import { rm } from "node:fs/promises";

import os from "node:os";

import path from "node:path";

import { definePluginEntry, type OpenClawPluginApi } from "openclaw/plugin-sdk/plugin-entry";

import {

normalizeLowercaseStringOrEmpty,

normalizeOptionalString,

} from "openclaw/plugin-sdk/text-runtime";

import {

clearDeviceBootstrapTokens,

definePluginEntry,

issueDeviceBootstrapToken,

listDevicePairing,

PAIRING_SETUP_BOOTSTRAP_PROFILE,

renderQrPngDataUrl,

writeQrPngTempFile,

revokeDeviceBootstrapToken,

resolveGatewayBindUrl,

resolveGatewayPort,

resolvePreferredOpenClawTmpDir,

runPluginCommandWithTimeout,

resolveTailnetHostWithRunner,

type OpenClawPluginApi,

} from "./api.js";

import {

armPairNotifyOnce,

formatPendingRequests,

handleNotifyCommand,

registerPairingNotifierService,

} from "./notify.js";

import {

approvePendingPairingRequest,

selectPendingApprovalRequest,

} from "./pair-command-approve.js";

import {

buildMissingPairingScopeReply,

resolvePairingCommandAuthState,

} from "./pair-command-auth.js";

type DevicePairApiModule = typeof import("./api.js");

type NotifyModule = typeof import("./notify.js");

type PairCommandApproveModule = typeof import("./pair-command-approve.js");

type PairCommandAuthModule = typeof import("./pair-command-auth.js");

let devicePairApiModulePromise: Promise<DevicePairApiModule> | undefined;

let notifyModulePromise: Promise<NotifyModule> | undefined;

let pairCommandApproveModulePromise: Promise<PairCommandApproveModule> | undefined;

let pairCommandAuthModulePromise: Promise<PairCommandAuthModule> | undefined;

function loadDevicePairApiModule(): Promise<DevicePairApiModule> {

devicePairApiModulePromise ??= import("./api.js");

return devicePairApiModulePromise;

}

function loadNotifyModule(): Promise<NotifyModule> {

notifyModulePromise ??= import("./notify.js");

return notifyModulePromise;

}

function loadPairCommandApproveModule(): Promise<PairCommandApproveModule> {

pairCommandApproveModulePromise ??= import("./pair-command-approve.js");

return pairCommandApproveModulePromise;

}

function loadPairCommandAuthModule(): Promise<PairCommandAuthModule> {

pairCommandAuthModulePromise ??= import("./pair-command-auth.js");

return pairCommandAuthModulePromise;

}

function formatDurationMinutes(expiresAtMs: number): string {

const msRemaining = Math.max(0, expiresAtMs - Date.now());

}

async function resolveTailnetHost(): Promise<string | null> {

const { resolveTailnetHostWithRunner, runPluginCommandWithTimeout } =

await loadDevicePairApiModule();

return await resolveTailnetHostWithRunner((argv, opts) =>

runPluginCommandWithTimeout({

argv,

}

async function resolveGatewayUrl(api: OpenClawPluginApi): Promise<ResolveUrlResult> {

const { resolveGatewayBindUrl, resolveGatewayPort } = await loadDevicePairApiModule();

const cfg = api.config;

const pluginCfg = (api.pluginConfig ?? {}) as DevicePairPluginConfig;

const scheme = resolveScheme(cfg);

}

async function issueSetupPayload(url: string): Promise<SetupPayload> {

const { issueDeviceBootstrapToken, PAIRING_SETUP_BOOTSTRAP_PROFILE } =

await loadDevicePairApiModule();

const issuedBootstrap = await issueDeviceBootstrapToken({

profile: PAIRING_SETUP_BOOTSTRAP_PROFILE,

});

name: "Device Pair",

description: "QR/bootstrap pairing helpers for OpenClaw devices",

register(api: OpenClawPluginApi) {

registerPairingNotifierService(api);

let notifierService: ReturnType<NotifyModule["createPairingNotifierService"]> | undefined;

api.registerService({

id: "device-pair-notifier",

start: async (ctx) => {

const { createPairingNotifierService } = await loadNotifyModule();

notifierService = createPairingNotifierService(api);

await notifierService.start(ctx);

},

stop: async (ctx) => {

await notifierService?.stop?.(ctx);

notifierService = undefined;

},

});

api.registerCommand({

name: "pair",

const gatewayClientScopes = Array.isArray(ctx.gatewayClientScopes)

? ctx.gatewayClientScopes

: undefined;

const { buildMissingPairingScopeReply, resolvePairingCommandAuthState } =

await loadPairCommandAuthModule();

const authState = resolvePairingCommandAuthState({

channel: ctx.channel,

gatewayClientScopes,

);

if (action === "status" || action === "pending") {

const [{ listDevicePairing }, { formatPendingRequests }] = await Promise.all([

loadDevicePairApiModule(),

loadNotifyModule(),

]);

const list = await listDevicePairing();

return { text: formatPendingRequests(list.pending) };

}

if (action === "notify") {

const notifyAction = normalizeLowercaseStringOrEmpty(tokens[1]) || "status";

const { handleNotifyCommand } = await loadNotifyModule();

return await handleNotifyCommand({

api,

ctx,

if (authState.isMissingInternalPairingPrivilege) {

return buildMissingPairingScopeReply();

}

const [

{ listDevicePairing },

{ approvePendingPairingRequest, selectPendingApprovalRequest },

] = await Promise.all([loadDevicePairApiModule(), loadPairCommandApproveModule()]);

const list = await listDevicePairing();

const selected = selectPendingApprovalRequest({

pending: list.pending,

if (authState.isMissingInternalPairingPrivilege) {

return buildMissingPairingScopeReply();

}

const { clearDeviceBootstrapTokens } = await loadDevicePairApiModule();

const cleared = await clearDeviceBootstrapTokens();

return {

text:

if (channel === "telegram" && target) {

try {

const { armPairNotifyOnce } = await loadNotifyModule();

autoNotifyArmed = await armPairNotifyOnce({ api, ctx });

} catch (err) {

api.logger.warn?.(

if (target && canSendQrPngToChannel(channel)) {

let qrFilePath: string | undefined;

try {

const { resolvePreferredOpenClawTmpDir, writeQrPngTempFile } =

await loadDevicePairApiModule();

qrFilePath = (

await writeQrPngTempFile(setupCode, {

tmpRoot: resolvePreferredOpenClawTmpDir(),

};

}

} catch (err) {

const { revokeDeviceBootstrapToken } = await loadDevicePairApiModule();

api.logger.warn?.(

`device-pair: QR image send failed channel=${channel}, falling back (${(err as Error)?.message ?? err})`,

);

if (channel === "webchat") {

let qrDataUrl: string;

try {

const { renderQrPngDataUrl } = await loadDevicePairApiModule();

qrDataUrl = await renderQrPngDataUrl(setupCode);

} catch (err) {

const { revokeDeviceBootstrapToken } = await loadDevicePairApiModule();

api.logger.warn?.(

`device-pair: webchat QR render failed, falling back (${(err as Error)?.message ?? err})`,

);