nextclaw 0.13.8 → 0.13.9

package/dist/cli/index.js

@@ -7,9 +7,9 @@ import { registerRemoteCommands } from "@nextclaw/remote";
 
 // src/cli/runtime.ts
 import {
-  loadConfig as loadConfig14,
+  loadConfig as loadConfig15,
   saveConfig as saveConfig10,
-  getConfigPath as getConfigPath7,
+  getConfigPath as getConfigPath8,
   getDataDir as getDataDir9,
   ConfigSchema as ConfigSchema2,
   getWorkspacePath as getWorkspacePath10,
@@ -32,7 +32,7 @@ import { existsSync as existsSync12, mkdirSync as mkdirSync7, readFileSync as re
 import { join as join8, resolve as resolve12 } from "path";
 import { createInterface as createInterface3 } from "readline";
 import { fileURLToPath as fileURLToPath5 } from "url";
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 
 // src/cli/restart-coordinator.ts
 var RestartCoordinator = class {
@@ -3002,7 +3002,7 @@ function readLoginPayload(raw) {
   return { token, role };
 }
 var PlatformAuthCommands = class {
-  async login(opts = {}) {
+  async loginResult(opts = {}) {
     const { configPath, config: config2, providers, nextclawProvider, platformBase, v1Base, inputApiBase } = resolveProviderConfig(opts);
     const { email, password } = await resolveCredentials(opts);
     const endpoint = opts.register ? `${platformBase}/platform/auth/register` : `${platformBase}/platform/auth/login`;
@@ -3029,10 +3029,28 @@ var PlatformAuthCommands = class {
     nextclawProvider.apiKey = token;
     providers.nextclaw = nextclawProvider;
     saveConfig6(config2, configPath);
-    console.log(`\u2713 Logged in to NextClaw platform (${platformBase})`);
-    console.log(`\u2713 Account: ${email} (${role})`);
+    return {
+      token,
+      role,
+      email,
+      platformBase,
+      v1Base
+    };
+  }
+  async login(opts = {}) {
+    const result = await this.loginResult(opts);
+    console.log(`\u2713 Logged in to NextClaw platform (${result.platformBase})`);
+    console.log(`\u2713 Account: ${result.email} (${result.role})`);
     console.log(`\u2713 Token saved into providers.nextclaw.apiKey`);
   }
+  logout() {
+    const { configPath, config: config2, providers, nextclawProvider } = resolveProviderConfig({});
+    const cleared = Boolean(nextclawProvider.apiKey?.trim());
+    nextclawProvider.apiKey = "";
+    providers.nextclaw = nextclawProvider;
+    saveConfig6(config2, configPath);
+    return { cleared };
+  }
 };
 
 // src/cli/commands/remote.ts
@@ -3135,15 +3153,18 @@ async function probeLocalUi(localOrigin) {
   }
 }
 var RemoteCommands = class {
-  enableConfig(opts = {}) {
+  updateConfig(params = {}) {
     const config2 = loadConfig9(getConfigPath4());
+    const nextEnabled = typeof params.enabled === "boolean" ? params.enabled : config2.remote.enabled;
+    const nextPlatformApiBase = typeof params.apiBase === "string" ? params.apiBase.trim() : config2.remote.platformApiBase;
+    const nextDeviceName = typeof params.name === "string" ? params.name.trim() : config2.remote.deviceName;
     const next = {
       ...config2,
       remote: {
         ...config2.remote,
-        enabled: true,
-        ...normalizeOptionalString3(opts.apiBase) ? { platformApiBase: normalizeOptionalString3(opts.apiBase) ?? "" } : {},
-        ...normalizeOptionalString3(opts.name) ? { deviceName: normalizeOptionalString3(opts.name) ?? "" } : {}
+        enabled: nextEnabled,
+        platformApiBase: nextPlatformApiBase,
+        deviceName: nextDeviceName
       }
     };
     saveConfig7(next);
@@ -3152,20 +3173,15 @@ var RemoteCommands = class {
       config: next
     };
   }
+  enableConfig(opts = {}) {
+    return this.updateConfig({
+      enabled: true,
+      apiBase: typeof opts.apiBase === "string" ? opts.apiBase : void 0,
+      name: typeof opts.name === "string" ? opts.name : void 0
+    });
+  }
   disableConfig() {
-    const config2 = loadConfig9(getConfigPath4());
-    const next = {
-      ...config2,
-      remote: {
-        ...config2.remote,
-        enabled: false
-      }
-    };
-    saveConfig7(next);
-    return {
-      changed: config2.remote.enabled !== next.remote.enabled,
-      config: next
-    };
+    return this.updateConfig({ enabled: false });
   }
   async connect(opts = {}) {
     const connector = createNextclawRemoteConnector();
@@ -3174,23 +3190,31 @@ var RemoteCommands = class {
       mode: "foreground"
     });
   }
-  async status(opts = {}) {
+  getStatusView() {
     const config2 = loadConfig9(getConfigPath4());
     const snapshot = resolveNextclawRemoteStatusSnapshot(config2);
+    return {
+      configuredEnabled: snapshot.configuredEnabled,
+      runtime: snapshot.runtime,
+      localOrigin: resolveConfiguredLocalOrigin(config2),
+      deviceName: snapshot.runtime?.deviceName ?? normalizeOptionalString3(config2.remote.deviceName) ?? hostname(),
+      platformBase: snapshot.runtime?.platformBase ?? normalizeOptionalString3(config2.remote.platformApiBase) ?? normalizeOptionalString3(config2.providers.nextclaw?.apiBase) ?? null
+    };
+  }
+  async status(opts = {}) {
+    const view = this.getStatusView();
     if (opts.json) {
-      console.log(JSON.stringify(snapshot, null, 2));
+      console.log(JSON.stringify(view, null, 2));
       return;
     }
-    const runtime2 = snapshot.runtime;
+    const runtime2 = view.runtime;
     console.log("NextClaw Remote Status");
-    console.log(`Enabled: ${snapshot.configuredEnabled ? "yes" : "no"}`);
+    console.log(`Enabled: ${view.configuredEnabled ? "yes" : "no"}`);
     console.log(`Mode: ${runtime2?.mode ?? "service"}`);
     console.log(`State: ${runtime2?.state ?? "disabled"}`);
-    console.log(`Device: ${runtime2?.deviceName ?? normalizeOptionalString3(config2.remote.deviceName) ?? hostname()}`);
-    console.log(
-      `Platform: ${runtime2?.platformBase ?? normalizeOptionalString3(config2.remote.platformApiBase) ?? normalizeOptionalString3(config2.providers.nextclaw?.apiBase) ?? "not set"}`
-    );
-    console.log(`Local origin: ${runtime2?.localOrigin ?? resolveConfiguredLocalOrigin(config2)}`);
+    console.log(`Device: ${view.deviceName}`);
+    console.log(`Platform: ${view.platformBase ?? "not set"}`);
+    console.log(`Local origin: ${runtime2?.localOrigin ?? view.localOrigin}`);
     if (runtime2?.deviceId) {
       console.log(`Device ID: ${runtime2.deviceId}`);
     }
@@ -3201,7 +3225,7 @@ var RemoteCommands = class {
       console.log(`Last error: ${runtime2.lastError}`);
     }
   }
-  async doctor(opts = {}) {
+  async getDoctorView() {
     const config2 = loadConfig9(getConfigPath4());
     const snapshot = resolveNextclawRemoteStatusSnapshot(config2);
     const localOrigin = resolveConfiguredLocalOrigin(config2);
@@ -3235,12 +3259,20 @@ var RemoteCommands = class {
         detail: snapshot.runtime ? snapshot.runtime.state : "no managed remote runtime detected"
       }
     ];
+    return {
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      checks,
+      snapshot
+    };
+  }
+  async doctor(opts = {}) {
+    const report = await this.getDoctorView();
     if (opts.json) {
-      console.log(JSON.stringify({ generatedAt: (/* @__PURE__ */ new Date()).toISOString(), checks, snapshot }, null, 2));
+      console.log(JSON.stringify(report, null, 2));
       return;
     }
     console.log("NextClaw Remote Doctor");
-    for (const check of checks) {
+    for (const check of report.checks) {
       console.log(`${check.ok ? "\u2713" : "\u2717"} ${check.name}: ${check.detail}`);
     }
   }
@@ -3642,7 +3674,7 @@ import {
 import { startUiServer } from "@nextclaw/server";
 import { appendFileSync, closeSync, cpSync as cpSync2, existsSync as existsSync10, mkdirSync as mkdirSync5, openSync } from "fs";
 import { dirname as dirname2, join as join6, resolve as resolve10 } from "path";
-import { spawn as spawn2 } from "child_process";
+import { spawn as spawn3 } from "child_process";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { createServer as createNetServer2 } from "net";
@@ -3658,8 +3690,8 @@ import {
   redactConfigObject
 } from "@nextclaw/core";
 var hashRaw = (raw) => createHash("sha256").update(raw).digest("hex");
-var readConfigSnapshot = (getConfigPath8) => {
-  const path2 = getConfigPath8();
+var readConfigSnapshot = (getConfigPath9) => {
+  const path2 = getConfigPath9();
   let raw = "";
   let parsed = {};
   if (existsSync7(path2)) {
@@ -6368,6 +6400,296 @@ function writeReadyManagedServiceState(params) {
   return state;
 }
 
+// src/cli/commands/remote-access-host.ts
+import { getConfigPath as getConfigPath6, loadConfig as loadConfig13 } from "@nextclaw/core";
+import { spawn as spawn2 } from "child_process";
+var FORCED_PUBLIC_UI_HOST = "0.0.0.0";
+function normalizeOptionalString5(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function decodeJwtPayload(token) {
+  const segments = token.split(".");
+  if (segments.length < 2) {
+    return null;
+  }
+  try {
+    const raw = Buffer.from(segments[1], "base64url").toString("utf-8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function toRemoteRuntimeView(runtime2) {
+  if (!runtime2) {
+    return null;
+  }
+  return {
+    enabled: runtime2.enabled,
+    mode: runtime2.mode,
+    state: runtime2.state,
+    deviceId: runtime2.deviceId,
+    deviceName: runtime2.deviceName,
+    platformBase: runtime2.platformBase,
+    localOrigin: runtime2.localOrigin,
+    lastConnectedAt: runtime2.lastConnectedAt,
+    lastError: runtime2.lastError,
+    updatedAt: runtime2.updatedAt
+  };
+}
+var RemoteAccessHost = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  getStatus() {
+    const config2 = loadConfig13(getConfigPath6());
+    const status = this.deps.remoteCommands.getStatusView();
+    const serviceState = readServiceState();
+    const serviceRunning = Boolean(serviceState && isProcessRunning(serviceState.pid));
+    const account = this.readAccountView({
+      token: normalizeOptionalString5(config2.providers.nextclaw?.apiKey),
+      apiBase: normalizeOptionalString5(config2.providers.nextclaw?.apiBase),
+      platformBase: status.platformBase
+    });
+    const service = {
+      running: serviceRunning,
+      currentProcess: Boolean(serviceRunning && serviceState?.pid === process.pid),
+      ...serviceState?.pid ? { pid: serviceState.pid } : {},
+      ...serviceState?.uiUrl ? { uiUrl: serviceState.uiUrl } : {},
+      ...typeof serviceState?.uiPort === "number" ? { uiPort: serviceState.uiPort } : {}
+    };
+    return {
+      account,
+      settings: {
+        enabled: config2.remote.enabled,
+        deviceName: config2.remote.deviceName,
+        platformApiBase: config2.remote.platformApiBase
+      },
+      service,
+      localOrigin: status.localOrigin,
+      configuredEnabled: status.configuredEnabled,
+      platformBase: status.platformBase,
+      runtime: toRemoteRuntimeView(status.runtime)
+    };
+  }
+  async login(input) {
+    await this.deps.platformAuthCommands.loginResult(input);
+    return this.getStatus();
+  }
+  logout() {
+    this.deps.platformAuthCommands.logout();
+    return this.getStatus();
+  }
+  updateSettings(input) {
+    this.deps.remoteCommands.updateConfig({
+      enabled: input.enabled,
+      apiBase: input.platformApiBase,
+      name: input.deviceName
+    });
+    return this.getStatus();
+  }
+  async runDoctor() {
+    const report = await this.deps.remoteCommands.getDoctorView();
+    return {
+      generatedAt: report.generatedAt,
+      checks: report.checks,
+      snapshot: {
+        configuredEnabled: report.snapshot.configuredEnabled,
+        runtime: toRemoteRuntimeView(report.snapshot.runtime)
+      }
+    };
+  }
+  async controlService(action) {
+    const state = readServiceState();
+    const running = Boolean(state && isProcessRunning(state.pid));
+    const currentProcess = Boolean(running && state?.pid === process.pid);
+    const uiOverrides = this.resolveManagedUiOverrides();
+    if (action === "start") {
+      if (running) {
+        return {
+          accepted: true,
+          action,
+          message: currentProcess ? "Managed service is already running for this UI." : "Managed service is already running."
+        };
+      }
+      await this.deps.serviceCommands.startService({
+        uiOverrides,
+        open: false
+      });
+      return {
+        accepted: true,
+        action,
+        message: "Managed service started."
+      };
+    }
+    if (!running) {
+      if (action === "restart") {
+        await this.deps.serviceCommands.startService({
+          uiOverrides,
+          open: false
+        });
+        return {
+          accepted: true,
+          action,
+          message: "Managed service was not running and has been started."
+        };
+      }
+      return {
+        accepted: true,
+        action,
+        message: "No managed service is currently running."
+      };
+    }
+    if (currentProcess) {
+      if (action === "restart") {
+        await this.deps.requestManagedServiceRestart({
+          uiPort: uiOverrides.port ?? 18791
+        });
+      } else {
+        this.scheduleSelfStop();
+      }
+      return {
+        accepted: true,
+        action,
+        message: action === "restart" ? "Restart scheduled. This page may disconnect for a few seconds." : "Stop scheduled. This page will disconnect shortly."
+      };
+    }
+    if (action === "stop") {
+      await this.deps.serviceCommands.stopService();
+      return {
+        accepted: true,
+        action,
+        message: "Managed service stopped."
+      };
+    }
+    await this.deps.serviceCommands.stopService();
+    await this.deps.serviceCommands.startService({
+      uiOverrides,
+      open: false
+    });
+    return {
+      accepted: true,
+      action,
+      message: "Managed service restarted."
+    };
+  }
+  resolveManagedUiOverrides() {
+    const config2 = loadConfig13(getConfigPath6());
+    const resolved = resolveUiConfig(config2, {
+      enabled: true,
+      host: FORCED_PUBLIC_UI_HOST,
+      open: false
+    });
+    return {
+      enabled: true,
+      host: FORCED_PUBLIC_UI_HOST,
+      open: false,
+      port: resolved.port
+    };
+  }
+  readAccountView(params) {
+    if (!params.token) {
+      return {
+        loggedIn: false,
+        apiBase: params.apiBase,
+        platformBase: params.platformBase
+      };
+    }
+    const payload = decodeJwtPayload(params.token);
+    const email = typeof payload?.email === "string" ? payload.email : void 0;
+    const role = typeof payload?.role === "string" ? payload.role : void 0;
+    return {
+      loggedIn: true,
+      email,
+      role,
+      apiBase: params.apiBase,
+      platformBase: params.platformBase
+    };
+  }
+  scheduleSelfStop() {
+    this.launchManagedSelfControl();
+  }
+  launchManagedSelfControl(params = {}) {
+    const script = [
+      'const { spawn } = require("node:child_process");',
+      'const { rmSync } = require("node:fs");',
+      `const parentPid = ${process.pid};`,
+      `const serviceStatePath = ${JSON.stringify(resolveServiceStatePath())};`,
+      `const command = ${JSON.stringify(params.command ?? null)};`,
+      `const args = ${JSON.stringify(params.args ?? [])};`,
+      `const cwd = ${JSON.stringify(process.cwd())};`,
+      "const env = process.env;",
+      "function isRunning(pid) {",
+      "  try {",
+      "    process.kill(pid, 0);",
+      "    return true;",
+      "  } catch {",
+      "    return false;",
+      "  }",
+      "}",
+      "setTimeout(() => {",
+      "  try {",
+      "    process.kill(parentPid, 'SIGTERM');",
+      "  } catch {}",
+      "}, 150);",
+      "const startedAt = Date.now();",
+      "const maxWaitMs = 30000;",
+      "const timer = setInterval(() => {",
+      "  if (isRunning(parentPid)) {",
+      "    if (Date.now() - startedAt > maxWaitMs) {",
+      "      try {",
+      "        process.kill(parentPid, 'SIGKILL');",
+      "      } catch {}",
+      "    }",
+      "    return;",
+      "  }",
+      "  clearInterval(timer);",
+      "  try {",
+      "    rmSync(serviceStatePath, { force: true });",
+      "  } catch {}",
+      "  if (command) {",
+      "    const child = spawn(command, args, { detached: true, stdio: 'ignore', cwd, env });",
+      "    child.unref();",
+      "  }",
+      "  process.exit(0);",
+      "}, 250);"
+    ].join("");
+    const helper = spawn2(process.execPath, ["-e", script], {
+      detached: true,
+      stdio: "ignore",
+      env: process.env,
+      cwd: process.cwd()
+    });
+    helper.unref();
+  }
+};
+
+// src/cli/commands/service-remote-access.ts
+function requestManagedServiceRestart(requestRestart, options = {}) {
+  const uiPort = typeof options.uiPort === "number" && Number.isFinite(options.uiPort) ? Math.floor(options.uiPort) : void 0;
+  const reason = options.reason?.trim() || "remote access service restart";
+  const manualMessage = uiPort ? `Restart the managed service to restore the UI on port ${uiPort}.` : "Restart the managed service to restore the UI.";
+  return requestRestart({
+    reason,
+    manualMessage,
+    strategy: "background-service-or-exit",
+    delayMs: 500,
+    silentOnServiceRestart: true
+  });
+}
+function createRemoteAccessHost(params) {
+  return new RemoteAccessHost({
+    serviceCommands: params.serviceCommands,
+    requestManagedServiceRestart: (options) => requestManagedServiceRestart(params.requestRestart, options),
+    remoteCommands: new RemoteCommands(),
+    platformAuthCommands: new PlatformAuthCommands()
+  });
+}
+
 // src/cli/commands/ui-chat-run-coordinator.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync4, readdirSync as readdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
@@ -6992,14 +7314,14 @@ var {
   ChannelManager: ChannelManager2,
   CronService: CronService2,
   getApiBase,
-  getConfigPath: getConfigPath6,
+  getConfigPath: getConfigPath7,
   getDataDir: getDataDir7,
   getProvider,
   getProviderName,
   getWorkspacePath: getWorkspacePath9,
   HeartbeatService,
   LiteLLMProvider,
-  loadConfig: loadConfig13,
+  loadConfig: loadConfig14,
   MessageBus,
   ProviderManager,
   resolveConfigSecrets: resolveConfigSecrets2,
@@ -7023,8 +7345,8 @@ var ServiceCommands = class {
   async startGateway(options = {}) {
     this.applyLiveConfigReload = null;
     this.liveUiNcpAgent = null;
-    const runtimeConfigPath = getConfigPath6();
-    const config2 = resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath });
+    const runtimeConfigPath = getConfigPath7();
+    const config2 = resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath });
     const workspace = getWorkspacePath9(config2.agents.defaults.workspace);
     let pluginRegistry = loadPluginRegistry(config2, workspace);
     let extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -7053,7 +7375,7 @@ var ServiceCommands = class {
       sessionManager,
       providerManager,
       makeProvider: (nextConfig) => this.makeProvider(nextConfig, { allowMissing: true }) ?? this.makeMissingProvider(nextConfig),
-      loadConfig: () => resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+      loadConfig: () => resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
       getExtensionChannels: () => extensionRegistry.channels,
       onRestartRequired: (paths) => {
         void this.deps.requestRestart({
@@ -7064,13 +7386,13 @@ var ServiceCommands = class {
       }
     });
     this.applyLiveConfigReload = async () => {
-      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }));
+      await reloader.applyReloadPlan(resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }));
     };
     const gatewayController = new GatewayControllerImpl({
       reloader,
       cron: cron2,
       sessionManager,
-      getConfigPath: getConfigPath6,
+      getConfigPath: getConfigPath7,
       saveConfig: saveConfig9,
       requestRestart: async (options2) => {
         await this.deps.requestRestart({
@@ -7097,7 +7419,7 @@ var ServiceCommands = class {
       resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
         accountId
       })
     });
@@ -7130,12 +7452,12 @@ var ServiceCommands = class {
     });
     let pluginChannelBindings = getPluginChannelBindings3(pluginRegistry);
     setPluginRuntimeBridge({
-      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }), pluginChannelBindings),
+      loadConfig: () => toPluginConfigView(resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }), pluginChannelBindings),
       writeConfigFile: async (nextConfigView) => {
         if (!nextConfigView || typeof nextConfigView !== "object" || Array.isArray(nextConfigView)) {
           throw new Error("plugin runtime writeConfigFile expects an object config");
         }
-        const current = loadConfig13();
+        const current = loadConfig14();
         const next = mergePluginConfigView(current, nextConfigView, pluginChannelBindings);
         saveConfig9(next);
       },
@@ -7211,12 +7533,12 @@ var ServiceCommands = class {
       providerManager,
       bus,
       gatewayController,
-      () => resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+      () => resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
       () => extensionRegistry,
       ({ channel, accountId }) => resolvePluginChannelMessageToolHints({
         registry: pluginRegistry,
         channel,
-        cfg: resolveConfigSecrets2(loadConfig13(), { configPath: runtimeConfigPath }),
+        cfg: resolveConfigSecrets2(loadConfig14(), { configPath: runtimeConfigPath }),
         accountId
       })
     );
@@ -7254,7 +7576,7 @@ var ServiceCommands = class {
     return trimmed || void 0;
   }
   watchConfigFile(reloader) {
-    const configPath = resolve10(getConfigPath6());
+    const configPath = resolve10(getConfigPath7());
     const watcher = chokidar.watch(configPath, {
       ignoreInitial: true,
       awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 }
@@ -7375,7 +7697,7 @@ var ServiceCommands = class {
     });
   }
   async runForeground(options) {
-    const config2 = loadConfig13();
+    const config2 = loadConfig14();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     if (options.open) {
@@ -7388,7 +7710,7 @@ var ServiceCommands = class {
     });
   }
   async startService(options) {
-    const config2 = loadConfig13();
+    const config2 = loadConfig14();
     const uiConfig = resolveUiConfig(config2, options.uiOverrides);
     const uiUrl = resolveUiApiBase(uiConfig.host, uiConfig.port);
     const apiUrl = `${uiUrl}/api`;
@@ -7461,7 +7783,7 @@ var ServiceCommands = class {
     console.log(`Starting ${APP_NAME3} background service (readiness timeout ${Math.ceil(readinessTimeoutMs / 1e3)}s)...`);
     const serveArgs = buildServeArgs({ uiPort: uiConfig.port });
     this.appendStartupStage(logPath, `spawning background process: ${process.execPath} ${[...process.execArgv, ...serveArgs].join(" ")}`);
-    const child = spawn2(process.execPath, [...process.execArgv, ...serveArgs], {
+    const child = spawn3(process.execPath, [...process.execArgv, ...serveArgs], {
       env: process.env,
       stdio: ["ignore", logFd, logFd],
       detached: true
@@ -7796,7 +8118,7 @@ var ServiceCommands = class {
         return null;
       }
       console.error("Error: No API key configured.");
-      console.error(`Set one in ${getConfigPath6()} under providers section`);
+      console.error(`Set one in ${getConfigPath7()} under providers section`);
       process.exit(1);
     }
     return new LiteLLMProvider({
@@ -7909,10 +8231,7 @@ var ServiceCommands = class {
       gatewayController,
       getConfig,
       getExtensionRegistry,
-      resolveMessageToolHints: ({ channel, accountId }) => resolveMessageToolHints({
-        channel,
-        accountId
-      })
+      resolveMessageToolHints: ({ channel, accountId }) => resolveMessageToolHints({ channel, accountId })
     });
     this.liveUiNcpAgent = ncpAgent;
     const marketplaceInstaller = new ServiceMarketplaceInstaller({
@@ -7920,10 +8239,11 @@ var ServiceCommands = class {
       runCliSubcommand: (args) => this.runCliSubcommand(args),
       installBuiltinSkill: (slug, force) => this.installBuiltinMarketplaceSkill(slug, force)
     }).createInstaller();
+    const remoteAccess = createRemoteAccessHost({ serviceCommands: this, requestRestart: this.deps.requestRestart });
     const uiServer = startUiServer({
       host: uiConfig.host,
       port: uiConfig.port,
-      configPath: getConfigPath6(),
+      configPath: getConfigPath7(),
       productVersion: getPackageVersion(),
       staticDir: uiStaticDir ?? void 0,
       cronService,
@@ -7931,6 +8251,7 @@ var ServiceCommands = class {
         apiBaseUrl: process.env.NEXTCLAW_MARKETPLACE_API_BASE,
         installer: marketplaceInstaller
       },
+      remoteAccess,
       ncpAgent,
       chatRuntime: {
         listSessionTypes: async () => {
@@ -8011,7 +8332,7 @@ var ServiceCommands = class {
     }
   }
   installBuiltinMarketplaceSkill(slug, force) {
-    const workspace = getWorkspacePath9(loadConfig13().agents.defaults.workspace);
+    const workspace = getWorkspacePath9(loadConfig14().agents.defaults.workspace);
     const destination = join6(workspace, "skills", slug);
     const destinationSkillFile = join6(destination, "SKILL.md");
     if (existsSync10(destinationSkillFile) && !force) {
@@ -8052,7 +8373,7 @@ ${stderr}`.trim();
   runCommand(command, args, options = {}) {
     const timeoutMs = options.timeoutMs ?? 18e4;
     return new Promise((resolvePromise, rejectPromise) => {
-      const child = spawn2(command, args, {
+      const child = spawn3(command, args, {
         cwd: options.cwd ?? process.cwd(),
         env: process.env,
         stdio: ["ignore", "pipe", "pipe"]
@@ -8270,7 +8591,7 @@ var WorkspaceManager = class {
 // src/cli/runtime.ts
 var LOGO = "\u{1F916}";
 var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "/exit", "/quit", ":q"]);
-var FORCED_PUBLIC_UI_HOST = "0.0.0.0";
+var FORCED_PUBLIC_UI_HOST2 = "0.0.0.0";
 function resolveSkillsInstallWorkdir(params) {
   if (params.explicitWorkdir) {
     return expandHome2(params.explicitWorkdir);
@@ -8350,7 +8671,7 @@ var CliRuntime = class {
       if (!state || !isProcessRunning(state.pid) || state.pid === process.pid) {
         return false;
       }
-      const uiHost = FORCED_PUBLIC_UI_HOST;
+      const uiHost = FORCED_PUBLIC_UI_HOST2;
       const uiPort = typeof state.uiPort === "number" && Number.isFinite(state.uiPort) ? state.uiPort : 18791;
       console.log(
         `Applying changes (${reason}): restarting ${APP_NAME5} background service...`
@@ -8447,7 +8768,7 @@ var CliRuntime = class {
       "}, delayMs);"
     ].join("\n");
     try {
-      const helper = spawn3(process.execPath, ["-e", helperScript], {
+      const helper = spawn4(process.execPath, ["-e", helperScript], {
         detached: true,
         stdio: "ignore",
         env: process.env
@@ -8516,14 +8837,14 @@ var CliRuntime = class {
     const source = options.source ?? "init";
     const prefix = options.auto ? "Auto init" : "Init";
     const force = Boolean(options.force);
-    const configPath = getConfigPath7();
+    const configPath = getConfigPath8();
     let createdConfig = false;
     if (!existsSync12(configPath)) {
       const config3 = ConfigSchema2.parse({});
       saveConfig10(config3);
       createdConfig = true;
     }
-    const config2 = loadConfig14();
+    const config2 = loadConfig15();
     const workspaceSetting = config2.agents.defaults.workspace;
     const workspacePath = !workspaceSetting || workspaceSetting === DEFAULT_WORKSPACE_PATH ? join8(getDataDir9(), DEFAULT_WORKSPACE_DIR) : expandHome2(workspaceSetting);
     const workspaceExisted = existsSync12(workspacePath);
@@ -8562,7 +8883,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   }
   async gateway(opts) {
     const uiOverrides = {
-      host: FORCED_PUBLIC_UI_HOST
+      host: FORCED_PUBLIC_UI_HOST2
     };
     if (opts.ui) {
       uiOverrides.enabled = true;
@@ -8578,7 +8899,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   async ui(opts) {
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: Boolean(opts.open)
     };
     if (opts.port) {
@@ -8594,7 +8915,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.init({ source: "start", auto: true });
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: false
     };
     if (opts.uiPort) {
@@ -8623,7 +8944,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
   async serve(opts) {
     const uiOverrides = {
       enabled: true,
-      host: FORCED_PUBLIC_UI_HOST,
+      host: FORCED_PUBLIC_UI_HOST2,
       open: false
     };
     if (opts.uiPort) {
@@ -8649,8 +8970,8 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.serviceCommands.stopService();
   }
   async agent(opts) {
-    const configPath = getConfigPath7();
-    const config2 = resolveConfigSecrets3(loadConfig14(), { configPath });
+    const configPath = getConfigPath8();
+    const config2 = resolveConfigSecrets3(loadConfig15(), { configPath });
     const workspace = getWorkspacePath10(config2.agents.defaults.workspace);
     const pluginRegistry = loadPluginRegistry(config2, workspace);
     const extensionRegistry = toExtensionRegistry(pluginRegistry);
@@ -8658,7 +8979,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     const pluginChannelBindings = getPluginChannelBindings4(pluginRegistry);
     setPluginRuntimeBridge2({
       loadConfig: () => toPluginConfigView(
-        resolveConfigSecrets3(loadConfig14(), { configPath }),
+        resolveConfigSecrets3(loadConfig15(), { configPath }),
         pluginChannelBindings
       ),
       writeConfigFile: async (nextConfigView) => {
@@ -8667,7 +8988,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
             "plugin runtime writeConfigFile expects an object config"
           );
         }
-        const current = loadConfig14();
+        const current = loadConfig15();
         const next = mergePluginConfigView(
           current,
           nextConfigView,
@@ -8699,7 +9020,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
         resolveMessageToolHints: ({ channel, accountId }) => resolvePluginChannelMessageToolHints2({
           registry: pluginRegistry,
           channel,
-          cfg: resolveConfigSecrets3(loadConfig14(), { configPath }),
+          cfg: resolveConfigSecrets3(loadConfig15(), { configPath }),
           accountId
         })
       });
@@ -8894,7 +9215,7 @@ ${this.logo} ${APP_NAME5} is ready! (${source})`);
     await this.diagnosticsCommands.doctor(opts);
   }
   async skillsInstall(options) {
-    const config2 = loadConfig14();
+    const config2 = loadConfig15();
     const workdir = resolveSkillsInstallWorkdir({
       explicitWorkdir: options.workdir,
       configuredWorkspace: config2.agents.defaults.workspace