clawdentity 0.0.4 → 0.0.6

package/dist/bin.js

@@ -18495,9 +18495,9 @@ var createConfigCommand = () => {
 
 // src/commands/connector.ts
 import { execFile as execFileCallback } from "child_process";
-import { mkdir as mkdir4, readFile as readFile4, rm, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir4, readFile as readFile3, rm, writeFile as writeFile4 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join6 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 import { fileURLToPath } from "url";
 import { promisify } from "util";
 
@@ -19151,271 +19151,15 @@ import { mkdir as mkdir3, rename as rename2, writeFile as writeFile3 } from "fs/
 import {
   createServer
 } from "http";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 import { WebSocket as NodeWebSocket } from "ws";
-
-// ../../packages/connector/src/relay-echo.ts
-import { readFile as readFile3 } from "fs/promises";
-import { join as join4 } from "path";
-var OPENCLAW_RELAY_RUNTIME_CONFIG_FILENAME = "openclaw-relay.json";
-var PEERS_CONFIG_FILENAME = "peers.json";
-var ECHO_EMPTY_MESSAGE_FALLBACK = "(no message content)";
-var MIN_ECHO_MAX_LENGTH = 50;
-var MAX_ECHO_MAX_LENGTH = 2e3;
-var DEFAULT_RELAY_ECHO_ENABLED = true;
-var DEFAULT_RELAY_ECHO_CHANNEL = "last";
-var DEFAULT_RELAY_ECHO_MAX_LENGTH = 500;
-function isRecord4(value) {
-  return typeof value === "object" && value !== null;
-}
-function parseAbsoluteHttpUrl(value, field) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new Error(`${field} must be a non-empty string`);
-  }
-  let parsed;
-  try {
-    parsed = new URL(value.trim());
-  } catch {
-    throw new Error(`${field} must be a valid absolute URL`);
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`${field} must use http or https`);
-  }
-  if (parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0) {
-    return parsed.origin;
-  }
-  return parsed.toString();
-}
-function parseBoolean(value, field) {
-  if (typeof value !== "boolean") {
-    throw new Error(`${field} must be a boolean`);
-  }
-  return value;
-}
-function parsePositiveInt(value, field, min, max) {
-  const parsed = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
-  if (!Number.isInteger(parsed) || parsed < min || parsed > max) {
-    throw new Error(`${field} must be an integer between ${min} and ${max}`);
-  }
-  return parsed;
-}
-function parseOptionalString(value, field) {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (typeof value !== "string") {
-    throw new Error(`${field} must be a string`);
-  }
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    return void 0;
-  }
-  return trimmed;
-}
-function parseEchoConfig(value) {
-  if (value === void 0) {
-    return {
-      enabled: DEFAULT_RELAY_ECHO_ENABLED,
-      channel: DEFAULT_RELAY_ECHO_CHANNEL,
-      maxLength: DEFAULT_RELAY_ECHO_MAX_LENGTH
-    };
-  }
-  if (!isRecord4(value)) {
-    throw new Error("echo config must be an object");
-  }
-  return {
-    enabled: value.enabled === void 0 ? DEFAULT_RELAY_ECHO_ENABLED : parseBoolean(value.enabled, "echo.enabled"),
-    channel: parseOptionalString(value.channel, "echo.channel") ?? DEFAULT_RELAY_ECHO_CHANNEL,
-    to: parseOptionalString(value.to, "echo.to"),
-    maxLength: value.maxLength === void 0 ? DEFAULT_RELAY_ECHO_MAX_LENGTH : parsePositiveInt(
-      value.maxLength,
-      "echo.maxLength",
-      MIN_ECHO_MAX_LENGTH,
-      MAX_ECHO_MAX_LENGTH
-    )
-  };
-}
-async function loadRelayRuntimeConfigFile(input) {
-  const relayRuntimeConfigPath = join4(
-    input.configDir,
-    OPENCLAW_RELAY_RUNTIME_CONFIG_FILENAME
-  );
-  let raw;
-  try {
-    raw = await readFile3(relayRuntimeConfigPath, "utf8");
-  } catch (error48) {
-    if (typeof error48 === "object" && error48 !== null && "code" in error48 && error48.code === "ENOENT") {
-      return void 0;
-    }
-    throw new Error(
-      `Unable to read relay runtime config at ${relayRuntimeConfigPath}`
-    );
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(
-      `Unable to parse relay runtime config at ${relayRuntimeConfigPath}`
-    );
-  }
-  if (!isRecord4(parsed)) {
-    throw new Error("Relay runtime config root must be a JSON object");
-  }
-  const config2 = parsed;
-  const openclawBaseUrl = config2.openclawBaseUrl === void 0 ? void 0 : parseAbsoluteHttpUrl(config2.openclawBaseUrl, "openclawBaseUrl");
-  return {
-    openclawBaseUrl,
-    echo: parseEchoConfig(config2.echo)
-  };
-}
-function compactString(value) {
-  return value.replaceAll(/\s+/g, " ").trim();
-}
-function toCompactJson(value) {
-  try {
-    const raw = JSON.stringify(value);
-    if (typeof raw !== "string" || raw.length === 0) {
-      return ECHO_EMPTY_MESSAGE_FALLBACK;
-    }
-    return raw;
-  } catch {
-    return ECHO_EMPTY_MESSAGE_FALLBACK;
-  }
-}
-function truncateMessage(value, maxLength) {
-  if (value.length <= maxLength) {
-    return value;
-  }
-  return `${value.slice(0, maxLength)}...`;
-}
-function extractRelayMessageContent(payload) {
-  if (typeof payload === "string") {
-    const compact = compactString(payload);
-    return compact.length > 0 ? compact : ECHO_EMPTY_MESSAGE_FALLBACK;
-  }
-  if (isRecord4(payload)) {
-    for (const candidateKey of ["message", "text", "content"]) {
-      const candidateValue = payload[candidateKey];
-      if (typeof candidateValue === "string") {
-        const compact = compactString(candidateValue);
-        if (compact.length > 0) {
-          return compact;
-        }
-      }
-    }
-  }
-  return toCompactJson(payload);
-}
-function formatInboundRelayEcho(input) {
-  const content = truncateMessage(
-    extractRelayMessageContent(input.payload),
-    input.maxLength
-  );
-  return `\u{1F517} [${input.fromLabel}]: ${content}`;
-}
-function formatOutboundRelayEcho(input) {
-  const content = truncateMessage(
-    extractRelayMessageContent(input.payload),
-    input.maxLength
-  );
-  return `\u21A9\uFE0F Reply to [${input.toLabel}]: ${content}`;
-}
-async function loadPeerLabelsByDid(input) {
-  const peersPath = join4(input.configDir, PEERS_CONFIG_FILENAME);
-  let raw;
-  try {
-    raw = await readFile3(peersPath, "utf8");
-  } catch (error48) {
-    if (typeof error48 === "object" && error48 !== null && "code" in error48 && error48.code === "ENOENT") {
-      return /* @__PURE__ */ new Map();
-    }
-    throw new Error(`Unable to read peers config at ${peersPath}`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error(`Unable to parse peers config at ${peersPath}`);
-  }
-  if (!isRecord4(parsed) || !isRecord4(parsed.peers)) {
-    return /* @__PURE__ */ new Map();
-  }
-  const labels = /* @__PURE__ */ new Map();
-  for (const [alias, entry] of Object.entries(parsed.peers)) {
-    if (!isRecord4(entry) || typeof entry.did !== "string") {
-      continue;
-    }
-    const did = entry.did.trim();
-    if (did.length === 0) {
-      continue;
-    }
-    const name = typeof entry.name === "string" && entry.name.trim().length > 0 ? entry.name.trim() : alias.trim();
-    if (name.length === 0) {
-      continue;
-    }
-    labels.set(did, name);
-  }
-  return labels;
-}
-function resolvePeerLabel(input) {
-  if (input.peerDid !== void 0) {
-    const byDid = input.peerLabelsByDid.get(input.peerDid);
-    if (typeof byDid === "string" && byDid.length > 0) {
-      return byDid;
-    }
-  }
-  const fallback = input.fallbackLabel.trim();
-  if (fallback.length > 0) {
-    return fallback;
-  }
-  return input.peerDid?.trim() || "Unknown peer";
-}
-async function sendRelayEchoToOpenclaw(input) {
-  if (!input.echoConfig.enabled) {
-    return;
-  }
-  const payload = {
-    message: input.message,
-    name: "Clawdentity Relay",
-    wakeMode: "now",
-    deliver: true,
-    channel: input.echoConfig.channel
-  };
-  if (input.echoConfig.to !== void 0) {
-    payload.to = input.echoConfig.to;
-  }
-  const headers = {
-    "content-type": "application/json"
-  };
-  if (input.requestId !== void 0 && input.requestId.trim().length > 0) {
-    headers["x-request-id"] = input.requestId.trim();
-  }
-  if (input.hookToken !== void 0 && input.hookToken.trim().length > 0) {
-    headers["x-openclaw-token"] = input.hookToken.trim();
-  }
-  const response = await input.fetchImpl(input.endpoint, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(payload)
-  });
-  if (!response.ok) {
-    input.logger.warn("connector.relay_echo.rejected", {
-      status: response.status,
-      requestId: input.requestId
-    });
-    throw new Error(`Relay echo rejected with status ${response.status}`);
-  }
-}
-
-// ../../packages/connector/src/runtime.ts
 var REGISTRY_AUTH_FILENAME = "registry-auth.json";
 var AGENTS_DIR_NAME2 = "agents";
 var REFRESH_SINGLE_FLIGHT_PREFIX = "connector-runtime";
 var NONCE_SIZE = 16;
 var MAX_OUTBOUND_BODY_BYTES = 1024 * 1024;
 var ACCESS_TOKEN_REFRESH_SKEW_MS = 3e4;
-function isRecord5(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null;
 }
 function toPathWithQuery2(url2) {
@@ -19465,38 +19209,9 @@ function normalizeWebSocketUrl(urlInput) {
   }
   return parsed.toString();
 }
-function parseOpenclawBaseUrl(value) {
-  let parsed;
-  try {
-    parsed = new URL(value);
-  } catch {
-    throw new Error("OpenClaw base URL is invalid");
-  }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error("OpenClaw base URL is invalid");
-  }
-  if (parsed.pathname === "/" && parsed.search.length === 0 && parsed.hash.length === 0) {
-    return parsed.origin;
-  }
-  return parsed.toString();
-}
-async function resolveOpenclawRuntimeSettings(input) {
-  const fileConfig = await loadRelayRuntimeConfigFile({
-    configDir: input.configDir
-  });
-  const baseUrlFromOption = input.openclawBaseUrlOption?.trim();
-  const baseUrlFromEnv = process.env.OPENCLAW_BASE_URL?.trim();
-  const openclawBaseUrl = parseOpenclawBaseUrl(
-    baseUrlFromOption || baseUrlFromEnv || fileConfig?.openclawBaseUrl || DEFAULT_OPENCLAW_BASE_URL
-  );
-  return {
-    openclawBaseUrl,
-    echoConfig: fileConfig?.echo ?? {
-      enabled: DEFAULT_RELAY_ECHO_ENABLED,
-      channel: DEFAULT_RELAY_ECHO_CHANNEL,
-      maxLength: DEFAULT_RELAY_ECHO_MAX_LENGTH
-    }
-  };
+function resolveOpenclawBaseUrl(input) {
+  const value = input?.trim() || process.env.OPENCLAW_BASE_URL?.trim() || DEFAULT_OPENCLAW_BASE_URL;
+  return value;
 }
 function resolveOpenclawHookPath(input) {
   const value = input?.trim() || process.env.OPENCLAW_HOOK_PATH?.trim() || DEFAULT_OPENCLAW_HOOK_PATH;
@@ -19536,7 +19251,7 @@ function shouldRefreshAccessToken(auth, nowMs) {
   return expiresAtMs <= nowMs + ACCESS_TOKEN_REFRESH_SKEW_MS;
 }
 function parseOutboundRelayRequest(payload) {
-  if (!isRecord5(payload)) {
+  if (!isRecord4(payload)) {
     throw new AppError({
       code: "CONNECTOR_OUTBOUND_INVALID_REQUEST",
       message: "Outbound relay request must be an object",
@@ -19594,7 +19309,7 @@ function createWebSocketFactory() {
   };
 }
 async function writeRegistryAuthAtomic(input) {
-  const targetPath = join5(
+  const targetPath = join4(
     input.configDir,
     AGENTS_DIR_NAME2,
     input.agentName,
@@ -19691,63 +19406,14 @@ async function startConnectorRuntime(input) {
     accessToken: currentAuth.accessToken,
     secretKey
   });
-  const openclawRuntimeSettings = await resolveOpenclawRuntimeSettings({
-    configDir: input.configDir,
-    openclawBaseUrlOption: input.openclawBaseUrl
-  });
-  const peerLabelsByDid = await loadPeerLabelsByDid({
-    configDir: input.configDir
-  });
-  const openclawHookPath = resolveOpenclawHookPath(input.openclawHookPath);
-  const openclawHookToken = resolveOpenclawHookToken(input.openclawHookToken);
-  const openclawHookUrl = new URL(
-    openclawHookPath,
-    openclawRuntimeSettings.openclawBaseUrl
-  ).toString();
-  const queueRelayEcho = (echoInput) => {
-    void sendRelayEchoToOpenclaw({
-      endpoint: openclawHookUrl,
-      echoConfig: openclawRuntimeSettings.echoConfig,
-      fetchImpl,
-      hookToken: openclawHookToken,
-      logger: logger12,
-      message: echoInput.message,
-      requestId: echoInput.requestId
-    }).catch((error48) => {
-      logger12.warn("connector.relay_echo.failed", {
-        direction: echoInput.direction,
-        errorName: error48 instanceof Error ? error48.name : "unknown",
-        requestId: echoInput.requestId
-      });
-    });
-  };
   const connectorClient = new ConnectorClient({
     connectorUrl: wsParsed.toString(),
     connectionHeaders: upgradeHeaders,
-    openclawBaseUrl: openclawRuntimeSettings.openclawBaseUrl,
-    openclawHookPath,
-    openclawHookToken,
+    openclawBaseUrl: resolveOpenclawBaseUrl(input.openclawBaseUrl),
+    openclawHookPath: resolveOpenclawHookPath(input.openclawHookPath),
+    openclawHookToken: resolveOpenclawHookToken(input.openclawHookToken),
     fetchImpl,
     logger: logger12,
-    hooks: {
-      onDeliverSucceeded: (frame) => {
-        const fromLabel = resolvePeerLabel({
-          peerLabelsByDid,
-          peerDid: frame.fromAgentDid,
-          fallbackLabel: frame.fromAgentDid
-        });
-        const echoMessage = formatInboundRelayEcho({
-          fromLabel,
-          payload: frame.payload,
-          maxLength: openclawRuntimeSettings.echoConfig.maxLength
-        });
-        queueRelayEcho({
-          direction: "inbound",
-          message: echoMessage,
-          requestId: frame.id
-        });
-      }
-    },
     webSocketFactory: createWebSocketFactory()
   });
   const outboundBaseUrl = normalizeOutboundBaseUrl(input.outboundBaseUrl);
@@ -19833,22 +19499,6 @@ async function startConnectorRuntime(input) {
       const requestBody = await readRequestJson(req);
       const relayRequest = parseOutboundRelayRequest(requestBody);
       await relayToPeer(relayRequest);
-      const toLabel = resolvePeerLabel({
-        peerLabelsByDid,
-        peerDid: relayRequest.peerDid,
-        fallbackLabel: relayRequest.peer
-      });
-      const requestId = typeof req.headers["x-request-id"] === "string" ? req.headers["x-request-id"] : void 0;
-      const echoMessage = formatOutboundRelayEcho({
-        toLabel,
-        payload: relayRequest.payload,
-        maxLength: openclawRuntimeSettings.echoConfig.maxLength
-      });
-      queueRelayEcho({
-        direction: "outbound",
-        message: echoMessage,
-        requestId
-      });
       writeJson(res, 202, { accepted: true, peer: relayRequest.peer });
     } catch (error48) {
       if (error48 instanceof AppError) {
@@ -19927,14 +19577,16 @@ var IDENTITY_FILE_NAME2 = "identity.json";
 var AIT_FILE_NAME2 = "ait.jwt";
 var SECRET_KEY_FILE_NAME = "secret.key";
 var REGISTRY_AUTH_FILE_NAME2 = "registry-auth.json";
+var OPENCLAW_RELAY_RUNTIME_FILE_NAME = "openclaw-relay.json";
+var OPENCLAW_CONNECTORS_FILE_NAME = "openclaw-connectors.json";
 var SERVICE_LOG_DIR_NAME = "logs";
 var DEFAULT_CONNECTOR_BASE_URL2 = "http://127.0.0.1:19400";
 var DEFAULT_CONNECTOR_OUTBOUND_PATH2 = "/v1/outbound";
-function isRecord6(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null;
 }
 function getErrorCode(error48) {
-  if (!isRecord6(error48)) {
+  if (!isRecord5(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -20010,13 +19662,43 @@ function normalizeOutboundPath2(pathValue) {
   }
   return trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
 }
-function resolveConnectorBaseUrl() {
+function resolveConnectorBaseUrlFromEnv() {
   const value = process.env.CLAWDENTITY_CONNECTOR_BASE_URL;
   if (typeof value !== "string" || value.trim().length === 0) {
-    return DEFAULT_CONNECTOR_BASE_URL2;
+    return void 0;
   }
   return parseConnectorBaseUrl(value.trim());
 }
+async function readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl) {
+  const assignmentsPath = join5(configDir, OPENCLAW_CONNECTORS_FILE_NAME);
+  let raw;
+  try {
+    raw = await readFileImpl(assignmentsPath, "utf8");
+  } catch (error48) {
+    if (getErrorCode(error48) === "ENOENT") {
+      return void 0;
+    }
+    throw error48;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw createCliError3(
+      "CLI_CONNECTOR_INVALID_ASSIGNMENTS",
+      "Connector assignments config is invalid JSON",
+      { assignmentsPath }
+    );
+  }
+  if (!isRecord5(parsed) || !isRecord5(parsed.agents)) {
+    return void 0;
+  }
+  const entry = parsed.agents[agentName];
+  if (!isRecord5(entry) || typeof entry.connectorBaseUrl !== "string") {
+    return void 0;
+  }
+  return parseConnectorBaseUrl(entry.connectorBaseUrl);
+}
 function resolveConnectorOutboundPath() {
   const value = process.env.CLAWDENTITY_CONNECTOR_OUTBOUND_PATH;
   if (typeof value !== "string" || value.trim().length === 0) {
@@ -20051,6 +19733,34 @@ async function readRequiredTrimmedFile(filePath, label, readFileImpl) {
   }
   return trimmed;
 }
+async function readRelayRuntimeConfig(configDir, readFileImpl) {
+  const filePath = join5(configDir, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
+  let raw;
+  try {
+    raw = await readFileImpl(filePath, "utf8");
+  } catch (error48) {
+    if (getErrorCode(error48) === "ENOENT") {
+      return void 0;
+    }
+    throw error48;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord5(parsed)) {
+    return void 0;
+  }
+  const openclawHookToken = typeof parsed.openclawHookToken === "string" && parsed.openclawHookToken.trim().length > 0 ? parsed.openclawHookToken.trim() : void 0;
+  if (!openclawHookToken) {
+    return void 0;
+  }
+  return {
+    openclawHookToken
+  };
+}
 function parseJsonRecord(value, code, message2) {
   let parsed;
   try {
@@ -20058,7 +19768,7 @@ function parseJsonRecord(value, code, message2) {
   } catch {
     throw createCliError3(code, message2);
   }
-  if (!isRecord6(parsed)) {
+  if (!isRecord5(parsed)) {
     throw createCliError3(code, message2);
   }
   return parsed;
@@ -20098,7 +19808,7 @@ async function loadDefaultConnectorModule() {
   };
 }
 function resolveWaitPromise(runtime) {
-  if (!runtime || !isRecord6(runtime)) {
+  if (!runtime || !isRecord5(runtime)) {
     return void 0;
   }
   if (typeof runtime.waitUntilStopped === "function") {
@@ -20163,7 +19873,7 @@ function buildConnectorStartArgs(agentName, commandOptions) {
 }
 function resolveCliEntryPath(resolveCurrentModulePathImpl) {
   const modulePath = resolveCurrentModulePathImpl?.() ?? fileURLToPath(import.meta.url);
-  return join6(dirname3(modulePath), "..", "bin.js");
+  return join5(dirname3(modulePath), "..", "bin.js");
 }
 function escapeXml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
@@ -20261,7 +19971,7 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
   );
   const configDir = serviceDependencies.getConfigDirImpl();
   const homeDir = serviceDependencies.getHomeDirImpl();
-  const logsDir = join6(configDir, SERVICE_LOG_DIR_NAME);
+  const logsDir = join5(configDir, SERVICE_LOG_DIR_NAME);
   const serviceName = sanitizeServiceSegment(
     `clawdentity-connector-${agentName}`
   );
@@ -20271,12 +19981,12 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
     resolveCliEntryPath(serviceDependencies.resolveCurrentModulePathImpl),
     ...startArgs
   ];
-  const outputLogPath = join6(logsDir, `${serviceName}.out.log`);
-  const errorLogPath = join6(logsDir, `${serviceName}.err.log`);
+  const outputLogPath = join5(logsDir, `${serviceName}.out.log`);
+  const errorLogPath = join5(logsDir, `${serviceName}.err.log`);
   await serviceDependencies.mkdirImpl(logsDir, { recursive: true });
   if (platform === "systemd") {
-    const serviceDir = join6(homeDir, ".config", "systemd", "user");
-    const serviceFilePath2 = join6(serviceDir, `${serviceName}.service`);
+    const serviceDir = join5(homeDir, ".config", "systemd", "user");
+    const serviceFilePath2 = join5(serviceDir, `${serviceName}.service`);
     await serviceDependencies.mkdirImpl(serviceDir, { recursive: true });
     await serviceDependencies.writeFileImpl(
       serviceFilePath2,
@@ -20315,9 +20025,9 @@ async function installConnectorServiceForAgent(agentName, commandOptions = {}, d
       serviceFilePath: serviceFilePath2
     };
   }
-  const launchAgentsDir = join6(homeDir, "Library", "LaunchAgents");
+  const launchAgentsDir = join5(homeDir, "Library", "LaunchAgents");
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join6(
+  const serviceFilePath = join5(
     launchAgentsDir,
     `${serviceNameWithDomain}.plist`
   );
@@ -20376,7 +20086,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     `clawdentity-connector-${agentName}`
   );
   if (platform === "systemd") {
-    const serviceFilePath2 = join6(
+    const serviceFilePath2 = join5(
       homeDir,
       ".config",
       "systemd",
@@ -20407,7 +20117,7 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
     };
   }
   const serviceNameWithDomain = `com.clawdentity.${serviceName}`;
-  const serviceFilePath = join6(
+  const serviceFilePath = join5(
     homeDir,
     "Library",
     "LaunchAgents",
@@ -20431,38 +20141,42 @@ async function uninstallConnectorServiceForAgent(agentName, commandOptions = {},
 async function startConnectorForAgent(agentName, commandOptions = {}, dependencies = {}) {
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
-  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile4(path, encoding));
+  const readFileImpl = dependencies.readFileImpl ?? ((path, encoding) => readFile3(path, encoding));
   const loadConnectorModule = dependencies.loadConnectorModule ?? loadDefaultConnectorModule;
   const configDir = getConfigDirImpl();
-  const agentDirectory = join6(configDir, AGENTS_DIR_NAME3, agentName);
+  const agentDirectory = join5(configDir, AGENTS_DIR_NAME3, agentName);
   const [
     rawAit,
     rawSecretKey,
     rawIdentity,
     rawRegistryAuth,
+    assignedConnectorBaseUrl,
+    relayRuntimeConfig,
     config2,
     connectorModule
   ] = await Promise.all([
     readRequiredTrimmedFile(
-      join6(agentDirectory, AIT_FILE_NAME2),
+      join5(agentDirectory, AIT_FILE_NAME2),
       AIT_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join6(agentDirectory, SECRET_KEY_FILE_NAME),
+      join5(agentDirectory, SECRET_KEY_FILE_NAME),
       SECRET_KEY_FILE_NAME,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join6(agentDirectory, IDENTITY_FILE_NAME2),
+      join5(agentDirectory, IDENTITY_FILE_NAME2),
       IDENTITY_FILE_NAME2,
       readFileImpl
     ),
     readRequiredTrimmedFile(
-      join6(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
+      join5(agentDirectory, REGISTRY_AUTH_FILE_NAME2),
       REGISTRY_AUTH_FILE_NAME2,
       readFileImpl
     ),
+    readConnectorAssignedBaseUrl(configDir, agentName, readFileImpl),
+    readRelayRuntimeConfig(configDir, readFileImpl),
     resolveConfigImpl(),
     loadConnectorModule()
   ]);
@@ -20474,7 +20188,8 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
   }
   const identity = parseAgentIdentity(rawIdentity);
   const registryAuth = parseRegistryAuth(rawRegistryAuth);
-  const outboundBaseUrl = resolveConnectorBaseUrl();
+  const openclawHookToken = commandOptions.openclawHookToken ?? relayRuntimeConfig?.openclawHookToken;
+  const outboundBaseUrl = resolveConnectorBaseUrlFromEnv() ?? assignedConnectorBaseUrl ?? DEFAULT_CONNECTOR_BASE_URL2;
   const outboundPath = resolveConnectorOutboundPath();
   const runtime = await connectorModule.startConnectorRuntime({
     agentName,
@@ -20485,7 +20200,7 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
     proxyWebsocketUrl: commandOptions.proxyWsUrl,
     openclawBaseUrl: commandOptions.openclawBaseUrl,
     openclawHookPath: commandOptions.openclawHookPath,
-    openclawHookToken: commandOptions.openclawHookToken,
+    openclawHookToken,
     credentials: {
       agentDid: identity.did,
       ait: rawAit,
@@ -20497,8 +20212,8 @@ async function startConnectorForAgent(agentName, commandOptions = {}, dependenci
       tokenType: registryAuth.tokenType
     }
   });
-  const outboundUrl = runtime && isRecord6(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
-  const proxyWebsocketUrl = runtime && isRecord6(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : void 0 : void 0;
+  const outboundUrl = runtime && isRecord5(runtime) && typeof runtime.outboundUrl === "string" ? runtime.outboundUrl : resolveOutboundUrl(outboundBaseUrl, outboundPath);
+  const proxyWebsocketUrl = runtime && isRecord5(runtime) ? typeof runtime.websocketUrl === "string" ? runtime.websocketUrl : typeof runtime.proxyWebsocketUrl === "string" ? runtime.proxyWebsocketUrl : void 0 : void 0;
   return {
     outboundUrl,
     proxyWebsocketUrl,
@@ -20629,7 +20344,7 @@ function createConnectorCommand(dependencies = {}) {
 // src/commands/invite.ts
 import { Command as Command6 } from "commander";
 var logger7 = createLogger({ service: "cli", module: "invite" });
-var isRecord7 = (value) => {
+var isRecord6 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function parseNonEmptyString6(value) {
@@ -20670,7 +20385,7 @@ function toRegistryRequestUrl(registryUrl, path) {
   return new URL(path.slice(1), normalizedBaseUrl).toString();
 }
 function extractRegistryErrorCode(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord6(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20681,7 +20396,7 @@ function extractRegistryErrorCode(payload) {
   return trimmed.length > 0 ? trimmed : void 0;
 }
 function extractRegistryErrorMessage3(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord6(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -20755,13 +20470,13 @@ function mapRedeemInviteError(status, payload) {
   return `Invite redeem failed (${status})`;
 }
 function parseInviteRecord(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord6(payload)) {
     throw createCliError4(
       "CLI_INVITE_CREATE_INVALID_RESPONSE",
       "Invite response is invalid"
     );
   }
-  const source = isRecord7(payload.invite) ? payload.invite : payload;
+  const source = isRecord6(payload.invite) ? payload.invite : payload;
   const code = parseNonEmptyString6(source.code);
   if (code.length === 0) {
     throw createCliError4(
@@ -20786,15 +20501,15 @@ function parseInviteRecord(payload) {
   return invite;
 }
 function parseInviteRedeemResponse(payload) {
-  if (!isRecord7(payload)) {
+  if (!isRecord6(payload)) {
     throw createCliError4(
       "CLI_INVITE_REDEEM_INVALID_RESPONSE",
       "Invite redeem response is invalid"
     );
   }
-  const apiKeySource = isRecord7(payload.apiKey) ? payload.apiKey : payload;
+  const apiKeySource = isRecord6(payload.apiKey) ? payload.apiKey : payload;
   const apiKeyToken = parseNonEmptyString6(
-    isRecord7(payload.apiKey) ? payload.apiKey.token : payload.token
+    isRecord6(payload.apiKey) ? payload.apiKey.token : payload.token
   );
   if (apiKeyToken.length === 0) {
     throw createCliError4(
@@ -20902,7 +20617,7 @@ async function persistRedeemConfig(registryUrl, apiKeyToken, dependencies = {})
 }
 var createInviteCommand = (dependencies = {}) => {
   const inviteCommand = new Command6("invite").description(
-    "Manage registry onboarding invites (not OpenClaw peer relay invites)"
+    "Manage registry onboarding invites"
   );
   inviteCommand.command("create").description("Create a registry invite code (admin only)").option("--expires-at <timestamp>", "Optional invite expiry (ISO-8601)").option("--registry-url <url>", "Override registry URL").action(
     withErrorHandling(
@@ -20945,6 +20660,7 @@ var createInviteCommand = (dependencies = {}) => {
           dependencies
         );
         writeStdoutLine("API key saved to local config");
+        writeStdoutLine("Onboarding auth complete");
       }
     )
   );
@@ -20952,9 +20668,11 @@ var createInviteCommand = (dependencies = {}) => {
 };
 
 // src/commands/openclaw.ts
-import { chmod as chmod3, copyFile, mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
+import { randomBytes as randomBytes3 } from "crypto";
+import { existsSync } from "fs";
+import { chmod as chmod3, copyFile, mkdir as mkdir5, readFile as readFile4, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join7 } from "path";
+import { dirname as dirname4, join as join6, resolve as resolvePath } from "path";
 import { Command as Command7 } from "commander";
 var logger8 = createLogger({ service: "cli", module: "openclaw" });
 var CLAWDENTITY_DIR_NAME = ".clawdentity";
@@ -20964,25 +20682,35 @@ var SECRET_KEY_FILE_NAME2 = "secret.key";
 var PEERS_FILE_NAME = "peers.json";
 var OPENCLAW_DIR_NAME = ".openclaw";
 var OPENCLAW_CONFIG_FILE_NAME = "openclaw.json";
+var LEGACY_OPENCLAW_STATE_DIR_NAMES = [".clawdbot", ".moldbot", ".moltbot"];
+var LEGACY_OPENCLAW_CONFIG_FILE_NAMES = ["clawdbot.json", "moldbot.json", "moltbot.json"];
 var OPENCLAW_AGENT_FILE_NAME = "openclaw-agent-name";
-var OPENCLAW_RELAY_RUNTIME_FILE_NAME = "openclaw-relay.json";
+var OPENCLAW_RELAY_RUNTIME_FILE_NAME2 = "openclaw-relay.json";
+var OPENCLAW_CONNECTORS_FILE_NAME2 = "openclaw-connectors.json";
 var SKILL_DIR_NAME = "clawdentity-openclaw-relay";
 var RELAY_MODULE_FILE_NAME = "relay-to-peer.mjs";
+var RELAY_RUNTIME_FILE_NAME = "clawdentity-relay.json";
+var RELAY_PEERS_FILE_NAME = "clawdentity-peers.json";
 var HOOK_MAPPING_ID = "clawdentity-send-to-peer";
 var HOOK_PATH_SEND_TO_PEER = "send-to-peer";
 var OPENCLAW_SEND_TO_PEER_HOOK_PATH = "hooks/send-to-peer";
 var DEFAULT_OPENCLAW_BASE_URL2 = "http://127.0.0.1:18789";
-var DEFAULT_RELAY_ECHO_ENABLED2 = true;
-var DEFAULT_RELAY_ECHO_CHANNEL2 = "last";
-var DEFAULT_RELAY_ECHO_MAX_LENGTH2 = 500;
-var MIN_RELAY_ECHO_MAX_LENGTH = 50;
-var MAX_RELAY_ECHO_MAX_LENGTH = 2e3;
+var DEFAULT_CONNECTOR_PORT = 19400;
+var DEFAULT_CONNECTOR_OUTBOUND_PATH3 = "/v1/outbound";
+var CONNECTOR_HOST_LOOPBACK = "127.0.0.1";
+var CONNECTOR_HOST_DOCKER = "host.docker.internal";
+var CONNECTOR_HOST_DOCKER_GATEWAY = "gateway.docker.internal";
+var CONNECTOR_HOST_LINUX_BRIDGE = "172.17.0.1";
 var INVITE_CODE_PREFIX = "clawd1_";
 var PEER_ALIAS_PATTERN = /^[a-zA-Z0-9._-]+$/;
 var FILE_MODE3 = 384;
+var OPENCLAW_HOOK_TOKEN_BYTES = 32;
+var OPENCLAW_SETUP_COMMAND_HINT = "Run: clawdentity openclaw setup <agentName> --peer-alias <alias> --peer-did <did> --peer-proxy-url <proxy-url>";
+var OPENCLAW_SETUP_RESTART_COMMAND_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} and restart OpenClaw`;
+var OPENCLAW_SETUP_WITH_BASE_URL_HINT = `${OPENCLAW_SETUP_COMMAND_HINT} --openclaw-base-url <url>`;
 var textEncoder2 = new TextEncoder();
 var textDecoder = new TextDecoder();
-function isRecord8(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null;
 }
 function createCliError5(code, message2, details) {
@@ -20994,7 +20722,7 @@ function createCliError5(code, message2, details) {
   });
 }
 function getErrorCode2(error48) {
-  if (!isRecord8(error48)) {
+  if (!isRecord7(error48)) {
     return void 0;
   }
   return typeof error48.code === "string" ? error48.code : void 0;
@@ -21064,82 +20792,13 @@ function parseHttpUrl(value, input) {
   }
   return parsedUrl.toString();
 }
-function parseOpenclawBaseUrl2(value) {
+function parseOpenclawBaseUrl(value) {
   return parseHttpUrl(value, {
     label: "OpenClaw base URL",
     code: "CLI_OPENCLAW_INVALID_OPENCLAW_BASE_URL",
     message: "OpenClaw base URL must be a valid URL"
   });
 }
-function parseBooleanValue(value, label) {
-  if (typeof value === "boolean") {
-    return value;
-  }
-  if (typeof value === "string") {
-    const normalized = value.trim().toLowerCase();
-    if (normalized === "true" || normalized === "1" || normalized === "yes" || normalized === "on") {
-      return true;
-    }
-    if (normalized === "false" || normalized === "0" || normalized === "no" || normalized === "off") {
-      return false;
-    }
-  }
-  throw createCliError5(
-    "CLI_OPENCLAW_INVALID_INPUT",
-    `${label} must be true or false`,
-    { label }
-  );
-}
-function parseRelayEchoChannel(value) {
-  return parseNonEmptyString7(value, "relay echo channel");
-}
-function parseRelayEchoMaxLength(value) {
-  const parsed = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
-  if (!Number.isInteger(parsed) || parsed < MIN_RELAY_ECHO_MAX_LENGTH || parsed > MAX_RELAY_ECHO_MAX_LENGTH) {
-    throw createCliError5(
-      "CLI_OPENCLAW_INVALID_ECHO_MAX_LENGTH",
-      `echo max length must be an integer between ${MIN_RELAY_ECHO_MAX_LENGTH} and ${MAX_RELAY_ECHO_MAX_LENGTH}`
-    );
-  }
-  return parsed;
-}
-function parseRelayEchoEnabled(value) {
-  return parseBooleanValue(value, "relay echo enabled");
-}
-function parseRelayEchoTo(value) {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (typeof value !== "string") {
-    throw createCliError5(
-      "CLI_OPENCLAW_INVALID_INPUT",
-      "relay echo target must be a string",
-      { label: "relay echo target" }
-    );
-  }
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    return void 0;
-  }
-  return trimmed;
-}
-function defaultRelayEchoConfig() {
-  return {
-    enabled: DEFAULT_RELAY_ECHO_ENABLED2,
-    channel: DEFAULT_RELAY_ECHO_CHANNEL2,
-    maxLength: DEFAULT_RELAY_ECHO_MAX_LENGTH2
-  };
-}
-function resolveSetupRelayEchoConfig(input) {
-  const current = input.existingConfig?.echo ?? defaultRelayEchoConfig();
-  const options = input.options;
-  return {
-    enabled: options.echoEnabled === void 0 ? current.enabled : parseRelayEchoEnabled(options.echoEnabled),
-    channel: options.echoChannel === void 0 ? current.channel : parseRelayEchoChannel(options.echoChannel),
-    to: options.echoTo === void 0 ? current.to : parseRelayEchoTo(options.echoTo),
-    maxLength: options.echoMaxLength === void 0 ? current.maxLength : parseRelayEchoMaxLength(options.echoMaxLength)
-  };
-}
 function parseAgentDid2(value, label) {
   const did = parseNonEmptyString7(value, label);
   try {
@@ -21158,7 +20817,7 @@ function parseAgentDid2(value, label) {
   return did;
 }
 function parseInvitePayload(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord7(value)) {
     throw createCliError5(
       "CLI_OPENCLAW_INVALID_INVITE",
       "invite payload must be an object"
@@ -21207,23 +20866,86 @@ function resolveHomeDir(homeDir) {
   }
   return homedir3();
 }
+function resolveHomePrefixedPath(input, homeDir) {
+  const trimmed = input.trim();
+  if (trimmed.startsWith("~")) {
+    return resolvePath(trimmed.replace(/^~(?=$|[\\/])/, homeDir));
+  }
+  return resolvePath(trimmed);
+}
+function readNonEmptyEnvPath(value, homeDir) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    return void 0;
+  }
+  return resolveHomePrefixedPath(value, homeDir);
+}
+function resolveOpenclawHomeDir(homeDir) {
+  const envOpenclawHome = readNonEmptyEnvPath(process.env.OPENCLAW_HOME, homeDir);
+  return envOpenclawHome ?? homeDir;
+}
+function resolveDefaultOpenclawStateDir(openclawHomeDir) {
+  const newStateDir = join6(openclawHomeDir, OPENCLAW_DIR_NAME);
+  if (existsSync(newStateDir)) {
+    return newStateDir;
+  }
+  for (const legacyDirName of LEGACY_OPENCLAW_STATE_DIR_NAMES) {
+    const legacyStateDir = join6(openclawHomeDir, legacyDirName);
+    if (existsSync(legacyStateDir)) {
+      return legacyStateDir;
+    }
+  }
+  return newStateDir;
+}
 function resolveOpenclawDir(openclawDir, homeDir) {
   if (typeof openclawDir === "string" && openclawDir.trim().length > 0) {
-    return openclawDir.trim();
+    return resolveHomePrefixedPath(openclawDir, homeDir);
   }
-  return join7(homeDir, OPENCLAW_DIR_NAME);
+  const envStateDir = readNonEmptyEnvPath(
+    process.env.OPENCLAW_STATE_DIR ?? process.env.CLAWDBOT_STATE_DIR,
+    homeDir
+  );
+  if (envStateDir !== void 0) {
+    return envStateDir;
+  }
+  const envConfigPath = readNonEmptyEnvPath(
+    process.env.OPENCLAW_CONFIG_PATH ?? process.env.CLAWDBOT_CONFIG_PATH,
+    homeDir
+  );
+  if (envConfigPath !== void 0) {
+    return dirname4(envConfigPath);
+  }
+  const openclawHomeDir = resolveOpenclawHomeDir(homeDir);
+  return resolveDefaultOpenclawStateDir(openclawHomeDir);
 }
 function resolveAgentDirectory(homeDir, agentName) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, AGENTS_DIR_NAME4, agentName);
 }
 function resolvePeersPath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, PEERS_FILE_NAME);
 }
-function resolveOpenclawConfigPath(openclawDir) {
-  return join7(openclawDir, OPENCLAW_CONFIG_FILE_NAME);
+function resolveOpenclawConfigPath(openclawDir, homeDir) {
+  const envConfigPath = readNonEmptyEnvPath(
+    process.env.OPENCLAW_CONFIG_PATH ?? process.env.CLAWDBOT_CONFIG_PATH,
+    homeDir
+  );
+  if (envConfigPath !== void 0) {
+    return envConfigPath;
+  }
+  const configCandidates = [
+    join6(openclawDir, OPENCLAW_CONFIG_FILE_NAME),
+    ...LEGACY_OPENCLAW_CONFIG_FILE_NAMES.map(
+      (fileName) => join6(openclawDir, fileName)
+    )
+  ];
+  for (const candidate of configCandidates) {
+    if (existsSync(candidate)) {
+      return candidate;
+    }
+  }
+  return configCandidates[0];
 }
 function resolveDefaultTransformSource(openclawDir) {
-  return join7(
+  return join6(
     openclawDir,
     "workspace",
     "skills",
@@ -21232,16 +20954,25 @@ function resolveDefaultTransformSource(openclawDir) {
   );
 }
 function resolveTransformTargetPath(openclawDir) {
-  return join7(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
+  return join6(openclawDir, "hooks", "transforms", RELAY_MODULE_FILE_NAME);
 }
 function resolveOpenclawAgentNamePath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_AGENT_FILE_NAME);
 }
 function resolveRelayRuntimeConfigPath(homeDir) {
-  return join7(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME);
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_RELAY_RUNTIME_FILE_NAME2);
+}
+function resolveConnectorAssignmentsPath(homeDir) {
+  return join6(homeDir, CLAWDENTITY_DIR_NAME, OPENCLAW_CONNECTORS_FILE_NAME2);
+}
+function resolveTransformRuntimePath(openclawDir) {
+  return join6(openclawDir, "hooks", "transforms", RELAY_RUNTIME_FILE_NAME);
+}
+function resolveTransformPeersPath(openclawDir) {
+  return join6(openclawDir, "hooks", "transforms", RELAY_PEERS_FILE_NAME);
 }
 async function readJsonFile(filePath) {
-  const raw = await readFile5(filePath, "utf8");
+  const raw = await readFile4(filePath, "utf8");
   try {
     return JSON.parse(raw);
   } catch {
@@ -21253,13 +20984,13 @@ async function readJsonFile(filePath) {
 async function ensureLocalAgentCredentials(homeDir, agentName) {
   const agentDir = resolveAgentDirectory(homeDir, agentName);
   const requiredFiles = [
-    join7(agentDir, SECRET_KEY_FILE_NAME2),
-    join7(agentDir, AIT_FILE_NAME3)
+    join6(agentDir, SECRET_KEY_FILE_NAME2),
+    join6(agentDir, AIT_FILE_NAME3)
   ];
   for (const filePath of requiredFiles) {
     let content;
     try {
-      content = await readFile5(filePath, "utf8");
+      content = await readFile4(filePath, "utf8");
     } catch (error48) {
       if (getErrorCode2(error48) === "ENOENT") {
         throw createCliError5(
@@ -21279,10 +21010,6 @@ async function ensureLocalAgentCredentials(homeDir, agentName) {
     }
   }
 }
-function encodeInvitePayload(payload) {
-  const encoded = encodeBase64url(textEncoder2.encode(JSON.stringify(payload)));
-  return `${INVITE_CODE_PREFIX}${encoded}`;
-}
 function decodeInvitePayload(code) {
   const rawCode = parseNonEmptyString7(code, "invite code");
   if (!rawCode.startsWith(INVITE_CODE_PREFIX)) {
@@ -21333,7 +21060,7 @@ async function loadPeersConfig(peersPath) {
     }
     throw error48;
   }
-  if (!isRecord8(parsed)) {
+  if (!isRecord7(parsed)) {
     throw createCliError5(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config root must be a JSON object",
@@ -21344,7 +21071,7 @@ async function loadPeersConfig(peersPath) {
   if (peersValue === void 0) {
     return { peers: {} };
   }
-  if (!isRecord8(peersValue)) {
+  if (!isRecord7(peersValue)) {
     throw createCliError5(
       "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
       "Peer config peers field must be an object",
@@ -21354,7 +21081,7 @@ async function loadPeersConfig(peersPath) {
   const peers = {};
   for (const [alias, value] of Object.entries(peersValue)) {
     const normalizedAlias = parsePeerAlias(alias);
-    if (!isRecord8(value)) {
+    if (!isRecord7(value)) {
       throw createCliError5(
         "CLI_OPENCLAW_INVALID_PEERS_CONFIG",
         "Peer entry must be an object",
@@ -21376,35 +21103,100 @@ async function savePeersConfig(peersPath, config2) {
   await writeSecureFile3(peersPath, `${JSON.stringify(config2, null, 2)}
 `);
 }
-function parseRelayRuntimeEchoConfig(value, relayRuntimeConfigPath) {
-  if (value === void 0) {
-    return defaultRelayEchoConfig();
-  }
-  if (!isRecord8(value)) {
+function parseConnectorBaseUrlForAssignment(value, label) {
+  return parseHttpUrl(value, {
+    label,
+    code: "CLI_OPENCLAW_INVALID_CONNECTOR_BASE_URL",
+    message: "Connector base URL must be a valid URL"
+  });
+}
+function parseConnectorAssignments(value, connectorAssignmentsPath) {
+  if (!isRecord7(value)) {
     throw createCliError5(
-      "CLI_OPENCLAW_INVALID_RELAY_RUNTIME_CONFIG",
-      "Relay runtime echo config must be an object",
-      { relayRuntimeConfigPath }
+      "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
+      "Connector assignments config must be an object",
+      { connectorAssignmentsPath }
     );
   }
-  const defaults = defaultRelayEchoConfig();
-  try {
-    return {
-      enabled: value.enabled === void 0 ? defaults.enabled : parseRelayEchoEnabled(value.enabled),
-      channel: value.channel === void 0 ? defaults.channel : parseRelayEchoChannel(value.channel),
-      to: parseRelayEchoTo(value.to),
-      maxLength: value.maxLength === void 0 ? defaults.maxLength : parseRelayEchoMaxLength(value.maxLength)
+  const agentsRaw = value.agents;
+  if (!isRecord7(agentsRaw)) {
+    return { agents: {} };
+  }
+  const agents = {};
+  for (const [agentName, entryValue] of Object.entries(agentsRaw)) {
+    if (!isRecord7(entryValue)) {
+      throw createCliError5(
+        "CLI_OPENCLAW_INVALID_CONNECTOR_ASSIGNMENTS",
+        "Connector assignment entry must be an object",
+        { connectorAssignmentsPath, agentName }
+      );
+    }
+    const connectorBaseUrl = parseConnectorBaseUrlForAssignment(
+      entryValue.connectorBaseUrl,
+      "connectorBaseUrl"
+    );
+    const updatedAt = typeof entryValue.updatedAt === "string" && entryValue.updatedAt.trim().length > 0 ? entryValue.updatedAt.trim() : nowIso();
+    agents[assertValidAgentName(agentName)] = {
+      connectorBaseUrl,
+      updatedAt
     };
+  }
+  return { agents };
+}
+async function loadConnectorAssignments(connectorAssignmentsPath) {
+  let parsed;
+  try {
+    parsed = await readJsonFile(connectorAssignmentsPath);
   } catch (error48) {
-    throw createCliError5(
-      "CLI_OPENCLAW_INVALID_RELAY_RUNTIME_CONFIG",
-      error48 instanceof Error ? error48.message : "Relay runtime echo config is invalid",
-      { relayRuntimeConfigPath }
-    );
+    if (getErrorCode2(error48) === "ENOENT") {
+      return { agents: {} };
+    }
+    throw error48;
+  }
+  return parseConnectorAssignments(parsed, connectorAssignmentsPath);
+}
+async function saveConnectorAssignments(connectorAssignmentsPath, config2) {
+  await writeSecureFile3(
+    connectorAssignmentsPath,
+    `${JSON.stringify(config2, null, 2)}
+`
+  );
+}
+function parseConnectorPortFromBaseUrl(baseUrl) {
+  const parsed = new URL(baseUrl);
+  if (parsed.port) {
+    return Number(parsed.port);
   }
+  return parsed.protocol === "https:" ? 443 : 80;
+}
+function allocateConnectorPort(assignments, agentName) {
+  const existing = assignments.agents[agentName];
+  if (existing) {
+    return parseConnectorPortFromBaseUrl(existing.connectorBaseUrl);
+  }
+  const usedPorts = /* @__PURE__ */ new Set();
+  for (const entry of Object.values(assignments.agents)) {
+    usedPorts.add(parseConnectorPortFromBaseUrl(entry.connectorBaseUrl));
+  }
+  let nextPort = DEFAULT_CONNECTOR_PORT;
+  while (usedPorts.has(nextPort)) {
+    nextPort += 1;
+  }
+  return nextPort;
+}
+function buildConnectorBaseUrl(host, port) {
+  return `http://${host}:${port}`;
+}
+function buildRelayConnectorBaseUrls(port) {
+  return [
+    buildConnectorBaseUrl(CONNECTOR_HOST_DOCKER, port),
+    buildConnectorBaseUrl(CONNECTOR_HOST_DOCKER_GATEWAY, port),
+    buildConnectorBaseUrl(CONNECTOR_HOST_LINUX_BRIDGE, port),
+    buildConnectorBaseUrl(CONNECTOR_HOST_LOOPBACK, port)
+  ];
 }
 function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
-  if (!isRecord8(value)) {
+  if (!isRecord7(value)) {
     throw createCliError5(
       "CLI_OPENCLAW_INVALID_RELAY_RUNTIME_CONFIG",
       "Relay runtime config must be an object",
@@ -21412,11 +21204,11 @@ function parseRelayRuntimeConfig(value, relayRuntimeConfigPath) {
     );
   }
   const updatedAt = typeof value.updatedAt === "string" && value.updatedAt.trim().length > 0 ? value.updatedAt.trim() : void 0;
-  const echo = parseRelayRuntimeEchoConfig(value.echo, relayRuntimeConfigPath);
+  const openclawHookToken = typeof value.openclawHookToken === "string" && value.openclawHookToken.trim().length > 0 ? value.openclawHookToken.trim() : void 0;
   return {
-    openclawBaseUrl: parseOpenclawBaseUrl2(value.openclawBaseUrl),
-    updatedAt,
-    echo
+    openclawBaseUrl: parseOpenclawBaseUrl(value.openclawBaseUrl),
+    openclawHookToken,
+    updatedAt
   };
 }
 async function loadRelayRuntimeConfig(relayRuntimeConfigPath) {
@@ -21431,11 +21223,11 @@ async function loadRelayRuntimeConfig(relayRuntimeConfigPath) {
   }
   return parseRelayRuntimeConfig(parsed, relayRuntimeConfigPath);
 }
-async function saveRelayRuntimeConfig(relayRuntimeConfigPath, openclawBaseUrl, relayEchoConfig) {
+async function saveRelayRuntimeConfig(relayRuntimeConfigPath, openclawBaseUrl, openclawHookToken) {
   const config2 = {
     openclawBaseUrl,
-    updatedAt: nowIso(),
-    echo: relayEchoConfig
+    ...openclawHookToken ? { openclawHookToken } : {},
+    updatedAt: nowIso()
   };
   await writeSecureFile3(
     relayRuntimeConfigPath,
@@ -21443,13 +21235,13 @@ async function saveRelayRuntimeConfig(relayRuntimeConfigPath, openclawBaseUrl, r
 `
   );
 }
-async function resolveOpenclawBaseUrl(input) {
+async function resolveOpenclawBaseUrl2(input) {
   if (typeof input.optionValue === "string" && input.optionValue.trim().length > 0) {
-    return parseOpenclawBaseUrl2(input.optionValue);
+    return parseOpenclawBaseUrl(input.optionValue);
   }
   const envOpenclawBaseUrl = process.env.OPENCLAW_BASE_URL;
   if (typeof envOpenclawBaseUrl === "string" && envOpenclawBaseUrl.trim().length > 0) {
-    return parseOpenclawBaseUrl2(envOpenclawBaseUrl);
+    return parseOpenclawBaseUrl(envOpenclawBaseUrl);
   }
   const existingConfig = await loadRelayRuntimeConfig(
     input.relayRuntimeConfigPath
@@ -21475,21 +21267,24 @@ function normalizeStringArrayWithValue(value, requiredValue) {
   normalized.add(requiredValue);
   return Array.from(normalized);
 }
+function generateOpenclawHookToken() {
+  return randomBytes3(OPENCLAW_HOOK_TOKEN_BYTES).toString("hex");
+}
 function upsertRelayHookMapping(mappingsValue) {
-  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord8).map((mapping) => ({ ...mapping })) : [];
+  const mappings = Array.isArray(mappingsValue) ? mappingsValue.filter(isRecord7).map((mapping) => ({ ...mapping })) : [];
   const existingIndex = mappings.findIndex((mapping) => {
     if (mapping.id === HOOK_MAPPING_ID) {
       return true;
     }
-    if (!isRecord8(mapping.match)) {
+    if (!isRecord7(mapping.match)) {
       return false;
     }
     return mapping.match.path === HOOK_PATH_SEND_TO_PEER;
   });
-  const baseMapping = existingIndex >= 0 && isRecord8(mappings[existingIndex]) ? mappings[existingIndex] : {};
-  const nextMatch = isRecord8(baseMapping.match) ? { ...baseMapping.match } : {};
+  const baseMapping = existingIndex >= 0 && isRecord7(mappings[existingIndex]) ? mappings[existingIndex] : {};
+  const nextMatch = isRecord7(baseMapping.match) ? { ...baseMapping.match } : {};
   nextMatch.path = HOOK_PATH_SEND_TO_PEER;
-  const nextTransform = isRecord8(baseMapping.transform) ? { ...baseMapping.transform } : {};
+  const nextTransform = isRecord7(baseMapping.transform) ? { ...baseMapping.transform } : {};
   nextTransform.module = RELAY_MODULE_FILE_NAME;
   const relayMapping = {
     ...baseMapping,
@@ -21506,7 +21301,7 @@ function upsertRelayHookMapping(mappingsValue) {
   mappings.push(relayMapping);
   return mappings;
 }
-async function patchOpenclawConfig(openclawConfigPath) {
+async function patchOpenclawConfig(openclawConfigPath, hookToken) {
   let config2;
   try {
     config2 = await readJsonFile(openclawConfigPath);
@@ -21520,15 +21315,19 @@ async function patchOpenclawConfig(openclawConfigPath) {
     }
     throw error48;
   }
-  if (!isRecord8(config2)) {
+  if (!isRecord7(config2)) {
     throw createCliError5(
       "CLI_OPENCLAW_INVALID_CONFIG",
       "OpenClaw config root must be an object",
       { openclawConfigPath }
     );
   }
-  const hooks = isRecord8(config2.hooks) ? { ...config2.hooks } : {};
+  const hooks = isRecord7(config2.hooks) ? { ...config2.hooks } : {};
+  const existingHookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
+  const preferredHookToken = typeof hookToken === "string" && hookToken.trim().length > 0 ? hookToken.trim() : void 0;
+  const resolvedHookToken = existingHookToken ?? preferredHookToken ?? generateOpenclawHookToken();
   hooks.enabled = true;
+  hooks.token = resolvedHookToken;
   hooks.allowRequestSessionKey = false;
   hooks.allowedSessionKeyPrefixes = normalizeStringArrayWithValue(
     hooks.allowedSessionKeyPrefixes,
@@ -21545,6 +21344,9 @@ async function patchOpenclawConfig(openclawConfigPath) {
 `,
     "utf8"
   );
+  return {
+    hookToken: resolvedHookToken
+  };
 }
 function toDoctorCheck(input) {
   return input;
@@ -21557,10 +21359,10 @@ function toDoctorResult(checks) {
   };
 }
 function isRelayHookMapping(value) {
-  if (!isRecord8(value)) {
+  if (!isRecord7(value)) {
     return false;
   }
-  if (!isRecord8(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
+  if (!isRecord7(value.match) || value.match.path !== HOOK_PATH_SEND_TO_PEER) {
     return false;
   }
   if (typeof value.id === "string" && value.id !== HOOK_MAPPING_ID) {
@@ -21569,7 +21371,7 @@ function isRelayHookMapping(value) {
   return true;
 }
 function hasRelayTransformModule(value) {
-  if (!isRecord8(value) || !isRecord8(value.transform)) {
+  if (!isRecord7(value) || !isRecord7(value.transform)) {
     return false;
   }
   return value.transform.module === RELAY_MODULE_FILE_NAME;
@@ -21580,8 +21382,8 @@ function parseDoctorPeerAlias(peerAlias) {
   }
   return parsePeerAlias(peerAlias);
 }
-function resolveHookToken(optionValue) {
-  const trimmedOption = optionValue?.trim();
+async function resolveHookToken(input) {
+  const trimmedOption = input.optionValue?.trim();
   if (trimmedOption !== void 0 && trimmedOption.length > 0) {
     return trimmedOption;
   }
@@ -21589,6 +21391,12 @@ function resolveHookToken(optionValue) {
   if (envValue !== void 0 && envValue.length > 0) {
     return envValue;
   }
+  const existingConfig = await loadRelayRuntimeConfig(
+    input.relayRuntimeConfigPath
+  );
+  if (existingConfig?.openclawHookToken) {
+    return existingConfig.openclawHookToken;
+  }
   return void 0;
 }
 function resolveProbeMessage(optionValue) {
@@ -21686,7 +21494,7 @@ async function runOpenclawDoctor(options = {}) {
   const selectedAgentPath = resolveOpenclawAgentNamePath(homeDir);
   let selectedAgentName;
   try {
-    const selectedAgentRaw = await readFile5(selectedAgentPath, "utf8");
+    const selectedAgentRaw = await readFile4(selectedAgentPath, "utf8");
     selectedAgentName = assertValidAgentName(selectedAgentRaw.trim());
     checks.push(
       toDoctorCheck({
@@ -21704,7 +21512,7 @@ async function runOpenclawDoctor(options = {}) {
         label: "Selected agent marker",
         status: "fail",
         message: missing ? `missing ${selectedAgentPath}` : "selected agent marker is invalid",
-        remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code>"
+        remediationHint: OPENCLAW_SETUP_COMMAND_HINT
       })
     );
   }
@@ -21715,7 +21523,7 @@ async function runOpenclawDoctor(options = {}) {
         label: "Local agent credentials",
         status: "fail",
         message: "cannot validate credentials without selected agent marker",
-        remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code>"
+        remediationHint: OPENCLAW_SETUP_COMMAND_HINT
       })
     );
   } else {
@@ -21757,7 +21565,7 @@ async function runOpenclawDoctor(options = {}) {
             label: "Peers map",
             status: "fail",
             message: `peer alias is missing: ${peerAlias}`,
-            remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code> --peer-alias <alias>",
+            remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
             details: { peersPath, peerAlias }
           })
         );
@@ -21779,7 +21587,7 @@ async function runOpenclawDoctor(options = {}) {
           label: "Peers map",
           status: "fail",
           message: "no peers are configured",
-          remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code>",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
           details: { peersPath }
         })
       );
@@ -21807,17 +21615,28 @@ async function runOpenclawDoctor(options = {}) {
     );
   }
   const transformTargetPath = resolveTransformTargetPath(openclawDir);
+  const relayTransformRuntimePath = resolveTransformRuntimePath(openclawDir);
+  const relayTransformPeersPath = resolveTransformPeersPath(openclawDir);
   try {
-    const transformContents = await readFile5(transformTargetPath, "utf8");
-    if (transformContents.trim().length === 0) {
+    const transformContents = await readFile4(transformTargetPath, "utf8");
+    const runtimeContents = await readFile4(relayTransformRuntimePath, "utf8");
+    const peersSnapshotContents = await readFile4(
+      relayTransformPeersPath,
+      "utf8"
+    );
+    if (transformContents.trim().length === 0 || runtimeContents.trim().length === 0 || peersSnapshotContents.trim().length === 0) {
       checks.push(
         toDoctorCheck({
           id: "state.transform",
           label: "Relay transform",
           status: "fail",
-          message: `transform file is empty: ${transformTargetPath}`,
+          message: "relay transform artifacts are missing or empty",
           remediationHint: "Run: npm install clawdentity --skill",
-          details: { transformTargetPath }
+          details: {
+            transformTargetPath,
+            relayTransformRuntimePath,
+            relayTransformPeersPath
+          }
         })
       );
     } else {
@@ -21826,8 +21645,12 @@ async function runOpenclawDoctor(options = {}) {
           id: "state.transform",
           label: "Relay transform",
           status: "pass",
-          message: "relay transform file exists",
-          details: { transformTargetPath }
+          message: "relay transform artifacts are present",
+          details: {
+            transformTargetPath,
+            relayTransformRuntimePath,
+            relayTransformPeersPath
+          }
         })
       );
     }
@@ -21837,20 +21660,26 @@ async function runOpenclawDoctor(options = {}) {
         id: "state.transform",
         label: "Relay transform",
         status: "fail",
-        message: `missing transform file: ${transformTargetPath}`,
+        message: "missing relay transform artifacts",
         remediationHint: "Run: npm install clawdentity --skill",
-        details: { transformTargetPath }
+        details: {
+          transformTargetPath,
+          relayTransformRuntimePath,
+          relayTransformPeersPath
+        }
       })
     );
   }
-  const openclawConfigPath = resolveOpenclawConfigPath(openclawDir);
+  const openclawConfigPath = resolveOpenclawConfigPath(openclawDir, homeDir);
   try {
     const openclawConfig = await readJsonFile(openclawConfigPath);
-    if (!isRecord8(openclawConfig)) {
+    if (!isRecord7(openclawConfig)) {
       throw new Error("root");
     }
-    const hooks = isRecord8(openclawConfig.hooks) ? openclawConfig.hooks : {};
-    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord8) : [];
+    const hooks = isRecord7(openclawConfig.hooks) ? openclawConfig.hooks : {};
+    const hooksEnabled = hooks.enabled === true;
+    const hookToken = typeof hooks.token === "string" && hooks.token.trim().length > 0 ? hooks.token.trim() : void 0;
+    const mappings = Array.isArray(hooks.mappings) ? hooks.mappings.filter(isRecord7) : [];
     const relayMapping = mappings.find(
       (mapping) => isRelayHookMapping(mapping)
     );
@@ -21861,7 +21690,7 @@ async function runOpenclawDoctor(options = {}) {
           label: "OpenClaw hook mapping",
           status: "fail",
           message: `missing send-to-peer mapping in ${openclawConfigPath}`,
-          remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code>",
+          remediationHint: OPENCLAW_SETUP_COMMAND_HINT,
           details: { openclawConfigPath }
         })
       );
@@ -21876,6 +21705,39 @@ async function runOpenclawDoctor(options = {}) {
         })
       );
     }
+    if (!hooksEnabled) {
+      checks.push(
+        toDoctorCheck({
+          id: "state.hookToken",
+          label: "OpenClaw hook auth",
+          status: "fail",
+          message: `hooks.enabled is not true in ${openclawConfigPath}`,
+          remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+          details: { openclawConfigPath }
+        })
+      );
+    } else if (hookToken === void 0) {
+      checks.push(
+        toDoctorCheck({
+          id: "state.hookToken",
+          label: "OpenClaw hook auth",
+          status: "fail",
+          message: `hooks.token is missing in ${openclawConfigPath}`,
+          remediationHint: OPENCLAW_SETUP_RESTART_COMMAND_HINT,
+          details: { openclawConfigPath }
+        })
+      );
+    } else {
+      checks.push(
+        toDoctorCheck({
+          id: "state.hookToken",
+          label: "OpenClaw hook auth",
+          status: "pass",
+          message: "hooks token is configured",
+          details: { openclawConfigPath }
+        })
+      );
+    }
   } catch {
     checks.push(
       toDoctorCheck({
@@ -21883,14 +21745,24 @@ async function runOpenclawDoctor(options = {}) {
         label: "OpenClaw hook mapping",
         status: "fail",
         message: `unable to read ${openclawConfigPath}`,
-        remediationHint: "Ensure ~/.openclaw/openclaw.json exists and rerun openclaw setup",
+        remediationHint: "Ensure the OpenClaw config file exists (OPENCLAW_CONFIG_PATH/CLAWDBOT_CONFIG_PATH, or state dir) and rerun openclaw setup",
+        details: { openclawConfigPath }
+      })
+    );
+    checks.push(
+      toDoctorCheck({
+        id: "state.hookToken",
+        label: "OpenClaw hook auth",
+        status: "fail",
+        message: `unable to read ${openclawConfigPath}`,
+        remediationHint: "Ensure the OpenClaw config file exists (OPENCLAW_CONFIG_PATH/CLAWDBOT_CONFIG_PATH, or state dir) and rerun openclaw setup",
         details: { openclawConfigPath }
       })
     );
   }
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath(homeDir);
   try {
-    const openclawBaseUrl = await resolveOpenclawBaseUrl({
+    const openclawBaseUrl = await resolveOpenclawBaseUrl2({
       relayRuntimeConfigPath
     });
     checks.push(
@@ -21908,7 +21780,7 @@ async function runOpenclawDoctor(options = {}) {
         label: "OpenClaw base URL",
         status: "fail",
         message: `unable to resolve OpenClaw base URL from ${relayRuntimeConfigPath}`,
-        remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code> --openclaw-base-url <url>"
+        remediationHint: OPENCLAW_SETUP_WITH_BASE_URL_HINT
       })
     );
   }
@@ -21924,7 +21796,13 @@ function parseRelayProbeFailure(input) {
   if (input.status === 404) {
     return {
       message: "OpenClaw send-to-peer hook is unavailable",
-      remediationHint: "Run: clawdentity openclaw setup <agentName> --invite-code <code>"
+      remediationHint: OPENCLAW_SETUP_COMMAND_HINT
+    };
+  }
+  if (input.status === 405) {
+    return {
+      message: "OpenClaw send-to-peer hook is not enabled for POST requests",
+      remediationHint: `${OPENCLAW_SETUP_COMMAND_HINT}, then restart OpenClaw`
     };
   }
   if (input.status === 500) {
@@ -21952,7 +21830,7 @@ async function runOpenclawRelayTest(options) {
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath(homeDir);
   let openclawBaseUrl = DEFAULT_OPENCLAW_BASE_URL2;
   try {
-    openclawBaseUrl = await resolveOpenclawBaseUrl({
+    openclawBaseUrl = await resolveOpenclawBaseUrl2({
       optionValue: options.openclawBaseUrl,
       relayRuntimeConfigPath
     });
@@ -21982,7 +21860,10 @@ async function runOpenclawRelayTest(options) {
       preflight
     };
   }
-  const hookToken = resolveHookToken(options.hookToken);
+  const hookToken = await resolveHookToken({
+    optionValue: options.hookToken,
+    relayRuntimeConfigPath
+  });
   const fetchImpl = options.fetchImpl ?? globalThis.fetch;
   if (typeof fetchImpl !== "function") {
     return {
@@ -22048,56 +21929,53 @@ async function runOpenclawRelayTest(options) {
     preflight
   };
 }
-function createOpenclawInviteCode(options) {
-  const did = parseAgentDid2(options.did, "invite did");
-  const proxyUrl = parseProxyUrl(options.proxyUrl);
-  const peerAlias = options.peerAlias === void 0 ? void 0 : parsePeerAlias(options.peerAlias);
-  const name = parseOptionalName(options.name);
-  const payload = parseInvitePayload({
-    v: 1,
-    issuedAt: nowIso(),
-    did,
-    proxyUrl,
-    alias: peerAlias,
-    name
-  });
-  const result = {
-    code: encodeInvitePayload(payload),
-    did: payload.did,
-    proxyUrl: payload.proxyUrl,
-    peerAlias: payload.alias,
-    name: payload.name
+function resolveOpenclawSetupPeerInput(options) {
+  const inviteCode = options.inviteCode?.trim();
+  const invite = inviteCode !== void 0 && inviteCode.length > 0 ? decodeInvitePayload(inviteCode) : void 0;
+  const peerAliasCandidate = options.peerAlias ?? invite?.alias;
+  const peerDidCandidate = options.peerDid ?? invite?.did;
+  const peerProxyUrlCandidate = options.peerProxyUrl ?? invite?.proxyUrl;
+  const peerNameCandidate = options.peerName ?? invite?.name;
+  const missingFields = [];
+  if (peerAliasCandidate === void 0 || peerAliasCandidate.trim().length === 0) {
+    missingFields.push("peerAlias");
+  }
+  if (peerDidCandidate === void 0 || peerDidCandidate.trim().length === 0) {
+    missingFields.push("peerDid");
+  }
+  if (peerProxyUrlCandidate === void 0 || peerProxyUrlCandidate.trim().length === 0) {
+    missingFields.push("peerProxyUrl");
+  }
+  if (missingFields.length > 0) {
+    throw createCliError5(
+      "CLI_OPENCLAW_PEER_INPUT_REQUIRED",
+      "Peer routing details are required. Provide --peer-alias, --peer-did, and --peer-proxy-url.",
+      { missingFields }
+    );
+  }
+  return {
+    peerAlias: parsePeerAlias(peerAliasCandidate),
+    peerDid: parseAgentDid2(peerDidCandidate, "peer DID"),
+    peerProxyUrl: parseProxyUrl(peerProxyUrlCandidate),
+    peerName: parseOptionalName(peerNameCandidate)
   };
-  return result;
 }
-async function setupOpenclawRelayFromInvite(agentName, options) {
+async function setupOpenclawRelay(agentName, options) {
   const normalizedAgentName = assertValidAgentName(agentName);
   const homeDir = resolveHomeDir(options.homeDir);
   const openclawDir = resolveOpenclawDir(options.openclawDir, homeDir);
-  const openclawConfigPath = resolveOpenclawConfigPath(openclawDir);
+  const openclawConfigPath = resolveOpenclawConfigPath(openclawDir, homeDir);
   const transformSource = typeof options.transformSource === "string" && options.transformSource.trim().length > 0 ? options.transformSource.trim() : resolveDefaultTransformSource(openclawDir);
   const transformTargetPath = resolveTransformTargetPath(openclawDir);
   const relayRuntimeConfigPath = resolveRelayRuntimeConfigPath(homeDir);
   const existingRelayRuntimeConfig = await loadRelayRuntimeConfig(
     relayRuntimeConfigPath
   );
-  const openclawBaseUrl = await resolveOpenclawBaseUrl({
+  const openclawBaseUrl = await resolveOpenclawBaseUrl2({
     optionValue: options.openclawBaseUrl,
     relayRuntimeConfigPath
   });
-  const relayEchoConfig = resolveSetupRelayEchoConfig({
-    existingConfig: existingRelayRuntimeConfig,
-    options
-  });
-  const invite = decodeInvitePayload(options.inviteCode);
-  const peerAliasCandidate = options.peerAlias ?? invite.alias;
-  if (!peerAliasCandidate) {
-    throw createCliError5(
-      "CLI_OPENCLAW_PEER_ALIAS_REQUIRED",
-      "Peer alias is required. Include alias in invite code or pass --peer-alias."
-    );
-  }
-  const peerAlias = parsePeerAlias(peerAliasCandidate);
+  const peerInput = resolveOpenclawSetupPeerInput(options);
   await ensureLocalAgentCredentials(homeDir, normalizedAgentName);
   await mkdir5(dirname4(transformTargetPath), { recursive: true });
   try {
@@ -22112,65 +21990,103 @@ async function setupOpenclawRelayFromInvite(agentName, options) {
     }
     throw error48;
   }
-  await patchOpenclawConfig(openclawConfigPath);
+  const patchedOpenclawConfig = await patchOpenclawConfig(
+    openclawConfigPath,
+    existingRelayRuntimeConfig?.openclawHookToken
+  );
   const peersPath = resolvePeersPath(homeDir);
   const peers = await loadPeersConfig(peersPath);
-  peers.peers[peerAlias] = invite.name === void 0 ? { did: invite.did, proxyUrl: invite.proxyUrl } : { did: invite.did, proxyUrl: invite.proxyUrl, name: invite.name };
+  peers.peers[peerInput.peerAlias] = peerInput.peerName === void 0 ? { did: peerInput.peerDid, proxyUrl: peerInput.peerProxyUrl } : {
+    did: peerInput.peerDid,
+    proxyUrl: peerInput.peerProxyUrl,
+    name: peerInput.peerName
+  };
   await savePeersConfig(peersPath, peers);
+  const relayTransformPeersPath = resolveTransformPeersPath(openclawDir);
+  await writeSecureFile3(
+    relayTransformPeersPath,
+    `${JSON.stringify(peers, null, 2)}
+`
+  );
+  const connectorAssignmentsPath = resolveConnectorAssignmentsPath(homeDir);
+  const connectorAssignments = await loadConnectorAssignments(
+    connectorAssignmentsPath
+  );
+  const connectorPort = allocateConnectorPort(
+    connectorAssignments,
+    normalizedAgentName
+  );
+  const connectorBaseUrl = buildConnectorBaseUrl(
+    CONNECTOR_HOST_LOOPBACK,
+    connectorPort
+  );
+  connectorAssignments.agents[normalizedAgentName] = {
+    connectorBaseUrl,
+    updatedAt: nowIso()
+  };
+  await saveConnectorAssignments(
+    connectorAssignmentsPath,
+    connectorAssignments
+  );
+  const relayTransformRuntimePath = resolveTransformRuntimePath(openclawDir);
+  await writeSecureFile3(
+    relayTransformRuntimePath,
+    `${JSON.stringify(
+      {
+        version: 1,
+        connectorBaseUrl: buildRelayConnectorBaseUrls(connectorPort)[0],
+        connectorBaseUrls: buildRelayConnectorBaseUrls(connectorPort),
+        connectorPath: DEFAULT_CONNECTOR_OUTBOUND_PATH3,
+        peersConfigPath: RELAY_PEERS_FILE_NAME,
+        updatedAt: nowIso()
+      },
+      null,
+      2
+    )}
+`
+  );
   const agentNamePath = resolveOpenclawAgentNamePath(homeDir);
   await writeSecureFile3(agentNamePath, `${normalizedAgentName}
 `);
   await saveRelayRuntimeConfig(
     relayRuntimeConfigPath,
     openclawBaseUrl,
-    relayEchoConfig
+    patchedOpenclawConfig.hookToken
   );
   logger8.info("cli.openclaw_setup_completed", {
     agentName: normalizedAgentName,
-    peerAlias,
-    peerDid: invite.did,
+    peerAlias: peerInput.peerAlias,
+    peerDid: peerInput.peerDid,
+    peerProxyUrl: peerInput.peerProxyUrl,
     openclawConfigPath,
     transformTargetPath,
+    relayTransformRuntimePath,
+    relayTransformPeersPath,
     openclawBaseUrl,
-    relayRuntimeConfigPath,
-    relayEchoConfig
+    connectorBaseUrl,
+    relayRuntimeConfigPath
   });
   return {
-    peerAlias,
-    peerDid: invite.did,
-    peerProxyUrl: invite.proxyUrl,
+    peerAlias: peerInput.peerAlias,
+    peerDid: peerInput.peerDid,
+    peerProxyUrl: peerInput.peerProxyUrl,
     openclawConfigPath,
     transformTargetPath,
+    relayTransformRuntimePath,
+    relayTransformPeersPath,
     openclawBaseUrl,
-    relayRuntimeConfigPath,
-    relayEcho: relayEchoConfig
+    connectorBaseUrl,
+    relayRuntimeConfigPath
   };
 }
 var createOpenclawCommand = () => {
   const openclawCommand = new Command7("openclaw").description(
-    "Manage OpenClaw invite codes and relay setup"
-  );
-  openclawCommand.command("invite").description("Create an invite code for peer relay onboarding").requiredOption("--did <did>", "Peer agent DID (did:claw:agent:...)").requiredOption(
-    "--proxy-url <url>",
-    "Public proxy URL ending in /hooks/agent"
-  ).option("--peer-alias <alias>", "Suggested peer alias for the receiver").option("--name <displayName>", "Human-friendly peer display name").action(
-    withErrorHandling(
-      "openclaw invite",
-      async (options) => {
-        const invite = createOpenclawInviteCode(options);
-        writeStdoutLine(`Invite code: ${invite.code}`);
-        writeStdoutLine(`Agent DID: ${invite.did}`);
-        writeStdoutLine(`Proxy URL: ${invite.proxyUrl}`);
-        if (invite.peerAlias) {
-          writeStdoutLine(`Suggested Alias: ${invite.peerAlias}`);
-        }
-      }
-    )
+    "Manage OpenClaw relay setup"
   );
-  openclawCommand.command("setup <agentName>").description("Apply OpenClaw relay setup using an invite code").requiredOption(
-    "--invite-code <code>",
-    "Invite code shared by peer operator"
-  ).option("--peer-alias <alias>", "Override peer alias for local routing").option(
+  openclawCommand.command("setup <agentName>").description("Apply OpenClaw relay setup using peer routing details").requiredOption("--peer-alias <alias>", "Peer alias for local routing").requiredOption("--peer-did <did>", "Peer agent DID (did:claw:agent:...)").requiredOption(
+    "--peer-proxy-url <url>",
+    "Peer proxy URL ending in /hooks/agent"
+  ).option("--peer-name <displayName>", "Human-friendly peer display name").option(
     "--openclaw-dir <path>",
     "OpenClaw state directory (default ~/.openclaw)"
   ).option(
@@ -22179,25 +22095,11 @@ var createOpenclawCommand = () => {
   ).option(
     "--openclaw-base-url <url>",
     "Base URL for local OpenClaw hook API (default http://127.0.0.1:18789)"
-  ).option(
-    "--echo-enabled <true|false>",
-    "Enable or disable relay echo to the operator chat channel (default true)",
-    parseRelayEchoEnabled
-  ).option(
-    "--echo-channel <channel>",
-    "Relay echo delivery channel (default last)"
-  ).option(
-    "--echo-to <target>",
-    "Relay echo delivery target id/recipient (optional)"
-  ).option(
-    "--echo-max-length <number>",
-    `Relay echo message truncation limit (${MIN_RELAY_ECHO_MAX_LENGTH}-${MAX_RELAY_ECHO_MAX_LENGTH}, default ${DEFAULT_RELAY_ECHO_MAX_LENGTH2})`,
-    parseRelayEchoMaxLength
   ).action(
     withErrorHandling(
       "openclaw setup",
       async (agentName, options) => {
-        const result = await setupOpenclawRelayFromInvite(agentName, options);
+        const result = await setupOpenclawRelay(agentName, options);
         writeStdoutLine(`Peer alias configured: ${result.peerAlias}`);
         writeStdoutLine(`Peer DID: ${result.peerDid}`);
         writeStdoutLine(`Peer proxy URL: ${result.peerProxyUrl}`);
@@ -22205,17 +22107,14 @@ var createOpenclawCommand = () => {
           `Updated OpenClaw config: ${result.openclawConfigPath}`
         );
         writeStdoutLine(`Installed transform: ${result.transformTargetPath}`);
-        writeStdoutLine(`OpenClaw base URL: ${result.openclawBaseUrl}`);
         writeStdoutLine(
-          `Relay echo enabled: ${result.relayEcho.enabled ? "true" : "false"}`
+          `Transform runtime config: ${result.relayTransformRuntimePath}`
         );
-        writeStdoutLine(`Relay echo channel: ${result.relayEcho.channel}`);
         writeStdoutLine(
-          `Relay echo target: ${result.relayEcho.to ?? "(last route default)"}`
-        );
-        writeStdoutLine(
-          `Relay echo max length: ${result.relayEcho.maxLength}`
+          `Transform peers snapshot: ${result.relayTransformPeersPath}`
         );
+        writeStdoutLine(`Connector base URL: ${result.connectorBaseUrl}`);
+        writeStdoutLine(`OpenClaw base URL: ${result.openclawBaseUrl}`);
         writeStdoutLine(
           `Relay runtime config: ${result.relayRuntimeConfigPath}`
         );
@@ -22286,9 +22185,9 @@ var createOpenclawCommand = () => {
 };
 
 // src/commands/pair.ts
-import { randomBytes as randomBytes3 } from "crypto";
-import { mkdir as mkdir6, readdir, readFile as readFile6, unlink as unlink2, writeFile as writeFile6 } from "fs/promises";
-import { dirname as dirname5, join as join8, resolve } from "path";
+import { randomBytes as randomBytes4 } from "crypto";
+import { mkdir as mkdir6, readdir, readFile as readFile5, unlink as unlink2, writeFile as writeFile6 } from "fs/promises";
+import { dirname as dirname5, join as join7, resolve } from "path";
 import { Command as Command8 } from "commander";
 import jsQR from "jsqr";
 import { PNG } from "pngjs";
@@ -22305,7 +22204,7 @@ var NONCE_SIZE2 = 24;
 var PAIRING_TICKET_PREFIX = "clwpair1_";
 var PAIRING_QR_MAX_AGE_SECONDS = 900;
 var PAIRING_QR_FILENAME_PATTERN = /-pair-(\d+)\.png$/;
-var isRecord9 = (value) => {
+var isRecord8 = (value) => {
   return typeof value === "object" && value !== null;
 };
 function createCliError6(code, message2) {
@@ -22372,7 +22271,7 @@ function toPathWithQuery3(url2) {
   return `${parsed.pathname}${parsed.search}`;
 }
 function extractErrorCode(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -22383,7 +22282,7 @@ function extractErrorCode(payload) {
   return code.length > 0 ? code : void 0;
 }
 function extractErrorMessage(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord8(payload)) {
     return void 0;
   }
   const envelope = payload;
@@ -22451,7 +22350,7 @@ function mapConfirmPairError(status, payload) {
   return `Pair confirm failed (${status})`;
 }
 function parsePairStartResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError6(
       "CLI_PAIR_START_INVALID_RESPONSE",
       "Pair start response is invalid"
@@ -22473,7 +22372,7 @@ function parsePairStartResponse(payload) {
   };
 }
 function parsePairConfirmResponse(payload) {
-  if (!isRecord9(payload)) {
+  if (!isRecord8(payload)) {
     throw createCliError6(
       "CLI_PAIR_CONFIRM_INVALID_RESPONSE",
       "Pair confirm response is invalid"
@@ -22495,16 +22394,16 @@ function parsePairConfirmResponse(payload) {
   };
 }
 async function readAgentProofMaterial(agentName, dependencies) {
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const readFileImpl = dependencies.readFileImpl ?? readFile5;
   const getConfigDirImpl = dependencies.getConfigDirImpl ?? getConfigDir;
   const normalizedAgentName = assertValidAgentName(agentName);
-  const agentDir = join8(
+  const agentDir = join7(
     getConfigDirImpl(),
     AGENTS_DIR_NAME5,
     normalizedAgentName
   );
-  const aitPath = join8(agentDir, AIT_FILE_NAME4);
-  const secretKeyPath = join8(agentDir, SECRET_KEY_FILE_NAME3);
+  const aitPath = join7(agentDir, AIT_FILE_NAME4);
+  const secretKeyPath = join7(agentDir, SECRET_KEY_FILE_NAME3);
   let ait;
   try {
     ait = (await readFileImpl(aitPath, "utf-8")).trim();
@@ -22618,8 +22517,8 @@ async function persistPairingQr(input) {
   const writeFileImpl = input.dependencies.writeFileImpl ?? writeFile6;
   const getConfigDirImpl = input.dependencies.getConfigDirImpl ?? getConfigDir;
   const qrEncodeImpl = input.dependencies.qrEncodeImpl ?? encodeTicketQrPng;
-  const baseDir = join8(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
-  const outputPath = parseNonEmptyString8(input.qrOutput) ? resolve(input.qrOutput ?? "") : join8(
+  const baseDir = join7(getConfigDirImpl(), PAIRING_QR_DIR_NAME);
+  const outputPath = parseNonEmptyString8(input.qrOutput) ? resolve(input.qrOutput ?? "") : join7(
     baseDir,
     `${assertValidAgentName(input.agentName)}-pair-${input.nowSeconds}.png`
   );
@@ -22645,7 +22544,7 @@ async function persistPairingQr(input) {
     if (issuedAtSeconds + PAIRING_QR_MAX_AGE_SECONDS > input.nowSeconds) {
       continue;
     }
-    const stalePath = join8(baseDir, fileName);
+    const stalePath = join7(baseDir, fileName);
     await unlinkImpl(stalePath).catch((error48) => {
       const nodeError = error48;
       if (nodeError.code === "ENOENT") {
@@ -22690,7 +22589,7 @@ async function startPairing(agentName, options, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const resolveConfigImpl = dependencies.resolveConfigImpl ?? resolveConfig;
   const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
-  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes3(NONCE_SIZE2).toString("base64url"));
+  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
   const ttlSeconds = parseTtlSeconds(options.ttlSeconds);
   const proxyUrl = resolveProxyUrl(options.proxyUrl);
   const config2 = await resolveConfigImpl();
@@ -22757,8 +22656,8 @@ async function startPairing(agentName, options, dependencies = {}) {
 async function confirmPairing(agentName, options, dependencies = {}) {
   const fetchImpl = dependencies.fetchImpl ?? fetch;
   const nowSecondsImpl = dependencies.nowSecondsImpl ?? (() => Math.floor(Date.now() / 1e3));
-  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes3(NONCE_SIZE2).toString("base64url"));
-  const readFileImpl = dependencies.readFileImpl ?? readFile6;
+  const nonceFactoryImpl = dependencies.nonceFactoryImpl ?? (() => randomBytes4(NONCE_SIZE2).toString("base64url"));
+  const readFileImpl = dependencies.readFileImpl ?? readFile5;
   const qrDecodeImpl = dependencies.qrDecodeImpl ?? decodeTicketFromPng;
   const ticketSource = resolveConfirmTicketSource(options);
   const proxyUrl = resolveProxyUrl(options.proxyUrl);
@@ -22896,7 +22795,7 @@ var createPairCommand = (dependencies = {}) => {
 };
 
 // src/commands/verify.ts
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { Command as Command9 } from "commander";
 var logger10 = createLogger({ service: "cli", module: "verify" });
 var REGISTRY_KEYS_CACHE_FILE = "registry-keys.json";
@@ -22909,7 +22808,7 @@ var VerifyCommandError = class extends Error {
     this.name = "VerifyCommandError";
   }
 };
-var isRecord10 = (value) => {
+var isRecord9 = (value) => {
   return typeof value === "object" && value !== null;
 };
 var normalizeRegistryUrl = (registryUrl) => {
@@ -22945,7 +22844,7 @@ var resolveToken = async (tokenOrFile) => {
     throw new VerifyCommandError("invalid token (value is empty)");
   }
   try {
-    const fileContents = await readFile7(input, "utf-8");
+    const fileContents = await readFile6(input, "utf-8");
     const token = fileContents.trim();
     if (token.length === 0) {
       throw new VerifyCommandError(`invalid token (${input} is empty)`);
@@ -22977,7 +22876,7 @@ var parseResponseJson = async (response) => {
   }
 };
 var parseSigningKeys = (payload) => {
-  if (!isRecord10(payload) || !Array.isArray(payload.keys)) {
+  if (!isRecord9(payload) || !Array.isArray(payload.keys)) {
     throw new VerifyCommandError(
       "verification keys unavailable (response payload is invalid)"
     );
@@ -22996,7 +22895,7 @@ var parseSigningKeys = (payload) => {
 };
 var parseRegistryKeysCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord10(parsed)) {
+  if (!isRecord9(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, keys } = parsed;
@@ -23022,7 +22921,7 @@ var parseRegistryKeysCache = (rawCache) => {
 };
 var parseCrlCache = (rawCache) => {
   const parsed = parseJson(rawCache);
-  if (!isRecord10(parsed)) {
+  if (!isRecord9(parsed)) {
     return void 0;
   }
   const { registryUrl, fetchedAtMs, claims } = parsed;
@@ -23120,7 +23019,7 @@ var fetchCrlClaims = async (input) => {
     );
   }
   const payload = await parseResponseJson(response);
-  if (!isRecord10(payload) || typeof payload.crl !== "string") {
+  if (!isRecord9(payload) || typeof payload.crl !== "string") {
     throw new VerifyCommandError(
       "revocation check unavailable (response payload is invalid)"
     );
@@ -23165,7 +23064,7 @@ var loadCrlClaims = async (input) => {
   return claims;
 };
 var toInvalidTokenReason = (error48) => {
-  if (isRecord10(error48) && typeof error48.message === "string") {
+  if (isRecord9(error48) && typeof error48.message === "string") {
     return `invalid token (${error48.message})`;
   }
   if (error48 instanceof Error && error48.message.length > 0) {