重构主控编排与运行时预热链路，统一工作区提示词/专家调度协议并补齐 wiki 记忆注入与写回闭环。

同时收敛启动与运维脚本默认行为（含 wiki worker）、更新 Admin 可观测性与相关测试，降低首轮时延并提高运行稳定性。

Made-with: Cursor

openclaw/extensions/device-pair/pair-command-auth.ts

@@ -0,0 +1,46 @@
+type PairingCommandAuthParams = {
+  channel: string;
+  gatewayClientScopes?: readonly string[] | null;
+};
+
+export type PairingCommandAuthState = {
+  isInternalGatewayCaller: boolean;
+  isMissingInternalPairingPrivilege: boolean;
+  approvalCallerScopes?: readonly string[];
+};
+
+function isInternalGatewayPairingCaller(params: PairingCommandAuthParams): boolean {
+  return params.channel === "webchat" || Array.isArray(params.gatewayClientScopes);
+}
+
+export function resolvePairingCommandAuthState(
+  params: PairingCommandAuthParams,
+): PairingCommandAuthState {
+  const isInternalGatewayCaller = isInternalGatewayPairingCaller(params);
+  if (!isInternalGatewayCaller) {
+    return {
+      isInternalGatewayCaller,
+      isMissingInternalPairingPrivilege: false,
+      approvalCallerScopes: undefined,
+    };
+  }
+
+  const approvalCallerScopes = Array.isArray(params.gatewayClientScopes)
+    ? params.gatewayClientScopes
+    : [];
+  const isMissingInternalPairingPrivilege =
+    !approvalCallerScopes.includes("operator.pairing") &&
+    !approvalCallerScopes.includes("operator.admin");
+
+  return {
+    isInternalGatewayCaller,
+    isMissingInternalPairingPrivilege,
+    approvalCallerScopes,
+  };
+}
+
+export function buildMissingPairingScopeReply(): { text: string } {
+  return {
+    text: "⚠️ This command requires operator.pairing for internal gateway callers.",
+  };
+}