nervepay 1.3.5 → 1.3.7

package/bin/nervepay-cli.js

@@ -380,7 +380,7 @@ program
   .option('--code <code>', 'Pairing code from dashboard (legacy flow)')
   .option('--api-url <url>', 'NervePay API URL', DEFAULT_API_URL)
   .option('--gateway-url <url>', 'Gateway URL')
-  .option('--gateway-token <token>', 'Gateway token (only for --code flow)')
+  .option('--gateway-token <token>', 'Gateway auth token')
   .option('--name <name>', 'Gateway display name', 'OpenClaw Gateway')
   .option('--timeout <seconds>', 'Approval timeout in seconds', '300')
   .action(async (options) => {
@@ -412,13 +412,17 @@ async function deviceNodePairing(options) {
     logOk('Agent loaded');
     field('  DID', agentDid);
 
-    // Resolve gateway URL
+    // Resolve gateway URL and token
     let gatewayUrl = options.gatewayUrl;
-    if (!gatewayUrl) {
+    let gatewayToken = options.gatewayToken;
+    if (!gatewayUrl || !gatewayToken) {
       const oc = await readOpenClawConfig();
-      gatewayUrl = extractGatewayConfig(oc).url;
+      const gwConf = extractGatewayConfig(oc);
+      gatewayUrl = gatewayUrl || gwConf.url;
+      gatewayToken = gatewayToken || gwConf.token;
     }
     if (!gatewayUrl) die('No gateway URL found', 'Use: nervepay pair --gateway-url <url>');
+    if (!gatewayToken) die('No gateway token found', 'Use: nervepay pair --gateway-token <token>');
 
     const wsUrl = httpToWs(gatewayUrl);
     field('  Gateway', wsUrl);
@@ -437,7 +441,9 @@ async function deviceNodePairing(options) {
 
     // Pre-compute crypto outside WS handler to avoid async race conditions
     const pubKeyBytes = decodeBase58(publicKeyBase58);
-    const pubKeyB64 = Buffer.from(pubKeyBytes).toString('base64');
+    // OpenClaw expects base64url encoding (no padding) for public key
+    const pubKeyB64Url = Buffer.from(pubKeyBytes).toString('base64')
+      .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 
     const result = await new Promise((resolve, reject) => {
       let settled = false;
@@ -472,13 +478,36 @@ async function deviceNodePairing(options) {
           const frame = JSON.parse(data.toString());
           logDebug('<<', JSON.stringify(frame).slice(0, 300));
 
-          // Challenge → sign and connect
+          // Challenge → build auth payload, sign, and connect
           if (frame.event === 'connect.challenge') {
             const nonce = frame.payload?.nonce || '';
             logOk('Challenge received');
 
-            const nonceBytes = new TextEncoder().encode(nonce);
-            const signatureB64 = await signRawBytes(privateKey, nonceBytes);
+            const signedAtMs = Date.now();
+            const role = 'operator';
+            const scopes = ['operator.read', 'operator.write'];
+
+            // Build structured payload per OpenClaw device-auth protocol (v2)
+            // Format: v2|deviceId|clientId|clientMode|role|scopes|signedAtMs|token|nonce
+            const payload = [
+              'v2',
+              deviceId,
+              'node-host',
+              'node',
+              role,
+              scopes.join(','),
+              String(signedAtMs),
+              gatewayToken,
+              nonce,
+            ].join('|');
+
+            logDebug('Auth payload:', payload);
+
+            const payloadBytes = new TextEncoder().encode(payload);
+            const signatureB64 = await signRawBytes(privateKey, payloadBytes);
+            // Convert to base64url (no padding)
+            const signatureB64Url = signatureB64
+              .replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 
             connectId = crypto.randomUUID();
             ws.send(JSON.stringify({
@@ -486,10 +515,10 @@ async function deviceNodePairing(options) {
               id: connectId,
               method: 'connect',
               params: {
-                role: 'operator',
+                role,
                 minProtocol: 3,
                 maxProtocol: 3,
-                scopes: ['operator.read', 'operator.write'],
+                scopes,
                 client: {
                   id: 'node-host',
                   version: VERSION,
@@ -498,11 +527,14 @@ async function deviceNodePairing(options) {
                 },
                 device: {
                   id: deviceId,
-                  publicKey: pubKeyB64,
-                  signature: signatureB64,
-                  signedAt: Date.now(),
+                  publicKey: pubKeyB64Url,
+                  signature: signatureB64Url,
+                  signedAt: signedAtMs,
                   nonce,
                 },
+                auth: {
+                  token: gatewayToken,
+                },
               },
             }));
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervepay",
-  "version": "1.3.5",
+  "version": "1.3.7",
   "description": "NervePay plugin for OpenClaw - Self-sovereign identity, vault, and orchestration",
   "type": "module",
   "main": "dist/index.js",