clawdentity 0.0.22 → 0.0.24

package/dist/bin.js

@@ -17110,11 +17110,24 @@ import { Command as Command11 } from "commander";
 import { Command } from "commander";
 
 // src/config/manager.ts
-import { chmod, mkdir, readFile, writeFile } from "fs/promises";
+import { readFileSync } from "fs";
+import {
+  chmod,
+  cp,
+  mkdir,
+  readdir,
+  readFile,
+  stat,
+  writeFile
+} from "fs/promises";
 import { homedir } from "os";
 import { dirname, join as join2 } from "path";
 var DEFAULT_REGISTRY_URL = "https://registry.clawdentity.com";
-var CONFIG_DIR = ".clawdentity";
+var DEFAULT_DEV_REGISTRY_URL = "https://dev.registry.clawdentity.com";
+var DEFAULT_LOCAL_REGISTRY_URL = "http://127.0.0.1:8788";
+var CONFIG_ROOT_DIR = ".clawdentity";
+var CONFIG_STATES_DIR = "states";
+var CONFIG_ROUTER_FILE = "router.json";
 var CONFIG_FILE = "config.json";
 var CACHE_DIR = "cache";
 var FILE_MODE = 384;
@@ -17130,9 +17143,26 @@ var LEGACY_ENV_KEY_MAP = {
 var DEFAULT_CONFIG = {
   registryUrl: DEFAULT_REGISTRY_URL
 };
+var STATE_KIND_BY_REGISTRY_HOST = {
+  "registry.clawdentity.com": "prod",
+  "dev.registry.clawdentity.com": "dev"
+};
+var LOCAL_REGISTRY_HOSTS = /* @__PURE__ */ new Set([
+  "localhost",
+  "127.0.0.1",
+  "host.docker.internal"
+]);
+var LEGACY_ROOT_ENTRIES = /* @__PURE__ */ new Set([CONFIG_STATES_DIR, CONFIG_ROUTER_FILE]);
 var isConfigObject = (value) => {
   return typeof value === "object" && value !== null;
 };
+var parseNonEmptyString2 = (value) => {
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+};
 var normalizeConfig = (raw) => {
   if (!isConfigObject(raw)) {
     return { ...DEFAULT_CONFIG };
@@ -17154,17 +17184,196 @@ var normalizeConfig = (raw) => {
   }
   return config2;
 };
-var getConfigDir = () => join2(homedir(), CONFIG_DIR);
-var getConfigFilePath = () => join2(getConfigDir(), CONFIG_FILE);
-var getCacheDir = () => join2(getConfigDir(), CACHE_DIR);
-var getCacheFilePath = (fileName) => join2(getCacheDir(), fileName);
+var isCliStateKind = (value) => {
+  return value === "prod" || value === "dev" || value === "local";
+};
+var resolveHomeDir = (options) => {
+  const configured = parseNonEmptyString2(options?.homeDir);
+  return configured ?? homedir();
+};
+var getConfigRootDir = (options) => {
+  return join2(resolveHomeDir(options), CONFIG_ROOT_DIR);
+};
+var getConfigStatesDir = (options) => {
+  return join2(getConfigRootDir(options), CONFIG_STATES_DIR);
+};
+var getRouterFilePath = (options) => {
+  return join2(getConfigRootDir(options), CONFIG_ROUTER_FILE);
+};
+var readRouterSync = (options) => {
+  try {
+    const raw = readFileSync(getRouterFilePath(options), "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!isConfigObject(parsed)) {
+      return {};
+    }
+    const lastRegistryUrl = parseNonEmptyString2(parsed.lastRegistryUrl);
+    const lastState = isCliStateKind(parsed.lastState) ? parsed.lastState : void 0;
+    const migratedLegacyState = parsed.migratedLegacyState === true;
+    return {
+      lastRegistryUrl,
+      lastState,
+      migratedLegacyState
+    };
+  } catch {
+    return {};
+  }
+};
+var getRegistryUrlOverrideFromEnv = () => {
+  const envCandidates = [
+    process.env.CLAWDENTITY_REGISTRY_URL,
+    process.env.CLAWDENTITY_REGISTRY
+  ];
+  return envCandidates.find((value) => {
+    return typeof value === "string" && value.trim().length > 0;
+  });
+};
+var resolveStateKindFromRegistryUrl = (registryUrl) => {
+  try {
+    const host = new URL(registryUrl).hostname.trim().toLowerCase();
+    const mapped = STATE_KIND_BY_REGISTRY_HOST[host];
+    if (mapped) {
+      return mapped;
+    }
+    if (LOCAL_REGISTRY_HOSTS.has(host)) {
+      return "local";
+    }
+    return "prod";
+  } catch {
+    return "prod";
+  }
+};
+var defaultRegistryUrlForState = (state) => {
+  switch (state) {
+    case "dev":
+      return DEFAULT_DEV_REGISTRY_URL;
+    case "local":
+      return DEFAULT_LOCAL_REGISTRY_URL;
+    default:
+      return DEFAULT_REGISTRY_URL;
+  }
+};
+var resolveStateSelection = (options) => {
+  const hintedRegistryUrl = parseNonEmptyString2(options?.registryUrlHint);
+  if (hintedRegistryUrl) {
+    return {
+      stateKind: resolveStateKindFromRegistryUrl(hintedRegistryUrl),
+      registryUrl: hintedRegistryUrl
+    };
+  }
+  const envRegistryUrl = getRegistryUrlOverrideFromEnv();
+  if (envRegistryUrl) {
+    return {
+      stateKind: resolveStateKindFromRegistryUrl(envRegistryUrl),
+      registryUrl: envRegistryUrl
+    };
+  }
+  const router = readRouterSync(options);
+  if (router.lastRegistryUrl) {
+    return {
+      stateKind: resolveStateKindFromRegistryUrl(router.lastRegistryUrl),
+      registryUrl: router.lastRegistryUrl
+    };
+  }
+  if (router.lastState) {
+    return {
+      stateKind: router.lastState,
+      registryUrl: defaultRegistryUrlForState(router.lastState)
+    };
+  }
+  return {
+    stateKind: "prod",
+    registryUrl: DEFAULT_REGISTRY_URL
+  };
+};
+var pathExists = async (path) => {
+  try {
+    await stat(path);
+    return true;
+  } catch (error48) {
+    const nodeError = error48;
+    if (nodeError.code === "ENOENT") {
+      return false;
+    }
+    throw error48;
+  }
+};
 var writeSecureFile = async (filePath, value) => {
   const targetDirectory = dirname(filePath);
   await mkdir(targetDirectory, { recursive: true });
   await writeFile(filePath, value, "utf-8");
   await chmod(filePath, FILE_MODE);
 };
+var writeRouter = async (router, options) => {
+  const payload = {};
+  if (router.lastRegistryUrl) {
+    payload.lastRegistryUrl = router.lastRegistryUrl;
+  }
+  if (router.lastState) {
+    payload.lastState = router.lastState;
+  }
+  if (router.migratedLegacyState === true) {
+    payload.migratedLegacyState = true;
+  }
+  await writeSecureFile(
+    getRouterFilePath(options),
+    `${JSON.stringify(payload)}
+`
+  );
+};
+var ensureStateLayoutMigrated = async (options) => {
+  const router = readRouterSync(options);
+  if (router.migratedLegacyState === true) {
+    return;
+  }
+  let entries;
+  try {
+    entries = await readdir(getConfigRootDir(options), {
+      withFileTypes: true
+    });
+  } catch (error48) {
+    const nodeError = error48;
+    if (nodeError.code === "ENOENT") {
+      return;
+    }
+    throw error48;
+  }
+  const legacyEntries = entries.filter((entry) => {
+    return !LEGACY_ROOT_ENTRIES.has(entry.name);
+  });
+  if (legacyEntries.length > 0) {
+    const prodStateDir = join2(getConfigStatesDir(options), "prod");
+    await mkdir(prodStateDir, { recursive: true });
+    for (const entry of legacyEntries) {
+      const sourcePath = join2(getConfigRootDir(options), entry.name);
+      const targetPath = join2(prodStateDir, entry.name);
+      if (await pathExists(targetPath)) {
+        continue;
+      }
+      await cp(sourcePath, targetPath, {
+        recursive: true,
+        errorOnExist: false
+      });
+    }
+  }
+  await writeRouter(
+    {
+      lastRegistryUrl: router.lastRegistryUrl ?? DEFAULT_REGISTRY_URL,
+      lastState: router.lastState ?? "prod",
+      migratedLegacyState: true
+    },
+    options
+  );
+};
+var getConfigDir = (options) => {
+  const selection = resolveStateSelection(options);
+  return join2(getConfigStatesDir(options), selection.stateKind);
+};
+var getConfigFilePath = (options) => join2(getConfigDir(options), CONFIG_FILE);
+var getCacheDir = (options) => join2(getConfigDir(options), CACHE_DIR);
+var getCacheFilePath = (fileName, options) => join2(getCacheDir(options), fileName);
 var readConfig = async () => {
+  await ensureStateLayoutMigrated();
   try {
     const configContents = await readFile(getConfigFilePath(), "utf-8");
     return normalizeConfig(JSON.parse(configContents));
@@ -17190,11 +17399,21 @@ var resolveConfig = async () => {
   return config2;
 };
 var writeConfig = async (config2) => {
+  await ensureStateLayoutMigrated();
+  const selection = resolveStateSelection({
+    registryUrlHint: config2.registryUrl
+  });
   await writeSecureFile(
-    getConfigFilePath(),
+    getConfigFilePath({ registryUrlHint: config2.registryUrl }),
     `${JSON.stringify(config2, null, 2)}
 `
   );
+  const currentRouter = readRouterSync();
+  await writeRouter({
+    lastRegistryUrl: selection.registryUrl,
+    lastState: selection.stateKind,
+    migratedLegacyState: currentRouter.migratedLegacyState === true
+  });
 };
 var getConfigValue = async (key) => {
   const config2 = await resolveConfig();
@@ -17208,6 +17427,7 @@ var setConfigValue = async (key, value) => {
   });
 };
 var readCacheFile = async (fileName) => {
+  await ensureStateLayoutMigrated();
   try {
     return await readFile(getCacheFilePath(fileName), "utf-8");
   } catch (error48) {
@@ -17219,6 +17439,7 @@ var readCacheFile = async (fileName) => {
   }
 };
 var writeCacheFile = async (fileName, value) => {
+  await ensureStateLayoutMigrated();
   await writeSecureFile(getCacheFilePath(fileName), value);
 };
 
@@ -17259,14 +17480,14 @@ function createCliError(code, message2) {
     status: 400
   });
 }
-function parseNonEmptyString2(value) {
+function parseNonEmptyString3(value) {
   if (typeof value !== "string") {
     return "";
   }
   return value.trim();
 }
 function resolveBootstrapRegistryUrl(input) {
-  const candidate = parseNonEmptyString2(input.overrideRegistryUrl) || input.configRegistryUrl;
+  const candidate = parseNonEmptyString3(input.overrideRegistryUrl) || input.configRegistryUrl;
   try {
     return new URL(candidate).toString();
   } catch {
@@ -17292,12 +17513,12 @@ function parseBootstrapResponse(payload) {
       "Bootstrap response is invalid"
     );
   }
-  const humanId = parseNonEmptyString2(human.id);
-  const humanDid = parseNonEmptyString2(human.did);
-  const humanDisplayName = parseNonEmptyString2(human.displayName);
-  const apiKeyId = parseNonEmptyString2(apiKey.id);
-  const apiKeyName = parseNonEmptyString2(apiKey.name);
-  const apiKeyToken = parseNonEmptyString2(apiKey.token);
+  const humanId = parseNonEmptyString3(human.id);
+  const humanDid = parseNonEmptyString3(human.did);
+  const humanDisplayName = parseNonEmptyString3(human.displayName);
+  const apiKeyId = parseNonEmptyString3(apiKey.id);
+  const apiKeyName = parseNonEmptyString3(apiKey.name);
+  const apiKeyToken = parseNonEmptyString3(apiKey.token);
   if (humanId.length === 0 || humanDid.length === 0 || humanDisplayName.length === 0 || apiKeyId.length === 0 || apiKeyName.length === 0 || apiKeyToken.length === 0) {
     throw createCliError(
       "CLI_ADMIN_BOOTSTRAP_INVALID_RESPONSE",
@@ -17335,7 +17556,7 @@ function mapBootstrapFailureMessage(payload) {
   return "Admin bootstrap request failed";
 }
 async function bootstrapAdmin(options, dependencies = {}) {
-  const bootstrapSecret = parseNonEmptyString2(options.bootstrapSecret);
+  const bootstrapSecret = parseNonEmptyString3(options.bootstrapSecret);
   if (bootstrapSecret.length === 0) {
     throw createCliError(
       "CLI_ADMIN_BOOTSTRAP_SECRET_REQUIRED",
@@ -17358,8 +17579,8 @@ async function bootstrapAdmin(options, dependencies = {}) {
         "x-bootstrap-secret": bootstrapSecret
       },
       body: JSON.stringify({
-        displayName: parseNonEmptyString2(options.displayName) || void 0,
-        apiKeyName: parseNonEmptyString2(options.apiKeyName) || void 0
+        displayName: parseNonEmptyString3(options.displayName) || void 0,
+        apiKeyName: parseNonEmptyString3(options.apiKeyName) || void 0
       })
     });
   } catch (error48) {
@@ -17470,7 +17691,7 @@ var FILE_MODE2 = 384;
 var isRecord2 = (value) => {
   return typeof value === "object" && value !== null;
 };
-var parseNonEmptyString3 = (value) => {
+var parseNonEmptyString4 = (value) => {
   if (typeof value !== "string") {
     return "";
   }
@@ -17540,7 +17761,7 @@ var readAgentIdentity = async (agentName) => {
       `Agent "${agentName}" has invalid ${IDENTITY_FILE_NAME} (missing did)`
     );
   }
-  const registryUrl = parseNonEmptyString3(parsed.registryUrl);
+  const registryUrl = parseNonEmptyString4(parsed.registryUrl);
   return {
     did,
     registryUrl: registryUrl.length > 0 ? registryUrl : void 0
@@ -17595,7 +17816,7 @@ var readAgentRegistryAuth = async (agentName) => {
       `Agent "${agentName}" has invalid ${REGISTRY_AUTH_FILE_NAME}`
     );
   }
-  const refreshToken = parseNonEmptyString3(parsed.refreshToken);
+  const refreshToken = parseNonEmptyString4(parsed.refreshToken);
   if (refreshToken.length === 0) {
     throw new Error(
       `Agent "${agentName}" has invalid ${REGISTRY_AUTH_FILE_NAME} (missing refreshToken)`
@@ -18120,7 +18341,7 @@ var logger4 = createLogger({ service: "cli", module: "api-key" });
 var isRecord3 = (value) => {
   return typeof value === "object" && value !== null;
 };
-function parseNonEmptyString4(value) {
+function parseNonEmptyString5(value) {
   if (typeof value !== "string") {
     return "";
   }
@@ -18134,7 +18355,7 @@ function createCliError2(code, message2) {
   });
 }
 function resolveRegistryUrl(input) {
-  const candidate = parseNonEmptyString4(input.overrideRegistryUrl) || input.configRegistryUrl;
+  const candidate = parseNonEmptyString5(input.overrideRegistryUrl) || input.configRegistryUrl;
   try {
     return new URL(candidate).toString();
   } catch {
@@ -18202,10 +18423,10 @@ function parseApiKeyMetadata(payload) {
       "API key response is invalid"
     );
   }
-  const id = parseNonEmptyString4(payload.id);
-  const name = parseNonEmptyString4(payload.name);
+  const id = parseNonEmptyString5(payload.id);
+  const name = parseNonEmptyString5(payload.name);
   const status = payload.status;
-  const createdAt = parseNonEmptyString4(payload.createdAt);
+  const createdAt = parseNonEmptyString5(payload.createdAt);
   const lastUsedAt = payload.lastUsedAt;
   if (id.length === 0 || name.length === 0 || status !== "active" && status !== "revoked" || createdAt.length === 0 || lastUsedAt !== null && typeof lastUsedAt !== "string") {
     throw createCliError2(
@@ -18229,7 +18450,7 @@ function parseApiKeyCreateResponse(payload) {
     );
   }
   const metadata = parseApiKeyMetadata(payload.apiKey);
-  const token = parseNonEmptyString4(payload.apiKey.token);
+  const token = parseNonEmptyString5(payload.apiKey.token);
   if (token.length === 0) {
     throw createCliError2(
       "CLI_API_KEY_INVALID_RESPONSE",
@@ -18301,7 +18522,7 @@ async function createApiKey(options, dependencies = {}) {
         "content-type": "application/json"
       },
       body: JSON.stringify({
-        name: parseNonEmptyString4(options.name) || void 0
+        name: parseNonEmptyString5(options.name) || void 0
       })
     }
   });
@@ -18445,7 +18666,7 @@ import { Command as Command4 } from "commander";
 function isRecord4(value) {
   return typeof value === "object" && value !== null;
 }
-function parseNonEmptyString5(value) {
+function parseNonEmptyString6(value) {
   if (typeof value !== "string") {
     return "";
   }
@@ -18503,7 +18724,7 @@ function parseMetadataPayload(payload, fallbackRegistryUrl) {
       "Registry metadata response is invalid"
     );
   }
-  const proxyUrlRaw = parseNonEmptyString5(payload.proxyUrl);
+  const proxyUrlRaw = parseNonEmptyString6(payload.proxyUrl);
   if (proxyUrlRaw.length === 0) {
     throw createCliError3(
       "CLI_REGISTRY_METADATA_INVALID_RESPONSE",
@@ -18511,10 +18732,10 @@ function parseMetadataPayload(payload, fallbackRegistryUrl) {
     );
   }
   const proxyUrl = parseUrl(proxyUrlRaw, "Proxy URL").toString();
-  const registryUrlRaw = parseNonEmptyString5(payload.registryUrl);
+  const registryUrlRaw = parseNonEmptyString6(payload.registryUrl);
   const registryUrl = registryUrlRaw.length > 0 ? parseUrl(registryUrlRaw, "Registry URL").toString() : normalizeRegistryUrl(fallbackRegistryUrl);
-  const environment = parseNonEmptyString5(payload.environment);
-  const version2 = parseNonEmptyString5(payload.version);
+  const environment = parseNonEmptyString6(payload.environment);
+  const version2 = parseNonEmptyString6(payload.version);
   return {
     proxyUrl,
     registryUrl,
@@ -18622,28 +18843,35 @@ var createConfigCommand = (dependencies = {}) => {
   );
   configCommand.command("init").description("Initialize local config file").option("--registry-url <url>", "Initialize config with registry URL").action(
     withErrorHandling("config init", async (options) => {
-      const configFilePath = getConfigFilePath();
+      const config2 = await readConfig();
+      const requestedRegistryUrl = options.registryUrl ?? getEnvRegistryUrlOverride() ?? config2.registryUrl;
+      const normalizedRegistryUrl = normalizeRegistryUrl(requestedRegistryUrl);
+      const requestedConfigFilePath = getConfigFilePath({
+        registryUrlHint: normalizedRegistryUrl
+      });
       try {
-        await access2(configFilePath);
-        writeStdoutLine(`Config already exists at ${configFilePath}`);
+        await access2(requestedConfigFilePath);
+        writeStdoutLine(
+          `Config already exists at ${requestedConfigFilePath}`
+        );
         return;
       } catch (error48) {
         if (!isNotFoundError(error48)) {
           throw error48;
         }
       }
-      const config2 = await readConfig();
-      const requestedRegistryUrl = options.registryUrl ?? getEnvRegistryUrlOverride() ?? config2.registryUrl;
-      const normalizedRegistryUrl = normalizeRegistryUrl(requestedRegistryUrl);
       const metadata = await fetchRegistryMetadata(normalizedRegistryUrl, {
         fetchImpl: dependencies.fetchImpl
       });
+      const targetConfigFilePath = getConfigFilePath({
+        registryUrlHint: metadata.registryUrl
+      });
       await writeConfig({
         ...config2,
         registryUrl: metadata.registryUrl,
         proxyUrl: metadata.proxyUrl
       });
-      writeStdoutLine(`Initialized config at ${configFilePath}`);
+      writeStdoutLine(`Initialized config at ${targetConfigFilePath}`);
       writeStdoutLine(
         JSON.stringify(
           maskApiKey({
@@ -20571,7 +20799,7 @@ function createCliError4(code, message2, details) {
     details
   });
 }
-function parseNonEmptyString6(value, label) {
+function parseNonEmptyString7(value, label) {
   if (typeof value !== "string") {
     throw createCliError4(
       "CLI_CONNECTOR_INVALID_INPUT",
@@ -20594,7 +20822,7 @@ function parseNonEmptyString6(value, label) {
   return trimmed;
 }
 function parseAgentDid(value) {
-  const did = parseNonEmptyString6(value, "agent did");
+  const did = parseNonEmptyString7(value, "agent did");
   if (!did.startsWith("did:claw:agent:")) {
     throw createCliError4(
       "CLI_CONNECTOR_INVALID_AGENT_IDENTITY",
@@ -20806,7 +21034,7 @@ function parseRegistryAuth(rawRegistryAuth) {
     "CLI_CONNECTOR_INVALID_REGISTRY_AUTH",
     "Agent registry auth is invalid for connector startup"
   );
-  const refreshToken = parseNonEmptyString6(parsed.refreshToken, "refreshToken");
+  const refreshToken = parseNonEmptyString7(parsed.refreshToken, "refreshToken");
   const accessToken = typeof parsed.accessToken === "string" && parsed.accessToken.trim().length > 0 ? parsed.accessToken.trim() : void 0;
   const accessExpiresAt = typeof parsed.accessExpiresAt === "string" && parsed.accessExpiresAt.trim().length > 0 ? parsed.accessExpiresAt.trim() : void 0;
   const refreshExpiresAt = typeof parsed.refreshExpiresAt === "string" && parsed.refreshExpiresAt.trim().length > 0 ? parsed.refreshExpiresAt.trim() : void 0;
@@ -21381,7 +21609,7 @@ var logger7 = createLogger({ service: "cli", module: "invite" });
 var isRecord8 = (value) => {
   return typeof value === "object" && value !== null;
 };
-function parseNonEmptyString7(value) {
+function parseNonEmptyString8(value) {
   if (typeof value !== "string") {
     return "";
   }
@@ -21409,7 +21637,7 @@ function normalizeProxyUrl(value) {
   }
 }
 function resolveRegistryUrl2(input) {
-  const candidate = parseNonEmptyString7(input.overrideRegistryUrl) || input.configRegistryUrl;
+  const candidate = parseNonEmptyString8(input.overrideRegistryUrl) || input.configRegistryUrl;
   return normalizeRegistryUrl(candidate);
 }
 function requireApiKey2(config2) {
@@ -21514,7 +21742,7 @@ function parseInviteRecord(payload) {
     );
   }
   const source = isRecord8(payload.invite) ? payload.invite : payload;
-  const code = parseNonEmptyString7(source.code);
+  const code = parseNonEmptyString8(source.code);
   if (code.length === 0) {
     throw createCliError5(
       "CLI_INVITE_CREATE_INVALID_RESPONSE",
@@ -21524,11 +21752,11 @@ function parseInviteRecord(payload) {
   const invite = {
     code
   };
-  const id = parseNonEmptyString7(source.id);
+  const id = parseNonEmptyString8(source.id);
   if (id.length > 0) {
     invite.id = id;
   }
-  const createdAt = parseNonEmptyString7(source.createdAt);
+  const createdAt = parseNonEmptyString8(source.createdAt);
   if (createdAt.length > 0) {
     invite.createdAt = createdAt;
   }
@@ -21545,7 +21773,7 @@ function parseInviteRedeemResponse(payload) {
     );
   }
   const apiKeySource = isRecord8(payload.apiKey) ? payload.apiKey : payload;
-  const apiKeyToken = parseNonEmptyString7(
+  const apiKeyToken = parseNonEmptyString8(
     isRecord8(payload.apiKey) ? payload.apiKey.token : payload.token
   );
   if (apiKeyToken.length === 0) {
@@ -21554,11 +21782,11 @@ function parseInviteRedeemResponse(payload) {
       "Invite redeem response is invalid"
     );
   }
-  const apiKeyId = parseNonEmptyString7(apiKeySource.id);
-  const apiKeyName = parseNonEmptyString7(apiKeySource.name);
+  const apiKeyId = parseNonEmptyString8(apiKeySource.id);
+  const apiKeyName = parseNonEmptyString8(apiKeySource.name);
   const humanSource = isRecord8(payload.human) ? payload.human : void 0;
-  const humanName = parseNonEmptyString7(humanSource?.displayName);
-  const proxyUrl = parseNonEmptyString7(payload.proxyUrl);
+  const humanName = parseNonEmptyString8(humanSource?.displayName);
+  const proxyUrl = parseNonEmptyString8(payload.proxyUrl);
   if (humanName.length === 0) {
     throw createCliError5(
       "CLI_INVITE_REDEEM_INVALID_RESPONSE",
@@ -21600,7 +21828,7 @@ async function createInvite(options, dependencies = {}) {
         "content-type": "application/json"
       },
       body: JSON.stringify({
-        expiresAt: parseNonEmptyString7(options.expiresAt) || void 0
+        expiresAt: parseNonEmptyString8(options.expiresAt) || void 0
       })
     }
   });
@@ -21617,21 +21845,21 @@ async function createInvite(options, dependencies = {}) {
   };
 }
 async function redeemInvite(code, options, dependencies = {}) {
-  const inviteCode = parseNonEmptyString7(code);
+  const inviteCode = parseNonEmptyString8(code);
   if (inviteCode.length === 0) {
     throw createCliError5(
       "CLI_INVITE_REDEEM_CODE_REQUIRED",
       "Invite code is required"
     );
   }
-  const displayName = parseNonEmptyString7(options.displayName);
+  const displayName = parseNonEmptyString8(options.displayName);
   if (displayName.length === 0) {
     throw createCliError5(
       "CLI_INVITE_REDEEM_DISPLAY_NAME_REQUIRED",
       "Display name is required. Pass --display-name <name>."
     );
   }
-  const apiKeyName = parseNonEmptyString7(options.apiKeyName);
+  const apiKeyName = parseNonEmptyString8(options.apiKeyName);
   const runtime = await resolveInviteRuntime(options.registryUrl, dependencies);
   const response = await executeInviteRequest({
     fetchImpl: runtime.fetchImpl,
@@ -21743,14 +21971,13 @@ var createInviteCommand = (dependencies = {}) => {
 // src/commands/openclaw.ts
 import { spawn } from "child_process";
 import { randomBytes as randomBytes3 } from "crypto";
-import { existsSync } from "fs";
+import { closeSync, existsSync, openSync } from "fs";
 import { chmod as chmod3, copyFile, mkdir as mkdir6, readFile as readFile6, writeFile as writeFile6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
 import { dirname as dirname5, join as join7, resolve as resolvePath } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { Command as Command7 } from "commander";
 var logger8 = createLogger({ service: "cli", module: "openclaw" });
-var CLAWDENTITY_DIR_NAME = ".clawdentity";
 var AGENTS_DIR_NAME4 = "agents";
 var AIT_FILE_NAME3 = "ait.jwt";
 var SECRET_KEY_FILE_NAME2 = "secret.key";
@@ -21788,6 +22015,8 @@ var CONNECTOR_HOST_DOCKER = "host.docker.internal";
 var CONNECTOR_HOST_DOCKER_GATEWAY = "gateway.docker.internal";
 var CONNECTOR_HOST_LINUX_BRIDGE = "172.17.0.1";
 var CONNECTOR_RUN_DIR_NAME = "run";
+var CONNECTOR_DETACHED_STDOUT_FILE_SUFFIX = "stdout.log";
+var CONNECTOR_DETACHED_STDERR_FILE_SUFFIX = "stderr.log";
 var PEER_ALIAS_PATTERN = /^[a-zA-Z0-9._-]+$/;
 var FILE_MODE3 = 384;
 var OPENCLAW_HOOK_TOKEN_BYTES = 32;
@@ -21799,6 +22028,8 @@ var OPENCLAW_DEVICE_APPROVAL_RECOVERY_HINT = "Run: clawdentity openclaw setup <a
 var OPENCLAW_GATEWAY_AUTH_RECOVERY_HINT = "Run: clawdentity openclaw setup <agentName> (ensures gateway auth mode/token are configured)";
 var OPENCLAW_GATEWAY_APPROVAL_COMMAND = "openclaw";
 var OPENCLAW_GATEWAY_APPROVAL_TIMEOUT_MS = 1e4;
+var OPENCLAW_SETUP_STABILITY_WINDOW_SECONDS = 20;
+var OPENCLAW_SETUP_STABILITY_POLL_INTERVAL_MS = 1e3;
 var textEncoder2 = new TextEncoder();
 var textDecoder = new TextDecoder();
 function isRecord9(value) {
@@ -21818,7 +22049,7 @@ function getErrorCode2(error48) {
   }
   return typeof error48.code === "string" ? error48.code : void 0;
 }
-function parseNonEmptyString8(value, label) {
+function parseNonEmptyString9(value, label) {
   if (typeof value !== "string") {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_INPUT",
@@ -21842,10 +22073,10 @@ function parseOptionalProfileName(value, label) {
   if (value === void 0) {
     return void 0;
   }
-  return parseNonEmptyString8(value, label);
+  return parseNonEmptyString9(value, label);
 }
 function parsePeerAlias(value) {
-  const alias = parseNonEmptyString8(value, "peer alias");
+  const alias = parseNonEmptyString9(value, "peer alias");
   if (alias.length > 128) {
     throw createCliError6(
       "CLI_OPENCLAW_INVALID_PEER_ALIAS",
@@ -21868,7 +22099,7 @@ function parseProxyUrl(value) {
   });
 }
 function parseHttpUrl(value, input) {
-  const candidate = parseNonEmptyString8(value, input.label);
+  const candidate = parseNonEmptyString9(value, input.label);
   let parsedUrl;
   try {
     parsedUrl = new URL(candidate);
@@ -21891,7 +22122,7 @@ function parseOpenclawBaseUrl(value) {
   });
 }
 function parseAgentDid2(value, label) {
-  const did = parseNonEmptyString8(value, label);
+  const did = parseNonEmptyString9(value, label);
   try {
     const parsed = parseDid(did);
     if (parsed.kind !== "agent") {
@@ -21907,7 +22138,7 @@ function parseAgentDid2(value, label) {
   }
   return did;
 }
-function resolveHomeDir(homeDir) {
+function resolveHomeDir2(homeDir) {
   if (typeof homeDir === "string" && homeDir.trim().length > 0) {
     return homeDir.trim();
   }
@@ -21968,10 +22199,10 @@ function resolveOpenclawDir(openclawDir, homeDir) {
   return resolveDefaultOpenclawStateDir(openclawHomeDir);
 }
 function resolveAgentDirectory(homeDir, agentName) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
+  return join7(getConfigDir({ homeDir }), AGENTS_DIR_NAME4, agentName);
 }
 function resolvePeersPath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
+  return join7(getConfigDir({ homeDir }), PEERS_FILE_NAME);
 }
 function resolveOpenclawConfigPath(openclawDir, homeDir) {
   const envConfigPath = readNonEmptyEnvPath(
@@ -22001,13 +22232,13 @@ function resolveTransformTargetPath(openclawDir) {
   return join7(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
 }
 function resolveOpenclawAgentNamePath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
+  return join7(getConfigDir({ homeDir }), OPENCLAW_AGENT_FILE_NAME);
 }
 function resolveRelayRuntimeConfigPath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
+  return join7(getConfigDir({ homeDir }), OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
 }
 function resolveConnectorAssignmentsPath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
+  return join7(getConfigDir({ homeDir }), OPENCLAW_CONNECTORS_FILE_NAME2);
 }
 function resolveTransformRuntimePath(openclawDir) {
   return join7(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
@@ -22475,12 +22706,51 @@ async function waitForConnectorConnected(input) {
   }
   return latest;
 }
+function sleepMilliseconds(durationMs) {
+  return new Promise((resolve2) => {
+    setTimeout(resolve2, durationMs);
+  });
+}
+async function monitorConnectorStabilityWindow(input) {
+  if (input.durationSeconds <= 0) {
+    return fetchConnectorHealthStatus({
+      connectorBaseUrl: input.connectorBaseUrl,
+      fetchImpl: input.fetchImpl
+    });
+  }
+  const deadline = Date.now() + input.durationSeconds * 1e3;
+  let latest = await fetchConnectorHealthStatus({
+    connectorBaseUrl: input.connectorBaseUrl,
+    fetchImpl: input.fetchImpl
+  });
+  if (!latest.connected) {
+    return latest;
+  }
+  while (Date.now() < deadline) {
+    await sleepMilliseconds(input.pollIntervalMs);
+    latest = await fetchConnectorHealthStatus({
+      connectorBaseUrl: input.connectorBaseUrl,
+      fetchImpl: input.fetchImpl
+    });
+    if (!latest.connected) {
+      return latest;
+    }
+  }
+  return latest;
+}
 function resolveConnectorRunDir(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, CONNECTOR_RUN_DIR_NAME);
+  return join7(getConfigDir({ homeDir }), CONNECTOR_RUN_DIR_NAME);
 }
 function resolveConnectorPidPath(homeDir, agentName) {
   return join7(resolveConnectorRunDir(homeDir), `connector-${agentName}.pid`);
 }
+function resolveDetachedConnectorLogPath(homeDir, agentName, stream) {
+  const suffix = stream === "stdout" ? CONNECTOR_DETACHED_STDOUT_FILE_SUFFIX : CONNECTOR_DETACHED_STDERR_FILE_SUFFIX;
+  return join7(
+    resolveConnectorRunDir(homeDir),
+    `connector-${agentName}.${suffix}`
+  );
+}
 async function readConnectorPidFile(pidPath) {
   try {
     const raw = (await readFile6(pidPath, "utf8")).trim();
@@ -22542,17 +22812,40 @@ async function startDetachedConnectorRuntime(input) {
     "--openclaw-base-url",
     input.openclawBaseUrl
   ];
-  const child = spawn(process.execPath, args, {
-    detached: true,
-    stdio: "ignore",
-    env: process.env
-  });
-  child.unref();
-  await writeSecureFile3(
-    resolveConnectorPidPath(input.homeDir, input.agentName),
-    `${child.pid}
-`
+  const stdoutLogPath = resolveDetachedConnectorLogPath(
+    input.homeDir,
+    input.agentName,
+    "stdout"
   );
+  const stderrLogPath = resolveDetachedConnectorLogPath(
+    input.homeDir,
+    input.agentName,
+    "stderr"
+  );
+  const stdoutFd = openSync(stdoutLogPath, "a");
+  const stderrFd = openSync(stderrLogPath, "a");
+  try {
+    const child = spawn(process.execPath, args, {
+      detached: true,
+      stdio: ["ignore", stdoutFd, stderrFd],
+      env: process.env
+    });
+    child.unref();
+    await writeSecureFile3(
+      resolveConnectorPidPath(input.homeDir, input.agentName),
+      `${child.pid}
+`
+    );
+    logger8.info("cli.openclaw.setup.detached_runtime_started", {
+      agentName: input.agentName,
+      pid: child.pid,
+      stdoutLogPath,
+      stderrLogPath
+    });
+  } finally {
+    closeSync(stdoutFd);
+    closeSync(stderrFd);
+  }
 }
 async function startSetupConnectorRuntime(input) {
   if (input.mode !== "service") {
@@ -22833,14 +23126,18 @@ async function patchOpenclawConfig(openclawConfigPath, hookToken) {
     hooks,
     gateway
   };
-  await writeFile6(
-    openclawConfigPath,
-    `${JSON.stringify(nextConfig, null, 2)}
+  const configChanged = JSON.stringify(config2) !== JSON.stringify(nextConfig);
+  if (configChanged) {
+    await writeFile6(
+      openclawConfigPath,
+      `${JSON.stringify(nextConfig, null, 2)}
 `,
-    "utf8"
-  );
+      "utf8"
+    );
+  }
   return {
-    hookToken: resolvedHookToken
+    hookToken: resolvedHookToken,
+    configChanged
   };
 }
 function toDoctorCheck(input) {
@@ -22938,7 +23235,7 @@ function toSendToPeerEndpoint(openclawBaseUrl) {
   return new URL(OPENCLAW_SEND_TO_PEER_HOOK_PATH, normalizedBase).toString();
 }
 async function runOpenclawDoctor(options = {}) {
-  const homeDir = resolveHomeDir(options.homeDir);
+  const homeDir = resolveHomeDir2(options.homeDir);
   const openclawDir = resolveOpenclawDir(options.openclawDir, homeDir);
   const peerAlias = parseDoctorPeerAlias(options.peerAlias);
   const checks = [];
@@ -23037,7 +23334,7 @@ async function runOpenclawDoctor(options = {}) {
           label: "CLI config",
           status: "fail",
           message: "unable to resolve CLI config",
-          remediationHint: "Fix ~/.clawdentity/config.json or rerun: clawdentity config init"
+          remediationHint: "Run: clawdentity config init (or fix your CLI state config file)"
         })
       );
     }
@@ -23159,7 +23456,7 @@ async function runOpenclawDoctor(options = {}) {
         label: "Peers map",
         status: "fail",
         message: `invalid peers config at ${peersPath}`,
-        remediationHint: "Fix JSON in ~/.clawdentity/peers.json or rerun openclaw setup",
+        remediationHint: `Fix JSON in ${peersPath} or rerun openclaw setup`,
         details: { peersPath }
       })
     );
@@ -23818,7 +24115,7 @@ async function resolveRelayProbePeerAlias(input) {
   );
 }
 async function runOpenclawRelayTest(options) {
-  const homeDir = resolveHomeDir(options.homeDir);
+  const homeDir = resolveHomeDir2(options.homeDir);
   const openclawDir = resolveOpenclawDir(options.openclawDir, homeDir);
   const checkedAt = nowIso();
   let peerAlias;
@@ -23950,7 +24247,7 @@ async function runOpenclawRelayTest(options) {
 }
 async function setupOpenclawRelay(agentName, options) {
   const normalizedAgentName = assertValidAgentName(agentName);
-  const homeDir = resolveHomeDir(options.homeDir);
+  const homeDir = resolveHomeDir2(options.homeDir);
   const openclawDir = resolveOpenclawDir(options.openclawDir, homeDir);
   const openclawConfigPath = resolveOpenclawConfigPath(openclawDir, homeDir);
   const transformSource = typeof options.transformSource === "string" && options.transformSource.trim().length > 0 ? options.transformSource.trim() : resolveDefaultTransformSource(openclawDir);
@@ -24053,7 +24350,8 @@ async function setupOpenclawRelay(agentName, options) {
     relayTransformPeersPath,
     openclawBaseUrl,
     connectorBaseUrl,
-    relayRuntimeConfigPath
+    relayRuntimeConfigPath,
+    openclawConfigChanged: patchedOpenclawConfig.configChanged
   };
 }
 async function assertSetupChecklistHealthy(input) {
@@ -24121,12 +24419,13 @@ async function assertSetupChecklistHealthy(input) {
   );
 }
 async function setupOpenclawSelfReady(agentName, options) {
-  const resolvedHomeDir = resolveHomeDir(options.homeDir);
+  const normalizedAgentName = assertValidAgentName(agentName);
+  const resolvedHomeDir = resolveHomeDir2(options.homeDir);
   const resolvedOpenclawDir = resolveOpenclawDir(
     options.openclawDir,
     resolvedHomeDir
   );
-  const setup = await setupOpenclawRelay(agentName, {
+  const setup = await setupOpenclawRelay(normalizedAgentName, {
     ...options,
     homeDir: resolvedHomeDir,
     openclawDir: resolvedOpenclawDir
@@ -24156,8 +24455,8 @@ async function setupOpenclawSelfReady(agentName, options) {
   const waitTimeoutSeconds = parseWaitTimeoutSeconds(
     options.waitTimeoutSeconds
   );
-  const runtime = await startSetupConnectorRuntime({
-    agentName: assertValidAgentName(agentName),
+  let runtime = await startSetupConnectorRuntime({
+    agentName: normalizedAgentName,
     homeDir: resolvedHomeDir,
     openclawBaseUrl: setup.openclawBaseUrl,
     connectorBaseUrl: setup.connectorBaseUrl,
@@ -24171,6 +24470,44 @@ async function setupOpenclawSelfReady(agentName, options) {
     includeConnectorRuntimeCheck: true,
     gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
   });
+  const requiresStabilityGuard = setup.openclawConfigChanged && (runtime.runtimeMode === "existing" || runtime.runtimeMode === "detached");
+  if (requiresStabilityGuard) {
+    const stabilityWindowSeconds = Math.min(
+      waitTimeoutSeconds,
+      OPENCLAW_SETUP_STABILITY_WINDOW_SECONDS
+    );
+    const stableStatus = await monitorConnectorStabilityWindow({
+      connectorBaseUrl: setup.connectorBaseUrl,
+      fetchImpl,
+      durationSeconds: stabilityWindowSeconds,
+      pollIntervalMs: OPENCLAW_SETUP_STABILITY_POLL_INTERVAL_MS
+    });
+    if (!stableStatus.connected) {
+      logger8.warn("cli.openclaw.setup.connector_dropped_post_config_change", {
+        agentName: normalizedAgentName,
+        connectorBaseUrl: setup.connectorBaseUrl,
+        connectorStatusUrl: stableStatus.statusUrl,
+        reason: stableStatus.reason,
+        previousRuntimeMode: runtime.runtimeMode,
+        stabilityWindowSeconds
+      });
+      runtime = await startSetupConnectorRuntime({
+        agentName: normalizedAgentName,
+        homeDir: resolvedHomeDir,
+        openclawBaseUrl: setup.openclawBaseUrl,
+        connectorBaseUrl: setup.connectorBaseUrl,
+        mode: resolvedMode,
+        waitTimeoutSeconds,
+        fetchImpl
+      });
+      await assertSetupChecklistHealthy({
+        homeDir: resolvedHomeDir,
+        openclawDir: resolvedOpenclawDir,
+        includeConnectorRuntimeCheck: true,
+        gatewayDeviceApprovalRunner: options.gatewayDeviceApprovalRunner
+      });
+    }
+  }
   return {
     ...setup,
     ...runtime
@@ -24256,7 +24593,7 @@ var createOpenclawCommand = () => {
   const relayCommand = openclawCommand.command("relay").description("Run OpenClaw relay diagnostics");
   relayCommand.command("test").description(
     "Send a relay probe to a configured peer (auto-selects when one peer exists)"
-  ).option("--peer <alias>", "Peer alias in ~/.clawdentity/peers.json").option(
+  ).option("--peer <alias>", "Peer alias in local peers map").option(
     "--openclaw-base-url <url>",
     "Base URL for local OpenClaw hook API (default OPENCLAW_BASE_URL or relay runtime config)"
   ).option(
@@ -24300,7 +24637,7 @@ import { randomBytes as randomBytes4 } from "crypto";
 import {
   chmod as chmod4,
   mkdir as mkdir7,
-  readdir,
+  readdir as readdir2,
   readFile as readFile7,
   unlink as unlink2,
   writeFile as writeFile7
@@ -24339,7 +24676,7 @@ function createCliError7(code, message2) {
     status: 400
   });
 }
-function parseNonEmptyString9(value) {
+function parseNonEmptyString10(value) {
   if (typeof value !== "string") {
     return "";
   }
@@ -24355,7 +24692,7 @@ function hasControlChars2(value) {
   return false;
 }
 function parseProfileName(value, label) {
-  const candidate = parseNonEmptyString9(value);
+  const candidate = parseNonEmptyString10(value);
   if (candidate.length === 0) {
     throw createCliError7(
       "CLI_PAIR_PROFILE_INVALID",
@@ -24389,16 +24726,20 @@ function parsePeerProfile(payload) {
   };
 }
 function parsePairingTicket(value) {
-  const ticket = parseNonEmptyString9(value);
+  let ticket = parseNonEmptyString10(value);
+  while (ticket.startsWith("`")) {
+    ticket = ticket.slice(1);
+  }
+  while (ticket.endsWith("`")) {
+    ticket = ticket.slice(0, -1);
+  }
+  ticket = ticket.trim().replace(/\s+/gu, "");
   if (!ticket.startsWith(PAIRING_TICKET_PREFIX)) {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_TICKET_INVALID",
       "Pairing ticket is invalid"
     );
   }
-  return ticket;
-}
-function parsePairingTicketIssuerOrigin(ticket) {
   const encodedPayload = ticket.slice(PAIRING_TICKET_PREFIX.length);
   if (encodedPayload.length === 0) {
     throw createCliError7(
@@ -24406,15 +24747,26 @@ function parsePairingTicketIssuerOrigin(ticket) {
       "Pairing ticket is invalid"
     );
   }
-  let payloadRaw;
   try {
-    payloadRaw = new TextDecoder().decode(decodeBase64url(encodedPayload));
+    const payloadRaw = new TextDecoder().decode(
+      decodeBase64url(encodedPayload)
+    );
+    const payload = JSON.parse(payloadRaw);
+    if (!isRecord10(payload)) {
+      throw new Error("invalid payload");
+    }
   } catch {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_TICKET_INVALID",
       "Pairing ticket is invalid"
     );
   }
+  return ticket;
+}
+function parsePairingTicketIssuerOrigin(ticket) {
+  const normalizedTicket = parsePairingTicket(ticket);
+  const encodedPayload = normalizedTicket.slice(PAIRING_TICKET_PREFIX.length);
+  const payloadRaw = new TextDecoder().decode(decodeBase64url(encodedPayload));
   let payload;
   try {
     payload = JSON.parse(payloadRaw);
@@ -24447,6 +24799,26 @@ function parsePairingTicketIssuerOrigin(ticket) {
   }
   return issuerUrl.origin;
 }
+function assertTicketIssuerMatchesProxy(input) {
+  const issuerOrigin = parsePairingTicketIssuerOrigin(input.ticket);
+  let proxyOrigin;
+  try {
+    proxyOrigin = new URL(input.proxyUrl).origin;
+  } catch {
+    throw createCliError7(
+      "CLI_PAIR_PROXY_URL_INVALID",
+      "Configured proxyUrl is invalid. Run `clawdentity config set proxyUrl <url>` and retry."
+    );
+  }
+  if (issuerOrigin === proxyOrigin) {
+    return;
+  }
+  const command = input.context === "confirm" ? "pair confirm" : "pair status";
+  throw createCliError7(
+    "CLI_PAIR_TICKET_ISSUER_MISMATCH",
+    `Pairing ticket was issued by ${issuerOrigin}, but current proxy URL is ${proxyOrigin}. Run \`clawdentity config set proxyUrl ${issuerOrigin}\` and retry \`${command}\`.`
+  );
+}
 function parseAitAgentDid(ait) {
   const parts = ait.split(".");
   if (parts.length < 2) {
@@ -24544,16 +24916,16 @@ function parsePeerEntry(value) {
       "Peer entry must be an object"
     );
   }
-  const did = parseNonEmptyString9(value.did);
-  const proxyUrl = parseNonEmptyString9(value.proxyUrl);
+  const did = parseNonEmptyString10(value.did);
+  const proxyUrl = parseNonEmptyString10(value.proxyUrl);
   if (did.length === 0 || proxyUrl.length === 0) {
     throw createCliError7(
       "CLI_PAIR_PEERS_CONFIG_INVALID",
       "Peer entry is invalid"
     );
   }
-  const agentNameRaw = parseNonEmptyString9(value.agentName);
-  const humanNameRaw = parseNonEmptyString9(value.humanName);
+  const agentNameRaw = parseNonEmptyString10(value.agentName);
+  const humanNameRaw = parseNonEmptyString10(value.humanName);
   const entry = {
     did,
     proxyUrl
@@ -24652,7 +25024,7 @@ async function loadRelayTransformPeersPath(input) {
   if (!isRecord10(parsed)) {
     return void 0;
   }
-  const relayTransformPeersPath = parseNonEmptyString9(
+  const relayTransformPeersPath = parseNonEmptyString10(
     parsed.relayTransformPeersPath
   );
   if (relayTransformPeersPath.length === 0) {
@@ -24700,7 +25072,7 @@ async function syncOpenclawRelayPeersSnapshot(input) {
   }
 }
 function parseTtlSeconds(value) {
-  const raw = parseNonEmptyString9(value);
+  const raw = parseNonEmptyString10(value);
   if (raw.length === 0) {
     return void 0;
   }
@@ -24714,7 +25086,7 @@ function parseTtlSeconds(value) {
   return parsed;
 }
 function parsePositiveIntegerOption(input) {
-  const raw = parseNonEmptyString9(input.value);
+  const raw = parseNonEmptyString10(input.value);
   if (raw.length === 0) {
     return input.defaultValue;
   }
@@ -24728,7 +25100,7 @@ function parsePositiveIntegerOption(input) {
   return parsed;
 }
 function resolveLocalPairProfile(input) {
-  const humanName = parseNonEmptyString9(input.config.humanName);
+  const humanName = parseNonEmptyString10(input.config.humanName);
   if (humanName.length === 0) {
     throw createCliError7(
       "CLI_PAIR_HUMAN_NAME_MISSING",
@@ -24752,7 +25124,7 @@ function parseProxyUrl2(candidate) {
   }
 }
 async function resolveProxyUrl(input) {
-  const fromEnv = parseNonEmptyString9(process.env.CLAWDENTITY_PROXY_URL);
+  const fromEnv = parseNonEmptyString10(process.env.CLAWDENTITY_PROXY_URL);
   if (fromEnv.length > 0) {
     return parseProxyUrl2(fromEnv);
   }
@@ -24760,7 +25132,7 @@ async function resolveProxyUrl(input) {
     fetchImpl: input.fetchImpl
   });
   const metadataProxyUrl = parseProxyUrl2(metadata.proxyUrl);
-  const configuredProxyUrl = parseNonEmptyString9(input.config.proxyUrl);
+  const configuredProxyUrl = parseNonEmptyString10(input.config.proxyUrl);
   if (configuredProxyUrl.length === 0) {
     return metadataProxyUrl;
   }
@@ -24846,6 +25218,12 @@ function mapConfirmPairError(status, payload) {
   if (code === "PROXY_PAIR_TICKET_EXPIRED" || status === 410) {
     return "Pairing ticket has expired";
   }
+  if (code === "PROXY_PAIR_TICKET_INVALID_ISSUER") {
+    return message2 ? `Pair confirm failed: ticket issuer does not match this proxy (${message2}). Use the same proxy URL where the ticket was issued.` : "Pair confirm failed: ticket issuer does not match this proxy. Use the same proxy URL where the ticket was issued.";
+  }
+  if (code === "PROXY_PAIR_TICKET_INVALID_FORMAT" || code === "PROXY_PAIR_TICKET_UNSUPPORTED_VERSION") {
+    return message2 ? `Pair confirm request is invalid (400): ${message2}. Re-copy the full ticket/QR without truncation.` : "Pair confirm request is invalid (400): pairing ticket is malformed. Re-copy the full ticket/QR without truncation.";
+  }
   if (status === 400) {
     return message2 ? `Pair confirm request is invalid (400): ${message2}` : "Pair confirm request is invalid (400).";
   }
@@ -24869,6 +25247,12 @@ function mapStatusPairError(status, payload) {
   if (code === "PROXY_PAIR_STATUS_FORBIDDEN" || status === 403) {
     return message2 ? `Pair status request is forbidden (403): ${message2}` : "Pair status request is forbidden (403).";
   }
+  if (code === "PROXY_PAIR_TICKET_INVALID_ISSUER") {
+    return message2 ? `Pair status failed: ticket issuer does not match this proxy (${message2}). Use the same proxy URL where the ticket was issued.` : "Pair status failed: ticket issuer does not match this proxy. Use the same proxy URL where the ticket was issued.";
+  }
+  if (code === "PROXY_PAIR_TICKET_INVALID_FORMAT" || code === "PROXY_PAIR_TICKET_UNSUPPORTED_VERSION") {
+    return message2 ? `Pair status request is invalid (400): ${message2}. Re-copy the full ticket/QR without truncation.` : "Pair status request is invalid (400): pairing ticket is malformed. Re-copy the full ticket/QR without truncation.";
+  }
   if (status === 400) {
     return message2 ? `Pair status request is invalid (400): ${message2}` : "Pair status request is invalid (400).";
   }
@@ -24888,8 +25272,8 @@ function parsePairStartResponse(payload) {
     );
   }
   const ticket = parsePairingTicket(payload.ticket);
-  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
-  const expiresAt = parseNonEmptyString9(payload.expiresAt);
+  const initiatorAgentDid = parseNonEmptyString10(payload.initiatorAgentDid);
+  const expiresAt = parseNonEmptyString10(payload.expiresAt);
   let initiatorProfile;
   if (initiatorAgentDid.length === 0 || expiresAt.length === 0) {
     throw createCliError7(
@@ -24920,8 +25304,8 @@ function parsePairConfirmResponse(payload) {
     );
   }
   const paired = payload.paired === true;
-  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
-  const responderAgentDid = parseNonEmptyString9(payload.responderAgentDid);
+  const initiatorAgentDid = parseNonEmptyString10(payload.initiatorAgentDid);
+  const responderAgentDid = parseNonEmptyString10(payload.responderAgentDid);
   let initiatorProfile;
   let responderProfile;
   if (!paired || initiatorAgentDid.length === 0 || responderAgentDid.length === 0) {
@@ -24954,17 +25338,17 @@ function parsePairStatusResponse(payload) {
       "Pair status response is invalid"
     );
   }
-  const statusRaw = parseNonEmptyString9(payload.status);
+  const statusRaw = parseNonEmptyString10(payload.status);
   if (statusRaw !== "pending" && statusRaw !== "confirmed") {
     throw createCliError7(
       "CLI_PAIR_STATUS_INVALID_RESPONSE",
       "Pair status response is invalid"
     );
   }
-  const initiatorAgentDid = parseNonEmptyString9(payload.initiatorAgentDid);
-  const responderAgentDid = parseNonEmptyString9(payload.responderAgentDid);
-  const expiresAt = parseNonEmptyString9(payload.expiresAt);
-  const confirmedAt = parseNonEmptyString9(payload.confirmedAt);
+  const initiatorAgentDid = parseNonEmptyString10(payload.initiatorAgentDid);
+  const responderAgentDid = parseNonEmptyString10(payload.responderAgentDid);
+  const expiresAt = parseNonEmptyString10(payload.expiresAt);
+  const confirmedAt = parseNonEmptyString10(payload.confirmedAt);
   let initiatorProfile;
   if (initiatorAgentDid.length === 0 || expiresAt.length === 0) {
     throw createCliError7(
@@ -25112,7 +25496,7 @@ function decodeTicketFromPng(imageBytes) {
     decodedPng.data.byteLength
   );
   const decoded = jsQR(imageData, decodedPng.width, decodedPng.height);
-  if (!decoded || parseNonEmptyString9(decoded.data).length === 0) {
+  if (!decoded || parseNonEmptyString10(decoded.data).length === 0) {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_QR_NOT_FOUND",
       "No pairing QR code was found in the image"
@@ -25122,13 +25506,13 @@ function decodeTicketFromPng(imageBytes) {
 }
 async function persistPairingQr(input) {
   const mkdirImpl = input.dependencies.mkdirImpl ?? mkdir7;
-  const readdirImpl = input.dependencies.readdirImpl ?? readdir;
+  const readdirImpl = input.dependencies.readdirImpl ?? readdir2;
   const unlinkImpl = input.dependencies.unlinkImpl ?? unlink2;
   const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile7;
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
   const qrEncodeImpl = input.dependencies.qrEncodeImpl ?? encodeTicketQrPng;
   const baseDir = join8(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
-  const outputPath = parseNonEmptyString9(input.qrOutput) ? resolve(input.qrOutput ?? "") : join8(
+  const outputPath = parseNonEmptyString10(input.qrOutput) ? resolve(input.qrOutput ?? "") : join8(
     baseDir,
     `${assertValidAgentName(input.agentName)}-pair-${input.nowSeconds}.png`
   );
@@ -25169,8 +25553,8 @@ async function persistPairingQr(input) {
   return outputPath;
 }
 function resolveConfirmTicketSource(options) {
-  const inlineTicket = parseNonEmptyString9(options.ticket);
-  const qrFile = parseNonEmptyString9(options.qrFile);
+  const inlineTicket = parseNonEmptyString10(options.ticket);
+  const qrFile = parseNonEmptyString10(options.qrFile);
   if (inlineTicket.length > 0 && qrFile.length > 0) {
     throw createCliError7(
       "CLI_PAIR_CONFIRM_INPUT_CONFLICT",
@@ -25347,6 +25731,12 @@ async function confirmPairing(agentName, options, dependencies = {}) {
     }
     ticket = parsePairingTicket(qrDecodeImpl(new Uint8Array(imageBytes)));
   }
+  ticket = parsePairingTicket(ticket);
+  assertTicketIssuerMatchesProxy({
+    ticket,
+    proxyUrl,
+    context: "confirm"
+  });
   const { ait, secretKey } = await readAgentProofMaterial(
     normalizedAgentName,
     dependencies
@@ -25424,6 +25814,11 @@ async function getPairingStatusOnce(agentName, options, dependencies = {}) {
     fetchImpl
   });
   const ticket = parsePairingTicket(options.ticket);
+  assertTicketIssuerMatchesProxy({
+    ticket,
+    proxyUrl,
+    context: "status"
+  });
   const { ait, secretKey } = await readAgentProofMaterial(
     agentName,
     dependencies
@@ -25529,7 +25924,7 @@ async function waitForPairingStatus(input) {
   }
 }
 async function getPairingStatus(agentName, options, dependencies = {}) {
-  const ticketRaw = parseNonEmptyString9(options.ticket);
+  const ticketRaw = parseNonEmptyString10(options.ticket);
   if (ticketRaw.length === 0) {
     throw createCliError7(
       "CLI_PAIR_STATUS_TICKET_REQUIRED",
@@ -25740,7 +26135,7 @@ import { Command as Command9 } from "commander";
 
 // src/install-skill-mode.ts
 import { constants, existsSync as existsSync2 } from "fs";
-import { access as access3, copyFile as copyFile2, mkdir as mkdir8, readdir as readdir2, readFile as readFile8 } from "fs/promises";
+import { access as access3, copyFile as copyFile2, mkdir as mkdir8, readdir as readdir3, readFile as readFile8 } from "fs/promises";
 import { createRequire } from "module";
 import { homedir as homedir4 } from "os";
 import { dirname as dirname7, join as join9, relative } from "path";
@@ -25768,7 +26163,7 @@ function getErrorCode3(error48) {
   }
   return typeof error48.code === "string" ? error48.code : void 0;
 }
-function resolveHomeDir2(inputHomeDir) {
+function resolveHomeDir3(inputHomeDir) {
   if (typeof inputHomeDir === "string" && inputHomeDir.trim().length > 0) {
     return inputHomeDir.trim();
   }
@@ -25841,7 +26236,7 @@ async function assertReadableFile(filePath, details) {
   }
 }
 async function listFilesRecursively(directoryPath) {
-  const entries = await readdir2(directoryPath, { withFileTypes: true });
+  const entries = await readdir3(directoryPath, { withFileTypes: true });
   const files = [];
   for (const entry of entries.sort(
     (left, right) => left.name.localeCompare(right.name)
@@ -25950,7 +26345,7 @@ async function copyArtifact(input) {
 }
 async function installOpenclawSkillArtifacts(options = {}) {
   const env = options.env ?? process.env;
-  const homeDir = resolveHomeDir2(options.homeDir);
+  const homeDir = resolveHomeDir3(options.homeDir);
   const openclawDir = resolveOpenclawDir2(homeDir, options.openclawDir);
   const skillPackageRoot = resolveSkillPackageRoot({
     skillPackageRoot: options.skillPackageRoot,