nextclaw 0.13.8 → 0.13.10

package/dist/cli/index.js

@@ -7,9 +7,9 @@ import { registerRemoteCommands } from "@nextclaw/remote";
 
 // src/cli/runtime.ts
 import {
-  loadConfig as loadConfig14,
+  loadConfig as loadConfig15,
   saveConfig as saveConfig10,
-  getConfigPath as getConfigPath7,
+  getConfigPath as getConfigPath8,
   getDataDir as getDataDir9,
   ConfigSchema as ConfigSchema2,
   getWorkspacePath as getWorkspacePath10,
@@ -32,7 +32,7 @@ import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as re
 import { join as join8, resolve as resolve12 } from "path";
 import { createInterface as createInterface3 } from "readline";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 
 // src/cli/restart-coordinator.ts
 var RestartCoordinator = class {
@@ -3001,8 +3001,75 @@ function readLoginPayload(raw) {
   }
   return { token, role };
 }
+function persistPlatformToken(params) {
+  params.nextclawProvider.apiBase = params.v1Base;
+  params.nextclawProvider.apiKey = params.token;
+  params.providers.nextclaw = params.nextclawProvider;
+  saveConfig6(params.config, params.configPath);
+}
+function parseJsonText(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function readPlatformErrorMessage(raw, fallbackStatus) {
+  const parsed = parseJsonText(raw);
+  return typeof parsed === "object" && parsed && "error" in parsed && typeof parsed.error?.message === "string" ? parsed.error.message : raw || `Request failed (${fallbackStatus})`;
+}
+function readBrowserAuthStartPayload(raw) {
+  const parsed = parseJsonText(raw);
+  const data = typeof parsed === "object" && parsed && "data" in parsed ? parsed.data : null;
+  const sessionId = typeof data?.sessionId === "string" ? data.sessionId.trim() : "";
+  const verificationUri = typeof data?.verificationUri === "string" ? data.verificationUri.trim() : "";
+  const expiresAt = typeof data?.expiresAt === "string" ? data.expiresAt.trim() : "";
+  const intervalMs = typeof data?.intervalMs === "number" && Number.isFinite(data.intervalMs) ? Math.max(1e3, Math.trunc(data.intervalMs)) : 1500;
+  if (!sessionId || !verificationUri || !expiresAt) {
+    throw new Error("Browser authorization session payload is incomplete.");
+  }
+  return {
+    sessionId,
+    verificationUri,
+    expiresAt,
+    intervalMs
+  };
+}
+function readBrowserAuthPollPayload(raw) {
+  const parsed = parseJsonText(raw);
+  const data = typeof parsed === "object" && parsed && "data" in parsed ? parsed.data : null;
+  const status = typeof data?.status === "string" ? data.status.trim() : "";
+  if (status === "pending") {
+    return {
+      status,
+      nextPollMs: typeof data?.nextPollMs === "number" && Number.isFinite(data.nextPollMs) ? Math.max(1e3, Math.trunc(data.nextPollMs)) : 1500
+    };
+  }
+  if (status === "expired") {
+    return {
+      status,
+      message: typeof data?.message === "string" && data.message.trim() ? data.message.trim() : "Authorization session expired."
+    };
+  }
+  if (status !== "authorized") {
+    throw new Error("Unexpected browser authorization status.");
+  }
+  const token = typeof data?.token === "string" ? data.token.trim() : "";
+  const user = typeof data?.user === "object" && data.user ? data.user : null;
+  const role = typeof user?.role === "string" ? user.role.trim() : "user";
+  const email = typeof user?.email === "string" ? user.email.trim() : "";
+  if (!token || !email) {
+    throw new Error("Authorized browser login payload is incomplete.");
+  }
+  return {
+    status,
+    token,
+    role,
+    email
+  };
+}
 var PlatformAuthCommands = class {
-  async login(opts = {}) {
+  async loginResult(opts = {}) {
     const { configPath, config: config2, providers, nextclawProvider, platformBase, v1Base, inputApiBase } = resolveProviderConfig(opts);
     const { email, password } = await resolveCredentials(opts);
     const endpoint = opts.register ? `${platformBase}/platform/auth/register` : `${platformBase}/platform/auth/login`;
@@ -3015,23 +3082,105 @@ var PlatformAuthCommands = class {
     });
     const raw = await response.text();
     if (!response.ok) {
-      let parsed = null;
-      try {
-        parsed = JSON.parse(raw);
-      } catch {
-        parsed = null;
-      }
-      const maybeMessage = typeof parsed === "object" && parsed && "error" in parsed && typeof parsed.error?.message === "string" ? parsed.error.message : raw || `Request failed (${response.status})`;
-      throw new Error(buildPlatformApiBaseErrorMessage(inputApiBase, maybeMessage));
+      throw new Error(buildPlatformApiBaseErrorMessage(inputApiBase, readPlatformErrorMessage(raw, response.status)));
     }
     const { token, role } = readLoginPayload(raw);
-    nextclawProvider.apiBase = v1Base;
-    nextclawProvider.apiKey = token;
+    persistPlatformToken({
+      configPath,
+      config: config2,
+      providers,
+      nextclawProvider,
+      v1Base,
+      token
+    });
+    return {
+      token,
+      role,
+      email,
+      platformBase,
+      v1Base
+    };
+  }
+  async startBrowserAuth(opts = {}) {
+    const { platformBase, v1Base, inputApiBase } = resolveProviderConfig(opts);
+    const response = await fetch(`${platformBase}/platform/auth/browser/start`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({})
+    });
+    const raw = await response.text();
+    if (!response.ok) {
+      throw new Error(buildPlatformApiBaseErrorMessage(inputApiBase, readPlatformErrorMessage(raw, response.status)));
+    }
+    const result = readBrowserAuthStartPayload(raw);
+    return {
+      ...result,
+      platformBase,
+      v1Base
+    };
+  }
+  async pollBrowserAuth(params) {
+    const { configPath, config: config2, providers, nextclawProvider, platformBase, v1Base, inputApiBase } = resolveProviderConfig({
+      apiBase: params.apiBase
+    });
+    const response = await fetch(`${platformBase}/platform/auth/browser/poll`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        sessionId: params.sessionId
+      })
+    });
+    const raw = await response.text();
+    if (!response.ok) {
+      throw new Error(buildPlatformApiBaseErrorMessage(inputApiBase, readPlatformErrorMessage(raw, response.status)));
+    }
+    const result = readBrowserAuthPollPayload(raw);
+    if (result.status === "pending") {
+      return {
+        status: "pending",
+        nextPollMs: result.nextPollMs ?? 1500
+      };
+    }
+    if (result.status === "expired") {
+      return {
+        status: "expired",
+        message: result.message ?? "Authorization session expired."
+      };
+    }
+    persistPlatformToken({
+      configPath,
+      config: config2,
+      providers,
+      nextclawProvider,
+      v1Base,
+      token: result.token ?? ""
+    });
+    return {
+      status: "authorized",
+      token: result.token ?? "",
+      role: result.role ?? "user",
+      email: result.email ?? "",
+      platformBase,
+      v1Base
+    };
+  }
+  async login(opts = {}) {
+    const result = await this.loginResult(opts);
+    console.log(`\u2713 Logged in to NextClaw platform (${result.platformBase})`);
+    console.log(`\u2713 Account: ${result.email} (${result.role})`);
+    console.log(`\u2713 Token saved into providers.nextclaw.apiKey`);
+  }
+  logout() {
+    const { configPath, config: config2, providers, nextclawProvider } = resolveProviderConfig({});
+    const cleared = Boolean(nextclawProvider.apiKey?.trim());
+    nextclawProvider.apiKey = "";
     providers.nextclaw = nextclawProvider;
     saveConfig6(config2, configPath);
-    console.log(`\u2713 Logged in to NextClaw platform (${platformBase})`);
-    console.log(`\u2713 Account: ${email} (${role})`);
-    console.log(`\u2713 Token saved into providers.nextclaw.apiKey`);
+    return { cleared };
   }
 };
 
@@ -3112,6 +3261,9 @@ function normalizeOptionalString3(value) {
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : void 0;
 }
+function isPlatformSessionToken(value) {
+  return typeof value === "string" && value.startsWith("nca.");
+}
 function resolveConfiguredLocalOrigin(config2) {
   const state = readServiceState();
   if (state && isProcessRunning(state.pid) && Number.isFinite(state.uiPort)) {
@@ -3135,15 +3287,18 @@ async function probeLocalUi(localOrigin) {
   }
 }
 var RemoteCommands = class {
-  enableConfig(opts = {}) {
+  updateConfig(params = {}) {
     const config2 = loadConfig9(getConfigPath4());
+    const nextEnabled = typeof params.enabled === "boolean" ? params.enabled : config2.remote.enabled;
+    const nextPlatformApiBase = typeof params.apiBase === "string" ? params.apiBase.trim() : config2.remote.platformApiBase;
+    const nextDeviceName = typeof params.name === "string" ? params.name.trim() : config2.remote.deviceName;
     const next = {
       ...config2,
       remote: {
         ...config2.remote,
-        enabled: true,
-        ...normalizeOptionalString3(opts.apiBase) ? { platformApiBase: normalizeOptionalString3(opts.apiBase) ?? "" } : {},
-        ...normalizeOptionalString3(opts.name) ? { deviceName: normalizeOptionalString3(opts.name) ?? "" } : {}
+        enabled: nextEnabled,
+        platformApiBase: nextPlatformApiBase,
+        deviceName: nextDeviceName
       }
     };
     saveConfig7(next);
@@ -3152,20 +3307,15 @@ var RemoteCommands = class {
       config: next
     };
   }
+  enableConfig(opts = {}) {
+    return this.updateConfig({
+      enabled: true,
+      apiBase: typeof opts.apiBase === "string" ? opts.apiBase : void 0,
+      name: typeof opts.name === "string" ? opts.name : void 0
+    });
+  }
   disableConfig() {
-    const config2 = loadConfig9(getConfigPath4());
-    const next = {
-      ...config2,
-      remote: {
-        ...config2.remote,
-        enabled: false
-      }
-    };
-    saveConfig7(next);
-    return {
-      changed: config2.remote.enabled !== next.remote.enabled,
-      config: next
-    };
+    return this.updateConfig({ enabled: false });
   }
   async connect(opts = {}) {
     const connector = createNextclawRemoteConnector();
@@ -3174,23 +3324,31 @@ var RemoteCommands = class {
       mode: "foreground"
     });
   }
-  async status(opts = {}) {
+  getStatusView() {
     const config2 = loadConfig9(getConfigPath4());
     const snapshot = resolveNextclawRemoteStatusSnapshot(config2);
+    return {
+      configuredEnabled: snapshot.configuredEnabled,
+      runtime: snapshot.runtime,
+      localOrigin: resolveConfiguredLocalOrigin(config2),
+      deviceName: snapshot.runtime?.deviceName ?? normalizeOptionalString3(config2.remote.deviceName) ?? hostname(),
+      platformBase: snapshot.runtime?.platformBase ?? normalizeOptionalString3(config2.remote.platformApiBase) ?? normalizeOptionalString3(config2.providers.nextclaw?.apiBase) ?? null
+    };
+  }
+  async status(opts = {}) {
+    const view = this.getStatusView();
     if (opts.json) {
-      console.log(JSON.stringify(snapshot, null, 2));
+      console.log(JSON.stringify(view, null, 2));
       return;
     }
-    const runtime2 = snapshot.runtime;
+    const runtime2 = view.runtime;
     console.log("NextClaw Remote Status");
-    console.log(`Enabled: ${snapshot.configuredEnabled ? "yes" : "no"}`);
+    console.log(`Enabled: ${view.configuredEnabled ? "yes" : "no"}`);
     console.log(`Mode: ${runtime2?.mode ?? "service"}`);
     console.log(`State: ${runtime2?.state ?? "disabled"}`);
-    console.log(`Device: ${runtime2?.deviceName ?? normalizeOptionalString3(config2.remote.deviceName) ?? hostname()}`);
-    console.log(
-      `Platform: ${runtime2?.platformBase ?? normalizeOptionalString3(config2.remote.platformApiBase) ?? normalizeOptionalString3(config2.providers.nextclaw?.apiBase) ?? "not set"}`
-    );
-    console.log(`Local origin: ${runtime2?.localOrigin ?? resolveConfiguredLocalOrigin(config2)}`);
+    console.log(`Device: ${view.deviceName}`);
+    console.log(`Platform: ${view.platformBase ?? "not set"}`);
+    console.log(`Local origin: ${runtime2?.localOrigin ?? view.localOrigin}`);
     if (runtime2?.deviceId) {
       console.log(`Device ID: ${runtime2.deviceId}`);
     }
@@ -3201,7 +3359,7 @@ var RemoteCommands = class {
       console.log(`Last error: ${runtime2.lastError}`);
     }
   }
-  async doctor(opts = {}) {
+  async getDoctorView() {
     const config2 = loadConfig9(getConfigPath4());
     const snapshot = resolveNextclawRemoteStatusSnapshot(config2);
     const localOrigin = resolveConfiguredLocalOrigin(config2);
@@ -3216,8 +3374,8 @@ var RemoteCommands = class {
       },
       {
         name: "platform-token",
-        ok: Boolean(token),
-        detail: token ? "token configured" : 'run "nextclaw login" first'
+        ok: isPlatformSessionToken(token),
+        detail: isPlatformSessionToken(token) ? "platform session token configured" : 'run remote browser login or "nextclaw login" first'
       },
       {
         name: "platform-api-base",
@@ -3235,12 +3393,20 @@ var RemoteCommands = class {
         detail: snapshot.runtime ? snapshot.runtime.state : "no managed remote runtime detected"
       }
     ];
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      checks,
+      snapshot
+    };
+  }
+  async doctor(opts = {}) {
+    const report = await this.getDoctorView();
     if (opts.json) {
-      console.log(JSON.stringify({ generatedAt: (/* @__PURE__ */ new Date()).toISOString(), checks, snapshot }, null, 2));
+      console.log(JSON.stringify(report, null, 2));
       return;
     }
     console.log("NextClaw Remote Doctor");
-    for (const check of checks) {
+    for (const check of report.checks) {
       console.log(`${check.ok ? "\u2713" : "\u2717"} ${check.name}: ${check.detail}`);
     }
   }
@@ -3642,7 +3808,7 @@ import {
 import { startUiServer } from "@nextclaw/server";
 import { appendFileSync, closeSync, cpSync as cpSync2, existsSync as existsSync10, mkdirSync as mkdirSync5, openSync } from "fs";
 import { dirname as dirname2, join as join6, resolve as resolve10 } from "path";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { createServer as createNetServer2 } from "net";
@@ -3658,8 +3824,8 @@ import {
   redactConfigObject
 } from "@nextclaw/core";
 var hashRaw = (raw) => createHash("sha256").update(raw).digest("hex");
-var readConfigSnapshot = (getConfigPath8) => {
-  const path2 = getConfigPath8();
+var readConfigSnapshot = (getConfigPath9) => {
+  const path2 = getConfigPath9();
   let raw = "";
   let parsed = {};
   if (existsSync7(path2)) {
@@ -6368,6 +6534,325 @@ function writeReadyManagedServiceState(params) {
   return state;
 }
 
+// src/cli/commands/remote-access-host.ts
+import { getConfigPath as getConfigPath6, loadConfig as loadConfig13 } from "@nextclaw/core";
+import { spawn as spawn2 } from "child_process";
+var FORCED_PUBLIC_UI_HOST = "0.0.0.0";
+function normalizeOptionalString5(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function decodeJwtPayload(token) {
+  const segments = token.split(".");
+  if (segments.length < 2) {
+    return null;
+  }
+  try {
+    const raw = Buffer.from(segments[1], "base64url").toString("utf-8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isPlatformSessionToken2(token) {
+  return typeof token === "string" && token.startsWith("nca.");
+}
+function toRemoteRuntimeView(runtime2) {
+  if (!runtime2) {
+    return null;
+  }
+  return {
+    enabled: runtime2.enabled,
+    mode: runtime2.mode,
+    state: runtime2.state,
+    deviceId: runtime2.deviceId,
+    deviceName: runtime2.deviceName,
+    platformBase: runtime2.platformBase,
+    localOrigin: runtime2.localOrigin,
+    lastConnectedAt: runtime2.lastConnectedAt,
+    lastError: runtime2.lastError,
+    updatedAt: runtime2.updatedAt
+  };
+}
+var RemoteAccessHost = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  getStatus() {
+    const config2 = loadConfig13(getConfigPath6());
+    const status = this.deps.remoteCommands.getStatusView();
+    const serviceState = readServiceState();
+    const serviceRunning = Boolean(serviceState && isProcessRunning(serviceState.pid));
+    const account = this.readAccountView({
+      token: normalizeOptionalString5(config2.providers.nextclaw?.apiKey),
+      apiBase: normalizeOptionalString5(config2.providers.nextclaw?.apiBase),
+      platformBase: status.platformBase
+    });
+    const service = {
+      running: serviceRunning,
+      currentProcess: Boolean(serviceRunning && serviceState?.pid === process.pid),
+      ...serviceState?.pid ? { pid: serviceState.pid } : {},
+      ...serviceState?.uiUrl ? { uiUrl: serviceState.uiUrl } : {},
+      ...typeof serviceState?.uiPort === "number" ? { uiPort: serviceState.uiPort } : {}
+    };
+    return {
+      account,
+      settings: {
+        enabled: config2.remote.enabled,
+        deviceName: config2.remote.deviceName,
+        platformApiBase: config2.remote.platformApiBase
+      },
+      service,
+      localOrigin: status.localOrigin,
+      configuredEnabled: status.configuredEnabled,
+      platformBase: status.platformBase,
+      runtime: toRemoteRuntimeView(status.runtime)
+    };
+  }
+  async login(input) {
+    await this.deps.platformAuthCommands.loginResult(input);
+    return this.getStatus();
+  }
+  async startBrowserAuth(input) {
+    const result = await this.deps.platformAuthCommands.startBrowserAuth({
+      apiBase: input.apiBase
+    });
+    return {
+      sessionId: result.sessionId,
+      verificationUri: result.verificationUri,
+      expiresAt: result.expiresAt,
+      intervalMs: result.intervalMs
+    };
+  }
+  async pollBrowserAuth(input) {
+    const config2 = loadConfig13(getConfigPath6());
+    const result = await this.deps.platformAuthCommands.pollBrowserAuth({
+      apiBase: normalizeOptionalString5(input.apiBase) ?? normalizeOptionalString5(config2.remote.platformApiBase) ?? normalizeOptionalString5(config2.providers.nextclaw?.apiBase) ?? void 0,
+      sessionId: input.sessionId
+    });
+    if (result.status !== "authorized") {
+      return result;
+    }
+    return {
+      status: "authorized",
+      email: result.email,
+      role: result.role
+    };
+  }
+  logout() {
+    this.deps.platformAuthCommands.logout();
+    return this.getStatus();
+  }
+  updateSettings(input) {
+    this.deps.remoteCommands.updateConfig({
+      enabled: input.enabled,
+      apiBase: input.platformApiBase,
+      name: input.deviceName
+    });
+    return this.getStatus();
+  }
+  async runDoctor() {
+    const report = await this.deps.remoteCommands.getDoctorView();
+    return {
+      generatedAt: report.generatedAt,
+      checks: report.checks,
+      snapshot: {
+        configuredEnabled: report.snapshot.configuredEnabled,
+        runtime: toRemoteRuntimeView(report.snapshot.runtime)
+      }
+    };
+  }
+  async controlService(action) {
+    const state = readServiceState();
+    const running = Boolean(state && isProcessRunning(state.pid));
+    const currentProcess = Boolean(running && state?.pid === process.pid);
+    const uiOverrides = this.resolveManagedUiOverrides();
+    if (action === "start") {
+      if (running) {
+        return {
+          accepted: true,
+          action,
+          message: currentProcess ? "Managed service is already running for this UI." : "Managed service is already running."
+        };
+      }
+      await this.deps.serviceCommands.startService({
+        uiOverrides,
+        open: false
+      });
+      return {
+        accepted: true,
+        action,
+        message: "Managed service started."
+      };
+    }
+    if (!running) {
+      if (action === "restart") {
+        await this.deps.serviceCommands.startService({
+          uiOverrides,
+          open: false
+        });
+        return {
+          accepted: true,
+          action,
+          message: "Managed service was not running and has been started."
+        };
+      }
+      return {
+        accepted: true,
+        action,
+        message: "No managed service is currently running."
+      };
+    }
+    if (currentProcess) {
+      if (action === "restart") {
+        await this.deps.requestManagedServiceRestart({
+          uiPort: uiOverrides.port ?? 18791
+        });
+      } else {
+        this.scheduleSelfStop();
+      }
+      return {
+        accepted: true,
+        action,
+        message: action === "restart" ? "Restart scheduled. This page may disconnect for a few seconds." : "Stop scheduled. This page will disconnect shortly."
+      };
+    }
+    if (action === "stop") {
+      await this.deps.serviceCommands.stopService();
+      return {
+        accepted: true,
+        action,
+        message: "Managed service stopped."
+      };
+    }
+    await this.deps.serviceCommands.stopService();
+    await this.deps.serviceCommands.startService({
+      uiOverrides,
+      open: false
+    });
+    return {
+      accepted: true,
+      action,
+      message: "Managed service restarted."
+    };
+  }
+  resolveManagedUiOverrides() {
+    const config2 = loadConfig13(getConfigPath6());
+    const resolved = resolveUiConfig(config2, {
+      enabled: true,
+      host: FORCED_PUBLIC_UI_HOST,
+      open: false
+    });
+    return {
+      enabled: true,
+      host: FORCED_PUBLIC_UI_HOST,
+      open: false,
+      port: resolved.port
+    };
+  }
+  readAccountView(params) {
+    if (!isPlatformSessionToken2(params.token)) {
+      return {
+        loggedIn: false,
+        apiBase: params.apiBase,
+        platformBase: params.platformBase
+      };
+    }
+    const payload = decodeJwtPayload(params.token);
+    const email = typeof payload?.email === "string" ? payload.email : void 0;
+    const role = typeof payload?.role === "string" ? payload.role : void 0;
+    return {
+      loggedIn: true,
+      email,
+      role,
+      apiBase: params.apiBase,
+      platformBase: params.platformBase
+    };
+  }
+  scheduleSelfStop() {
+    this.launchManagedSelfControl();
+  }
+  launchManagedSelfControl(params = {}) {
+    const script = [
+      'const { spawn } = require("node:child_process");',
+      'const { rmSync } = require("node:fs");',
+      `const parentPid = ${process.pid};`,
+      `const serviceStatePath = ${JSON.stringify(resolveServiceStatePath())};`,
+      `const command = ${JSON.stringify(params.command ?? null)};`,
+      `const args = ${JSON.stringify(params.args ?? [])};`,
+      `const cwd = ${JSON.stringify(process.cwd())};`,
+      "const env = process.env;",
+      "function isRunning(pid) {",
+      "  try {",
+      "    process.kill(pid, 0);",
+      "    return true;",
+      "  } catch {",
+      "    return false;",
+      "  }",
+      "}",
+      "setTimeout(() => {",
+      "  try {",
+      "    process.kill(parentPid, 'SIGTERM');",
+      "  } catch {}",
+      "}, 150);",
+      "const startedAt = Date.now();",
+      "const maxWaitMs = 30000;",
+      "const timer = setInterval(() => {",
+      "  if (isRunning(parentPid)) {",
+      "    if (Date.now() - startedAt > maxWaitMs) {",
+      "      try {",
+      "        process.kill(parentPid, 'SIGKILL');",
+      "      } catch {}",
+      "    }",
+      "    return;",
+      "  }",
+      "  clearInterval(timer);",
+      "  try {",
+      "    rmSync(serviceStatePath, { force: true });",
+      "  } catch {}",
+      "  if (command) {",
+      "    const child = spawn(command, args, { detached: true, stdio: 'ignore', cwd, env });",
+      "    child.unref();",
+      "  }",
+      "  process.exit(0);",
+      "}, 250);"
+    ].join("");
+    const helper = spawn2(process.execPath, ["-e", script], {
+      detached: true,
+      stdio: "ignore",
+      env: process.env,
+      cwd: process.cwd()
+    });
+    helper.unref();
+  }
+};
+
+// src/cli/commands/service-remote-access.ts
+function requestManagedServiceRestart(requestRestart, options = {}) {
+  const uiPort = typeof options.uiPort === "number" && Number.isFinite(options.uiPort) ? Math.floor(options.uiPort) : void 0;
+  const reason = options.reason?.trim() || "remote access service restart";
+  const manualMessage = uiPort ? `Restart the managed service to restore the UI on port ${uiPort}.` : "Restart the managed service to restore the UI.";
+  return requestRestart({
+    reason,
+    manualMessage,
+    strategy: "background-service-or-exit",
+    delayMs: 500,
+    silentOnServiceRestart: true
+  });
+}
+function createRemoteAccessHost(params) {
+  return new RemoteAccessHost({
+    serviceCommands: params.serviceCommands,
+    requestManagedServiceRestart: (options) => requestManagedServiceRestart(params.requestRestart, options),
+    remoteCommands: new RemoteCommands(),
+    platformAuthCommands: new PlatformAuthCommands()
+  });
+}
+
 // src/cli/commands/ui-chat-run-coordinator.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
@@ -6992,14 +7477,14 @@ var {
   ChannelManager: ChannelManager2,
   CronService: CronService2,
   getApiBase,
-  getConfigPath: getConfigPath6,
+  getConfigPath: getConfigPath7,
   getDataDir: getDataDir7,
   getProvider,
   getProviderName,
   getWorkspacePath: getWorkspacePath9,
   HeartbeatService,
   LiteLLMProvider,
-  loadConfig: loadConfig13,
+  loadConfig: loadConfig14,
   MessageBus,
   ProviderManager,
   resolveConfigSecrets: resolveConfigSecrets2,
@@ -7023,8 +7508,8 @@ var ServiceCommands = class {
   async startGateway(options = {}) {
     this.applyLiveConfigReload = null;
     this.liveUiNcpAgent = null;
-    const runtimeConfigPath = getConfigPath6();
-    const config2 = resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath });
+    const runtimeConfigPath = getConfigPath7();
+    const config2 = resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath });
     const workspace = getWorkspacePath9(config2.agents.defaults.workspace);
     let pluginRegistry = loadPluginRegistry(config2, workspace);
     let extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -7053,7 +7538,7 @@ var ServiceCommands = class {
       sessionManager,
       providerManager,
       makeProvider: (nextConfig) => this.makeProvider(nextConfig, { allowMissing: true }) ?? this.makeMissingProvider(nextConfig),
-      loadConfig: () => resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+      loadConfig: () => resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
       getExtensionChannels: () => extensionRegistry.channels,
       onRestartRequired: (paths) => {
         void this.deps.requestRestart({
@@ -7064,13 +7549,13 @@ var ServiceCommands = class {
       }
     });
     this.applyLiveConfigReload = async () => {
-      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }));
+      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }));
     };
     const gatewayController = new GatewayControllerImpl({
       reloader,
       cron: cron2,
       sessionManager,
-      getConfigPath: getConfigPath6,
+      getConfigPath: getConfigPath7,
       saveConfig: saveConfig9,
       requestRestart: async (options2) => {
         await this.deps.requestRestart({
@@ -7097,7 +7582,7 @@ var ServiceCommands = class {
       resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
         accountId
       })
     });
@@ -7130,12 +7615,12 @@ var ServiceCommands = class {
     });
     let pluginChannelBindings = getPluginChannelBindings3(pluginRegistry);
     setPluginRuntimeBridge({
-      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }), pluginChannelBindings),
+      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }), pluginChannelBindings),
       writeConfigFile: async (nextConfigView) => {
         if (!nextConfigView || typeof nextConfigView !== "object" || Array.isArray(nextConfigView)) {
           throw new Error("plugin runtime writeConfigFile expects an object config");
         }
-        const current = loadConfig13();
+        const current = loadConfig14();
         const next = mergePluginConfigView(current, nextConfigView, pluginChannelBindings);
         saveConfig9(next);
       },
@@ -7211,12 +7696,12 @@ var ServiceCommands = class {
       providerManager,
       bus,
       gatewayController,
-      () => resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+      () => resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
       () => extensionRegistry,
       ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
         accountId
       })
     );
@@ -7254,7 +7739,7 @@ var ServiceCommands = class {
     return trimmed || void 0;
   }
   watchConfigFile(reloader) {
-    const configPath = resolve10(getConfigPath6());
+    const configPath = resolve10(getConfigPath7());
     const watcher = chokidar.watch(configPath, {
       ignoreInitial: true,
       awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 }
@@ -7375,7 +7860,7 @@ var ServiceCommands = class {
     });
   }
   async runForeground(options) {
-    const config2 = loadConfig13();
+    const config2 = loadConfig14();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     if (options.open) {
@@ -7388,7 +7873,7 @@ var ServiceCommands = class {
     });
   }
   async startService(options) {
-    const config2 = loadConfig13();
+    const config2 = loadConfig14();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     const apiUrl = `${uiUrl}/api`;
@@ -7461,7 +7946,7 @@ var ServiceCommands = class {
     console.log(`Starting ${APP_NAME3} background service (readiness timeout ${Math.ceil(readinessTimeoutMs / 1e3)}s)...`);
     const serveArgs = buildServeArgs({ uiPort: uiConfig.port });
     this.appendStartupStage(logPath, `spawning background process: ${process.execPath} ${[...process.execArgv, ...serveArgs].join(" ")}`);
-    const child = spawn2(process.execPath, [...process.execArgv, ...serveArgs], {
+    const child = spawn3(process.execPath, [...process.execArgv, ...serveArgs], {
       env: process.env,
       stdio: ["ignore", logFd, logFd],
       detached: true
@@ -7796,7 +8281,7 @@ var ServiceCommands = class {
         return null;
       }
       console.error("Error: No API key configured.");
-      console.error(`Set one in ${getConfigPath6()} under providers section`);
+      console.error(`Set one in ${getConfigPath7()} under providers section`);
       process.exit(1);
     }
     return new LiteLLMProvider({
@@ -7909,10 +8394,7 @@ var ServiceCommands = class {
       gatewayController,
       getConfig,
       getExtensionRegistry,
-      resolveMessageToolHints: ({ channel, accountId }) => resolveMessageToolHints({
-        channel,
-        accountId
-      })
+      resolveMessageToolHints: ({ channel, accountId }) => resolveMessageToolHints({ channel, accountId })
     });
     this.liveUiNcpAgent = ncpAgent;
     const marketplaceInstaller = new ServiceMarketplaceInstaller({
@@ -7920,10 +8402,11 @@ var ServiceCommands = class {
       runCliSubcommand: (args) => this.runCliSubcommand(args),
       installBuiltinSkill: (slug, force) => this.installBuiltinMarketplaceSkill(slug, force)
     }).createInstaller();
+    const remoteAccess = createRemoteAccessHost({ serviceCommands: this, requestRestart: this.deps.requestRestart });
     const uiServer = startUiServer({
       host: uiConfig.host,
       port: uiConfig.port,
-      configPath: getConfigPath6(),
+      configPath: getConfigPath7(),
       productVersion: getPackageVersion(),
       staticDir: uiStaticDir ?? void 0,
       cronService,
@@ -7931,6 +8414,7 @@ var ServiceCommands = class {
         apiBaseUrl: process.env.NEXTCLAW_MARKETPLACE_API_BASE,
         installer: marketplaceInstaller
       },
+      remoteAccess,
       ncpAgent,
       chatRuntime: {
         listSessionTypes: async () => {
@@ -8011,7 +8495,7 @@ var ServiceCommands = class {
     }
   }
   installBuiltinMarketplaceSkill(slug, force) {
-    const workspace = getWorkspacePath9(loadConfig13().agents.defaults.workspace);
+    const workspace = getWorkspacePath9(loadConfig14().agents.defaults.workspace);
     const destination = join6(workspace, "skills", slug);
     const destinationSkillFile = join6(destination, "SKILL.md");
     if (existsSync10(destinationSkillFile) && !force) {
@@ -8052,7 +8536,7 @@ ${stderr}`.trim();
   runCommand(command, args, options = {}) {
     const timeoutMs = options.timeoutMs ?? 18e4;
     return new Promise((resolvePromise, rejectPromise) => {
-      const child = spawn2(command, args, {
+      const child = spawn3(command, args, {
         cwd: options.cwd ?? process.cwd(),
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
@@ -8270,7 +8754,7 @@ var WorkspaceManager = class {
 // src/cli/runtime.ts
 var LOGO = "\u{1F916}";
 var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "/exit", "/quit", ":q"]);
-var FORCED_PUBLIC_UI_HOST = "0.0.0.0";
+var FORCED_PUBLIC_UI_HOST2 = "0.0.0.0";
 function resolveSkillsInstallWorkdir(params) {
   if (params.explicitWorkdir) {
     return expandHome2(params.explicitWorkdir);
@@ -8350,7 +8834,7 @@ var CliRuntime = class {
       if (!state || !isProcessRunning(state.pid) || state.pid === process.pid) {
         return false;
       }
-      const uiHost = FORCED_PUBLIC_UI_HOST;
+      const uiHost = FORCED_PUBLIC_UI_HOST2;
       const uiPort = typeof state.uiPort === "number" && Number.isFinite(state.uiPort) ? state.uiPort : 18791;
       console.log(
         `Applying changes (${reason}): restarting ${APP_NAME5} background service...`
@@ -8447,7 +8931,7 @@ var CliRuntime = class {
       "}, delayMs);"
     ].join("\n");
     try {
-      const helper = spawn3(process.execPath, ["-e", helperScript], {
+      const helper = spawn4(process.execPath, ["-e", helperScript], {
         detached: true,
         stdio: "ignore",
         env: process.env
@@ -8516,14 +9000,14 @@ var CliRuntime = class {
     const source = options.source ?? "init";
     const prefix = options.auto ? "Auto init" : "Init";
     const force = Boolean(options.force);
-    const configPath = getConfigPath7();
+    const configPath = getConfigPath8();
     let createdConfig = false;
     if (!existsSync12(configPath)) {
       const config3 = ConfigSchema2.parse({});
       saveConfig10(config3);
       createdConfig = true;
     }
-    const config2 = loadConfig14();
+    const config2 = loadConfig15();
     const workspaceSetting = config2.agents.defaults.workspace;
     const workspacePath = !workspaceSetting || workspaceSetting === DEFAULT_WORKSPACE_PATH ? join8(getDataDir9(), DEFAULT_WORKSPACE_DIR) : expandHome2(workspaceSetting);
     const workspaceExisted = existsSync12(workspacePath);
@@ -8562,7 +9046,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   }
   async gateway(opts) {
     const uiOverrides = {
-      host: FORCED_PUBLIC_UI_HOST
+      host: FORCED_PUBLIC_UI_HOST2
     };
     if (opts.ui) {
       uiOverrides.enabled = true;
@@ -8578,7 +9062,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   async ui(opts) {
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: Boolean(opts.open)
     };
     if (opts.port) {
@@ -8594,7 +9078,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.init({ source: "start", auto: true });
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: false
     };
     if (opts.uiPort) {
@@ -8623,7 +9107,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   async serve(opts) {
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: false
     };
     if (opts.uiPort) {
@@ -8649,8 +9133,8 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.serviceCommands.stopService();
   }
   async agent(opts) {
-    const configPath = getConfigPath7();
-    const config2 = resolveConfigSecrets3(loadConfig14(), { configPath });
+    const configPath = getConfigPath8();
+    const config2 = resolveConfigSecrets3(loadConfig15(), { configPath });
     const workspace = getWorkspacePath10(config2.agents.defaults.workspace);
     const pluginRegistry = loadPluginRegistry(config2, workspace);
     const extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -8658,7 +9142,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     const pluginChannelBindings = getPluginChannelBindings4(pluginRegistry);
     setPluginRuntimeBridge2({
       loadConfig: () => toPluginConfigView(
-        resolveConfigSecrets3(loadConfig14(), { configPath }),
+        resolveConfigSecrets3(loadConfig15(), { configPath }),
         pluginChannelBindings
       ),
       writeConfigFile: async (nextConfigView) => {
@@ -8667,7 +9151,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
             "plugin runtime writeConfigFile expects an object config"
           );
         }
-        const current = loadConfig14();
+        const current = loadConfig15();
         const next = mergePluginConfigView(
           current,
           nextConfigView,
@@ -8699,7 +9183,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
         resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints2({
           registry: pluginRegistry,
           channel,
-          cfg: resolveConfigSecrets3(loadConfig14(), { configPath }),
+          cfg: resolveConfigSecrets3(loadConfig15(), { configPath }),
           accountId
         })
       });
@@ -8894,7 +9378,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.diagnosticsCommands.doctor(opts);
   }
   async skillsInstall(options) {
-    const config2 = loadConfig14();
+    const config2 = loadConfig15();
     const workdir = resolveSkillsInstallWorkdir({
       explicitWorkdir: options.workdir,
       configuredWorkspace: config2.agents.defaults.workspace