openclaw-navigator 4.4.0 → 4.6.0

package/cli.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 
 /**
- * openclaw-navigator v4.0.0
+ * openclaw-navigator v4.1.0
  *
  * One-command bridge + tunnel for the Navigator browser.
  * Starts a local bridge, creates a Cloudflare tunnel automatically,
  * and gives you a 6-digit pairing code. Works on any OS.
+ * Auto-installs, builds, and starts the OC Web UI on first run.
  *
  * Usage:
  *   npx openclaw-navigator                  Auto-tunnel (default)
@@ -15,10 +16,10 @@
 
 import { spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { existsSync } from "node:fs";
+import { existsSync, appendFileSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
 import { createServer, request as httpRequest } from "node:http";
 import { connect as netConnect } from "node:net";
-import { networkInterfaces, hostname, userInfo } from "node:os";
+import { networkInterfaces, hostname, userInfo, homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 // readline reserved for future interactive mode
@@ -68,6 +69,209 @@ let bridgePort = 18790;
 // Tunnel URL — set once the tunnel is active, exposed via /navigator/status
 let activeTunnelURL = null;
 
+// ── Persistent bridge identity ────────────────────────────────────────────
+// Survives restarts — same pairing code + token across tunnel reconnects.
+// Navigator re-resolves the code to get the new tunnel URL automatically.
+const BRIDGE_IDENTITY_PATH = join(homedir(), ".openclaw", "bridge-identity.json");
+
+function loadBridgeIdentity() {
+  try {
+    const data = JSON.parse(readFileSync(BRIDGE_IDENTITY_PATH, "utf8"));
+    if (data.pairingCode && data.token) {
+      return data;
+    }
+  } catch { /* first run */ }
+  return null;
+}
+
+function saveBridgeIdentity(code, token, name) {
+  mkdirSync(join(homedir(), ".openclaw"), { recursive: true });
+  writeFileSync(
+    BRIDGE_IDENTITY_PATH,
+    JSON.stringify({ pairingCode: code, token, name, createdAt: Date.now() }, null, 2) + "\n",
+    "utf8",
+  );
+}
+
+// ── User profiling storage ─────────────────────────────────────────────────
+// Files stored in ~/.openclaw/ as JSONL (append-only) and JSON (overwrite)
+const OPENCLAW_DIR = join(homedir(), ".openclaw");
+const PAGE_VISITS_PATH = join(OPENCLAW_DIR, "page-visits.jsonl");
+const PAGE_SUMMARIES_PATH = join(OPENCLAW_DIR, "page-summaries.jsonl");
+const USER_PROFILE_PATH = join(OPENCLAW_DIR, "user-profile.json");
+
+function ensureStorageDir() {
+  mkdirSync(OPENCLAW_DIR, { recursive: true });
+}
+
+function appendJSONL(filePath, record) {
+  ensureStorageDir();
+  appendFileSync(filePath, JSON.stringify(record) + "\n", "utf8");
+}
+
+function readJSONL(filePath, limit = 200) {
+  try {
+    const lines = readFileSync(filePath, "utf8").trim().split("\n").filter(Boolean);
+    const parsed = lines.map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+    return limit > 0 ? parsed.slice(-limit) : parsed;
+  } catch {
+    return [];
+  }
+}
+
+function readJSON(filePath) {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function writeJSON(filePath, data) {
+  ensureStorageDir();
+  writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
+}
+
+// ── OC Web UI lifecycle ──────────────────────────────────────────────────────
+
+const UI_DIR = join(homedir(), ".openclaw", "ui");
+const UI_REPO = "https://github.com/sandman66666/openclaw-ui.git";
+let uiProcess = null;
+
+async function isUIInstalled() {
+  return existsSync(join(UI_DIR, "package.json")) && existsSync(join(UI_DIR, ".next"));
+}
+
+async function setupUI() {
+  const { execSync } = await import("node:child_process");
+
+  if (existsSync(join(UI_DIR, "package.json"))) {
+    info("  UI directory exists, reinstalling...");
+    return await buildUI();
+  }
+
+  heading("Setting up OC Web UI (first time)");
+  info("  Cloning from GitHub...");
+
+  mkdirSync(join(homedir(), ".openclaw"), { recursive: true });
+
+  try {
+    execSync(`git clone --depth 1 ${UI_REPO} "${UI_DIR}"`, {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 60000,
+    });
+    ok("Repository cloned");
+  } catch (err) {
+    fail(`Failed to clone UI repo: ${err.message}`);
+    return false;
+  }
+
+  return await buildUI();
+}
+
+async function buildUI() {
+  const { execSync } = await import("node:child_process");
+
+  process.stdout.write(`  ${DIM}Installing dependencies (this may take a minute)...${RESET}`);
+  try {
+    execSync("npm install --production=false", {
+      cwd: UI_DIR,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 120000,
+      env: { ...process.env, NODE_ENV: "development" },
+    });
+    process.stdout.write(`\r${" ".repeat(70)}\r`);
+    ok("Dependencies installed");
+  } catch (err) {
+    process.stdout.write(`\r${" ".repeat(70)}\r`);
+    fail(`npm install failed: ${err.stderr?.toString()?.slice(-200) || err.message}`);
+    return false;
+  }
+
+  process.stdout.write(`  ${DIM}Building web UI...${RESET}`);
+  try {
+    execSync("npx next build", {
+      cwd: UI_DIR,
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 180000,
+    });
+    process.stdout.write(`\r${" ".repeat(70)}\r`);
+    ok("Web UI built successfully");
+    return true;
+  } catch (err) {
+    process.stdout.write(`\r${" ".repeat(70)}\r`);
+    fail(`Build failed: ${err.stderr?.toString()?.slice(-200) || err.message}`);
+    return false;
+  }
+}
+
+async function updateUI() {
+  const { execSync } = await import("node:child_process");
+
+  if (!existsSync(join(UI_DIR, ".git"))) {
+    warn("UI not installed yet — running full setup instead");
+    return await setupUI();
+  }
+
+  heading("Updating OC Web UI");
+
+  try {
+    const result = execSync("git pull --rebase origin main", {
+      cwd: UI_DIR,
+      encoding: "utf8",
+      timeout: 30000,
+    });
+
+    if (result.includes("Already up to date")) {
+      ok("Already up to date");
+      return true;
+    }
+
+    ok("Pulled latest changes");
+    return await buildUI();
+  } catch (err) {
+    fail(`Update failed: ${err.message}`);
+    return false;
+  }
+}
+
+function startUIServer(port) {
+  if (uiProcess) {
+    uiProcess.kill();
+    uiProcess = null;
+  }
+
+  uiProcess = spawn("npx", ["next", "start", "-p", String(port)], {
+    cwd: UI_DIR,
+    stdio: ["ignore", "pipe", "pipe"],
+    env: { ...process.env, PORT: String(port), NODE_ENV: "production" },
+  });
+
+  uiProcess.on("error", (err) => {
+    warn(`OC Web UI failed to start: ${err.message}`);
+    uiProcess = null;
+  });
+
+  uiProcess.on("exit", (code) => {
+    if (code !== null && code !== 0) {
+      warn(`OC Web UI exited with code ${code}`);
+    }
+    uiProcess = null;
+  });
+
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => {
+      ok(`OC Web UI starting on port ${port} (PID ${uiProcess?.pid})`);
+      resolve(true);
+    }, 1500);
+
+    uiProcess.on("exit", () => {
+      clearTimeout(timer);
+      resolve(false);
+    });
+  });
+}
+
 // Pairing code state
 let pairingCode = null;
 let pairingData = null;
@@ -202,6 +406,13 @@ function sendJSON(res, status, body) {
   res.end(JSON.stringify(body));
 }
 
+function validateBridgeAuth(req) {
+  const authHeader = req.headers["authorization"];
+  if (!authHeader) return false;
+  const token = authHeader.replace(/^Bearer\s+/i, "");
+  return validTokens.has(token);
+}
+
 function handleRequest(req, res) {
   // CORS preflight
   if (req.method === "OPTIONS") {
@@ -251,6 +462,10 @@ function handleRequest(req, res) {
 
   // ── GET /navigator/commands ──
   if (req.method === "GET" && path === "/navigator/commands") {
+    if (!validateBridgeAuth(req)) {
+      sendJSON(res, 401, { ok: false, error: "unauthorized", hint: "Include Authorization: Bearer <token> header" });
+      return;
+    }
     if (!bridgeState.connected) {
       bridgeState.connected = true;
       bridgeState.connectedAt = Date.now();
@@ -266,6 +481,10 @@ function handleRequest(req, res) {
 
   // ── POST /navigator/events ──
   if (req.method === "POST" && path === "/navigator/events") {
+    if (!validateBridgeAuth(req)) {
+      sendJSON(res, 401, { ok: false, error: "unauthorized", hint: "Include Authorization: Bearer <token> header" });
+      return;
+    }
     readBody(req)
       .then((bodyStr) => {
         try {
@@ -292,6 +511,22 @@ function handleRequest(req, res) {
           if (body.type === "page.navigated") {
             bridgeState.currentURL = body.url;
             console.log(`  ${DIM}📄 ${body.title || body.url}${RESET}`);
+
+            // ── Auto-persist page visit for user profiling ──
+            // Stores URL, title, and content snippet for later AI summarization
+            try {
+              const visitRecord = {
+                url: body.url,
+                title: body.title ?? null,
+                content: body.content ? String(body.content).slice(0, 8000) : null,
+                tabId: body.tabId ?? null,
+                timestamp: Date.now(),
+                date: new Date().toISOString().slice(0, 10),
+              };
+              appendJSONL(PAGE_VISITS_PATH, visitRecord);
+            } catch (e) {
+              // Silent — never block event flow for storage errors
+            }
           }
 
           sendJSON(res, 200, { ok: true, received: event.type });
@@ -333,6 +568,10 @@ function handleRequest(req, res) {
 
   // ── POST /navigator/command ──
   if (req.method === "POST" && path === "/navigator/command") {
+    if (!validateBridgeAuth(req)) {
+      sendJSON(res, 401, { ok: false, error: "unauthorized", hint: "Include Authorization: Bearer <token> header" });
+      return;
+    }
     readBody(req)
       .then((bodyStr) => {
         try {
@@ -479,6 +718,151 @@ function handleRequest(req, res) {
     return;
   }
 
+  // ── GET /navigator/page-visits ──
+  // Returns recent page visits (last N, default 100). Supports ?date=YYYY-MM-DD filter.
+  if (req.method === "GET" && path === "/navigator/page-visits") {
+    const limit = parseInt(url.searchParams.get("limit") ?? "100", 10);
+    const dateFilter = url.searchParams.get("date"); // YYYY-MM-DD
+    const sinceFilter = url.searchParams.get("since"); // timestamp ms
+    let visits = readJSONL(PAGE_VISITS_PATH, 0); // read all
+
+    if (dateFilter) {
+      visits = visits.filter((v) => v.date === dateFilter);
+    }
+    if (sinceFilter) {
+      const sinceTs = parseInt(sinceFilter, 10);
+      visits = visits.filter((v) => v.timestamp > sinceTs);
+    }
+
+    // Return newest last, capped at limit
+    visits = visits.slice(-limit);
+    sendJSON(res, 200, { ok: true, visits, total: visits.length });
+    return;
+  }
+
+  // ── GET /navigator/page-visits/unsummarized ──
+  // Returns page visits that don't have a corresponding summary yet.
+  // The agent calls this to find pages that need Haiku summarization.
+  if (req.method === "GET" && path === "/navigator/page-visits/unsummarized") {
+    const limit = parseInt(url.searchParams.get("limit") ?? "50", 10);
+    const visits = readJSONL(PAGE_VISITS_PATH, 0);
+    const summaries = readJSONL(PAGE_SUMMARIES_PATH, 0);
+    const summarizedURLs = new Set(summaries.map((s) => s.url));
+
+    // De-duplicate by URL (keep latest visit) and exclude already-summarized
+    const urlMap = new Map();
+    for (const v of visits) {
+      if (!summarizedURLs.has(v.url)) {
+        urlMap.set(v.url, v);
+      }
+    }
+
+    const unsummarized = [...urlMap.values()].slice(-limit);
+    sendJSON(res, 200, { ok: true, visits: unsummarized, total: unsummarized.length });
+    return;
+  }
+
+  // ── POST /navigator/page-summary ──
+  // Agent saves an AI-generated summary for a page visit.
+  if (req.method === "POST" && path === "/navigator/page-summary") {
+    readBody(req)
+      .then((bodyStr) => {
+        try {
+          const body = JSON.parse(bodyStr);
+          if (!body.url || !body.summary) {
+            sendJSON(res, 400, { ok: false, error: "Missing 'url' and 'summary' fields" });
+            return;
+          }
+
+          const summaryRecord = {
+            url: body.url,
+            title: body.title ?? null,
+            summary: body.summary,
+            signals: body.signals ?? null, // { names, interests, services, purchases, intent, ... }
+            model: body.model ?? "haiku",
+            timestamp: Date.now(),
+            date: new Date().toISOString().slice(0, 10),
+          };
+          appendJSONL(PAGE_SUMMARIES_PATH, summaryRecord);
+          sendJSON(res, 200, { ok: true, saved: summaryRecord.url });
+        } catch {
+          sendJSON(res, 400, { ok: false, error: "Invalid JSON" });
+        }
+      })
+      .catch(() => {
+        sendJSON(res, 400, { ok: false, error: "Bad request" });
+      });
+    return;
+  }
+
+  // ── GET /navigator/page-summaries ──
+  // Returns page summaries, optionally filtered by date.
+  if (req.method === "GET" && path === "/navigator/page-summaries") {
+    const limit = parseInt(url.searchParams.get("limit") ?? "100", 10);
+    const dateFilter = url.searchParams.get("date");
+    const sinceFilter = url.searchParams.get("since");
+    let summaries = readJSONL(PAGE_SUMMARIES_PATH, 0);
+
+    if (dateFilter) {
+      summaries = summaries.filter((s) => s.date === dateFilter);
+    }
+    if (sinceFilter) {
+      const sinceTs = parseInt(sinceFilter, 10);
+      summaries = summaries.filter((s) => s.timestamp > sinceTs);
+    }
+
+    summaries = summaries.slice(-limit);
+    sendJSON(res, 200, { ok: true, summaries, total: summaries.length });
+    return;
+  }
+
+  // ── GET /navigator/profile ──
+  // Returns the current user profile (created by Opus daily synthesis).
+  if (req.method === "GET" && path === "/navigator/profile") {
+    const profile = readJSON(USER_PROFILE_PATH);
+    if (profile) {
+      sendJSON(res, 200, { ok: true, profile });
+    } else {
+      sendJSON(res, 200, {
+        ok: true,
+        profile: null,
+        hint: "No profile yet. The agent should create one by summarizing page visits.",
+      });
+    }
+    return;
+  }
+
+  // ── POST /navigator/profile ──
+  // Agent saves/updates the user profile (Opus daily synthesis result).
+  if (req.method === "POST" && path === "/navigator/profile") {
+    readBody(req)
+      .then((bodyStr) => {
+        try {
+          const body = JSON.parse(bodyStr);
+          if (!body.profile) {
+            sendJSON(res, 400, { ok: false, error: "Missing 'profile' field" });
+            return;
+          }
+
+          const profileData = {
+            profile: body.profile,
+            updatedAt: Date.now(),
+            updatedDate: new Date().toISOString().slice(0, 10),
+            model: body.model ?? "opus",
+            version: (readJSON(USER_PROFILE_PATH)?.version ?? 0) + 1,
+          };
+          writeJSON(USER_PROFILE_PATH, profileData);
+          sendJSON(res, 200, { ok: true, version: profileData.version });
+        } catch {
+          sendJSON(res, 400, { ok: false, error: "Invalid JSON" });
+        }
+      })
+      .catch(() => {
+        sendJSON(res, 400, { ok: false, error: "Bad request" });
+      });
+    return;
+  }
+
   // ── Reverse proxy: /ui/* → OC Web UI (localhost:ocUIPort) ──────────────
   // Strips /ui prefix so /ui/dashboard → localhost:4000/dashboard
   if (path === "/ui" || path.startsWith("/ui/")) {
@@ -703,6 +1087,13 @@ async function main() {
   let bindHost = "127.0.0.1";
   let noTunnel = false;
   let withMcp = false;
+  let pm2Setup = false;
+  let tunnelToken = null;   // For named tunnels (Cloudflare)
+  let tunnelHostname = null; // For named tunnels (stable URL)
+  let freshIdentity = false; // --new-code: force new pairing code
+  let setupUIFlag = false;
+  let updateUIFlag = false;
+  let noUIFlag = false;
 
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--port" && args[i + 1]) {
@@ -723,6 +1114,27 @@ async function main() {
     if (args[i] === "--gateway-port" && args[i + 1]) {
       ocGatewayPort = parseInt(args[i + 1], 10);
     }
+    if (args[i] === "--pm2-setup") {
+      pm2Setup = true;
+    }
+    if (args[i] === "--tunnel-token" && args[i + 1]) {
+      tunnelToken = args[i + 1];
+    }
+    if (args[i] === "--tunnel-hostname" && args[i + 1]) {
+      tunnelHostname = args[i + 1];
+    }
+    if (args[i] === "--new-code") {
+      freshIdentity = true;
+    }
+    if (args[i] === "--setup-ui") {
+      setupUIFlag = true;
+    }
+    if (args[i] === "--update-ui") {
+      updateUIFlag = true;
+    }
+    if (args[i] === "--no-ui") {
+      noUIFlag = true;
+    }
     if (args[i] === "--help" || args[i] === "-h") {
       console.log(`
 ${BOLD}openclaw-navigator${RESET} — One-command bridge + tunnel for Navigator
@@ -734,13 +1146,22 @@ ${BOLD}Usage:${RESET}
   npx openclaw-navigator --port 18790     Custom port
 
 ${BOLD}Options:${RESET}
-  --port <port>         Bridge server port (default: 18790)
-  --mcp                 Also start the MCP server (stdio) for OpenClaw agent
-  --ui-port <port>      OC web UI port to reverse-proxy (default: 4000)
-  --gateway-port <port> OC gateway port for API + WebSocket (default: 18789)
-  --no-tunnel           Skip auto-tunnel, use SSH or LAN instead
-  --bind <host>         Bind address (default: 127.0.0.1)
-  --help                Show this help
+  --port <port>             Bridge server port (default: 18790)
+  --mcp                     Also start the MCP server (stdio) for OpenClaw agent
+  --ui-port <port>          OC web UI port to reverse-proxy (default: 4000)
+  --gateway-port <port>     OC gateway port for API + WebSocket (default: 18789)
+  --no-tunnel               Skip auto-tunnel, use SSH or LAN instead
+  --bind <host>             Bind address (default: 127.0.0.1)
+  --new-code                Force a new pairing code (discard saved identity)
+  --setup-ui                Force (re)install + build OC Web UI
+  --update-ui               Pull latest UI changes and rebuild
+  --no-ui                   Don't auto-start the web UI
+  --help                    Show this help
+
+${BOLD}Stability (recommended for production):${RESET}
+  --pm2-setup               Generate PM2 ecosystem.config.cjs and exit
+  --tunnel-token <token>    Use a named Cloudflare tunnel (stable URL)
+  --tunnel-hostname <host>  Hostname for named tunnel (e.g. nav.yourdomain.com)
 
 ${BOLD}Routing (through Cloudflare tunnel):${RESET}
   /ui/*          → localhost:<ui-port>      Web UI (login page, dashboard)
@@ -766,6 +1187,56 @@ ${BOLD}How it works:${RESET}
 
   bridgePort = port; // Expose for status endpoint
 
+  // ── PM2 setup mode ──────────────────────────────────────────────────────
+  if (pm2Setup) {
+    const { execSync: findNode } = await import("node:child_process");
+    let npxPath;
+    try { npxPath = findNode("which npx", { encoding: "utf8" }).trim(); } catch { npxPath = "npx"; }
+
+    const ecosystemContent = `// PM2 ecosystem config for openclaw-navigator bridge
+// Generated by: npx openclaw-navigator --pm2-setup
+// Start with: pm2 start ecosystem.config.cjs
+module.exports = {
+  apps: [{
+    name: "openclaw-navigator",
+    script: "${npxPath}",
+    args: "openclaw-navigator@latest --mcp --no-ui --port ${port}",
+    cwd: "${homedir()}",
+    autorestart: true,
+    max_restarts: 50,
+    restart_delay: 3000,
+    exp_backoff_restart_delay: 1000,
+    watch: false,
+    env: {
+      OPENCLAW_UI_PORT: "${ocUIPort}",
+      OPENCLAW_GATEWAY_PORT: "${ocGatewayPort}",
+      NODE_ENV: "production",
+    },
+    log_file: "${join(homedir(), ".openclaw/navigator-bridge.log")}",
+    error_file: "${join(homedir(), ".openclaw/navigator-bridge-error.log")}",
+    merge_logs: true,
+    time: true,
+  }]
+};
+`;
+    const ecosystemPath = join(process.cwd(), "ecosystem.config.cjs");
+    writeFileSync(ecosystemPath, ecosystemContent, "utf8");
+    ok(`PM2 ecosystem config written to: ${ecosystemPath}`);
+    console.log("");
+    console.log(`${BOLD}To start with PM2:${RESET}`);
+    console.log(`  ${CYAN}npm install -g pm2${RESET}          ${DIM}(if not installed)${RESET}`);
+    console.log(`  ${CYAN}pm2 start ecosystem.config.cjs${RESET}`);
+    console.log(`  ${CYAN}pm2 save${RESET}                    ${DIM}(auto-start on boot)${RESET}`);
+    console.log(`  ${CYAN}pm2 startup${RESET}                 ${DIM}(install system startup hook)${RESET}`);
+    console.log("");
+    console.log(`${BOLD}Useful PM2 commands:${RESET}`);
+    console.log(`  ${CYAN}pm2 logs openclaw-navigator${RESET} ${DIM}(view logs)${RESET}`);
+    console.log(`  ${CYAN}pm2 restart openclaw-navigator${RESET}`);
+    console.log(`  ${CYAN}pm2 stop openclaw-navigator${RESET}`);
+    console.log("");
+    process.exit(0);
+  }
+
   heading("🧭 Navigator Bridge");
   info("One-command bridge + tunnel for the Navigator browser\n");
 
@@ -830,30 +1301,128 @@ ${BOLD}How it works:${RESET}
 
   ok(`Bridge server running on ${bindHost}:${port}`);
 
-  // ── Step 2: Set up connectivity ───────────────────────────────────────
+  // ── Step 2: Persistent identity ─────────────────────────────────────
+  // Reuse the same pairing code + token across restarts so Navigator
+  // doesn't need to re-pair. The code resolves to the NEW tunnel URL
+  // via the relay, so everything reconnects automatically.
   const displayName = hostname().replace(/\.local$/, "");
+  let token;
+
+  const savedIdentity = freshIdentity ? null : loadBridgeIdentity();
+  if (savedIdentity) {
+    pairingCode = savedIdentity.pairingCode;
+    token = savedIdentity.token;
+    validTokens.add(token);
+    ok(`Restored pairing code: ${BOLD}${GREEN}${pairingCode}${RESET} (same as last session)`);
+  } else {
+    token = randomUUID().replace(/-/g, "");
+    validTokens.add(token);
+    pairingCode = generatePairingCode();
+    saveBridgeIdentity(pairingCode, token, displayName);
+    ok(`New pairing code generated: ${BOLD}${GREEN}${pairingCode}${RESET}`);
+  }
+
   let gatewayURL = `http://localhost:${port}`;
   let tunnelURL = null;
   let tunnelProcess = null;
+  let cloudflaredBin = null;
+  pairingData = { url: gatewayURL, token, name: displayName };
+
+  // ── Step 3: Set up connectivity ───────────────────────────────────────
+
+  /**
+   * Start (or restart) the tunnel. Updates all references to the new URL
+   * and re-registers with the relay so Navigator can re-resolve the code.
+   */
+  let tunnelReconnectAttempts = 0;
+  const MAX_TUNNEL_RECONNECT_DELAY = 60_000; // cap at 60s
+
+  async function startOrReconnectTunnel() {
+    if (!cloudflaredBin) return null;
+
+    // Named tunnel mode (stable URL, no reconnect gymnastics needed)
+    if (tunnelToken) {
+      const tunnelArgs = ["tunnel", "run", "--token", tunnelToken];
+      if (tunnelHostname) {
+        tunnelArgs.push("--url", `http://localhost:${port}`);
+      }
+      const child = spawn(cloudflaredBin, tunnelArgs, {
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+
+      child.on("exit", (code) => {
+        warn(`Named tunnel exited (code ${code}) — restarting in 5s...`);
+        tunnelProcess = null;
+        setTimeout(startOrReconnectTunnel, 5000);
+      });
+
+      tunnelProcess = child;
+      const namedURL = tunnelHostname ? `https://${tunnelHostname}` : null;
+      if (namedURL) {
+        tunnelURL = namedURL;
+        activeTunnelURL = namedURL;
+        gatewayURL = namedURL;
+        pairingData.url = namedURL;
+        ok(`Named tunnel active: ${CYAN}${namedURL}${RESET}`);
+      }
+      return child;
+    }
+
+    // Quick Tunnel mode — URL changes on every start
+    const result = await startTunnel(cloudflaredBin, port);
+    if (!result) {
+      const delay = Math.min(2000 * Math.pow(2, tunnelReconnectAttempts), MAX_TUNNEL_RECONNECT_DELAY);
+      tunnelReconnectAttempts++;
+      warn(`Tunnel failed — retrying in ${Math.round(delay / 1000)}s (attempt ${tunnelReconnectAttempts})...`);
+      setTimeout(startOrReconnectTunnel, delay);
+      return null;
+    }
+
+    tunnelReconnectAttempts = 0; // reset on success
+    tunnelURL = result.url;
+    activeTunnelURL = tunnelURL;
+    gatewayURL = tunnelURL;
+    pairingData.url = tunnelURL;
+    tunnelProcess = result.process;
+
+    ok(`Tunnel active: ${CYAN}${tunnelURL}${RESET}`);
+
+    // Re-register with relay using the SAME pairing code
+    const relayOk = await registerWithRelay(pairingCode, gatewayURL, token, displayName);
+    if (relayOk) {
+      ok("Code re-registered with relay — Navigator will auto-reconnect");
+    } else {
+      warn("Relay unavailable — Navigator may need manual reconnect");
+    }
+
+    // Monitor tunnel process — restart on crash
+    result.process.on("exit", (code) => {
+      if (code !== null && code !== 0) {
+        warn(`Tunnel crashed (code ${code}) — auto-reconnecting...`);
+      } else {
+        info("Tunnel process exited — reconnecting...");
+      }
+      tunnelProcess = null;
+      activeTunnelURL = null;
+      // Exponential backoff restart
+      const delay = Math.min(3000 * Math.pow(2, tunnelReconnectAttempts), MAX_TUNNEL_RECONNECT_DELAY);
+      tunnelReconnectAttempts++;
+      setTimeout(startOrReconnectTunnel, delay);
+    });
+
+    return result;
+  }
 
   if (!noTunnel) {
     // ── Auto-tunnel mode (default) ──────────────────────────────────
     process.stdout.write(`  ${DIM}Setting up tunnel...${RESET}`);
-    const cloudflaredBin = await ensureCloudflared();
+    cloudflaredBin = await ensureCloudflared();
 
     if (cloudflaredBin) {
-      const result = await startTunnel(cloudflaredBin, port);
+      const result = await startOrReconnectTunnel();
       process.stdout.write(`\r${" ".repeat(60)}\r`);
 
-      if (result) {
-        tunnelURL = result.url;
-        activeTunnelURL = tunnelURL; // Expose via /navigator/status
-        tunnelProcess = result.process;
-        gatewayURL = tunnelURL; // Use tunnel URL as the gateway URL
-
-        ok(`Tunnel active: ${CYAN}${tunnelURL}${RESET}`);
-      } else {
-        process.stdout.write(`\r${" ".repeat(60)}\r`);
+      if (!result && !tunnelToken) {
         warn("Tunnel failed to start. Falling back to local-only mode.");
         warn("Navigator must be on the same machine, or use --no-tunnel + SSH.");
       }
@@ -861,6 +1430,11 @@ ${BOLD}How it works:${RESET}
       process.stdout.write(`\r${" ".repeat(60)}\r`);
       warn("Could not install tunnel tool. Falling back to local-only mode.");
     }
+
+    // Show named tunnel tip if using Quick Tunnel
+    if (tunnelURL && !tunnelToken) {
+      info(`  ${DIM}💡 For a stable URL that never changes: npx openclaw-navigator --help${RESET}`);
+    }
   } else {
     // ── No-tunnel mode (SSH/LAN) ────────────────────────────────────
     const tailscaleIP = getTailscaleIP();
@@ -880,27 +1454,40 @@ ${BOLD}How it works:${RESET}
     console.log("");
   }
 
-  // ── Step 3: Generate pairing token + code ─────────────────────────────
-  const token = randomUUID().replace(/-/g, "");
-  validTokens.add(token);
-  pairingCode = generatePairingCode();
-  pairingData = { url: gatewayURL, token, name: displayName };
+  // ── OC Web UI: auto-setup + start ─────────────────────────────────────
+  if (!noUIFlag) {
+    if (setupUIFlag) {
+      await setupUI();
+    } else if (updateUIFlag) {
+      await updateUI();
+    }
 
-  // ── Step 4: Register with relay (for remote pairing) ────────────────
-  if (tunnelURL) {
-    const relayOk = await registerWithRelay(pairingCode, gatewayURL, token, displayName);
-    if (relayOk) {
-      ok("Code registered with relay — works from any device");
-    } else {
-      warn("Relay unavailable — code works on same machine only");
+    if (await isUIInstalled()) {
+      await startUIServer(ocUIPort);
+    } else if (!setupUIFlag && !noUIFlag) {
+      heading("OC Web UI not found — setting up automatically");
+      const setupOk = await setupUI();
+      if (setupOk) {
+        await startUIServer(ocUIPort);
+      } else {
+        warn("Web UI setup failed — you can retry with: npx openclaw-navigator --setup-ui");
+        warn("The bridge will still work, but /ui/* won't serve the dashboard");
+      }
     }
   }
 
+  // ── Step 4: Register initial pairing code with relay ────────────────
+  if (tunnelURL && !tunnelToken) {
+    // Already registered inside startOrReconnectTunnel()
+  } else if (!tunnelURL) {
+    // Local mode — register code for local resolution
+  }
+
   // ── Step 5: Show connection info ──────────────────────────────────────
   showPairingCode(pairingCode);
 
   // Deep link (always show as fallback)
-  const deepLink = `navigator://connect?url=${encodeURIComponent(gatewayURL)}&token=${token}&name=${encodeURIComponent(displayName)}`;
+  const deepLink = `navigator://connect?url=${encodeURIComponent(gatewayURL)}&token=${token}&name=${encodeURIComponent(displayName)}&code=${pairingCode}`;
 
   if (tunnelURL) {
     console.log(`  ${DIM}Or paste the deep link in Navigator's address bar:${RESET}`);
@@ -915,6 +1502,7 @@ ${BOLD}How it works:${RESET}
     info(`  URL:   ${gatewayURL}`);
     info(`  Token: ${token}`);
   }
+  info(`  Pairing code: ${pairingCode} (persisted across restarts)`);
 
   // ── Show OC Web UI access + routing info ─────────────────────────────
   const uiURL = tunnelURL ? `${tunnelURL}/ui/` : `http://localhost:${port}/ui/`;
@@ -1154,6 +1742,130 @@ ${BOLD}How it works:${RESET}
       writeFileSync(skillPath, skillContent, "utf8");
       ok("Installed navigator-bridge skill for OC agent");
       info(`  Skill: ${skillPath}`);
+
+      // ── Install user-profiler skill ────────────────────────────────────
+      // Instructs the OC agent to build a user profile from browsing data.
+      const profilerSkillLocations = [
+        "/opt/homebrew/lib/node_modules/openclaw/skills/user-profiler",
+        join(homedir(), ".openclaw/skills/user-profiler"),
+      ];
+      let profilerSkillDir = profilerSkillLocations[0];
+      for (const loc of profilerSkillLocations) {
+        const parent = dirname(loc);
+        if (existsSync(parent)) {
+          profilerSkillDir = loc;
+          break;
+        }
+      }
+      const profilerSkillPath = join(profilerSkillDir, "SKILL.md");
+      const profilerSkillContent = [
+        "---",
+        "name: user-profiler",
+        "description: Build and maintain a rich user profile from Navigator browsing data. Summarizes every page visit with Haiku, creates daily profile synthesis with Opus.",
+        "metadata:",
+        '  { "openclaw": { "emoji": "🧠", "schedule": { "summarize": "every_10_minutes", "profile": "daily" } } }',
+        "---",
+        "",
+        "# User Profiler — Browsing Intelligence System",
+        "",
+        "You have access to the user's browsing activity through Navigator. Your job is to build and maintain a comprehensive user profile by analyzing what they browse.",
+        "",
+        "## How It Works",
+        "",
+        "### 1. Page Visit Storage (Automatic)",
+        "Every page the user visits is automatically stored with URL, title, and content.",
+        "You don't need to do anything for this — it happens in the bridge.",
+        "",
+        "### 2. Page Summarization (You Do This — Use Haiku 4.6)",
+        "",
+        "Periodically (every ~10 minutes or when prompted), check for unsummarized page visits:",
+        "",
+        BT + "bash",
+        "# Get pages that haven't been summarized yet",
+        "mcporter call navigator.navigator_get_page_visits unsummarized=true limit=20",
+        BT,
+        "",
+        "For each unsummarized page, use **Claude Haiku 4.6** to extract a concise summary with these signals:",
+        "",
+        "- **Names**: People, companies, brands mentioned",
+        "- **Interests**: Topics, hobbies, categories the user is exploring",
+        "- **Services**: Tools, platforms, SaaS products the user uses or is evaluating",
+        "- **Purchases**: Things bought, wishlisted, or actively shopping for",
+        "- **Intent**: What the user appears to be trying to accomplish",
+        "- **Topics**: Key themes, industries, domains",
+        "- **Sentiment**: Positive/negative signals about products or services",
+        "",
+        "Save each summary:",
+        "",
+        BT + "bash",
+        "mcporter call navigator.navigator_save_page_summary \\",
+        '  url="<page_url>" \\',
+        '  title="<page_title>" \\',
+        '  summary="<haiku_generated_summary>" \\',
+        "  signals='{\"names\":[],\"interests\":[],\"services\":[],\"purchases\":[],\"intent\":[],\"topics\":[]}'",
+        BT,
+        "",
+        "### 3. Daily Profile Synthesis (You Do This — Use Opus 4.6)",
+        "",
+        "Once daily (or when prompted), synthesize a comprehensive user profile:",
+        "",
+        "1. **Read the current profile** (may be null if first time):",
+        "",
+        BT + "bash",
+        "mcporter call navigator.navigator_get_user_profile",
+        BT,
+        "",
+        "2. **Read today's page summaries** (and optionally recent days):",
+        "",
+        BT + "bash",
+        "mcporter call navigator.navigator_get_page_summaries date=$(date +%Y-%m-%d)",
+        BT,
+        "",
+        "3. **Use Opus 4.6** to merge the previous profile with new data. The profile should:",
+        "   - Reinforce patterns that appear repeatedly (high confidence)",
+        "   - Add new observations from today's browsing",
+        "   - Decay stale signals that haven't been reinforced",
+        "   - Include confidence levels (low/medium/high) for each signal",
+        "   - Be structured and machine-readable",
+        "",
+        "4. **Save the updated profile:**",
+        "",
+        BT + "bash",
+        "mcporter call navigator.navigator_save_user_profile \\",
+        "  profile='{",
+        '    "summary": "Overall description of the user",',
+        '    "interests": [{"topic": "...", "confidence": "high", "lastSeen": "2025-01-15"}],',
+        '    "services": [{"name": "...", "usage": "active|evaluating|former"}],',
+        '    "purchases": [{"item": "...", "status": "bought|considering|wishlisted"}],',
+        '    "patterns": ["Browses tech news in morning", "Shops on weekends"],',
+        '    "demographics": {"profession": "...", "location_hints": []},',
+        '    "relationships": [{"name": "...", "context": "colleague|friend|vendor"}],',
+        '    "preferences": {"brands": [], "categories": []},',
+        '    "lastUpdated": "2025-01-15",',
+        '    "version": 1',
+        "  }'",
+        BT,
+        "",
+        "## Profile Quality Guidelines",
+        "",
+        "- **Be smart about noise**: Ignore login pages, error pages, redirects",
+        "- **Respect privacy**: Don't store passwords, tokens, or PII like SSNs/credit cards",
+        "- **Extract signal from noise**: A visit to \"Nike Air Max\" tells you about shopping interest, not just a URL",
+        "- **Cross-reference**: If user visits Stripe docs AND Vercel, they're likely a developer building a SaaS",
+        "- **Temporal awareness**: Morning habits vs evening habits, weekday vs weekend",
+        "- **Don't hallucinate**: Only include signals backed by actual browsing data",
+        "",
+        "## When to Run",
+        "",
+        "- **Summarization**: Every 10 minutes while the user is actively browsing",
+        "- **Profile synthesis**: Once daily, preferably at end of day",
+        "- **On demand**: User can ask \"update my profile\" or \"what do you know about me\"",
+        "",
+      ].join("\n");
+      mkdirSync(profilerSkillDir, { recursive: true });
+      writeFileSync(profilerSkillPath, profilerSkillContent, "utf8");
+      ok("Installed user-profiler skill for OC agent");
+      info(`  Skill: ${profilerSkillPath}`);
     } catch (err) {
       warn(`mcporter registration failed: ${err.message}`);
       info("  You can manually configure mcporter for Navigator MCP");
@@ -1248,6 +1960,10 @@ ${BOLD}How it works:${RESET}
   // ── Graceful shutdown ─────────────────────────────────────────────────
   const shutdown = () => {
     console.log(`\n${DIM}Shutting down bridge...${RESET}`);
+    if (uiProcess) {
+      uiProcess.kill();
+      uiProcess = null;
+    }
     if (mcpProcess) {
       mcpProcess.kill();
     }

package/mcp.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 /**
- * openclaw-navigator MCP server v4.3.0
+ * openclaw-navigator MCP server v4.4.0
  *
  * Exposes the Navigator bridge HTTP API as MCP tools so the OpenClaw agent
  * can control the browser natively via its tool schema.
@@ -149,7 +149,7 @@ async function sendCommand(command, payload, poll) {
   };
 }
 
-// ── Tool definitions (15 tools) ───────────────────────────────────────────
+// ── Tool definitions (21 tools: 16 browser + 5 profiling) ────────────────
 
 const TOOLS = [
   // ── Direct HTTP ──
@@ -338,6 +338,92 @@ const TOOLS = [
       },
     },
   },
+
+  // ── User Profiling Tools ──
+  {
+    name: "navigator_get_page_visits",
+    description:
+      "Get recent page visits from the user's browsing history. Each visit includes URL, title, content snippet, and timestamp. Use 'unsummarized=true' to only get visits that haven't been summarized yet (for Haiku batch processing). Supports date filter (YYYY-MM-DD) and limit.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: {
+          type: "number",
+          description: "Maximum visits to return (default: 50)",
+        },
+        date: {
+          type: "string",
+          description: "Filter by date (YYYY-MM-DD)",
+        },
+        unsummarized: {
+          type: "boolean",
+          description: "If true, only return visits that haven't been summarized yet",
+        },
+      },
+    },
+  },
+  {
+    name: "navigator_save_page_summary",
+    description:
+      "Save an AI-generated summary for a page visit. Call this after using Haiku to summarize a page. Include the extracted signals: names mentioned, interests, services used, purchases/intent, and any other useful profile data.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "URL of the page that was summarized" },
+        title: { type: "string", description: "Page title" },
+        summary: {
+          type: "string",
+          description: "AI-generated summary of the page content",
+        },
+        signals: {
+          type: "object",
+          description:
+            "Extracted profile signals: { names: [], interests: [], services: [], purchases: [], intent: [], topics: [], other: {} }",
+        },
+      },
+      required: ["url", "summary"],
+    },
+  },
+  {
+    name: "navigator_get_page_summaries",
+    description:
+      "Get AI-generated page summaries. Use this to review what the user has been browsing and the extracted signals. Supports date filter.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        limit: {
+          type: "number",
+          description: "Maximum summaries to return (default: 100)",
+        },
+        date: {
+          type: "string",
+          description: "Filter by date (YYYY-MM-DD)",
+        },
+      },
+    },
+  },
+  {
+    name: "navigator_get_user_profile",
+    description:
+      "Get the current user profile — a comprehensive, AI-synthesized understanding of the user based on their browsing patterns, interests, services, purchases, and behavior. Returns null if no profile exists yet.",
+    inputSchema: { type: "object", properties: {} },
+  },
+  {
+    name: "navigator_save_user_profile",
+    description:
+      "Save or update the user profile. Call this after synthesizing a new profile from page summaries. The profile should merge previous profile data with new observations to build an increasingly accurate picture of the user.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        profile: {
+          type: "object",
+          description:
+            "The complete user profile object. Should include: { summary: 'overall description', interests: [], services: [], purchases: [], intent: [], patterns: [], demographics: {}, preferences: {}, relationships: [], ... }",
+        },
+      },
+      required: ["profile"],
+    },
+  },
 ];
 
 // ── Tool handler dispatch ─────────────────────────────────────────────────
@@ -460,6 +546,44 @@ async function handleTool(name, args) {
           ),
         );
 
+      // ── User Profiling Tools ──
+      case "navigator_get_page_visits": {
+        const limit = args.limit ?? 50;
+        const unsummarized = args.unsummarized ?? false;
+        const endpoint = unsummarized
+          ? `/navigator/page-visits/unsummarized?limit=${limit}`
+          : `/navigator/page-visits?limit=${limit}${args.date ? `&date=${args.date}` : ""}`;
+        return jsonResult(await bridgeGet(endpoint));
+      }
+
+      case "navigator_save_page_summary":
+        return jsonResult(
+          await bridgePost("/navigator/page-summary", {
+            url: args.url,
+            title: args.title,
+            summary: args.summary,
+            signals: args.signals,
+            model: "haiku-4.6",
+          }),
+        );
+
+      case "navigator_get_page_summaries": {
+        const limit = args.limit ?? 100;
+        const dateParam = args.date ? `&date=${args.date}` : "";
+        return jsonResult(await bridgeGet(`/navigator/page-summaries?limit=${limit}${dateParam}`));
+      }
+
+      case "navigator_get_user_profile":
+        return jsonResult(await bridgeGet("/navigator/profile"));
+
+      case "navigator_save_user_profile":
+        return jsonResult(
+          await bridgePost("/navigator/profile", {
+            profile: args.profile,
+            model: "opus-4.6",
+          }),
+        );
+
       default:
         return errorResult(`Unknown tool: ${name}`);
     }
@@ -472,7 +596,7 @@ async function handleTool(name, args) {
 // ── MCP server wiring ─────────────────────────────────────────────────────
 
 const server = new Server(
-  { name: "openclaw-navigator", version: "4.3.0" },
+  { name: "openclaw-navigator", version: "4.4.0" },
   { capabilities: { tools: {} } },
 );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-navigator",
-  "version": "4.4.0",
+  "version": "4.6.0",
   "description": "One-command bridge + tunnel for the Navigator browser — works on any machine, any OS",
   "keywords": [
     "browser",