@1claw/cli 0.35.1 → 0.36.1

package/dist/src/docker/base/chat-ui/server.js

@@ -18,7 +18,33 @@ const MODULES = (process.env.ONECLAW_CONTAINER_MODULES || "")
     .split(",")
     .map((m) => m.trim())
     .filter(Boolean);
-const MODE = process.env.ONECLAW_LOCAL_VAULT === "true" ? "local" : "cloud";
+const MODE = process.env.ONECLAW_MODE
+    ? process.env.ONECLAW_MODE
+    : process.env.ONECLAW_LOCAL_VAULT === "true"
+      ? "local"
+      : "cloud";
+
+// ── LLM via Shroud (trust-preserving) ───────────────────────────────────────
+// The container NEVER holds the agent key. When configured, chat messages are
+// POSTed to the host daemon's /proxy, which injects the X-Shroud-Agent-Key
+// header toward Shroud and returns only the model's response. The raw key never
+// enters this process.
+const LLM_VIA_SHROUD = process.env.ONECLAW_LLM_VIA_SHROUD === "true";
+const SHROUD_URL = (process.env.ONECLAW_SHROUD_URL || "https://shroud.1claw.xyz").replace(/\/+$/, "");
+const SHROUD_SECRET = process.env.ONECLAW_SHROUD_SECRET || "";
+// Optional BYOK provider key secret. When set, the daemon also injects it as
+// the X-Shroud-Api-Key header (the container never sees the value).
+const SHROUD_API_KEY_SECRET = process.env.ONECLAW_SHROUD_API_KEY_SECRET || "";
+const SHROUD_PROVIDER = process.env.ONECLAW_SHROUD_PROVIDER || "openai";
+const SHROUD_MODEL = process.env.ONECLAW_SHROUD_MODEL || "gpt-4o-mini";
+const SYSTEM_PROMPT =
+    process.env.ONECLAW_SHROUD_SYSTEM_PROMPT ||
+    "You are a helpful AI agent running inside a 1Claw secure container. Your credentials are held by the host daemon and never exposed to you.";
+
+// Short in-memory conversation history (newest last), capped to keep prompts small.
+const HISTORY_MAX = 20;
+/** @type {{role: string, content: string}[]} */
+const conversation = [];
 
 let INDEX_HTML = "<h1>1Claw Agent Running</h1>";
 try {
@@ -94,7 +120,6 @@ function readBody(req) {
 }
 
 async function daemonReachable() {
-    if (MODE !== "local") return false;
     try {
         const r = await daemonRequest("GET", "/health");
         return r.status === 200;
@@ -103,15 +128,83 @@ async function daemonReachable() {
     }
 }
 
-// A minimal, LLM-optional assistant. Demonstrates the daemon trust boundary
-// with slash commands; if an LLM provider is wired in later it replaces this.
+/**
+ * Send the conversation to Shroud via the host daemon's /proxy. The daemon
+ * injects the X-Shroud-Agent-Key header; Shroud inspects, applies policy, and
+ * (when 1Claw LLM token billing is enabled for the org) routes through the
+ * Stripe AI Gateway. Returns the assistant's text or an error string.
+ */
+async function shroudChat(userText) {
+    const messages = [
+        { role: "system", content: SYSTEM_PROMPT },
+        ...conversation,
+        { role: "user", content: userText },
+    ];
+    const proxyBody = {
+        secretName: SHROUD_SECRET,
+        url: `${SHROUD_URL}/v1/chat/completions`,
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            "X-Shroud-Provider": SHROUD_PROVIDER,
+        },
+        body: JSON.stringify({ model: SHROUD_MODEL, messages }),
+    };
+    // BYOK: have the daemon also inject the provider key as X-Shroud-Api-Key.
+    if (SHROUD_API_KEY_SECRET) {
+        proxyBody.injectSecrets = [SHROUD_API_KEY_SECRET];
+    }
+    const r = await daemonRequest("POST", "/proxy", proxyBody);
+
+    if (r.status !== 200) {
+        const detail = r.body && (r.body.error || JSON.stringify(r.body));
+        return { ok: false, reply: `Daemon refused the LLM call (${r.status}): ${detail}` };
+    }
+
+    // The daemon returns the upstream response: { status, headers, body }.
+    const upstreamStatus = r.body.status;
+    let upstream;
+    try {
+        upstream = typeof r.body.body === "string" ? JSON.parse(r.body.body) : r.body.body;
+    } catch {
+        upstream = { raw: r.body.body };
+    }
+
+    if (upstreamStatus !== 200) {
+        const msg =
+            (upstream && upstream.error && (upstream.error.message || upstream.error)) ||
+            (upstream && upstream.raw) ||
+            JSON.stringify(upstream);
+        return { ok: false, reply: `Shroud/upstream returned ${upstreamStatus}: ${msg}` };
+    }
+
+    const content =
+        upstream &&
+        upstream.choices &&
+        upstream.choices[0] &&
+        upstream.choices[0].message &&
+        upstream.choices[0].message.content;
+
+    if (!content) {
+        return { ok: false, reply: `No content in model response: ${JSON.stringify(upstream).slice(0, 400)}` };
+    }
+    return { ok: true, reply: String(content) };
+}
+
+// A minimal assistant. Slash commands demonstrate the daemon trust boundary;
+// free-text messages are answered by an LLM via Shroud when configured.
 async function handleChat(message) {
     const text = (message || "").trim();
 
     if (text === "/help" || text === "") {
+        const llmLine = LLM_VIA_SHROUD
+            ? `LLM is wired via Shroud (${SHROUD_PROVIDER}/${SHROUD_MODEL}) — just type a message to chat.\n`
+            : "No LLM is wired — only the commands below work in this container.\n";
         return {
             reply:
-                "1Claw agent ready. Commands:\n" +
+                "1Claw agent ready.\n" +
+                llmLine +
+                "Commands:\n" +
                 "  /secrets        — list secret names available via the daemon\n" +
                 "  /info           — show this agent's runtime info\n" +
                 "  /proxy <name> <url> — make a request with the secret injected by the daemon\n" +
@@ -121,8 +214,11 @@ async function handleChat(message) {
     }
 
     if (text === "/info") {
+        const llm = LLM_VIA_SHROUD
+            ? ` · llm=shroud:${SHROUD_PROVIDER}/${SHROUD_MODEL}`
+            : " · llm=none";
         return {
-            reply: `Agent ${AGENT_ID || "(local)"} · mode=${MODE} · modules=${MODULES.join(", ") || "none"}`,
+            reply: `Agent ${AGENT_ID || "(local)"} · mode=${MODE} · modules=${MODULES.join(", ") || "none"}${llm}`,
             tool: "info",
         };
     }
@@ -170,11 +266,27 @@ async function handleChat(message) {
         }
     }
 
+    // Free-text → LLM via Shroud (if wired). The container never sees the key.
+    if (LLM_VIA_SHROUD && SHROUD_SECRET) {
+        try {
+            const out = await shroudChat(text);
+            if (out.ok) {
+                conversation.push({ role: "user", content: text });
+                conversation.push({ role: "assistant", content: out.reply });
+                while (conversation.length > HISTORY_MAX) conversation.shift();
+                return { reply: out.reply, tool: "shroud_llm" };
+            }
+            return { reply: out.reply, tool: "shroud_llm" };
+        } catch (err) {
+            return { reply: `Could not reach the daemon for LLM call: ${err.message}`, tool: "shroud_llm" };
+        }
+    }
+
     return {
         reply:
             "No LLM provider is configured in this container yet. " +
             "Try /help, /secrets, /info, or /proxy. " +
-            "Wire a model via a module to enable conversational replies.",
+            "Run with a cloud agent (Shroud) or wire a model via a module to enable conversational replies.",
         tool: null,
     };
 }
@@ -192,6 +304,14 @@ const server = http.createServer(async (req, res) => {
             agentId: AGENT_ID || null,
             modules: MODULES,
             mode: MODE,
+            llm: LLM_VIA_SHROUD
+                ? {
+                      via: "shroud",
+                      provider: SHROUD_PROVIDER,
+                      model: SHROUD_MODEL,
+                      keySource: SHROUD_API_KEY_SECRET ? "byok-local" : "cloud-or-billing",
+                  }
+                : null,
             daemonReachable: await daemonReachable(),
         });
     }

package/dist/src/lib/container-config.d.ts

@@ -34,7 +34,16 @@ export declare function saveContainerState(state: ContainerState): void;
 export declare function loadContainerState(name: string): ContainerState | null;
 export declare function deleteContainerState(name: string): boolean;
 export declare function listContainerStates(): ContainerState[];
-/** Check whether a TCP port is free to bind on localhost. */
+/**
+ * Check whether a TCP port is free to publish a container on.
+ *
+ * Binds `0.0.0.0` (all interfaces) to match how Docker publishes ports
+ * (`-p host:container` binds `0.0.0.0` by default). Binding `127.0.0.1`
+ * here is NOT sufficient: on macOS a loopback-only listen can succeed even
+ * while Docker already holds `0.0.0.0:<port>`, which let `findAvailablePort`
+ * hand back a port that `docker run` then rejected with
+ * "Bind for 0.0.0.0:<port> failed: port is already allocated".
+ */
 export declare function isPortAvailable(port: number): Promise<boolean>;
 /** Find the first available port at or after `start` (bounded search). */
 export declare function findAvailablePort(start: number): Promise<number>;

package/dist/src/lib/container-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"container-config.d.ts","sourceRoot":"","sources":["../../../src/lib/container-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,cAAc,QAAiC,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACtB,CAAC;CACL;AAYD,4DAA4D;AAC5D,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAS9D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAQtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAgBtD;AAED,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9D;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,aAAa,kBAAkB,CAAC"}
+{"version":3,"file":"container-config.d.ts","sourceRoot":"","sources":["../../../src/lib/container-config.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,cAAc,QAAiC,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,oDAAoD;IACpD,UAAU,CAAC,EAAE;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;KACtB,CAAC;CACL;AAYD,4DAA4D;AAC5D,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,gDAAgD;AAChD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAS9D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAQtE;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAK1D;AAED,wBAAgB,mBAAmB,IAAI,cAAc,EAAE,CAgBtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9D;AAED,0EAA0E;AAC1E,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtE;AAED,8DAA8D;AAC9D,eAAO,MAAM,aAAa,kBAAkB,CAAC"}

package/dist/src/lib/container-config.js

@@ -74,7 +74,16 @@ export function listContainerStates() {
     }
     return states.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
-/** Check whether a TCP port is free to bind on localhost. */
+/**
+ * Check whether a TCP port is free to publish a container on.
+ *
+ * Binds `0.0.0.0` (all interfaces) to match how Docker publishes ports
+ * (`-p host:container` binds `0.0.0.0` by default). Binding `127.0.0.1`
+ * here is NOT sufficient: on macOS a loopback-only listen can succeed even
+ * while Docker already holds `0.0.0.0:<port>`, which let `findAvailablePort`
+ * hand back a port that `docker run` then rejected with
+ * "Bind for 0.0.0.0:<port> failed: port is already allocated".
+ */
 export function isPortAvailable(port) {
     return new Promise((resolve) => {
         const server = createServer();
@@ -82,7 +91,7 @@ export function isPortAvailable(port) {
         server.once("listening", () => {
             server.close(() => resolve(true));
         });
-        server.listen(port, "127.0.0.1");
+        server.listen(port, "0.0.0.0");
     });
 }
 /** Find the first available port at or after `start` (bounded search). */

package/dist/src/lib/container-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"container-config.js","sourceRoot":"","sources":["../../../src/lib/container-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,UAAU,GACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AA2B7D,SAAS,mBAAmB;IACxB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO;IACnB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB;IACjC,OAAO,gBAAgB,OAAO,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,qCAAqC;IACrC,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACpD,mBAAmB,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,cAAc;IAClB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,KAAK,CACN,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAClC,CACtB,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,uBAAuB;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACjD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,KAAK,CACX,oCAAoC,KAAK,IAAI,KAAK,GAAG,GAAG,GAAG,CAC9D,CAAC;AACN,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC"}
+{"version":3,"file":"container-config.js","sourceRoot":"","sources":["../../../src/lib/container-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,SAAS,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,UAAU,GACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AA2B7D,SAAS,mBAAmB;IACxB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9B,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,cAAc,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO;IACnB,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB;IACjC,OAAO,gBAAgB,OAAO,EAAE,EAAE,CAAC;AACvC,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,qCAAqC;IACrC,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACpD,mBAAmB,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACpE,IAAI,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,cAAc;IAClB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAmB,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC7C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB;IAC/B,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CACP,IAAI,CAAC,KAAK,CACN,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAClC,CACtB,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,uBAAuB;QAC3B,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC1B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACjD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,KAAK,CACX,oCAAoC,KAAK,IAAI,KAAK,GAAG,GAAG,GAAG,CAC9D,CAAC;AACN,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC"}

package/dist/src/lib/daemon-control.d.ts

@@ -1,4 +1,10 @@
 export declare function daemonSocketPath(): string;
+/**
+ * Stop a running daemon (via its PID file) and wait for the socket to clear.
+ * Best-effort — used to reload the daemon after writing new secrets/policies,
+ * since the daemon loads the vault into memory once at startup.
+ */
+export declare function stopDaemon(socketPath?: string, timeoutMs?: number): Promise<void>;
 /** Ping the daemon's /health over its Unix socket. */
 export declare function daemonHealthy(socketPath?: string): Promise<boolean>;
 /**

package/dist/src/lib/daemon-control.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-control.d.ts","sourceRoot":"","sources":["../../../src/lib/daemon-control.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,UAAU,SAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoB/E;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,MAAM,EAClB,UAAU,SAAqB,EAC/B,SAAS,SAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAwBlB"}
+{"version":3,"file":"daemon-control.d.ts","sourceRoot":"","sources":["../../../src/lib/daemon-control.ts"],"names":[],"mappings":"AASA,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC5B,UAAU,SAAqB,EAC/B,SAAS,SAAO,GACjB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,sDAAsD;AACtD,wBAAgB,aAAa,CAAC,UAAU,SAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAoB/E;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACrC,UAAU,EAAE,MAAM,EAClB,UAAU,SAAqB,EAC/B,SAAS,SAAQ,GAClB,OAAO,CAAC,OAAO,CAAC,CAwBlB"}

package/dist/src/lib/daemon-control.js

@@ -1,12 +1,49 @@
 import { request as httpRequest } from "node:http";
 import { spawn } from "node:child_process";
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const CONFIG_DIR = process.env.ONECLAW_CONFIG_DIR || join(homedir(), ".config", "1claw");
 export function daemonSocketPath() {
     return process.env.ONECLAW_DAEMON_SOCKET || join(CONFIG_DIR, "daemon.sock");
 }
+/**
+ * Stop a running daemon (via its PID file) and wait for the socket to clear.
+ * Best-effort — used to reload the daemon after writing new secrets/policies,
+ * since the daemon loads the vault into memory once at startup.
+ */
+export async function stopDaemon(socketPath = daemonSocketPath(), timeoutMs = 5000) {
+    const pidFile = join(CONFIG_DIR, "daemon.pid");
+    if (existsSync(pidFile)) {
+        try {
+            const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+            if (pid) {
+                try {
+                    process.kill(pid, "SIGTERM");
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+        }
+        catch {
+            /* unreadable */
+        }
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!(await daemonHealthy(socketPath)))
+            break;
+        await sleep(150);
+    }
+    try {
+        if (existsSync(socketPath))
+            unlinkSync(socketPath);
+    }
+    catch {
+        /* ok */
+    }
+}
 /** Ping the daemon's /health over its Unix socket. */
 export function daemonHealthy(socketPath = daemonSocketPath()) {
     return new Promise((resolve) => {

package/dist/src/lib/daemon-control.js.map

@@ -1 +1 @@
-{"version":3,"file":"daemon-control.js","sourceRoot":"","sources":["../../../src/lib/daemon-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,GACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1E,MAAM,UAAU,gBAAgB;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,gBAAgB,EAAE;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CACnB,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC7D,CAAC,GAAG,EAAE,EAAE;YACJ,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,CACJ,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,UAAkB,EAClB,UAAU,GAAG,gBAAgB,EAAE,EAC/B,SAAS,GAAG,KAAK;IAEjB,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CACf,OAAO,CAAC,QAAQ,EAChB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EACrD;QACI,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE;YACD,GAAG,OAAO,CAAC,GAAG;YACd,wBAAwB,EAAE,UAAU;SACvC;KACJ,CACJ,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,MAAM,aAAa,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"daemon-control.js","sourceRoot":"","sources":["../../../src/lib/daemon-control.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,UAAU,GACZ,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAE1E,MAAM,UAAU,gBAAgB;IAC5B,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,UAAU,GAAG,gBAAgB,EAAE,EAC/B,SAAS,GAAG,IAAI;IAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,GAAG,EAAE,CAAC;gBACN,IAAI,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;gBACjC,CAAC;gBAAC,MAAM,CAAC;oBACL,kBAAkB;gBACtB,CAAC;YACL,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,gBAAgB;QACpB,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;YAAE,MAAM;QAC9C,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,CAAC;YAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACL,QAAQ;IACZ,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,gBAAgB,EAAE;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,CAAC;YACf,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,WAAW,CACnB,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAC7D,CAAC,GAAG,EAAE,EAAE;YACJ,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;QACpC,CAAC,CACJ,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,OAAO,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,UAAkB,EAClB,UAAU,GAAG,gBAAgB,EAAE,EAC/B,SAAS,GAAG,KAAK;IAEjB,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CACf,OAAO,CAAC,QAAQ,EAChB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,EACrD;QACI,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE;YACD,GAAG,OAAO,CAAC,GAAG;YACd,wBAAwB,EAAE,UAAU;SACvC;KACJ,CACJ,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC3B,IAAI,MAAM,aAAa,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACrB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/src/lib/docker-client.d.ts

@@ -34,6 +34,8 @@ export declare function dockerAvailable(): Promise<boolean>;
 /** True if Docker is installed but the daemon is unreachable. */
 export declare function dockerDaemonError(): Promise<string | null>;
 export declare function dockerImageExists(image: string): Promise<boolean>;
+/** Read a single image label, or null if the image/label is absent. */
+export declare function dockerImageLabel(image: string, label: string): Promise<string | null>;
 export declare function dockerPull(image: string, onProgress?: (line: string) => void): Promise<void>;
 export declare function dockerBuild(opts: DockerBuildOptions): Promise<string>;
 export declare function dockerRun(opts: DockerRunOptions): Promise<string>;

package/dist/src/lib/docker-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker-client.d.ts","sourceRoot":"","sources":["../../../src/lib/docker-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAExE;;;;;;;GAOG;AAEH,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,cAAM,WAAY,SAAQ,KAAK;IAGhB,MAAM,CAAC,EAAE,MAAM;gBADtB,OAAO,EAAE,MAAM,EACR,MAAM,CAAC,EAAE,MAAM,YAAA;CAK7B;AAmFD,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOhE;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvE;AAED,wBAAsB,UAAU,CAC5B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBvE;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;AAED,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItE;AAED,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,wBAAsB,UAAU,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,wBAAsB,YAAY,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,YAAY,CAK1E;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,SAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"docker-client.d.ts","sourceRoot":"","sources":["../../../src/lib/docker-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAExE;;;;;;;GAOG;AAEH,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,cAAM,WAAY,SAAQ,KAAK;IAGhB,MAAM,CAAC,EAAE,MAAM;gBADtB,OAAO,EAAE,MAAM,EACR,MAAM,CAAC,EAAE,MAAM,YAAA;CAK7B;AAmFD,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAOxD;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOhE;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvE;AAED,uEAAuE;AACvE,wBAAsB,gBAAgB,CAClC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB;AAED,wBAAsB,UAAU,CAC5B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3E;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBvE;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;AAED,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAK7E;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAItE;AAED,MAAM,WAAW,eAAe;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,qBAAqB,CACvC,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAkB1B;AAED,wBAAsB,UAAU,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;AAED,wBAAsB,YAAY,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAGjB;AAED,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,YAAY,CAK1E;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,SAAgC,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/src/lib/docker-client.js

@@ -83,6 +83,23 @@ export async function dockerImageExists(image) {
         return false;
     }
 }
+/** Read a single image label, or null if the image/label is absent. */
+export async function dockerImageLabel(image, label) {
+    try {
+        const { stdout } = await run([
+            "image",
+            "inspect",
+            image,
+            "--format",
+            `{{ index .Config.Labels "${label}" }}`,
+        ]);
+        const v = stdout.trim();
+        return v && v !== "<no value>" ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function dockerPull(image, onProgress) {
     await runStreaming(["pull", image], onProgress);
 }

package/dist/src/lib/docker-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-client.js","sourceRoot":"","sources":["../../../src/lib/docker-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAgCxE,MAAM,WAAY,SAAQ,KAAK;IAGhB;IAFX,YACI,OAAe,EACR,MAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,WAAM,GAAN,MAAM,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAED,SAAS,GAAG,CACR,IAAc,EACd,OAAyB,EAAE;IAE3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,QAAQ,CACJ,QAAQ,EACR,IAAI,EACJ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAC9C,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpB,IAAI,GAAG,EAAE,CAAC;gBACN,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBACpC,OAAO;YACX,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,cAAc,CACnB,GAAwD,EACxD,MAAc;IAEd,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,WAAW,CAClB,0HAA0H,CAC7H,CAAC;IACN,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IACI,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAC5C,CAAC;QACC,OAAO,IAAI,WAAW,CAClB,6FAA6F,EAC7F,CAAC,CACJ,CAAC;IACN,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CACjB,IAAc,EACd,UAAmC,EACnC,GAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC5B,UAAU,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU,EAAE,CAAC;gBACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,IAAI,IAAI,CAAC,IAAI,EAAE;wBAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACtB,MAAM,CAAC,cAAc,CAAC,GAA4B,EAAE,UAAU,CAAC,CAAC,CACnE,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;;gBAEtB,MAAM,CACF,IAAI,WAAW,CACX,UAAU,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,EAC5C,UAAU,CACb,CACJ,CAAC;QACV,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACjD,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,KAAa,EACb,UAAmC;IAEnC,MAAM,YAAY,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACtD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,8BAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IAClD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C;IAClF,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC7C,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,KAAK,GAAG,KAAK;IAC1D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,QAAQ;YACR,UAAU;YACV,mFAAmF;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO;YACH,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,MAAM,KAAK,SAAS;YAC7B,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,GAAW,EACX,UAAmC;IAEnC,MAAM,YAAY,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,SAAiB,EACjB,GAAW;IAEX,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAe;IACxD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAQ,GAAG,6BAA6B;IACzE,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAiC,CAAC;QAChE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}
+{"version":3,"file":"docker-client.js","sourceRoot":"","sources":["../../../src/lib/docker-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAgCxE,MAAM,WAAY,SAAQ,KAAK;IAGhB;IAFX,YACI,OAAe,EACR,MAAe;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFR,WAAM,GAAN,MAAM,CAAS;QAGtB,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC9B,CAAC;CACJ;AAED,SAAS,GAAG,CACR,IAAc,EACd,OAAyB,EAAE;IAE3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,QAAQ,CACJ,QAAQ,EACR,IAAI,EACJ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAC9C,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpB,IAAI,GAAG,EAAE,CAAC;gBACN,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;gBACpC,OAAO;YACX,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC,CACJ,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,cAAc,CACnB,GAAwD,EACxD,MAAc;IAEd,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,IAAI,WAAW,CAClB,0HAA0H,CAC7H,CAAC;IACN,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IACI,CAAC,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAC5C,CAAC;QACC,OAAO,IAAI,WAAW,CAClB,6FAA6F,EAC7F,CAAC,CACJ,CAAC;IACN,CAAC;IACD,OAAO,IAAI,WAAW,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAC5E,SAAS,YAAY,CACjB,IAAc,EACd,UAAmC,EACnC,GAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC5B,UAAU,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,UAAU,EAAE,CAAC;gBACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAClC,IAAI,IAAI,CAAC,IAAI,EAAE;wBAAE,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;gBAChD,CAAC;YACL,CAAC;QACL,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEjC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACtB,MAAM,CAAC,cAAc,CAAC,GAA4B,EAAE,UAAU,CAAC,CAAC,CACnE,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACvB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;;gBAEtB,MAAM,CACF,IAAI,WAAW,CACX,UAAU,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,EAC5C,UAAU,CACb,CACJ,CAAC;QACV,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAa;IACjD,IAAI,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,KAAa,EACb,KAAa;IAEb,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;YACzB,OAAO;YACP,SAAS;YACT,KAAK;YACL,UAAU;YACV,4BAA4B,KAAK,MAAM;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,KAAa,EACb,UAAmC;IAEnC,MAAM,YAAY,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACtD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1C,8BAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IAClD,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,4CAA4C;IAClF,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC7C,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,KAAK,GAAG,KAAK;IAC1D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAChD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,QAAgB;IAEhB,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC;YACzB,SAAS;YACT,QAAQ;YACR,UAAU;YACV,mFAAmF;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO;YACH,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,MAAM,KAAK,SAAS;YAC7B,MAAM;YACN,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC5B,GAAW,EACX,UAAmC;IAEnC,MAAM,YAAY,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc;IAC1D,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,SAAiB,EACjB,GAAW;IAEX,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,MAAe;IACxD,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,IAAI,MAAM;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,OAAO,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAQ,GAAG,6BAA6B;IACzE,IAAI,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAiC,CAAC;QAChE,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,IAAI,CAAC;QACV,KAAK,QAAQ,CAAC;QACd,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/src/lib/image-build.d.ts

@@ -1,10 +1,17 @@
 import { type ModuleManifest } from "../modules/registry.js";
 export declare const DEFAULT_BASE_IMAGE = "1claw/agent:stable";
+/**
+ * Revision of the bundled base assets (chat UI, entrypoint, Dockerfile). Bump
+ * this whenever those change so an existing `1claw/agent:stable` is rebuilt
+ * instead of silently reused. Stamped into the image as a label.
+ */
+export declare const BASE_IMAGE_VERSION = "3";
 /** Build the base image from the bundled Docker context. */
 export declare function buildBaseImage(tag?: string, onProgress?: (line: string) => void): Promise<string>;
 /**
  * Ensure the base image is available locally. If it's the default 1Claw image
- * and missing, build it from bundled assets (works offline). Otherwise pull it.
+ * and missing (or stale — built from an older bundled-asset revision), build it
+ * from bundled assets (works offline). Otherwise pull it.
  */
 export declare function ensureBaseImage(baseImage: string, onProgress?: (line: string) => void): Promise<void>;
 /** Produce the full Dockerfile content for a base image + module layers. */

package/dist/src/lib/image-build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-build.d.ts","sourceRoot":"","sources":["../../../src/lib/image-build.ts"],"names":[],"mappings":"AAeA,OAAO,EAGH,KAAK,cAAc,EACtB,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,4DAA4D;AAC5D,wBAAsB,cAAc,CAChC,GAAG,SAAqB,EACxB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,GAC1B,MAAM,CAMR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,GAC1B;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAkBxB;AAED,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,EACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAM9C"}
+{"version":3,"file":"image-build.d.ts","sourceRoot":"","sources":["../../../src/lib/image-build.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGH,KAAK,cAAc,EACtB,MAAM,wBAAwB,CAAC;AAEhC,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAGtC,4DAA4D;AAC5D,wBAAsB,cAAc,CAChC,GAAG,SAAqB,EACxB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACjC,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAC9B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,GAC1B,MAAM,CAMR;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC7B,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,GAC1B;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,CAkBxB;AAED,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EAAE,EACzB,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GACpC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAM9C"}

package/dist/src/lib/image-build.js

@@ -1,10 +1,17 @@
 import { mkdtempSync, mkdirSync, copyFileSync, writeFileSync, existsSync, } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, dirname } from "node:path";
-import { dockerImageExists, dockerPull, dockerBuild, } from "./docker-client.js";
+import { dockerImageExists, dockerImageLabel, dockerPull, dockerBuild, } from "./docker-client.js";
 import { dockerBaseContext, moduleDir } from "./paths.js";
 import { generateDockerLayers, moduleSetHash, } from "../modules/registry.js";
 export const DEFAULT_BASE_IMAGE = "1claw/agent:stable";
+/**
+ * Revision of the bundled base assets (chat UI, entrypoint, Dockerfile). Bump
+ * this whenever those change so an existing `1claw/agent:stable` is rebuilt
+ * instead of silently reused. Stamped into the image as a label.
+ */
+export const BASE_IMAGE_VERSION = "3";
+const BASE_VERSION_LABEL = "org.1claw.base-version";
 /** Build the base image from the bundled Docker context. */
 export async function buildBaseImage(tag = DEFAULT_BASE_IMAGE, onProgress) {
     const context = dockerBaseContext();
@@ -12,19 +19,34 @@ export async function buildBaseImage(tag = DEFAULT_BASE_IMAGE, onProgress) {
     if (!existsSync(dockerfile)) {
         throw new Error(`Base Dockerfile not found at ${dockerfile}`);
     }
-    return dockerBuild({ context, dockerfile, tag, onProgress });
+    return dockerBuild({
+        context,
+        dockerfile,
+        tag,
+        buildArgs: { ONECLAW_BASE_VERSION: BASE_IMAGE_VERSION },
+        onProgress,
+    });
 }
 /**
  * Ensure the base image is available locally. If it's the default 1Claw image
- * and missing, build it from bundled assets (works offline). Otherwise pull it.
+ * and missing (or stale — built from an older bundled-asset revision), build it
+ * from bundled assets (works offline). Otherwise pull it.
  */
 export async function ensureBaseImage(baseImage, onProgress) {
-    if (await dockerImageExists(baseImage))
-        return;
+    const exists = await dockerImageExists(baseImage);
     if (baseImage === DEFAULT_BASE_IMAGE) {
+        if (exists) {
+            const ver = await dockerImageLabel(baseImage, BASE_VERSION_LABEL);
+            if (ver === BASE_IMAGE_VERSION)
+                return;
+            // Missing/old label → rebuild from current bundled assets.
+            onProgress?.("base image is stale — rebuilding");
+        }
         await buildBaseImage(baseImage, onProgress);
         return;
     }
+    if (exists)
+        return;
     await dockerPull(baseImage, onProgress);
 }
 /** Produce the full Dockerfile content for a base image + module layers. */

package/dist/src/lib/image-build.js.map

@@ -1 +1 @@
-{"version":3,"file":"image-build.js","sourceRoot":"","sources":["../../../src/lib/image-build.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACH,iBAAiB,EACjB,UAAU,EACV,WAAW,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACH,oBAAoB,EACpB,aAAa,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAG,GAAG,kBAAkB,EACxB,UAAmC;IAEnC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,SAAiB,EACjB,UAAmC;IAEnC,IAAI,MAAM,iBAAiB,CAAC,SAAS,CAAC;QAAE,OAAO;IAC/C,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACnC,MAAM,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO;IACX,CAAC;IACD,MAAM,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAC9B,SAAiB,EACjB,OAAyB;IAEzB,MAAM,MAAM,GACR,sDAAsD;QACtD,QAAQ,SAAS,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAW,EACX,SAAiB,EACjB,OAAyB;IAEzB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/C,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACX,WAAW,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,GAAG,IAAI,CAC3D,CAAC;YACN,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,OAAyB;IACpD,OAAO,gBAAgB,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,SAAiB,EACjB,OAAyB,EACzB,UAAmC;IAEnC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC"}
+{"version":3,"file":"image-build.js","sourceRoot":"","sources":["../../../src/lib/image-build.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,WAAW,EACX,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACH,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,WAAW,GACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EACH,oBAAoB,EACpB,aAAa,GAEhB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AACtC,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAG,GAAG,kBAAkB,EACxB,UAAmC;IAEnC,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,WAAW,CAAC;QACf,OAAO;QACP,UAAU;QACV,GAAG;QACH,SAAS,EAAE,EAAE,oBAAoB,EAAE,kBAAkB,EAAE;QACvD,UAAU;KACb,CAAC,CAAC;AACP,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACjC,SAAiB,EACjB,UAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,kBAAkB,EAAE,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;YAClE,IAAI,GAAG,KAAK,kBAAkB;gBAAE,OAAO;YACvC,2DAA2D;YAC3D,UAAU,EAAE,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO;IACX,CAAC;IACD,IAAI,MAAM;QAAE,OAAO;IACnB,MAAM,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAC9B,SAAiB,EACjB,OAAyB;IAEzB,MAAM,MAAM,GACR,sDAAsD;QACtD,QAAQ,SAAS,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,OAAO,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAW,EACX,SAAiB,EACjB,OAAyB;IAEzB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/C,aAAa,CAAC,cAAc,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAEtE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACX,WAAW,CAAC,CAAC,IAAI,8BAA8B,CAAC,CAAC,GAAG,IAAI,CAC3D,CAAC;YACN,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC1C,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,OAAyB;IACpD,OAAO,gBAAgB,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAClC,SAAiB,EACjB,OAAyB,EACzB,UAAmC;IAEnC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IACjE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC"}

package/dist/src/secret-proxy.d.ts

@@ -6,6 +6,13 @@ export interface ProxyRequest {
     method?: string;
     headers?: Record<string, string>;
     body?: string;
+    /**
+     * Additional secrets to inject into the same request (each resolved and
+     * host-checked against its own policy, then merged). Enables e.g. injecting
+     * both an auth header and a provider API-key header without exposing either
+     * value to the caller.
+     */
+    injectSecrets?: string[];
 }
 export interface ProxyResponse {
     status: number;

package/dist/src/secret-proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-proxy.d.ts","sourceRoot":"","sources":["../../src/secret-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,KAAK,UAAU,EAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,YAAY;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAC9B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,UAAU,GACnB,OAAO,CAAC,WAAW,CAAC,CAyEtB"}
+{"version":3,"file":"secret-proxy.d.ts","sourceRoot":"","sources":["../../src/secret-proxy.ts"],"names":[],"mappings":"AAGA,OAAO,EACH,KAAK,UAAU,EAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,YAAY;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAC9B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,UAAU,GACnB,OAAO,CAAC,WAAW,CAAC,CA+EtB"}

package/dist/src/secret-proxy.js

@@ -9,26 +9,33 @@ import { isHostAllowed, resolveInjection, } from "./local-policy.js";
  * request per the policy rules.
  */
 export async function proxyRequest(req, vault, policy) {
-    const secret = vault.secrets[req.secretName];
-    if (!secret) {
-        return {
-            success: false,
-            error: `Secret "${req.secretName}" not found in local vault.`,
-        };
-    }
-    const hostCheck = isHostAllowed(policy, req.secretName, req.url);
-    if (!hostCheck.allowed) {
-        return { success: false, error: hostCheck.reason };
-    }
-    const injection = resolveInjection(policy, req.secretName, secret.value);
+    // Resolve every secret to inject: the primary plus any additional ones.
+    // Each is independently host-checked against its own policy and merged.
+    const names = [req.secretName, ...(req.injectSecrets ?? [])];
+    const seen = new Set();
     const url = new URL(req.url);
-    for (const [k, v] of Object.entries(injection.queryParams)) {
-        url.searchParams.set(k, v);
+    const mergedHeaders = { ...(req.headers ?? {}) };
+    for (const name of names) {
+        if (seen.has(name))
+            continue;
+        seen.add(name);
+        const secret = vault.secrets[name];
+        if (!secret) {
+            return {
+                success: false,
+                error: `Secret "${name}" not found in local vault.`,
+            };
+        }
+        const hostCheck = isHostAllowed(policy, name, req.url);
+        if (!hostCheck.allowed) {
+            return { success: false, error: hostCheck.reason };
+        }
+        const injection = resolveInjection(policy, name, secret.value);
+        for (const [k, v] of Object.entries(injection.queryParams)) {
+            url.searchParams.set(k, v);
+        }
+        Object.assign(mergedHeaders, injection.headers);
     }
-    const mergedHeaders = {
-        ...(req.headers ?? {}),
-        ...injection.headers,
-    };
     const method = req.method ?? "GET";
     return new Promise((resolve) => {
         const isHttps = url.protocol === "https:";

package/dist/src/secret-proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-proxy.js","sourceRoot":"","sources":["../../src/secret-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAwB,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAEH,aAAa,EACb,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AAuB3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,GAAiB,EACjB,KAAqB,EACrB,MAAkB;IAElB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO;YACH,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,WAAW,GAAG,CAAC,UAAU,6BAA6B;SAChE,CAAC;IACN,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAEzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,GAA2B;QAC1C,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QACtB,GAAG,SAAS,CAAC,OAAO;KACvB,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAEvD,MAAM,WAAW,GAAG,SAAS,CACzB,GAAG,EACH,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAClC,CAAC,GAAoB,EAAE,EAAE;YACrB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrD,MAAM,eAAe,GAA2B,EAAE,CAAC;gBACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;yBAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;wBAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,CAAC;oBACJ,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG;wBAC7B,OAAO,EAAE,eAAe;wBACxB,IAAI;qBACP;iBACJ,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;QAEF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,OAAO,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,GAAG,CAAC,OAAO,EAAE;aACnD,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE;YAChC,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACX,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"secret-proxy.js","sourceRoot":"","sources":["../../src/secret-proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAwB,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAEH,aAAa,EACb,gBAAgB,GACnB,MAAM,mBAAmB,CAAC;AA8B3B;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAC9B,GAAiB,EACjB,KAAqB,EACrB,MAAkB;IAElB,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,aAAa,GAA2B,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAEzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEf,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,WAAW,IAAI,6BAA6B;aACtD,CAAC;QACN,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;QACvD,CAAC;QAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IAEnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAEvD,MAAM,WAAW,GAAG,SAAS,CACzB,GAAG,EACH,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,EAClC,CAAC,GAAoB,EAAE,EAAE;YACrB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACrD,MAAM,eAAe,GAA2B,EAAE,CAAC;gBACnD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/C,IAAI,OAAO,CAAC,KAAK,QAAQ;wBAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;yBAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;wBAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjE,CAAC;gBACD,OAAO,CAAC;oBACJ,OAAO,EAAE,IAAI;oBACb,QAAQ,EAAE;wBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG;wBAC7B,OAAO,EAAE,eAAe;wBACxB,IAAI;qBACP;iBACJ,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;QAEF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,OAAO,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,4BAA4B,GAAG,CAAC,OAAO,EAAE;aACnD,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QAEH,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE;YAChC,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;QAEH,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACX,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,WAAW,CAAC,GAAG,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC"}