pubblue 0.4.7 → 0.4.10

package/dist/index.js

@@ -1,10 +1,15 @@
 #!/usr/bin/env node
+import {
+  getSocketPath,
+  ipcCall
+} from "./chunk-HJ5LTUHS.js";
 import {
   TunnelApiClient,
   TunnelApiError
-} from "./chunk-F4VBBHDR.js";
+} from "./chunk-7NFHPJ76.js";
 import {
   CHANNELS,
+  CONTROL_CHANNEL,
   generateMessageId
 } from "./chunk-MW35LBNH.js";
 
@@ -45,7 +50,7 @@ function loadConfig(homeDir) {
 }
 function saveConfig(config, homeDir) {
   const configPath = getConfigPath(homeDir);
-  fs.writeFileSync(configPath, `${JSON.stringify({ apiKey: config.apiKey }, null, 2)}
+  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}
 `, {
     mode: 384
   });
@@ -58,10 +63,10 @@ function getConfig(homeDir) {
   const envKey = process.env.PUBBLUE_API_KEY;
   const envUrl = process.env.PUBBLUE_URL;
   const baseUrl = envUrl || DEFAULT_BASE_URL;
+  const saved = loadConfig(homeDir);
   if (envKey) {
-    return { apiKey: envKey, baseUrl };
+    return { apiKey: envKey, baseUrl, bridge: saved?.bridge };
   }
-  const saved = loadConfig(homeDir);
   if (!saved) {
     throw new Error(
       "Not configured. Run `pubblue configure` or set PUBBLUE_API_KEY environment variable."
@@ -69,62 +74,11 @@ function getConfig(homeDir) {
   }
   return {
     apiKey: saved.apiKey,
-    baseUrl
+    baseUrl,
+    bridge: saved.bridge
   };
 }
 
-// src/lib/tunnel-ipc.ts
-import * as net from "net";
-function getSocketPath(tunnelId) {
-  return `/tmp/pubblue-${tunnelId}.sock`;
-}
-async function ipcCall(socketPath, request) {
-  return new Promise((resolve3, reject) => {
-    let settled = false;
-    let timeoutId = null;
-    const finish = (fn) => {
-      if (settled) return;
-      settled = true;
-      if (timeoutId) clearTimeout(timeoutId);
-      fn();
-    };
-    const client = net.createConnection(socketPath, () => {
-      client.write(`${JSON.stringify(request)}
-`);
-    });
-    let data = "";
-    client.on("data", (chunk) => {
-      data += chunk.toString();
-      const newlineIdx = data.indexOf("\n");
-      if (newlineIdx !== -1) {
-        const line = data.slice(0, newlineIdx);
-        client.end();
-        try {
-          finish(() => resolve3(JSON.parse(line)));
-        } catch {
-          finish(() => reject(new Error("Invalid response from daemon")));
-        }
-      }
-    });
-    client.on("error", (err) => {
-      if (err.code === "ECONNREFUSED" || err.code === "ENOENT") {
-        finish(() => reject(new Error("Daemon not running. Is the tunnel still active?")));
-      } else {
-        finish(() => reject(err));
-      }
-    });
-    client.on("end", () => {
-      if (!data.includes("\n")) {
-        finish(() => reject(new Error("Daemon closed connection unexpectedly")));
-      }
-    });
-    timeoutId = setTimeout(() => {
-      client.destroy();
-      finish(() => reject(new Error("Daemon request timed out")));
-    }, 1e4);
-  });
-}
-
 // src/commands/tunnel.ts
 var TEXT_FILE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
@@ -190,10 +144,38 @@ function tunnelInfoPath(tunnelId) {
 function tunnelLogPath(tunnelId) {
   return path2.join(tunnelInfoDir(), `${tunnelId}.log`);
 }
-function createApiClient() {
-  const config = getConfig();
+function bridgeInfoPath(tunnelId) {
+  return path2.join(tunnelInfoDir(), `${tunnelId}.bridge.json`);
+}
+function bridgeLogPath(tunnelId) {
+  return path2.join(tunnelInfoDir(), `${tunnelId}.bridge.log`);
+}
+function createApiClient(configOverride) {
+  const config = configOverride || getConfig();
   return new TunnelApiClient(config.baseUrl, config.apiKey);
 }
+function buildBridgeProcessEnv(bridgeConfig) {
+  const env = { ...process.env };
+  if (!bridgeConfig) return env;
+  const setIfMissing = (key, value) => {
+    if (value === void 0 || value === null) return;
+    const current = env[key];
+    if (typeof current === "string" && current.length > 0) return;
+    env[key] = String(value);
+  };
+  setIfMissing("OPENCLAW_PATH", bridgeConfig.openclawPath);
+  setIfMissing("OPENCLAW_SESSION_ID", bridgeConfig.sessionId);
+  setIfMissing("OPENCLAW_THREAD_ID", bridgeConfig.threadId);
+  if (bridgeConfig.deliver !== void 0) {
+    setIfMissing("OPENCLAW_DELIVER", bridgeConfig.deliver ? "1" : "0");
+  }
+  setIfMissing("OPENCLAW_DELIVER_CHANNEL", bridgeConfig.deliverChannel);
+  setIfMissing("OPENCLAW_REPLY_TO", bridgeConfig.replyTo);
+  if (bridgeConfig.deliverTimeoutMs !== void 0) {
+    setIfMissing("OPENCLAW_DELIVER_TIMEOUT_MS", bridgeConfig.deliverTimeoutMs);
+  }
+  return env;
+}
 async function ensureNodeDatachannelAvailable() {
   try {
     await import("node-datachannel");
@@ -220,6 +202,41 @@ function isDaemonRunning(tunnelId) {
     return false;
   }
 }
+function readBridgeProcessInfo(tunnelId) {
+  const infoPath = bridgeInfoPath(tunnelId);
+  if (!fs2.existsSync(infoPath)) return null;
+  try {
+    return JSON.parse(fs2.readFileSync(infoPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function isBridgeRunning(tunnelId) {
+  const infoPath = bridgeInfoPath(tunnelId);
+  if (!fs2.existsSync(infoPath)) return false;
+  try {
+    const info = JSON.parse(fs2.readFileSync(infoPath, "utf-8"));
+    process.kill(info.pid, 0);
+    return true;
+  } catch {
+    try {
+      fs2.unlinkSync(infoPath);
+    } catch {
+    }
+    return false;
+  }
+}
+function stopBridgeProcess(tunnelId) {
+  const info = readBridgeProcessInfo(tunnelId);
+  if (!info || !Number.isFinite(info.pid)) return;
+  try {
+    process.kill(info.pid, "SIGTERM");
+  } catch {
+  }
+}
+function buildBridgeForkStdio(logFd) {
+  return ["ignore", logFd, logFd, "ipc"];
+}
 function getFollowReadDelayMs(disconnected, consecutiveFailures) {
   if (!disconnected) return 1e3;
   return Math.min(5e3, 1e3 * 2 ** Math.min(consecutiveFailures, 3));
@@ -230,6 +247,28 @@ function resolveTunnelIdSelection(tunnelIdArg, tunnelOpt) {
 function buildDaemonForkStdio(logFd) {
   return ["ignore", logFd, logFd, "ipc"];
 }
+function parsePositiveIntegerOption(raw, optionName) {
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${optionName} must be a positive integer. Received: ${raw}`);
+  }
+  return parsed;
+}
+function parseBridgeMode(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "openclaw" || normalized === "none") {
+    return normalized;
+  }
+  throw new Error(`--bridge must be one of: openclaw, none. Received: ${raw}`);
+}
+function messageContainsPong(payload) {
+  if (!payload || typeof payload !== "object") return false;
+  const message = payload.msg;
+  if (!message || typeof message !== "object") return false;
+  const type = message.type;
+  const data = message.data;
+  return type === "text" && typeof data === "string" && data.trim().toLowerCase() === "pong";
+}
 function getPublicTunnelUrl(tunnelId) {
   const base = process.env.PUBBLUE_PUBLIC_URL || "https://pub.blue";
   return `${base.replace(/\/$/, "")}/t/${tunnelId}`;
@@ -269,186 +308,263 @@ async function cleanupCreatedTunnelOnStartFailure(apiClient, target) {
 }
 function registerTunnelCommands(program2) {
   const tunnel = program2.command("tunnel").description("P2P encrypted tunnel to browser");
-  tunnel.command("start").description("Start a tunnel daemon (reuses existing tunnel when possible)").option("--expires <duration>", "Auto-close after duration (e.g. 4h, 1d)", "24h").option("-t, --tunnel <tunnelId>", "Attach/start daemon for an existing tunnel").option("--new", "Always create a new tunnel (skip single-tunnel reuse)").option("--foreground", "Run in foreground (don't fork)").action(async (opts) => {
-    await ensureNodeDatachannelAvailable();
-    const apiClient = createApiClient();
-    let target = null;
-    if (opts.tunnel) {
+  tunnel.command("start").description("Start a tunnel daemon (reuses existing tunnel when possible)").option("--expires <duration>", "Auto-close after duration (e.g. 4h, 1d)", "24h").option("-t, --tunnel <tunnelId>", "Attach/start daemon for an existing tunnel").option("--new", "Always create a new tunnel (skip single-tunnel reuse)").option("--bridge <mode>", "Bridge mode: openclaw|none").option("--foreground", "Run in foreground (don't fork, no managed bridge)").action(
+    async (opts) => {
+      await ensureNodeDatachannelAvailable();
+      const runtimeConfig = getConfig();
+      const apiClient = createApiClient(runtimeConfig);
+      let target = null;
+      let bridgeMode;
       try {
-        const existing = await apiClient.get(opts.tunnel);
-        if (existing.status === "closed" || existing.expiresAt <= Date.now()) {
-          console.error(`Tunnel ${opts.tunnel} is closed or expired.`);
-          process.exit(1);
-        }
-        target = {
-          createdNew: false,
-          expiresAt: existing.expiresAt,
-          mode: "existing",
-          tunnelId: existing.tunnelId,
-          url: getPublicTunnelUrl(existing.tunnelId)
-        };
+        bridgeMode = parseBridgeMode(opts.bridge || runtimeConfig.bridge?.mode || "openclaw");
       } catch (error) {
-        console.error(`Failed to use tunnel ${opts.tunnel}: ${formatApiError(error)}`);
+        console.error(error instanceof Error ? error.message : String(error));
         process.exit(1);
       }
-    } else if (!opts.new) {
-      try {
-        const listed = await apiClient.list();
-        const active = listed.filter((t) => t.status === "active" && t.expiresAt > Date.now()).sort((a, b) => b.createdAt - a.createdAt);
-        const reusable = pickReusableTunnel(listed);
-        if (reusable) {
+      const bridgeProcessEnv = buildBridgeProcessEnv(runtimeConfig.bridge);
+      if (opts.tunnel) {
+        try {
+          const existing = await apiClient.get(opts.tunnel);
+          if (existing.status === "closed" || existing.expiresAt <= Date.now()) {
+            console.error(`Tunnel ${opts.tunnel} is closed or expired.`);
+            process.exit(1);
+          }
           target = {
             createdNew: false,
-            expiresAt: reusable.expiresAt,
+            expiresAt: existing.expiresAt,
             mode: "existing",
-            tunnelId: reusable.tunnelId,
-            url: getPublicTunnelUrl(reusable.tunnelId)
+            tunnelId: existing.tunnelId,
+            url: getPublicTunnelUrl(existing.tunnelId)
           };
-          if (active.length > 1) {
-            console.error(
-              [
-                `Multiple active tunnels found: ${active.map((t) => t.tunnelId).join(", ")}`,
-                `Reusing most recent active tunnel ${reusable.tunnelId}.`,
-                "Use --tunnel <id> to choose explicitly or --new to force creation."
-              ].join("\n")
-            );
-          } else {
-            console.error(
-              `Reusing existing active tunnel ${reusable.tunnelId}. Use --new to force creation.`
-            );
+        } catch (error) {
+          console.error(`Failed to use tunnel ${opts.tunnel}: ${formatApiError(error)}`);
+          process.exit(1);
+        }
+      } else if (!opts.new) {
+        try {
+          const listed = await apiClient.list();
+          const active = listed.filter((t) => t.status === "active" && t.expiresAt > Date.now()).sort((a, b) => b.createdAt - a.createdAt);
+          const reusable = pickReusableTunnel(listed);
+          if (reusable) {
+            target = {
+              createdNew: false,
+              expiresAt: reusable.expiresAt,
+              mode: "existing",
+              tunnelId: reusable.tunnelId,
+              url: getPublicTunnelUrl(reusable.tunnelId)
+            };
+            if (active.length > 1) {
+              console.error(
+                [
+                  `Multiple active tunnels found: ${active.map((t) => t.tunnelId).join(", ")}`,
+                  `Reusing most recent active tunnel ${reusable.tunnelId}.`,
+                  "Use --tunnel <id> to choose explicitly or --new to force creation."
+                ].join("\n")
+              );
+            } else {
+              console.error(
+                `Reusing existing active tunnel ${reusable.tunnelId}. Use --new to force creation.`
+              );
+            }
           }
+        } catch (error) {
+          console.error(`Failed to list tunnels for reuse check: ${formatApiError(error)}`);
+          process.exit(1);
         }
-      } catch (error) {
-        console.error(`Failed to list tunnels for reuse check: ${formatApiError(error)}`);
-        process.exit(1);
       }
-    }
-    if (!target) {
-      try {
-        const created = await apiClient.create({
-          expiresIn: opts.expires
-        });
-        target = {
-          createdNew: true,
-          expiresAt: created.expiresAt,
-          mode: "created",
-          tunnelId: created.tunnelId,
-          url: created.url
-        };
-      } catch (error) {
-        console.error(`Failed to create tunnel: ${formatApiError(error)}`);
-        process.exit(1);
+      if (!target) {
+        try {
+          const created = await apiClient.create({
+            expiresIn: opts.expires
+          });
+          target = {
+            createdNew: true,
+            expiresAt: created.expiresAt,
+            mode: "created",
+            tunnelId: created.tunnelId,
+            url: created.url
+          };
+        } catch (error) {
+          console.error(`Failed to create tunnel: ${formatApiError(error)}`);
+          process.exit(1);
+        }
       }
-    }
-    if (!target) {
-      console.error("Failed to resolve tunnel target.");
-      process.exit(1);
-    }
-    const socketPath = getSocketPath(target.tunnelId);
-    const infoPath = tunnelInfoPath(target.tunnelId);
-    const logPath = tunnelLogPath(target.tunnelId);
-    if (opts.foreground) {
-      const { startDaemon } = await import("./tunnel-daemon-4LV6HLYN.js");
-      console.log(`Tunnel started: ${target.url}`);
-      console.log(`Tunnel ID: ${target.tunnelId}`);
-      console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-      if (target.mode === "existing") console.log("Mode: attached existing tunnel");
-      console.log("Running in foreground. Press Ctrl+C to stop.");
-      try {
-        await startDaemon({
-          tunnelId: target.tunnelId,
-          apiClient,
-          socketPath,
-          infoPath
-        });
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.error(`Daemon failed: ${message}`);
+      if (!target) {
+        console.error("Failed to resolve tunnel target.");
         process.exit(1);
       }
-    } else {
-      if (isDaemonRunning(target.tunnelId)) {
-        try {
-          const status = await ipcCall(socketPath, { method: "status", params: {} });
-          if (!status.ok) throw new Error(String(status.error || "status check failed"));
-        } catch (error) {
+      const socketPath = getSocketPath(target.tunnelId);
+      const infoPath = tunnelInfoPath(target.tunnelId);
+      const logPath = tunnelLogPath(target.tunnelId);
+      if (opts.foreground) {
+        if (bridgeMode !== "none") {
           console.error(
-            `Daemon process exists but is not responding: ${error instanceof Error ? error.message : String(error)}`
+            "Foreground mode disables managed bridge process. Use background mode for --bridge openclaw."
           );
-          console.error("Run `pubblue tunnel close <id>` and start again.");
-          process.exit(1);
         }
+        const { startDaemon } = await import("./tunnel-daemon-4LV6HLYN.js");
         console.log(`Tunnel started: ${target.url}`);
         console.log(`Tunnel ID: ${target.tunnelId}`);
         console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-        console.log("Daemon already running for this tunnel.");
-        console.log(`Daemon log: ${logPath}`);
-        return;
-      }
-      const daemonScript = path2.join(import.meta.dirname, "tunnel-daemon-entry.js");
-      const config = getConfig();
-      const daemonLogFd = fs2.openSync(logPath, "a");
-      const child = fork(daemonScript, [], {
-        detached: true,
-        stdio: buildDaemonForkStdio(daemonLogFd),
-        env: {
-          ...process.env,
-          PUBBLUE_DAEMON_TUNNEL_ID: target.tunnelId,
-          PUBBLUE_DAEMON_BASE_URL: config.baseUrl,
-          PUBBLUE_DAEMON_API_KEY: config.apiKey,
-          PUBBLUE_DAEMON_SOCKET: socketPath,
-          PUBBLUE_DAEMON_INFO: infoPath
+        if (target.mode === "existing") console.log("Mode: attached existing tunnel");
+        console.log("Running in foreground. Press Ctrl+C to stop.");
+        try {
+          await startDaemon({
+            tunnelId: target.tunnelId,
+            apiClient,
+            socketPath,
+            infoPath
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          console.error(`Daemon failed: ${message}`);
+          process.exit(1);
         }
-      });
-      fs2.closeSync(daemonLogFd);
-      if (child.connected) {
-        child.disconnect();
-      }
-      child.unref();
-      console.log(`Starting daemon for tunnel ${target.tunnelId}...`);
-      const ready = await waitForDaemonReady({
-        child,
-        infoPath,
-        socketPath,
-        timeoutMs: 8e3
-      });
-      if (!ready.ok) {
-        console.error(`Daemon failed to start: ${ready.reason ?? "unknown reason"}`);
-        console.error(`Daemon log: ${logPath}`);
-        const tail = readLogTail(logPath);
-        if (tail) {
-          console.error("---- daemon log tail ----");
-          console.error(tail.trimEnd());
-          console.error("---- end daemon log tail ----");
+      } else {
+        if (isDaemonRunning(target.tunnelId)) {
+          try {
+            const status = await ipcCall(socketPath, { method: "status", params: {} });
+            if (!status.ok) throw new Error(String(status.error || "status check failed"));
+          } catch (error) {
+            console.error(
+              `Daemon process exists but is not responding: ${error instanceof Error ? error.message : String(error)}`
+            );
+            console.error("Run `pubblue tunnel close <id>` and start again.");
+            process.exit(1);
+          }
+          if (bridgeMode !== "none") {
+            const bridgeReady = await ensureBridgeReady({
+              bridgeMode,
+              tunnelId: target.tunnelId,
+              socketPath,
+              bridgeProcessEnv,
+              timeoutMs: 8e3
+            });
+            if (!bridgeReady.ok) {
+              console.error(
+                `Bridge failed to start for running tunnel: ${bridgeReady.reason ?? "unknown reason"}`
+              );
+              const existingBridgeLog = bridgeLogPath(target.tunnelId);
+              if (fs2.existsSync(existingBridgeLog)) {
+                console.error(`Bridge log: ${existingBridgeLog}`);
+                const bridgeTail = readLogTail(existingBridgeLog);
+                if (bridgeTail) {
+                  console.error("---- bridge log tail ----");
+                  console.error(bridgeTail.trimEnd());
+                  console.error("---- end bridge log tail ----");
+                }
+              }
+              process.exit(1);
+            }
+          }
+          console.log(`Tunnel started: ${target.url}`);
+          console.log(`Tunnel ID: ${target.tunnelId}`);
+          console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
+          console.log("Daemon already running for this tunnel.");
+          console.log(`Daemon log: ${logPath}`);
+          if (bridgeMode !== "none") {
+            console.log("Bridge mode: openclaw");
+            console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
+          }
+          return;
         }
-        await cleanupCreatedTunnelOnStartFailure(apiClient, target);
-        process.exit(1);
-      }
-      const offerReady = await waitForAgentOffer({
-        apiClient,
-        tunnelId: target.tunnelId,
-        timeoutMs: 5e3
-      });
-      if (!offerReady.ok) {
-        console.error(`Daemon started but signaling is not ready: ${offerReady.reason}`);
-        console.error(`Daemon log: ${logPath}`);
-        const tail = readLogTail(logPath);
-        if (tail) {
-          console.error("---- daemon log tail ----");
-          console.error(tail.trimEnd());
-          console.error("---- end daemon log tail ----");
+        const daemonScript = path2.join(import.meta.dirname, "tunnel-daemon-entry.js");
+        const config = getConfig();
+        const daemonLogFd = fs2.openSync(logPath, "a");
+        const child = fork(daemonScript, [], {
+          detached: true,
+          stdio: buildDaemonForkStdio(daemonLogFd),
+          env: {
+            ...process.env,
+            PUBBLUE_DAEMON_TUNNEL_ID: target.tunnelId,
+            PUBBLUE_DAEMON_BASE_URL: config.baseUrl,
+            PUBBLUE_DAEMON_API_KEY: config.apiKey,
+            PUBBLUE_DAEMON_SOCKET: socketPath,
+            PUBBLUE_DAEMON_INFO: infoPath
+          }
+        });
+        fs2.closeSync(daemonLogFd);
+        if (child.connected) {
+          child.disconnect();
+        }
+        child.unref();
+        console.log(`Starting daemon for tunnel ${target.tunnelId}...`);
+        const ready = await waitForDaemonReady({
+          child,
+          infoPath,
+          socketPath,
+          timeoutMs: 8e3
+        });
+        if (!ready.ok) {
+          console.error(`Daemon failed to start: ${ready.reason ?? "unknown reason"}`);
+          console.error(`Daemon log: ${logPath}`);
+          const tail = readLogTail(logPath);
+          if (tail) {
+            console.error("---- daemon log tail ----");
+            console.error(tail.trimEnd());
+            console.error("---- end daemon log tail ----");
+          }
+          await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+          process.exit(1);
+        }
+        const offerReady = await waitForAgentOffer({
+          apiClient,
+          tunnelId: target.tunnelId,
+          timeoutMs: 5e3
+        });
+        if (!offerReady.ok) {
+          console.error(`Daemon started but signaling is not ready: ${offerReady.reason}`);
+          console.error(`Daemon log: ${logPath}`);
+          const tail = readLogTail(logPath);
+          if (tail) {
+            console.error("---- daemon log tail ----");
+            console.error(tail.trimEnd());
+            console.error("---- end daemon log tail ----");
+          }
+          await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+          process.exit(1);
+        }
+        if (bridgeMode !== "none") {
+          const bridgeReady = await ensureBridgeReady({
+            bridgeMode,
+            tunnelId: target.tunnelId,
+            socketPath,
+            bridgeProcessEnv,
+            timeoutMs: 8e3
+          });
+          if (!bridgeReady.ok) {
+            console.error(`Bridge failed to start: ${bridgeReady.reason ?? "unknown reason"}`);
+            const bridgeLog = bridgeLogPath(target.tunnelId);
+            if (fs2.existsSync(bridgeLog)) {
+              console.error(`Bridge log: ${bridgeLog}`);
+              const bridgeTail = readLogTail(bridgeLog);
+              if (bridgeTail) {
+                console.error("---- bridge log tail ----");
+                console.error(bridgeTail.trimEnd());
+                console.error("---- end bridge log tail ----");
+              }
+            }
+            try {
+              await ipcCall(socketPath, { method: "close", params: {} });
+            } catch {
+            }
+            await cleanupCreatedTunnelOnStartFailure(apiClient, target);
+            process.exit(1);
+          }
+        }
+        console.log(`Tunnel started: ${target.url}`);
+        console.log(`Tunnel ID: ${target.tunnelId}`);
+        console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
+        if (target.mode === "existing") console.log("Mode: attached existing tunnel");
+        console.log("Daemon health: OK");
+        console.log(`Daemon log: ${logPath}`);
+        if (bridgeMode !== "none") {
+          console.log("Bridge mode: openclaw");
+          console.log(`Bridge log: ${bridgeLogPath(target.tunnelId)}`);
         }
-        await cleanupCreatedTunnelOnStartFailure(apiClient, target);
-        process.exit(1);
       }
-      console.log(`Tunnel started: ${target.url}`);
-      console.log(`Tunnel ID: ${target.tunnelId}`);
-      console.log(`Expires: ${new Date(target.expiresAt).toISOString()}`);
-      if (target.mode === "existing") console.log("Mode: attached existing tunnel");
-      console.log("Daemon health: OK");
-      console.log(`Daemon log: ${logPath}`);
     }
-  });
+  );
   tunnel.command("write").description("Write data to a channel").argument("[message]", "Text message (or use --file)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("-c, --channel <channel>", "Channel name", "chat").option("-f, --file <file>", "Read content from file").action(
     async (messageArg, opts) => {
       let msg;
@@ -586,7 +702,148 @@ function registerTunnelCommands(program2) {
     if (fs2.existsSync(logPath)) {
       console.log(`  Log: ${logPath}`);
     }
+    const bridgeInfo = readBridgeProcessInfo(tunnelId);
+    if (bridgeInfo) {
+      const bridgeRunning = isBridgeRunning(tunnelId);
+      const bridgeState = bridgeInfo.status || (bridgeRunning ? "running" : "stopped");
+      console.log(`  Bridge: ${bridgeInfo.mode} (${bridgeState})`);
+      if (bridgeInfo.sessionId) {
+        console.log(`  Bridge session: ${bridgeInfo.sessionId}`);
+      }
+      if (!bridgeRunning && bridgeInfo.lastError) {
+        console.log(`  Bridge error: ${bridgeInfo.lastError}`);
+      }
+    }
+    const bridgeLog = bridgeLogPath(tunnelId);
+    if (fs2.existsSync(bridgeLog)) {
+      console.log(`  Bridge log: ${bridgeLog}`);
+    }
   });
+  tunnel.command("doctor").description("Run strict end-to-end tunnel checks (daemon, channels, chat/canvas ping)").option("-t, --tunnel <tunnelId>", "Tunnel ID (auto-detected if one active)").option("--timeout <seconds>", "Timeout for pong wait and repeated reads", "30").option("--wait-pong", "Wait for user to reply with exact text 'pong' on chat channel").option("--skip-chat", "Skip chat ping check").option("--skip-canvas", "Skip canvas ping check").action(
+    async (opts) => {
+      const timeoutSeconds = parsePositiveIntegerOption(opts.timeout, "--timeout");
+      const timeoutMs = timeoutSeconds * 1e3;
+      const tunnelId = opts.tunnel || await resolveActiveTunnel();
+      const socketPath = getSocketPath(tunnelId);
+      const apiClient = createApiClient();
+      const fail = (message) => {
+        console.error(`Doctor failed: ${message}`);
+        process.exit(1);
+      };
+      console.log(`Doctor tunnel: ${tunnelId}`);
+      let statusResponse = null;
+      try {
+        statusResponse = await ipcCall(socketPath, {
+          method: "status",
+          params: {}
+        });
+      } catch (error) {
+        fail(
+          `daemon is unreachable (${error instanceof Error ? error.message : String(error)}).`
+        );
+      }
+      if (!statusResponse) {
+        fail("daemon status returned no response.");
+      }
+      const daemonStatus = statusResponse;
+      if (!daemonStatus.ok) {
+        fail(`daemon returned non-ok status: ${String(daemonStatus.error || "unknown error")}`);
+      }
+      if (!daemonStatus.connected) {
+        fail("daemon is running but browser is not connected.");
+      }
+      const channelNames = Array.isArray(daemonStatus.channels) ? daemonStatus.channels.map((entry) => String(entry)) : [];
+      for (const required of [CONTROL_CHANNEL, CHANNELS.CHAT, CHANNELS.CANVAS]) {
+        if (!channelNames.includes(required)) {
+          fail(`required channel is missing: ${required}`);
+        }
+      }
+      console.log("Daemon/channel check: OK");
+      let tunnelInfo = null;
+      try {
+        tunnelInfo = await apiClient.get(tunnelId);
+      } catch (error) {
+        fail(`failed to fetch tunnel info from API: ${formatApiError(error)}`);
+      }
+      if (!tunnelInfo) {
+        fail("API returned no tunnel payload.");
+      }
+      const apiTunnel = tunnelInfo;
+      if (apiTunnel.status !== "active") {
+        fail(`API reports tunnel is not active (status: ${apiTunnel.status})`);
+      }
+      if (apiTunnel.expiresAt <= Date.now()) {
+        fail("API reports tunnel is expired.");
+      }
+      if (!apiTunnel.hasConnection) {
+        fail("API reports no browser connection.");
+      }
+      if (typeof apiTunnel.agentOffer !== "string" || apiTunnel.agentOffer.length === 0) {
+        fail("agent offer was not published.");
+      }
+      console.log("API/signaling check: OK");
+      if (!opts.skipChat) {
+        const pingText = "This is a ping test. Reply with 'pong'.";
+        const pingMsg = {
+          id: generateMessageId(),
+          type: "text",
+          data: pingText
+        };
+        const writeResponse = await ipcCall(socketPath, {
+          method: "write",
+          params: { channel: CHANNELS.CHAT, msg: pingMsg }
+        });
+        if (!writeResponse.ok) {
+          fail(`chat ping failed: ${String(writeResponse.error || "unknown write error")}`);
+        }
+        console.log("Chat ping write ACK: OK");
+        if (opts.waitPong) {
+          const startedAt = Date.now();
+          let receivedPong = false;
+          while (Date.now() - startedAt < timeoutMs) {
+            const readResponse = await ipcCall(socketPath, {
+              method: "read",
+              params: { channel: CHANNELS.CHAT }
+            });
+            if (!readResponse.ok) {
+              fail(
+                `chat read failed while waiting for pong: ${String(readResponse.error || "unknown read error")}`
+              );
+            }
+            const messages = Array.isArray(readResponse.messages) ? readResponse.messages : [];
+            if (messages.some((entry) => messageContainsPong(entry))) {
+              receivedPong = true;
+              break;
+            }
+            await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+          }
+          if (!receivedPong) {
+            fail(
+              `timed out after ${timeoutSeconds}s waiting for exact 'pong' reply on chat channel.`
+            );
+          }
+          console.log("Chat pong roundtrip: OK");
+        }
+      }
+      if (!opts.skipCanvas) {
+        const stamp = (/* @__PURE__ */ new Date()).toISOString();
+        const canvasMsg = {
+          id: generateMessageId(),
+          type: "html",
+          data: `<!doctype html><html><body style="margin:0;padding:24px;font-family:system-ui;background:#111;color:#f5f5f5">Canvas ping OK<br><small>${stamp}</small></body></html>`
+        };
+        const canvasResponse = await ipcCall(socketPath, {
+          method: "write",
+          params: { channel: CHANNELS.CANVAS, msg: canvasMsg }
+        });
+        if (!canvasResponse.ok) {
+          fail(`canvas ping failed: ${String(canvasResponse.error || "unknown write error")}`);
+        }
+        console.log("Canvas ping write ACK: OK");
+      }
+      console.log("Tunnel doctor: PASS");
+    }
+  );
   tunnel.command("list").description("List active tunnels").action(async () => {
     const apiClient = createApiClient();
     const tunnels = await apiClient.list();
@@ -597,11 +854,18 @@ function registerTunnelCommands(program2) {
     for (const t of tunnels) {
       const age = Math.floor((Date.now() - t.createdAt) / 6e4);
       const running = isDaemonRunning(t.tunnelId) ? "running" : "no daemon";
+      const bridgeInfo = readBridgeProcessInfo(t.tunnelId);
+      const bridge = bridgeInfo ? isBridgeRunning(t.tunnelId) ? `${bridgeInfo.mode}:running` : `${bridgeInfo.mode}:stopped` : "none";
       const conn = t.hasConnection ? "connected" : "waiting";
-      console.log(`  ${t.tunnelId}  ${conn}  ${running}  ${age}m ago`);
+      console.log(`  ${t.tunnelId}  ${conn}  ${running}  bridge=${bridge}  ${age}m ago`);
     }
   });
   tunnel.command("close").description("Close a tunnel and stop its daemon").argument("<tunnelId>", "Tunnel ID").action(async (tunnelId) => {
+    stopBridgeProcess(tunnelId);
+    try {
+      fs2.unlinkSync(bridgeInfoPath(tunnelId));
+    } catch {
+    }
     const socketPath = getSocketPath(tunnelId);
     try {
       await ipcCall(socketPath, { method: "close", params: {} });
@@ -622,7 +886,7 @@ function registerTunnelCommands(program2) {
 }
 async function resolveActiveTunnel() {
   const dir = tunnelInfoDir();
-  const files = fs2.readdirSync(dir).filter((f) => f.endsWith(".json"));
+  const files = fs2.readdirSync(dir).filter((f) => f.endsWith(".json") && !f.endsWith(".bridge.json"));
   const active = [];
   for (const f of files) {
     const tunnelId = f.replace(".json", "");
@@ -695,6 +959,94 @@ async function waitForAgentOffer(params) {
     reason: lastError ? `agent offer was not published in time (last API error: ${lastError})` : "agent offer was not published in time"
   };
 }
+async function ensureBridgeReady(params) {
+  if (params.bridgeMode === "none") {
+    return { ok: true };
+  }
+  const infoPath = bridgeInfoPath(params.tunnelId);
+  if (isBridgeRunning(params.tunnelId)) {
+    return waitForBridgeReady({
+      infoPath,
+      tunnelId: params.tunnelId,
+      timeoutMs: params.timeoutMs
+    });
+  }
+  const bridgeScript = path2.join(import.meta.dirname, "tunnel-bridge-entry.js");
+  const logPath = bridgeLogPath(params.tunnelId);
+  const logFd = fs2.openSync(logPath, "a");
+  const child = fork(bridgeScript, [], {
+    detached: true,
+    stdio: buildBridgeForkStdio(logFd),
+    env: {
+      ...params.bridgeProcessEnv,
+      PUBBLUE_BRIDGE_MODE: params.bridgeMode,
+      PUBBLUE_BRIDGE_TUNNEL_ID: params.tunnelId,
+      PUBBLUE_BRIDGE_SOCKET: params.socketPath,
+      PUBBLUE_BRIDGE_INFO: infoPath
+    }
+  });
+  fs2.closeSync(logFd);
+  if (child.connected) {
+    child.disconnect();
+  }
+  child.unref();
+  return waitForBridgeReady({
+    child,
+    infoPath,
+    tunnelId: params.tunnelId,
+    timeoutMs: params.timeoutMs
+  });
+}
+function waitForBridgeReady({
+  child,
+  infoPath,
+  tunnelId,
+  timeoutMs
+}) {
+  return new Promise((resolve3) => {
+    let settled = false;
+    let lastState;
+    let lastError;
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearInterval(poll);
+      clearTimeout(timeout);
+      if (child) {
+        child.off("exit", onExit);
+      }
+      resolve3(result);
+    };
+    const onExit = (code, signal) => {
+      const suffix = signal ? ` (signal ${signal})` : "";
+      done({ ok: false, reason: `bridge exited with code ${code ?? 0}${suffix}` });
+    };
+    if (child) {
+      child.on("exit", onExit);
+    }
+    const poll = setInterval(() => {
+      if (!fs2.existsSync(infoPath)) return;
+      const info = readBridgeProcessInfo(tunnelId);
+      if (!info) return;
+      lastState = info.status;
+      lastError = info.lastError;
+      if (info.status === "ready" && isBridgeRunning(tunnelId)) {
+        done({ ok: true });
+        return;
+      }
+      if (info.status === "error") {
+        done({
+          ok: false,
+          reason: info.lastError ? `bridge reported startup error: ${info.lastError}` : "bridge reported startup error"
+        });
+      }
+    }, 120);
+    const timeout = setTimeout(() => {
+      const reason = lastError && lastError.length > 0 ? `timed out after ${timeoutMs}ms waiting for bridge readiness (last error: ${lastError})` : `timed out after ${timeoutMs}ms waiting for bridge readiness (state: ${lastState || "unknown"})`;
+      done({ ok: false, reason });
+    }, timeoutMs);
+  });
+}
 
 // src/lib/api.ts
 var PubApiClient = class {
@@ -808,6 +1160,143 @@ async function resolveConfigureApiKey(opts) {
   }
   return readApiKeyFromPrompt();
 }
+function collectValues(value, previous) {
+  previous.push(value);
+  return previous;
+}
+function parseSetInput(raw) {
+  const sepIndex = raw.indexOf("=");
+  if (sepIndex <= 0 || sepIndex === raw.length - 1) {
+    throw new Error(`Invalid --set entry "${raw}". Use key=value.`);
+  }
+  return {
+    key: raw.slice(0, sepIndex).trim(),
+    value: raw.slice(sepIndex + 1).trim()
+  };
+}
+function parseBooleanValue(raw, key) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "1" || normalized === "true" || normalized === "yes" || normalized === "on")
+    return true;
+  if (normalized === "0" || normalized === "false" || normalized === "no" || normalized === "off")
+    return false;
+  throw new Error(`Invalid boolean value for ${key}: ${raw}`);
+}
+function parseBridgeModeValue(raw) {
+  const normalized = raw.trim().toLowerCase();
+  if (normalized === "openclaw" || normalized === "none") return normalized;
+  throw new Error(`Invalid bridge mode: ${raw}. Use openclaw or none.`);
+}
+function parsePositiveInteger(raw, key) {
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    throw new Error(`${key} must be a positive integer. Received: ${raw}`);
+  }
+  return parsed;
+}
+function applyBridgeSet(bridge, key, value) {
+  switch (key) {
+    case "bridge.mode":
+      bridge.mode = parseBridgeModeValue(value);
+      return;
+    case "openclaw.path":
+      bridge.openclawPath = value;
+      return;
+    case "openclaw.sessionId":
+      bridge.sessionId = value;
+      return;
+    case "openclaw.threadId":
+      bridge.threadId = value;
+      return;
+    case "openclaw.deliver":
+      bridge.deliver = parseBooleanValue(value, key);
+      return;
+    case "openclaw.deliverChannel":
+      bridge.deliverChannel = value;
+      return;
+    case "openclaw.replyTo":
+      bridge.replyTo = value;
+      return;
+    case "openclaw.deliverTimeoutMs":
+      bridge.deliverTimeoutMs = parsePositiveInteger(value, key);
+      return;
+    default:
+      throw new Error(
+        [
+          `Unknown config key: ${key}`,
+          "Supported keys:",
+          "  bridge.mode",
+          "  openclaw.path",
+          "  openclaw.sessionId",
+          "  openclaw.threadId",
+          "  openclaw.deliver",
+          "  openclaw.deliverChannel",
+          "  openclaw.replyTo",
+          "  openclaw.deliverTimeoutMs"
+        ].join("\n")
+      );
+  }
+}
+function applyBridgeUnset(bridge, key) {
+  switch (key) {
+    case "bridge.mode":
+      delete bridge.mode;
+      return;
+    case "openclaw.path":
+      delete bridge.openclawPath;
+      return;
+    case "openclaw.sessionId":
+      delete bridge.sessionId;
+      return;
+    case "openclaw.threadId":
+      delete bridge.threadId;
+      return;
+    case "openclaw.deliver":
+      delete bridge.deliver;
+      return;
+    case "openclaw.deliverChannel":
+      delete bridge.deliverChannel;
+      return;
+    case "openclaw.replyTo":
+      delete bridge.replyTo;
+      return;
+    case "openclaw.deliverTimeoutMs":
+      delete bridge.deliverTimeoutMs;
+      return;
+    default:
+      throw new Error(`Unknown config key for --unset: ${key}`);
+  }
+}
+function hasBridgeValues(bridge) {
+  return Object.values(bridge).some((value) => value !== void 0);
+}
+function maskApiKey(apiKey) {
+  if (apiKey.length <= 8) return "********";
+  return `${apiKey.slice(0, 4)}...${apiKey.slice(-4)}`;
+}
+function printConfigSummary(saved) {
+  if (!saved) {
+    console.log("Saved config: none");
+    return;
+  }
+  console.log("Saved config:");
+  console.log(`  apiKey: ${maskApiKey(saved.apiKey)}`);
+  if (!saved.bridge || !hasBridgeValues(saved.bridge)) {
+    console.log("  bridge: none");
+    return;
+  }
+  console.log(`  bridge.mode: ${saved.bridge.mode ?? "(unset)"}`);
+  if (saved.bridge.openclawPath) console.log(`  openclaw.path: ${saved.bridge.openclawPath}`);
+  if (saved.bridge.sessionId) console.log(`  openclaw.sessionId: ${saved.bridge.sessionId}`);
+  if (saved.bridge.threadId) console.log(`  openclaw.threadId: ${saved.bridge.threadId}`);
+  if (saved.bridge.deliver !== void 0)
+    console.log(`  openclaw.deliver: ${saved.bridge.deliver ? "true" : "false"}`);
+  if (saved.bridge.deliverChannel)
+    console.log(`  openclaw.deliverChannel: ${saved.bridge.deliverChannel}`);
+  if (saved.bridge.replyTo) console.log(`  openclaw.replyTo: ${saved.bridge.replyTo}`);
+  if (saved.bridge.deliverTimeoutMs !== void 0)
+    console.log(`  openclaw.deliverTimeoutMs: ${saved.bridge.deliverTimeoutMs}`);
+}
 function resolveVisibilityFlags(opts) {
   if (opts.public && opts.private) {
     throw new Error(`Use only one of --public or --private for ${opts.commandName}.`);
@@ -827,18 +1316,62 @@ function readFile(filePath) {
     basename: path3.basename(resolved)
   };
 }
-program.name("pubblue").description("Publish static content and get shareable URLs").version("0.4.7");
-program.command("configure").description("Configure the CLI with your API key").option("--api-key <key>", "Your API key (less secure: appears in shell history)").option("--api-key-stdin", "Read API key from stdin").action(async (opts) => {
-  try {
-    const apiKey = await resolveConfigureApiKey(opts);
-    saveConfig({ apiKey });
-    console.log("Configuration saved.");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : "Failed to configure CLI.";
-    console.error(message);
-    process.exit(1);
+program.name("pubblue").description("Publish static content and get shareable URLs").version("0.4.10");
+program.command("configure").description("Configure the CLI with your API key").option("--api-key <key>", "Your API key (less secure: appears in shell history)").option("--api-key-stdin", "Read API key from stdin").option(
+  "--set <key=value>",
+  "Set advanced config (repeatable). Example: --set openclaw.sessionId=<id>",
+  collectValues,
+  []
+).option("--unset <key>", "Unset advanced config key (repeatable)", collectValues, []).option("--show", "Show saved configuration").action(
+  async (opts) => {
+    try {
+      const saved = loadConfig();
+      const hasApiUpdate = Boolean(opts.apiKey || opts.apiKeyStdin);
+      const hasSet = opts.set.length > 0;
+      const hasUnset = opts.unset.length > 0;
+      const hasMutation = hasApiUpdate || hasSet || hasUnset;
+      if (!hasMutation && opts.show) {
+        printConfigSummary(saved);
+        return;
+      }
+      let apiKey = saved?.apiKey;
+      if (hasApiUpdate || !hasMutation) {
+        apiKey = await resolveConfigureApiKey(opts);
+      }
+      if (!apiKey) {
+        const envKey = process.env.PUBBLUE_API_KEY?.trim();
+        if (envKey) {
+          apiKey = envKey;
+        } else {
+          throw new Error(
+            "No API key available. Provide --api-key/--api-key-stdin (or run plain `pubblue configure` first)."
+          );
+        }
+      }
+      const nextBridge = { ...saved?.bridge ?? {} };
+      for (const entry of opts.set) {
+        const { key, value } = parseSetInput(entry);
+        applyBridgeSet(nextBridge, key, value);
+      }
+      for (const key of opts.unset) {
+        applyBridgeUnset(nextBridge, key.trim());
+      }
+      const nextConfig = {
+        apiKey,
+        bridge: hasBridgeValues(nextBridge) ? nextBridge : void 0
+      };
+      saveConfig(nextConfig);
+      console.log("Configuration saved.");
+      if (opts.show || hasSet || hasUnset) {
+        printConfigSummary(nextConfig);
+      }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "Failed to configure CLI.";
+      console.error(message);
+      process.exit(1);
+    }
   }
-});
+);
 program.command("create").description("Create a new publication").argument("[file]", "Path to the file (reads stdin if omitted)").option("--slug <slug>", "Custom slug for the URL").option("--title <title>", "Title for the publication").option("--public", "Make the publication public").option("--private", "Make the publication private (default)").option("--expires <duration>", "Auto-delete after duration (e.g. 1h, 24h, 7d)").action(
   async (fileArg, opts) => {
     const client = createClient();