fix(config): auto-pair the configuring client when enabling non-local exposure

Switching to a non-local exposure mode from `netclaw config` could lock the
operator out of `netclaw chat`. The config rewrite added a CLI pre-flight gate
(GetBootstrapPairingValidationError) that short-circuited the save — and thus the
bootstrap auto-pair — whenever any leftover/partial pairing state existed, routing
the operator to `netclaw doctor` instead. dev has no such gate: it relies on the
wizard/daemon bootstrap seeders, which auto-pair the current client.

Replace the block with EnsureCurrentClientPaired: after writing the exposure mode,
guarantee the configuring client keeps a working pairing. If the local DeviceToken
already matches a device, do nothing; if it is orphaned/mismatched, mint a device
that accepts the existing token; if absent (or corrupt/unparseable), mint a fresh
token+device. It never removes existing devices, so it only ever ADDS access for
the operator at the keyboard — mirroring the wizard's ContributeSecrets and the
daemon's BootstrapDeviceSeeder, which only auto-pair on a fully fresh install.

- ExposureModeStepViewModel: add EnsureCurrentClientPaired plus device/secret
  read+write helpers and base64-tolerant hashing; drop GetBootstrapPairingValidationError
- ExposureModeConfigViewModel: drop the pre-flight block; pair after WriteConfig
- tests: the orphaned/empty-registry/mismatched cases now assert the configuring
  client is paired rather than blocked

Author: Aaronontheweb

src/Netclaw.Cli.Tests/Tui/Config/ExposureModeConfigViewModelTests.cs

@@ -102,7 +102,7 @@ public void Saving_first_non_local_mode_auto_pairs_current_client()
     }
 
     [Fact]
-    public void Saving_non_local_with_orphaned_local_token_blocks_before_persistence()
+    public void Saving_non_local_with_orphaned_local_token_pairs_current_client()
     {
         File.WriteAllText(Context.Paths.NetclawConfigPath,
             """
@@ -113,24 +113,34 @@ public void Saving_non_local_with_orphaned_local_token_blocks_before_persistence
               }
             }
             """);
-        File.WriteAllText(Context.Paths.SecretsPath, "{\"configVersion\":1,\"DeviceToken\":\"orphaned-token\"}");
-        var configBefore = File.ReadAllText(Context.Paths.NetclawConfigPath);
+        // A real DeviceToken is always a base64url token; orphaned = present in secrets with no
+        // matching device in the (absent) registry.
+        var (orphanedToken, _) = CreatePairedDevice("orphan");
+        File.WriteAllText(Context.Paths.SecretsPath, JsonSerializer.Serialize(new Dictionary<string, object>
+        {
+            ["configVersion"] = 1,
+            ["DeviceToken"] = orphanedToken
+        }));
 
         using var vm = new ExposureModeConfigViewModel(Context.Paths);
         vm.Step.SelectedMode = ExposureMode.TailscaleServe;
 
         AdvanceTunnelModeToSave(vm);
 
-        Assert.False(vm.IsSaved.Value);
-        Assert.Contains("netclaw doctor", vm.Context.StatusMessage.Value, StringComparison.OrdinalIgnoreCase);
-        Assert.Contains("docs/spec/SPEC-006-gateway-exposure-and-remote-access.md", vm.Context.StatusMessage.Value, StringComparison.Ordinal);
-        Assert.Contains("#875", vm.Context.StatusMessage.Value, StringComparison.Ordinal);
-        Assert.Equal(configBefore, File.ReadAllText(Context.Paths.NetclawConfigPath));
-        Assert.False(File.Exists(Context.Paths.DevicesPath));
+        // Auto-pair instead of blocking: keep the operator's existing token and mint a device that
+        // accepts it so the configuring client is not locked out of chat.
+        Assert.True(vm.IsSaved.Value);
+        var config = ConfigFileHelper.LoadJsonDict(Context.Paths.NetclawConfigPath);
+        Assert.True(ConfigFileHelper.TryGetPathValue(config, "Daemon.ExposureMode", out var mode));
+        Assert.Equal("tailscale-serve", mode);
+        Assert.Equal(orphanedToken, ReadLocalDeviceToken());
+        var device = Assert.Single(ReadPairedDevices());
+        Assert.True(device.IsBootstrapDevice);
+        Assert.True(PairedDevice.VerifyToken(orphanedToken, device));
     }
 
     [Fact]
-    public void Saving_non_local_with_empty_devices_file_blocks_before_persistence()
+    public void Saving_non_local_with_empty_devices_file_pairs_current_client()
     {
         File.WriteAllText(Context.Paths.NetclawConfigPath,
             """
@@ -142,22 +152,26 @@ public void Saving_non_local_with_empty_devices_file_blocks_before_persistence()
             }
             """);
         File.WriteAllText(Context.Paths.DevicesPath, "[]");
-        var configBefore = File.ReadAllText(Context.Paths.NetclawConfigPath);
 
         using var vm = new ExposureModeConfigViewModel(Context.Paths);
         vm.Step.SelectedMode = ExposureMode.TailscaleServe;
 
         AdvanceTunnelModeToSave(vm);
 
-        Assert.False(vm.IsSaved.Value);
-        Assert.Contains("netclaw doctor", vm.Context.StatusMessage.Value, StringComparison.OrdinalIgnoreCase);
-        Assert.Contains("#875", vm.Context.StatusMessage.Value, StringComparison.Ordinal);
-        Assert.Equal(configBefore, File.ReadAllText(Context.Paths.NetclawConfigPath));
-        Assert.Equal("[]", File.ReadAllText(Context.Paths.DevicesPath));
+        // No token and an empty registry: mint a fresh token+device for the configuring client.
+        Assert.True(vm.IsSaved.Value);
+        var config = ConfigFileHelper.LoadJsonDict(Context.Paths.NetclawConfigPath);
+        Assert.True(ConfigFileHelper.TryGetPathValue(config, "Daemon.ExposureMode", out var mode));
+        Assert.Equal("tailscale-serve", mode);
+        var rawToken = ReadLocalDeviceToken();
+        Assert.False(string.IsNullOrWhiteSpace(rawToken));
+        var device = Assert.Single(ReadPairedDevices());
+        Assert.True(device.IsBootstrapDevice);
+        Assert.True(PairedDevice.VerifyToken(rawToken, device));
     }
 
     [Fact]
-    public void Saving_non_local_with_mismatched_local_token_blocks_before_persistence()
+    public void Saving_non_local_with_mismatched_local_token_pairs_current_client()
     {
         File.WriteAllText(Context.Paths.NetclawConfigPath,
             """
@@ -176,17 +190,23 @@ public void Saving_non_local_with_mismatched_local_token_blocks_before_persisten
             ["configVersion"] = 1,
             ["DeviceToken"] = mismatchedToken
         }));
-        var configBefore = File.ReadAllText(Context.Paths.NetclawConfigPath);
 
         using var vm = new ExposureModeConfigViewModel(Context.Paths);
         vm.Step.SelectedMode = ExposureMode.TailscaleServe;
 
         AdvanceTunnelModeToSave(vm);
 
-        Assert.False(vm.IsSaved.Value);
-        Assert.Contains("Bootstrap pairing state", vm.Context.StatusMessage.Value, StringComparison.OrdinalIgnoreCase);
-        Assert.Contains("#875", vm.Context.StatusMessage.Value, StringComparison.Ordinal);
-        Assert.Equal(configBefore, File.ReadAllText(Context.Paths.NetclawConfigPath));
+        // The local token matches no registered device: mint an additional device that accepts it
+        // without removing the pre-existing one, so the configuring client retains access.
+        Assert.True(vm.IsSaved.Value);
+        var config = ConfigFileHelper.LoadJsonDict(Context.Paths.NetclawConfigPath);
+        Assert.True(ConfigFileHelper.TryGetPathValue(config, "Daemon.ExposureMode", out var mode));
+        Assert.Equal("tailscale-serve", mode);
+        Assert.Equal(mismatchedToken, ReadLocalDeviceToken());
+        var devices = ReadPairedDevices();
+        Assert.Equal(2, devices.Count);
+        Assert.Contains(devices, d => PairedDevice.VerifyToken(mismatchedToken, d));
+        Assert.Contains(devices, d => d.Name == registeredDevice.Name);
     }
 
     [Fact]

src/Netclaw.Cli/Tui/Config/ExposureModeConfigViewModel.cs

@@ -62,14 +62,13 @@ public void GoNext()
             return;
         }
 
-        if (_step.GetBootstrapPairingValidationError(_context.Paths) is { } pairingError)
-        {
-            _context.StatusMessage.Value = pairingError;
-            NotifyContentChanged();
-            return;
-        }
-
         _orchestrator.WriteConfig();
+
+        // Keep the configuring client authenticated after switching to a non-local mode. WriteConfig
+        // already auto-pairs a fully fresh install (the wizard bootstrap path); this also covers
+        // leftover/partial pairing state so `netclaw config` never locks the operator out of chat.
+        _step.EnsureCurrentClientPaired(_context.Paths);
+
         IsSaved.Value = true;
         _context.StatusMessage.Value = "Exposure mode saved.";
         NotifyContentChanged();

src/Netclaw.Cli/Tui/Wizard/Steps/ExposureModeStepViewModel.cs

@@ -305,19 +305,119 @@ public IWizardStepViewModel CreateEditor(IServiceProvider services)
             : null;
     }
 
-    internal string? GetBootstrapPairingValidationError(NetclawPaths paths)
+    /// <summary>
+    /// Guarantees the operator's current client keeps daemon access after a non-local exposure
+    /// mode is saved. If the local <c>DeviceToken</c> does not already match a paired device, the
+    /// configuring client is paired: an existing-but-unmatched token (orphaned or mismatched local
+    /// state) gets a device minted to accept it; a missing token gets a fresh token+device. Existing
+    /// devices are never removed, so this only ever ADDS access for the operator at the keyboard.
+    ///
+    /// This replaces an earlier hard "fix pairing via `netclaw doctor` before saving" block: that
+    /// block locked the configuring client out of <c>netclaw chat</c> on any leftover/partial pairing
+    /// state. Auto-pairing here mirrors the wizard's bootstrap (<see cref="ContributeSecrets"/>) and
+    /// the daemon's <c>BootstrapDeviceSeeder</c>, which only auto-pair on a fully fresh install.
+    /// </summary>
+    public void EnsureCurrentClientPaired(NetclawPaths paths)
     {
         if (!SelectedMode.RequiresRemoteAuthentication())
-            return null;
+            return;
 
         var snapshot = DeviceRegistryInspector.Read(paths);
-        if (!snapshot.DevicesFileExists && !snapshot.HasLocalDeviceToken && !snapshot.HasCompletedBootstrap)
+        if (snapshot.LocalTokenMatchesDevice)
+            return; // The configuring client already has a working pairing — nothing to do.
+
+        var saltHex = Convert.ToHexString(RandomNumberGenerator.GetBytes(16)).ToLowerInvariant();
+
+        // Keep the operator's existing local token when one is present and usable (orphaned/
+        // mismatched) so an already-distributed token keeps working; otherwise — including a
+        // corrupted/unparseable token — mint a fresh one for this client rather than crash the save.
+        var rawToken = snapshot.HasLocalDeviceToken ? ReadLocalDeviceTokenValue(paths) : null;
+        if (string.IsNullOrWhiteSpace(rawToken) || !TryComputeTokenHash(rawToken, saltHex, out var tokenHash))
+        {
+            rawToken = Base64Url.EncodeToString(RandomNumberGenerator.GetBytes(32));
+            WriteLocalDeviceTokenValue(paths, rawToken);
+            tokenHash = PairedDevice.ComputeTokenHash(rawToken, saltHex);
+        }
+
+        var now = _timeProvider.GetUtcNow();
+        var device = new PairedDevice
+        {
+            Name = Environment.MachineName,
+            IsBootstrapDevice = true,
+            TokenHash = tokenHash,
+            Salt = saltHex,
+            CreatedAt = now,
+            LastUsedAt = now,
+        };
+
+        var devices = ReadPairedDevices(paths);
+        devices.Add(device);
+        WritePairedDevices(paths, devices);
+    }
+
+    private static string? ReadLocalDeviceTokenValue(NetclawPaths paths)
+    {
+        if (!File.Exists(paths.SecretsPath))
             return null;
 
-        if (snapshot.DeviceCount > 0 && snapshot.LocalTokenMatchesDevice)
+        var secrets = ConfigFileHelper.LoadJsonDict(paths.SecretsPath);
+        if (!secrets.TryGetValue("DeviceToken", out var rawValue))
             return null;
 
-        return "Bootstrap pairing state is incomplete or mismatched. Run 'netclaw doctor', review docs/spec/SPEC-006-gateway-exposure-and-remote-access.md, and see issue #875 before saving non-local exposure.";
+        var token = rawValue is JsonElement jsonElement ? jsonElement.GetString() : rawValue?.ToString();
+        return ConfigFileHelper.DecryptIfEncrypted(paths, token);
+    }
+
+    private static void WriteLocalDeviceTokenValue(NetclawPaths paths, string rawToken)
+    {
+        var secrets = File.Exists(paths.SecretsPath)
+            ? ConfigFileHelper.LoadJsonDict(paths.SecretsPath)
+            : new Dictionary<string, object>();
+        secrets["configVersion"] = EmbeddedSchemaLoader.CurrentSchemaVersion;
+        secrets["DeviceToken"] = rawToken;
+        ConfigFileHelper.WriteSecretsFile(paths, secrets);
+    }
+
+    private static List<PairedDevice> ReadPairedDevices(NetclawPaths paths)
+    {
+        if (!File.Exists(paths.DevicesPath))
+            return [];
+
+        try
+        {
+            using var doc = JsonDocument.Parse(File.ReadAllText(paths.DevicesPath));
+            return doc.RootElement.ValueKind == JsonValueKind.Array
+                ? JsonSerializer.Deserialize<List<PairedDevice>>(doc.RootElement.GetRawText(), DevicesJsonOptions) ?? []
+                : [];
+        }
+        catch (JsonException)
+        {
+            return [];
+        }
+    }
+
+    private static void WritePairedDevices(NetclawPaths paths, IReadOnlyList<PairedDevice> devices)
+    {
+        var json = JsonSerializer.Serialize(devices, DevicesJsonOptions);
+        File.WriteAllText(paths.DevicesPath, json);
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows) && File.Exists(paths.DevicesPath))
+            File.SetUnixFileMode(paths.DevicesPath, UnixFileMode.UserRead | UnixFileMode.UserWrite);
+    }
+
+    private static bool TryComputeTokenHash(string rawToken, string saltHex, out string tokenHash)
+    {
+        try
+        {
+            tokenHash = PairedDevice.ComputeTokenHash(rawToken, saltHex);
+            return true;
+        }
+        catch (FormatException)
+        {
+            // A corrupted/non-base64url local token cannot produce a usable device hash; signal the
+            // caller to mint a fresh token instead of letting the save crash.
+            tokenHash = string.Empty;
+            return false;
+        }
     }
 
     public SectionContribution BuildContribution(IWizardStepViewModel editor)