openclawConfig = await readJsonFile(openclawConfigPath);
-    if (!isRecord8(openclawConfig)) {
+    if (!isRecord9(openclawConfig)) {
       throw new Error("root");
     }
-    const hooks = isRecord8(openclawConfig.hooks) ? openclawConfig.hooks : {};
+    const hooks = isRecord9(openclawConfig.hooks) ? openclawConfig.hooks : {};
     const hooksEnabled = hooks.enabled === true;
     const hookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
     const defaultSessionKey = typeof hooks.defaultSessionKey === "string" && hooks.defaultSessionKey.trim().length > 0 ? hooks.defaultSessionKey.trim() : void 0;
@@ -22357,7 +23165,7 @@ async function runOpenclawDoctor(options = {}) {
     const missingRequiredSessionPrefixes = defaultSessionKey === void 0 ? ["hook:"] : ["hook:", defaultSessionKey].filter(
       (prefix) => !allowedSessionKeyPrefixes.includes(prefix)
     );
-    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord8) : [];
+    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord9) : [];
     const relayMapping = mappings.find(
       (mapping) => isRelayHookMapping(mapping)
     );
@@ -22511,81 +23319,99 @@ async function runOpenclawDoctor(options = {}) {
       })
     );
   }
-  const gatewayDevicePendingPath = join6(openclawDir, "devices", "pending.json");
-  try {
-    const pendingPayload = await readJsonFile(gatewayDevicePendingPath);
-    if (!isRecord8(pendingPayload)) {
+  const gatewayPendingState = await readOpenclawGatewayPendingState(openclawDir);
+  if (gatewayPendingState.status === "missing") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "pass",
+        message: "no pending gateway device approvals file was found",
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.status === "invalid") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `invalid pending device approvals file: ${gatewayPendingState.gatewayDevicePendingPath}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.status === "unreadable") {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `unable to read pending device approvals at ${gatewayPendingState.gatewayDevicePendingPath}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else if (gatewayPendingState.pendingRequestIds.length === 0) {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "pass",
+        message: "no pending gateway device approvals",
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath
+        }
+      })
+    );
+  } else {
+    checks.push(
+      toDoctorCheck({
+        id: "state.gatewayDevicePairing",
+        label: "OpenClaw gateway device pairing",
+        status: "fail",
+        message: `pending gateway device approvals: ${gatewayPendingState.pendingRequestIds.length}`,
+        remediationHint: OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT,
+        details: {
+          gatewayDevicePendingPath: gatewayPendingState.gatewayDevicePendingPath,
+          pendingRequestIds: gatewayPendingState.pendingRequestIds
+        }
+      })
+    );
+  }
+  if (options.includeConnectorRuntimeCheck !== false) {
+    if (selectedAgentName === void 0) {
       checks.push(
         toDoctorCheck({
-          id: "state.gatewayDevicePairing",
-          label: "OpenClaw gateway device pairing",
+          id: "state.connectorRuntime",
+          label: "Connector runtime",
           status: "fail",
-          message: `invalid pending device approvals file: ${gatewayDevicePendingPath}`,
-          remediationHint: OPENCLAW_DEVICE_APPROVAL_COMMAND_HINT,
-          details: { gatewayDevicePendingPath }
-        })
-      );
-    } else {
-      const pendingRequestIds = Object.keys(pendingPayload);
-      if (pendingRequestIds.length === 0) {
-        checks.push(
-          toDoctorCheck({
-            id: "state.gatewayDevicePairing",
-            label: "OpenClaw gateway device pairing",
-            status: "pass",
-            message: "no pending gateway device approvals",
-            details: { gatewayDevicePendingPath }
-          })
-        );
-      } else {
-        checks.push(
-          toDoctorCheck({
-            id: "state.gatewayDevicePairing",
-            label: "OpenClaw gateway device pairing",
-            status: "fail",
-            message: `pending gateway device approvals: ${pendingRequestIds.length}`,
-            remediationHint: OPENCLAW_DEVICE_APPROVAL_COMMAND_HINT,
-            details: {
-              gatewayDevicePendingPath,
-              pendingRequestIds
-            }
-          })
-        );
-      }
-    }
-  } catch (error48) {
-    if (getErrorCode2(error48) === "ENOENT") {
-      checks.push(
-        toDoctorCheck({
-          id: "state.gatewayDevicePairing",
-          label: "OpenClaw gateway device pairing",
-          status: "pass",
-          message: "no pending gateway device approvals file was found",
-          details: { gatewayDevicePendingPath }
+          message: "cannot validate connector runtime without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT
         })
       );
-    } else {
       checks.push(
         toDoctorCheck({
-          id: "state.gatewayDevicePairing",
-          label: "OpenClaw gateway device pairing",
+          id: "state.connectorInboundInbox",
+          label: "Connector inbound inbox",
           status: "fail",
-          message: `unable to read pending device approvals at ${gatewayDevicePendingPath}`,
-          remediationHint: OPENCLAW_DEVICE_APPROVAL_COMMAND_HINT,
-          details: { gatewayDevicePendingPath }
+          message: "cannot validate connector inbound inbox without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT
         })
       );
-    }
-  }
-  if (options.includeConnectorRuntimeCheck !== false) {
-    if (selectedAgentName === void 0) {
       checks.push(
         toDoctorCheck({
-          id: "state.connectorRuntime",
-          label: "Connector runtime",
+          id: "state.openclawHookHealth",
+          label: "OpenClaw hook health",
           status: "fail",
-          message: "cannot validate connector runtime without selected agent marker",
-          remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+          message: "cannot validate OpenClaw hook health without selected agent marker",
+          remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
         })
       );
     } else {
@@ -22606,6 +23432,26 @@ async function runOpenclawDoctor(options = {}) {
               details: { connectorAssignmentsPath, selectedAgentName }
             })
           );
+          checks.push(
+            toDoctorCheck({
+              id: "state.connectorInboundInbox",
+              label: "Connector inbound inbox",
+              status: "fail",
+              message: `no connector assignment found for ${selectedAgentName}`,
+              remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+              details: { connectorAssignmentsPath, selectedAgentName }
+            })
+          );
+          checks.push(
+            toDoctorCheck({
+              id: "state.openclawHookHealth",
+              label: "OpenClaw hook health",
+              status: "fail",
+              message: `no connector assignment found for ${selectedAgentName}`,
+              remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+              details: { connectorAssignmentsPath, selectedAgentName }
+            })
+          );
         } else {
           const fetchImpl = options.fetchImpl ?? globalThis.fetch;
           if (typeof fetchImpl !== "function") {
@@ -22618,6 +23464,24 @@ async function runOpenclawDoctor(options = {}) {
                 remediationHint: "Run doctor in a Node runtime with fetch support, or rerun openclaw setup"
               })
             );
+            checks.push(
+              toDoctorCheck({
+                id: "state.connectorInboundInbox",
+                label: "Connector inbound inbox",
+                status: "fail",
+                message: "fetch implementation is unavailable for connector inbox checks",
+                remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+              })
+            );
+            checks.push(
+              toDoctorCheck({
+                id: "state.openclawHookHealth",
+                label: "OpenClaw hook health",
+                status: "fail",
+                message: "fetch implementation is unavailable for OpenClaw hook health checks",
+                remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
+              })
+            );
           } else {
             const connectorStatus = await fetchConnectorHealthStatus({
               connectorBaseUrl: assignment.connectorBaseUrl,
@@ -22636,6 +23500,36 @@ async function runOpenclawDoctor(options = {}) {
                   }
                 })
               );
+              const inboxPendingCount = connectorStatus.inboundInbox?.pendingCount ?? 0;
+              const replayError = connectorStatus.inboundInbox?.lastReplayError;
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorInboundInbox",
+                  label: "Connector inbound inbox",
+                  status: "pass",
+                  message: inboxPendingCount === 0 ? "connector inbound inbox is empty" : `connector inbound inbox has ${inboxPendingCount} pending message(s)`,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl,
+                    ...connectorStatus.inboundInbox
+                  }
+                })
+              );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.openclawHookHealth",
+                  label: "OpenClaw hook health",
+                  status: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? "fail" : "pass",
+                  message: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? `connector replay to local OpenClaw hook is failing: ${replayError ?? "unknown error"}` : "connector replay to local OpenClaw hook is healthy",
+                  remediationHint: connectorStatus.openclawHook?.lastAttemptStatus === "failed" && inboxPendingCount > 0 ? OPENCLAW_SETUP_RESTART_COMMAND_HINT : void 0,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl,
+                    ...connectorStatus.openclawHook,
+                    inboxPendingCount
+                  }
+                })
+              );
             } else {
               const reason = connectorStatus.reason ?? "connector runtime is unavailable";
               checks.push(
@@ -22651,6 +23545,32 @@ async function runOpenclawDoctor(options = {}) {
                   }
                 })
               );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.connectorInboundInbox",
+                  label: "Connector inbound inbox",
+                  status: "fail",
+                  message: `unable to read connector inbound inbox status: ${reason}`,
+                  remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
+              checks.push(
+                toDoctorCheck({
+                  id: "state.openclawHookHealth",
+                  label: "OpenClaw hook health",
+                  status: "fail",
+                  message: `unable to verify OpenClaw hook health: ${reason}`,
+                  remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+                  details: {
+                    connectorStatusUrl: connectorStatus.statusUrl,
+                    connectorBaseUrl: assignment.connectorBaseUrl
+                  }
+                })
+              );
             }
           }
         }
@@ -22665,6 +23585,24 @@ async function runOpenclawDoctor(options = {}) {
             details: { connectorAssignmentsPath }
           })
         );
+        checks.push(
+          toDoctorCheck({
+            id: "state.connectorInboundInbox",
+            label: "Connector inbound inbox",
+            status: "fail",
+            message: "cannot validate connector inbound inbox without connector assignment",
+            remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+          })
+        );
+        checks.push(
+          toDoctorCheck({
+            id: "state.openclawHookHealth",
+            label: "OpenClaw hook health",
+            status: "fail",
+            message: "cannot validate OpenClaw hook health without connector assignment",
+            remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT
+          })
+        );
       }
     }
   }
@@ -22692,7 +23630,7 @@ function parseRelayProbeFailure(input) {
   if (input.status === 500) {
     return {
       message: "Relay probe failed inside local relay pipeline",
-      remediationHint: "Check connector runtime and peer pairing; rerun clawdentity openclaw doctor"
+      remediationHint: "Check peer pairing and rerun: clawdentity openclaw setup <agentName>"
     };
   }
   return {
@@ -22870,7 +23808,7 @@ async function setupOpenclawRelay(agentName, options) {
     relayRuntimeConfigPath
   });
   await ensureLocalAgentCredentials(homeDir, normalizedAgentName);
-  await mkdir5(dirname4(transformTargetPath), { recursive: true });
+  await mkdir6(dirname5(transformTargetPath), { recursive: true });
   try {
     await copyFile(transformSource, transformTargetPath);
   } catch (error48) {
@@ -22963,7 +23901,7 @@ async function setupOpenclawRelay(agentName, options) {
   };
 }
 async function assertSetupChecklistHealthy(input) {
-  const checklist = await runOpenclawDoctor({
+  let checklist = await runOpenclawDoctor({
     homeDir: input.homeDir,
     openclawDir: input.openclawDir,
     includeConfigCheck: false,
@@ -22972,14 +23910,56 @@ async function assertSetupChecklistHealthy(input) {
   if (checklist.status === "healthy") {
     return;
   }
-  const firstFailure = checklist.checks.find((check2) => check2.status === "fail");
+  let gatewayApprovalSummary;
+  const gatewayPairingFailure = checklist.checks.find(
+    (check2) => check2.id === "state.gatewayDevicePairing" && check2.status === "fail"
+  );
+  if (gatewayPairingFailure !== void 0) {
+    gatewayApprovalSummary = await autoApproveOpenclawGatewayDevices({
+      homeDir: input.homeDir,
+      openclawDir: input.openclawDir,
+      runner: input.gatewayDeviceApprovalRunner
+    });
+    if (gatewayApprovalSummary !== void 0) {
+      const successfulAttempts = gatewayApprovalSummary.attempts.filter(
+        (attempt) => attempt.ok
+      ).length;
+      const failedAttempts = gatewayApprovalSummary.attempts.filter(
+        (attempt) => !attempt.ok
+      );
+      logger8.info("cli.openclaw_setup_gateway_device_recovery_attempted", {
+        openclawDir: input.openclawDir,
+        pendingCount: gatewayApprovalSummary.pendingRequestIds.length,
+        successfulAttempts,
+        failedAttempts: failedAttempts.length,
+        commandUnavailable: failedAttempts.some(
+          (attempt) => attempt.unavailable
+        )
+      });
+      checklist = await runOpenclawDoctor({
+        homeDir: input.homeDir,
+        openclawDir: input.openclawDir,
+        includeConfigCheck: false,
+        includeConnectorRuntimeCheck: input.includeConnectorRuntimeCheck
+      });
+      if (checklist.status === "healthy") {
+        return;
+      }
+    }
+  }
+  const firstFailure = checklist.checks.find(
+    (check2) => check2.status === "fail"
+  );
+  const unavailableGatewayApprovalAttempt = gatewayApprovalSummary?.attempts.find((attempt) => attempt.unavailable);
+  const remediationHint = unavailableGatewayApprovalAttempt !== void 0 && firstFailure?.id === "state.gatewayDevicePairing" ? `${OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT}. Ensure the \`${resolveOpenclawGatewayApprovalCommand()}\` command is available.` : firstFailure?.remediationHint;
   throw createCliError6(
     "CLI_OPENCLAW_SETUP_CHECKLIST_FAILED",
     "OpenClaw setup checklist failed",
     {
       firstFailedCheckId: firstFailure?.id,
       firstFailedCheckMessage: firstFailure?.message,
-      remediationHint: firstFailure?.remediationHint,
+      remediationHint,
+      gatewayDeviceApproval: gatewayApprovalSummary,
       checks: checklist.checks
     }
   );
@@ -22999,7 +23979,8 @@ async function setupOpenclawSelfReady(agentName, options) {
     await assertSetupChecklistHealthy({
       homeDir: resolvedHomeDir,
       openclawDir: resolvedOpenclawDir,
-      includeConnectorRuntimeCheck: false
+      includeConnectorRuntimeCheck: false,
+      gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
     });
     return {
       ...setup,
@@ -23031,7 +24012,8 @@ async function setupOpenclawSelfReady(agentName, options) {
   await assertSetupChecklistHealthy({
     homeDir: resolvedHomeDir,
     openclawDir: resolvedOpenclawDir,
-    includeConnectorRuntimeCheck: true
+    includeConnectorRuntimeCheck: true,
+    gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
   });
   return {
     ...setup,
@@ -23161,13 +24143,13 @@ var createOpenclawCommand = () => {
 import { randomBytes as randomBytes4 } from "crypto";
 import {
   chmod as chmod4,
-  mkdir as mkdir6,
+  mkdir as mkdir7,
   readdir,
-  readFile as readFile6,
+  readFile as readFile7,
   unlink as unlink2,
-  writeFile as writeFile6
+  writeFile as writeFile7
 } from "fs/promises";
-import { dirname as dirname5, join as join7, resolve } from "path";
+import { dirname as dirname6, join as join8, resolve } from "path";
 import { Command as Command8 } from "commander";
 import jsQR from "jsqr";
 import { PNG } from "pngjs";
@@ -23191,7 +24173,7 @@ var PEER_ALIAS_PATTERN2 = /^[a-zA-Z0-9._-]+$/;
 var DEFAULT_STATUS_WAIT_SECONDS = 300;
 var DEFAULT_STATUS_POLL_INTERVAL_SECONDS = 3;
 var MAX_PROFILE_NAME_LENGTH = 64;
-var isRecord9 = (value) => {
+var isRecord10 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function createCliError7(code, message2) {
@@ -23239,7 +24221,7 @@ function parseProfileName(value, label) {
   return candidate;
 }
 function parsePeerProfile(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_PROFILE_INVALID",
       "Pair profile must be an object"
@@ -23286,7 +24268,7 @@ function parsePairingTicketIssuerOrigin(ticket) {
       "Pairing ticket is invalid"
     );
   }
-  if (!isRecord9(payload) || typeof payload.iss !== "string") {
+  if (!isRecord10(payload) || typeof payload.iss !== "string") {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_TICKET_INVALID",
       "Pairing ticket is invalid"
@@ -23335,7 +24317,7 @@ function parseAitAgentDid(ait) {
       "Agent AIT is invalid. Recreate the agent before pairing."
     );
   }
-  if (!isRecord9(payload) || typeof payload.sub !== "string") {
+  if (!isRecord10(payload) || typeof payload.sub !== "string") {
     throw createCliError7(
       "CLI_PAIR_AGENT_NOT_FOUND",
       "Agent AIT is invalid. Recreate the agent before pairing."
@@ -23397,10 +24379,10 @@ function resolvePeerAlias(input) {
   return `${baseAlias}-${index}`;
 }
 function resolvePeersConfigPath(getConfigDirImpl) {
-  return join7(getConfigDirImpl(), PEERS_FILE_NAME2);
+  return join8(getConfigDirImpl(), PEERS_FILE_NAME2);
 }
 function parsePeerEntry(value) {
-  if (!isRecord9(value)) {
+  if (!isRecord10(value)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer entry must be an object"
@@ -23449,7 +24431,7 @@ async function loadPeersConfig2(input) {
       "Peer config is not valid JSON"
     );
   }
-  if (!isRecord9(parsed)) {
+  if (!isRecord10(parsed)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer config must be a JSON object"
@@ -23458,7 +24440,7 @@ async function loadPeersConfig2(input) {
   if (parsed.peers === void 0) {
     return { peers: {} };
   }
-  if (!isRecord9(parsed.peers)) {
+  if (!isRecord10(parsed.peers)) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer config peers field must be an object"
@@ -23472,7 +24454,7 @@ async function loadPeersConfig2(input) {
 }
 async function savePeersConfig2(input) {
   const peersPath = resolvePeersConfigPath(input.getConfigDirImpl);
-  await input.mkdirImpl(dirname5(peersPath), { recursive: true });
+  await input.mkdirImpl(dirname6(peersPath), { recursive: true });
   await input.writeFileImpl(
     peersPath,
     `${JSON.stringify(input.config, null, 2)}
@@ -23482,7 +24464,7 @@ async function savePeersConfig2(input) {
   await input.chmodImpl(peersPath, FILE_MODE4);
 }
 function resolveRelayRuntimeConfigPath2(getConfigDirImpl) {
-  return join7(getConfigDirImpl(), OPENCLAW_RELAY_RUNTIME_FILE_NAME3);
+  return join8(getConfigDirImpl(), OPENCLAW_RELAY_RUNTIME_FILE_NAME3);
 }
 async function loadRelayTransformPeersPath(input) {
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath2(
@@ -23511,7 +24493,7 @@ async function loadRelayTransformPeersPath(input) {
     });
     return void 0;
   }
-  if (!isRecord9(parsed)) {
+  if (!isRecord10(parsed)) {
     return void 0;
   }
   const relayTransformPeersPath = parseNonEmptyString9(
@@ -23544,7 +24526,7 @@ async function syncOpenclawRelayPeersSnapshot(input) {
     return;
   }
   try {
-    await input.mkdirImpl(dirname5(relayTransformPeersPath), {
+    await input.mkdirImpl(dirname6(relayTransformPeersPath), {
       recursive: true
     });
     await input.writeFileImpl(
@@ -23644,7 +24626,7 @@ function toPathWithQuery3(url2) {
   return `${parsed.pathname}${parsed.search}`;
 }
 function extractErrorCode(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -23655,7 +24637,7 @@ function extractErrorCode(payload) {
   return code.length > 0 ? code : void 0;
 }
 function extractErrorMessage(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -23743,7 +24725,7 @@ function mapStatusPairError(status, payload) {
   return `Pair status failed (${status})`;
 }
 function parsePairStartResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_START_INVALID_RESPONSE",
       "Pair start response is invalid"
@@ -23775,7 +24757,7 @@ function parsePairStartResponse(payload) {
   };
 }
 function parsePairConfirmResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_INVALID_RESPONSE",
       "Pair confirm response is invalid"
@@ -23810,7 +24792,7 @@ function parsePairConfirmResponse(payload) {
   };
 }
 function parsePairStatusResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord10(payload)) {
     throw createCliError7(
       "CLI_PAIR_STATUS_INVALID_RESPONSE",
       "Pair status response is invalid"
@@ -23876,16 +24858,16 @@ function parsePairStatusResponse(payload) {
   };
 }
 async function readAgentProofMaterial(agentName, dependencies) {
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const readFileImpl = dependencies.readFileImpl ?? readFile7;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
   const normalizedAgentName = assertValidAgentName(agentName);
-  const agentDir = join7(
+  const agentDir = join8(
     getConfigDirImpl(),
     AGENTS_DIR_NAME5,
     normalizedAgentName
   );
-  const aitPath = join7(agentDir, AIT_FILE_NAME4);
-  const secretKeyPath = join7(agentDir, SECRET_KEY_FILE_NAME3);
+  const aitPath = join8(agentDir, AIT_FILE_NAME4);
+  const secretKeyPath = join8(agentDir, SECRET_KEY_FILE_NAME3);
   let ait;
   try {
     ait = (await readFileImpl(aitPath, "utf-8")).trim();
@@ -23983,14 +24965,14 @@ function decodeTicketFromPng(imageBytes) {
   return parsePairingTicket(decoded.data);
 }
 async function persistPairingQr(input) {
-  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir6;
+  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir7;
   const readdirImpl = input.dependencies.readdirImpl ?? readdir;
   const unlinkImpl = input.dependencies.unlinkImpl ?? unlink2;
-  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile6;
+  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile7;
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
   const qrEncodeImpl = input.dependencies.qrEncodeImpl ?? encodeTicketQrPng;
-  const baseDir = join7(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
-  const outputPath = parseNonEmptyString9(input.qrOutput) ? resolve(input.qrOutput ?? "") : join7(
+  const baseDir = join8(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
+  const outputPath = parseNonEmptyString9(input.qrOutput) ? resolve(input.qrOutput ?? "") : join8(
     baseDir,
     `${assertValidAgentName(input.agentName)}-pair-${input.nowSeconds}.png`
   );
@@ -24016,7 +24998,7 @@ async function persistPairingQr(input) {
     if (issuedAtSeconds + PAIRING_QR_MAX_AGE_SECONDS > input.nowSeconds) {
       continue;
     }
-    const stalePath = join7(baseDir, fileName);
+    const stalePath = join8(baseDir, fileName);
     await unlinkImpl(stalePath).catch((error48) => {
       const nodeError = error48;
       if (nodeError.code === "ENOENT") {
@@ -24025,7 +25007,7 @@ async function persistPairingQr(input) {
       throw error48;
     });
   }
-  await mkdirImpl(dirname5(outputPath), { recursive: true });
+  await mkdirImpl(dirname6(outputPath), { recursive: true });
   const imageBytes = await qrEncodeImpl(input.ticket);
   await writeFileImpl(outputPath, imageBytes);
   return outputPath;
@@ -24059,9 +25041,9 @@ function resolveConfirmTicketSource(options) {
 }
 async function persistPairedPeer(input) {
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
-  const readFileImpl = input.dependencies.readFileImpl ?? readFile6;
-  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir6;
-  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile6;
+  const readFileImpl = input.dependencies.readFileImpl ?? readFile7;
+  const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir7;
+  const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile7;
   const chmodImpl = input.dependencies.chmodImpl ?? chmod4;
   const issuerOrigin = parsePairingTicketIssuerOrigin(input.ticket);
   const peerProxyUrl = new URL("/hooks/agent", `${issuerOrigin}/`).toString();
@@ -24173,7 +25155,7 @@ async function confirmPairing(agentName, options, dependencies = {}) {
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
   const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const readFileImpl = dependencies.readFileImpl ?? readFile7;
   const qrDecodeImpl = dependencies.qrDecodeImpl ?? decodeTicketFromPng;
   const config2 = await resolveConfigImpl();
   const normalizedAgentName = assertValidAgentName(agentName);
@@ -24602,16 +25584,16 @@ import { Command as Command9 } from "commander";
 
 // src/install-skill-mode.ts
 import { constants, existsSync as existsSync2 } from "fs";
-import { access as access3, copyFile as copyFile2, mkdir as mkdir7, readdir as readdir2, readFile as readFile7 } from "fs/promises";
+import { access as access3, copyFile as copyFile2, mkdir as mkdir8, readdir as readdir2, readFile as readFile8 } from "fs/promises";
 import { createRequire } from "module";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname6, join as join8, relative } from "path";
+import { dirname as dirname7, join as join9, relative } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 var OPENCLAW_DIR_NAME2 = ".openclaw";
 var SKILL_PACKAGE_NAME = "@clawdentity/openclaw-skill";
 var SKILL_DIR_NAME2 = "clawdentity-openclaw-relay";
 var RELAY_MODULE_FILE_NAME2 = "relay-to-peer.mjs";
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null;
 }
 var SkillInstallError = class extends Error {
@@ -24625,7 +25607,7 @@ var SkillInstallError = class extends Error {
   }
 };
 function getErrorCode3(error48) {
-  if (!isRecord10(error48)) {
+  if (!isRecord11(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -24640,7 +25622,7 @@ function resolveOpenclawDir2(homeDir, inputOpenclawDir) {
   if (typeof inputOpenclawDir === "string" && inputOpenclawDir.trim().length > 0) {
     return inputOpenclawDir.trim();
   }
-  return join8(homeDir, OPENCLAW_DIR_NAME2);
+  return join9(homeDir, OPENCLAW_DIR_NAME2);
 }
 function resolveSkillPackageRoot(input) {
   if (typeof input.skillPackageRoot === "string" && input.skillPackageRoot.trim().length > 0) {
@@ -24650,8 +25632,8 @@ function resolveSkillPackageRoot(input) {
   if (typeof overriddenRoot === "string" && overriddenRoot.trim().length > 0) {
     return overriddenRoot.trim();
   }
-  const bundledSkillRoot = join8(
-    dirname6(fileURLToPath3(import.meta.url)),
+  const bundledSkillRoot = join9(
+    dirname7(fileURLToPath3(import.meta.url)),
     "..",
     "skill-bundle",
     "openclaw-skill"
@@ -24663,10 +25645,10 @@ function resolveSkillPackageRoot(input) {
   let packageJsonPath;
   try {
     packageJsonPath = require3.resolve(`${SKILL_PACKAGE_NAME}/package.json`);
-    return dirname6(packageJsonPath);
+    return dirname7(packageJsonPath);
   } catch {
-    const workspaceFallbackRoot = join8(
-      dirname6(fileURLToPath3(import.meta.url)),
+    const workspaceFallbackRoot = join9(
+      dirname7(fileURLToPath3(import.meta.url)),
       "..",
       "..",
       "openclaw-skill"
@@ -24708,7 +25690,7 @@ async function listFilesRecursively(directoryPath) {
   for (const entry of entries.sort(
     (left, right) => left.name.localeCompare(right.name)
   )) {
-    const entryPath = join8(directoryPath, entry.name);
+    const entryPath = join9(directoryPath, entry.name);
     if (entry.isDirectory()) {
       files.push(...await listFilesRecursively(entryPath));
       continue;
@@ -24720,10 +25702,10 @@ async function listFilesRecursively(directoryPath) {
   return files;
 }
 async function resolveArtifacts(input) {
-  const skillRoot = join8(input.skillPackageRoot, "skill");
-  const skillDocSource = join8(skillRoot, "SKILL.md");
-  const referencesRoot = join8(skillRoot, "references");
-  const relaySource = join8(
+  const skillRoot = join9(input.skillPackageRoot, "skill");
+  const skillDocSource = join9(skillRoot, "SKILL.md");
+  const referencesRoot = join9(skillRoot, "references");
+  const relaySource = join9(
     input.skillPackageRoot,
     "dist",
     RELAY_MODULE_FILE_NAME2
@@ -24759,19 +25741,19 @@ async function resolveArtifacts(input) {
       }
     });
   }
-  const targetSkillRoot = join8(input.openclawDir, "skills", SKILL_DIR_NAME2);
+  const targetSkillRoot = join9(input.openclawDir, "skills", SKILL_DIR_NAME2);
   const artifacts = [
     {
       sourcePath: skillDocSource,
-      targetPath: join8(targetSkillRoot, "SKILL.md")
+      targetPath: join9(targetSkillRoot, "SKILL.md")
     },
     {
       sourcePath: relaySource,
-      targetPath: join8(targetSkillRoot, RELAY_MODULE_FILE_NAME2)
+      targetPath: join9(targetSkillRoot, RELAY_MODULE_FILE_NAME2)
     },
     {
       sourcePath: relaySource,
-      targetPath: join8(
+      targetPath: join9(
         input.openclawDir,
         "hooks",
         "transforms",
@@ -24783,7 +25765,7 @@ async function resolveArtifacts(input) {
     const relativePath = relative(referencesRoot, referenceFile);
     artifacts.push({
       sourcePath: referenceFile,
-      targetPath: join8(targetSkillRoot, "references", relativePath)
+      targetPath: join9(targetSkillRoot, "references", relativePath)
     });
   }
   return artifacts.sort(
@@ -24791,10 +25773,10 @@ async function resolveArtifacts(input) {
   );
 }
 async function copyArtifact(input) {
-  const sourceContent = await readFile7(input.sourcePath);
+  const sourceContent = await readFile8(input.sourcePath);
   let existingContent;
   try {
-    existingContent = await readFile7(input.targetPath);
+    existingContent = await readFile8(input.targetPath);
   } catch (error48) {
     if (getErrorCode3(error48) !== "ENOENT") {
       throw error48;
@@ -24803,7 +25785,7 @@ async function copyArtifact(input) {
   if (existingContent !== void 0 && sourceContent.equals(existingContent)) {
     return "unchanged";
   }
-  await mkdir7(dirname6(input.targetPath), { recursive: true });
+  await mkdir8(dirname7(input.targetPath), { recursive: true });
   await copyFile2(input.sourcePath, input.targetPath);
   if (existingContent !== void 0) {
     return "updated";
@@ -24835,7 +25817,7 @@ async function installOpenclawSkillArtifacts(options = {}) {
     homeDir,
     openclawDir,
     skillPackageRoot,
-    targetSkillDirectory: join8(openclawDir, "skills", SKILL_DIR_NAME2),
+    targetSkillDirectory: join9(openclawDir, "skills", SKILL_DIR_NAME2),
     records
   };
 }
@@ -24926,7 +25908,7 @@ var createSkillCommand = () => {
 };
 
 // src/commands/verify.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import { Command as Command10 } from "commander";
 var logger10 = createLogger({ service: "cli", module: "verify" });
 var REGISTRY_KEYS_CACHE_FILE = "registry-keys.json";
@@ -24939,7 +25921,7 @@ var VerifyCommandError = class extends Error {
     this.name = "VerifyCommandError";
   }
 };
-var isRecord11 = (value) => {
+var isRecord12 = (value) => {
   return typeof value === "object" && value !== null;
 };
 var normalizeRegistryUrl2 = (registryUrl) => {
@@ -24975,7 +25957,7 @@ var resolveToken = async (tokenOrFile) => {
     throw new VerifyCommandError("invalid token (value is empty)");
   }
   try {
-    const fileContents = await readFile8(input, "utf-8");
+    const fileContents = await readFile9(input, "utf-8");
     const token = fileContents.trim();
     if (token.length === 0) {
       throw new VerifyCommandError(`invalid token (${input} is empty)`);
@@ -25007,7 +25989,7 @@ var parseResponseJson = async (response) => {
   }
 };
 var parseSigningKeys = (payload) => {
-  if (!isRecord11(payload) || !Array.isArray(payload.keys)) {
+  if (!isRecord12(payload) || !Array.isArray(payload.keys)) {
     throw new VerifyCommandError(
       "verification keys unavailable (response payload is invalid)"
     );
@@ -25026,7 +26008,7 @@ var parseSigningKeys = (payload) => {
 };
 var parseRegistryKeysCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord11(parsed)) {
+  if (!isRecord12(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, keys } = parsed;
@@ -25052,7 +26034,7 @@ var parseRegistryKeysCache = (rawCache) => {
 };
 var parseCrlCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord11(parsed)) {
+  if (!isRecord12(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, claims } = parsed;
@@ -25150,7 +26132,7 @@ var fetchCrlClaims = async (input) => {
     );
   }
   const payload = await parseResponseJson(response);
-  if (!isRecord11(payload) || typeof payload.crl !== "string") {
+  if (!isRecord12(payload) || typeof payload.crl !== "string") {
     throw new VerifyCommandError(
       "revocation check unavailable (response payload is invalid)"
     );
@@ -25195,7 +26177,7 @@ var loadCrlClaims = async (input) => {
   return claims;
 };
 var toInvalidTokenReason = (error48) => {
-  if (isRecord11(error48) && typeof error48.message === "string") {
+  if (isRecord12(error48) && typeof error48.message === "string") {
     return `invalid token (${error48.message})`;
   }
   if (error48 instanceof Error && error48.message.length > 0) {