openclaw-navigator 5.7.2 → 5.7.4

package/cli.mjs

@@ -1703,6 +1703,23 @@ async function registerWithRelay(code, url, token, name) {
     });
     clearTimeout(timeout);
     const data = await res.json();
+
+    // Also register with token as the lookup key — so Navigator can
+    // resolve by saved token even after the pairing code rotates.
+    // Uses first 8 chars of token as a "token code" (avoids relay key limits).
+    const tokenCode = `T${token.substring(0, 7)}`;
+    try {
+      const c2 = new AbortController();
+      const t2 = setTimeout(() => c2.abort(), 5000);
+      await fetch(`${RELAY_URL}/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ code: tokenCode, url, token, name }),
+        signal: c2.signal,
+      });
+      clearTimeout(t2);
+    } catch { /* non-critical */ }
+
     return data.ok === true;
   } catch {
     return false;
@@ -1927,25 +1944,30 @@ module.exports = {
   await killPort(ocUIPort);
   startWebUI();
 
-  // ── Step 2: Persistent identity ─────────────────────────────────────
-  // Reuse the same pairing code + token across restarts so Navigator
-  // doesn't need to re-pair. The code resolves to the NEW tunnel URL
-  // via the relay, so everything reconnects automatically.
+  // ── Step 2: Identity — persistent token, rotating code ──────────────
+  // Token is persistent: Navigator stores it after first pairing and uses
+  // it for all future requests. This is the real auth credential.
+  // Pairing code rotates every startup: it's a one-time handshake to
+  // exchange the token. A new code every time means nobody can reuse
+  // an old code to hijack the connection.
   const displayName = hostname().replace(/\.local$/, "");
   let token;
 
   const savedIdentity = freshIdentity ? null : loadBridgeIdentity();
   if (savedIdentity) {
-    pairingCode = savedIdentity.pairingCode;
+    // Keep the token (Navigator already has it) but rotate the code
     token = savedIdentity.token;
     validTokens.add(token);
-    ok(`Restored pairing code: ${BOLD}${GREEN}${pairingCode}${RESET} (same as last session)`);
+    pairingCode = generatePairingCode(); // fresh code every startup
+    saveBridgeIdentity(pairingCode, token, displayName);
+    ok(`Token restored (Navigator will auto-reconnect)`);
+    ok(`New pairing code: ${BOLD}${GREEN}${pairingCode}${RESET} (rotated for security)`);
   } else {
     token = randomUUID().replace(/-/g, "");
     validTokens.add(token);
     pairingCode = generatePairingCode();
     saveBridgeIdentity(pairingCode, token, displayName);
-    ok(`New pairing code generated: ${BOLD}${GREEN}${pairingCode}${RESET}`);
+    ok(`New pairing code: ${BOLD}${GREEN}${pairingCode}${RESET}`);
   }
 
   let gatewayURL = `http://localhost:${port}`;
@@ -2165,6 +2187,25 @@ module.exports = {
   console.log(`${BOLD}${GREEN}Bridge is running.${RESET} Waiting for Navigator to connect...`);
   console.log(`${DIM}Press Ctrl+C to stop.${RESET}\n`);
 
+  // ── Relay heartbeat — re-register every 5 minutes to prevent expiry ──
+  // Cloudflare KV entries may expire. This keeps our pairing code fresh
+  // so Navigator can always resolve it, even after long idle periods.
+  if (tunnelURL || gatewayURL) {
+    const relayHeartbeat = async () => {
+      const currentURL = tunnelURL || gatewayURL;
+      const ok = await registerWithRelay(pairingCode, currentURL, token, displayName);
+      if (ok) {
+        info(`  ${DIM}Relay heartbeat: code ${pairingCode} refreshed${RESET}`);
+      } else {
+        warn(`Relay heartbeat failed — Navigator may not be able to resolve code`);
+      }
+    };
+    // First heartbeat immediately (in case initial registration failed)
+    relayHeartbeat();
+    // Then every 5 minutes
+    setInterval(relayHeartbeat, 5 * 60 * 1000);
+  }
+
   // ── Step 6 (optional): Start MCP server + register with mcporter ────
   let mcpProcess = null;
   if (withMcp) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-navigator",
-  "version": "5.7.2",
+  "version": "5.7.4",
   "description": "One-command bridge + tunnel for the Navigator browser — works on any machine, any OS",
   "keywords": [
     "browser",