@alfe.ai/integrations 0.0.1

package/dist/index.js

@@ -0,0 +1,1351 @@
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { buildConfigValidationSchema, parseManifestFile } from "@alfe.ai/integration-manifest";
+import { createLogger } from "@auriclabs/logger";
+//#region src/registry.ts
+const DEFAULT_API_URL = "https://api.alfe.ai";
+const REGISTRY_PATH = "/integrations/registry";
+var Registry = class {
+	index = null;
+	apiUrl;
+	/**
+	* @param apiUrl - Base URL for the Alfe API (e.g. "https://api.alfe.ai").
+	*                 Falls back to ALFE_API_URL env var, then the production URL.
+	*/
+	constructor(apiUrl) {
+		this.apiUrl = (apiUrl ?? process.env.ALFE_API_URL ?? DEFAULT_API_URL).replace(/\/+$/, "");
+	}
+	/**
+	* Load the registry index. Uses cache if already loaded.
+	*/
+	async load() {
+		if (this.index) return this.index;
+		const url = `${this.apiUrl}${REGISTRY_PATH}`;
+		const res = await fetch(url);
+		if (!res.ok) throw new Error(`Failed to fetch registry index from ${url}: ${String(res.status)} ${res.statusText}`);
+		const body = await res.json();
+		if (!body.success || !body.data?.integrations) throw new Error(`Invalid registry response from ${url}`);
+		const raw = body.data.integrations;
+		let integrations;
+		if (Array.isArray(raw)) {
+			integrations = {};
+			for (const entry of raw) {
+				const { id, ...rest } = entry;
+				integrations[id] = rest;
+			}
+		} else integrations = raw;
+		this.index = {
+			version: 1,
+			integrations
+		};
+		return this.index;
+	}
+	/**
+	* Force reload the index (bypass cache).
+	*/
+	async reload() {
+		this.index = null;
+		return this.load();
+	}
+	/**
+	* Get a specific integration entry by name.
+	*/
+	async get(id) {
+		return (await this.load()).integrations[id];
+	}
+	/**
+	* List all integrations in the registry.
+	*/
+	async list() {
+		const index = await this.load();
+		return Object.entries(index.integrations).map(([id, entry]) => ({
+			id,
+			...entry
+		}));
+	}
+	/**
+	* Search integrations by name or description substring.
+	*/
+	async search(query) {
+		const all = await this.list();
+		const q = query.toLowerCase();
+		return all.filter((entry) => entry.id.toLowerCase().includes(q) || (entry.name?.toLowerCase().includes(q) ?? false) || entry.description.toLowerCase().includes(q));
+	}
+};
+//#endregion
+//#region src/resolver.ts
+var RegistryResolveError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RegistryResolveError";
+	}
+};
+var Resolver = class {
+	registry;
+	constructor(registry) {
+		this.registry = registry;
+	}
+	/**
+	* Resolve an integration name (+ optional version) to a git clone target.
+	*
+	* @param name - Integration name (e.g. "discord")
+	* @param version - Specific version (e.g. "1.0.0") or undefined for latest
+	* @returns Resolved integration with repo URL and git tag
+	*/
+	async resolve(id, version) {
+		const entry = await this.registry.get(id);
+		if (!entry) throw new RegistryResolveError(`Integration "${id}" not found in registry`);
+		const resolvedVersion = version ?? entry.latest;
+		if (!entry.versions.includes(resolvedVersion)) throw new RegistryResolveError(`Version "${resolvedVersion}" not found for integration "${id}". Available versions: ${entry.versions.join(", ")}`);
+		return {
+			id,
+			name: entry.name,
+			repo: entry.repository ? `${entry.repository}.git` : entry.repo,
+			version: resolvedVersion,
+			tag: `v${resolvedVersion}`,
+			commit: entry.commit,
+			subdir: entry.subdir,
+			description: entry.description
+		};
+	}
+	/**
+	* Check if an integration exists in the registry.
+	*/
+	async exists(id) {
+		return await this.registry.get(id) !== void 0;
+	}
+	/**
+	* Get all available versions for an integration.
+	*/
+	async versions(id) {
+		const entry = await this.registry.get(id);
+		if (!entry) throw new RegistryResolveError(`Integration "${id}" not found in registry`);
+		return entry.versions;
+	}
+};
+//#endregion
+//#region src/installer.ts
+/**
+* Installer — git clone/fetch integrations to ~/.alfe/integrations/{name}/.
+*
+* Manages the local installation directory for integration repos.
+* Each integration is a shallow git clone checked out to a version tag.
+*/
+const execFileAsync$1 = promisify(execFile);
+const INTEGRATIONS_DIR = join(homedir(), ".alfe", "integrations");
+const GIT_TIMEOUT_MS = 6e4;
+var InstallerError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InstallerError";
+	}
+};
+var Installer = class {
+	basePath;
+	/** Tracks subdir overrides per integration id */
+	subdirs = /* @__PURE__ */ new Map();
+	/**
+	* @param basePath - Override the integrations directory (for testing).
+	*                   Defaults to ~/.alfe/integrations/
+	*/
+	constructor(basePath) {
+		this.basePath = basePath ?? INTEGRATIONS_DIR;
+	}
+	/**
+	* Get the path where an integration's content lives.
+	* When a subdir is set, returns the subdir within the clone.
+	*/
+	getInstallPath(name) {
+		const base = join(this.basePath, name);
+		const subdir = this.subdirs.get(name);
+		return subdir ? join(base, subdir) : base;
+	}
+	/**
+	* Get the root clone path (without subdir).
+	*/
+	getClonePath(name) {
+		return join(this.basePath, name);
+	}
+	/**
+	* Install an integration by cloning its git repo and checking out the version tag.
+	* Returns the effective install path (with subdir if present).
+	*/
+	async install(resolved) {
+		const clonePath = this.getClonePath(resolved.id);
+		if (existsSync(clonePath)) throw new InstallerError(`Integration "${resolved.id}" is already installed at ${clonePath}`);
+		if (resolved.subdir) this.subdirs.set(resolved.id, resolved.subdir);
+		mkdirSync(this.basePath, { recursive: true });
+		try {
+			if (resolved.commit) {
+				await execFileAsync$1("git", [
+					"clone",
+					resolved.repo,
+					clonePath
+				], { timeout: GIT_TIMEOUT_MS });
+				await execFileAsync$1("git", ["checkout", resolved.commit], {
+					cwd: clonePath,
+					timeout: GIT_TIMEOUT_MS
+				});
+			} else await execFileAsync$1("git", [
+				"clone",
+				"--depth",
+				"1",
+				"--branch",
+				resolved.tag,
+				resolved.repo,
+				clonePath
+			], { timeout: GIT_TIMEOUT_MS });
+		} catch (err) {
+			if (existsSync(clonePath)) rmSync(clonePath, {
+				recursive: true,
+				force: true
+			});
+			this.subdirs.delete(resolved.id);
+			const message = err instanceof Error ? err.message : String(err);
+			throw new InstallerError(`Failed to clone integration "${resolved.id}": ${message}`);
+		}
+		return this.getInstallPath(resolved.id);
+	}
+	/**
+	* Update an installed integration to a new version.
+	*/
+	async update(name, resolved) {
+		const clonePath = this.getClonePath(name);
+		if (!existsSync(clonePath)) throw new InstallerError(`Integration "${name}" is not installed — cannot update`);
+		if (resolved.subdir) this.subdirs.set(name, resolved.subdir);
+		else this.subdirs.delete(name);
+		try {
+			await execFileAsync$1("git", [
+				"fetch",
+				"--depth",
+				"1",
+				"origin",
+				`tag`,
+				resolved.tag
+			], {
+				cwd: clonePath,
+				timeout: GIT_TIMEOUT_MS
+			});
+			await execFileAsync$1("git", ["checkout", resolved.tag], {
+				cwd: clonePath,
+				timeout: GIT_TIMEOUT_MS
+			});
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new InstallerError(`Failed to update integration "${name}" to ${resolved.version}: ${message}`);
+		}
+		return this.getInstallPath(name);
+	}
+	/**
+	* Remove an installed integration.
+	*/
+	remove(name) {
+		const clonePath = this.getClonePath(name);
+		if (!existsSync(clonePath)) throw new InstallerError(`Integration "${name}" is not installed at ${clonePath}`);
+		rmSync(clonePath, {
+			recursive: true,
+			force: true
+		});
+		this.subdirs.delete(name);
+		return Promise.resolve();
+	}
+	/**
+	* List all locally installed integrations.
+	*/
+	list() {
+		if (!existsSync(this.basePath)) return [];
+		const entries = readdirSync(this.basePath, { withFileTypes: true });
+		const installed = [];
+		for (const entry of entries) {
+			if (!entry.isDirectory()) continue;
+			const integrationPath = join(this.basePath, entry.name);
+			const manifestPath = join(integrationPath, "alfe-integration.yaml");
+			if (!existsSync(manifestPath)) continue;
+			try {
+				const manifest = parseManifestFile(manifestPath);
+				installed.push({
+					id: manifest.id,
+					name: manifest.name,
+					version: manifest.version,
+					path: integrationPath
+				});
+			} catch {
+				installed.push({
+					id: entry.name,
+					version: "unknown",
+					path: integrationPath
+				});
+			}
+		}
+		return installed;
+	}
+	/**
+	* Check if an integration is installed.
+	*/
+	isInstalled(name) {
+		return existsSync(this.getClonePath(name));
+	}
+};
+//#endregion
+//#region src/state.ts
+/**
+* State Manager — manages ~/.alfe/integrations.json.
+*
+* Read-modify-write with advisory file lock to prevent corruption
+* from concurrent access. Secrets are NEVER written to this file.
+*/
+const DEFAULT_STATE_PATH = join(homedir(), ".alfe", "integrations.json");
+const EMPTY_STATE = {
+	version: 1,
+	integrations: {}
+};
+var StateManager = class {
+	filePath;
+	lockHeld = false;
+	constructor(filePath) {
+		this.filePath = filePath ?? DEFAULT_STATE_PATH;
+	}
+	/**
+	* Read the current state file. Returns empty state if file doesn't exist.
+	*/
+	read() {
+		if (!existsSync(this.filePath)) return {
+			...EMPTY_STATE,
+			integrations: {}
+		};
+		try {
+			const raw = readFileSync(this.filePath, "utf-8");
+			const parsed = JSON.parse(raw);
+			if (typeof parsed !== "object" || parsed.version !== 1) return {
+				...EMPTY_STATE,
+				integrations: {}
+			};
+			return parsed;
+		} catch {
+			return {
+				...EMPTY_STATE,
+				integrations: {}
+			};
+		}
+	}
+	/**
+	* Write the state file atomically.
+	*/
+	write(state) {
+		mkdirSync(dirname(this.filePath), { recursive: true });
+		writeFileSync(this.filePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
+	}
+	/**
+	* Get a specific integration's state.
+	*/
+	get(name) {
+		return this.read().integrations[name];
+	}
+	/**
+	* Set an integration's state (read-modify-write).
+	*/
+	set(name, entry) {
+		const state = this.read();
+		state.integrations[name] = entry;
+		this.write(state);
+	}
+	/**
+	* Update only specific fields of an integration's state.
+	*/
+	update(name, partial) {
+		const state = this.read();
+		if (!(name in state.integrations)) throw new Error(`Integration "${name}" not found in state`);
+		state.integrations[name] = {
+			...state.integrations[name],
+			...partial
+		};
+		this.write(state);
+	}
+	/**
+	* Update integration status.
+	*/
+	setStatus(name, status, error) {
+		const state = this.read();
+		if (!(name in state.integrations)) return;
+		const existing = state.integrations[name];
+		existing.status = status;
+		if (error !== void 0) existing.error = error;
+		else existing.error = void 0;
+		this.write(state);
+	}
+	/**
+	* Remove an integration from the state file.
+	*/
+	remove(name) {
+		const state = this.read();
+		state.integrations = Object.fromEntries(Object.entries(state.integrations).filter(([key]) => key !== name));
+		this.write(state);
+	}
+	/**
+	* List all integrations in the state file.
+	*/
+	list() {
+		const state = this.read();
+		return Object.entries(state.integrations).map(([id, entry]) => ({
+			id,
+			...entry
+		}));
+	}
+	/**
+	* Check if an integration is in a given status.
+	*/
+	hasStatus(name, ...statuses) {
+		const entry = this.get(name);
+		if (!entry) return false;
+		return statuses.includes(entry.status);
+	}
+};
+//#endregion
+//#region src/lock.ts
+/**
+* Lock Manager — tracks aggregate desired state across all active integrations.
+*
+* Maintains ~/.alfe/runtime-lock.json with what each runtime should have
+* installed (plugins + skills) and which integration contributed each entry.
+*/
+const DEFAULT_LOCK_PATH = join(homedir(), ".alfe", "runtime-lock.json");
+const EMPTY_LOCK = {
+	version: 1,
+	runtimes: {},
+	updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+};
+var LockManager = class {
+	filePath;
+	constructor(filePath) {
+		this.filePath = filePath ?? DEFAULT_LOCK_PATH;
+	}
+	/**
+	* Read the current lock file. Returns empty lock if file doesn't exist.
+	*/
+	read() {
+		if (!existsSync(this.filePath)) return {
+			...EMPTY_LOCK,
+			runtimes: {},
+			updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		try {
+			const raw = readFileSync(this.filePath, "utf-8");
+			const parsed = JSON.parse(raw);
+			if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1) return {
+				...EMPTY_LOCK,
+				runtimes: {},
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			return parsed;
+		} catch {
+			return {
+				...EMPTY_LOCK,
+				runtimes: {},
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+		}
+	}
+	/**
+	* Write the lock file atomically.
+	*/
+	write(lock) {
+		mkdirSync(dirname(this.filePath), { recursive: true });
+		lock.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+		writeFileSync(this.filePath, JSON.stringify(lock, null, 2) + "\n", "utf-8");
+	}
+	/**
+	* Add entries for an integration activation in a specific runtime.
+	*/
+	addEntries(runtime, integrationId, version, plugins, skills, installPath) {
+		const lock = this.read();
+		if (!(runtime in lock.runtimes)) lock.runtimes[runtime] = {
+			plugins: [],
+			skills: []
+		};
+		const state = lock.runtimes[runtime];
+		for (const plugin of plugins) if (!state.plugins.some((p) => p.package === plugin.package && p.sourceIntegration === integrationId)) state.plugins.push({
+			package: plugin.package,
+			sourceIntegration: integrationId,
+			integrationVersion: version
+		});
+		for (const skill of skills) {
+			const name = skill.path.split("/").pop() ?? skill.path;
+			if (!state.skills.some((s) => s.name === name && s.sourceIntegration === integrationId)) state.skills.push({
+				name,
+				sourcePath: join(installPath, skill.path),
+				sourceIntegration: integrationId,
+				integrationVersion: version
+			});
+		}
+		this.write(lock);
+	}
+	/**
+	* Remove all entries for a given integration across all runtimes.
+	* Returns what was removed, keyed by runtime.
+	*/
+	removeEntries(integrationId) {
+		const lock = this.read();
+		const removed = {};
+		for (const [runtime, state] of Object.entries(lock.runtimes)) {
+			const removedPlugins = state.plugins.filter((p) => p.sourceIntegration === integrationId);
+			const removedSkills = state.skills.filter((s) => s.sourceIntegration === integrationId);
+			if (removedPlugins.length > 0 || removedSkills.length > 0) removed[runtime] = {
+				plugins: removedPlugins,
+				skills: removedSkills
+			};
+			state.plugins = state.plugins.filter((p) => p.sourceIntegration !== integrationId);
+			state.skills = state.skills.filter((s) => s.sourceIntegration !== integrationId);
+		}
+		this.write(lock);
+		return removed;
+	}
+	/**
+	* Get the full desired state for a specific runtime.
+	*/
+	getDesiredState(runtime) {
+		return this.read().runtimes[runtime] ?? {
+			plugins: [],
+			skills: []
+		};
+	}
+};
+//#endregion
+//#region src/hooks.ts
+/**
+* Hook Runner — executes integration lifecycle hook scripts.
+*
+* Hooks are shell scripts defined in the integration manifest.
+* They run as child processes with a 30-second timeout.
+* stdout/stderr are captured and returned.
+*
+* The runner injects standard environment variables:
+* - ALFE_INTEGRATION_DIR — path to the integration install directory
+* - ALFE_STATE_DIR — path to the integration state directory (created if needed)
+* - ALFE_<NAME>_<KEY> — config values (non-secret AND secret, both injected as env vars)
+*
+* Secrets are acceptable as env vars because:
+* - Child process env is ephemeral (dies with the process)
+* - Same security model as Docker secrets / systemd credentials
+* - Never written to disk
+*/
+const HOOK_TIMEOUT_MS = 3e4;
+const INTEGRATIONS_BASE_DIR = join(homedir(), ".alfe", "integrations");
+const STATE_BASE_DIR = join(homedir(), ".alfe", "state");
+/**
+* Build the environment variables for a hook script execution.
+*
+* Injects:
+* - ALFE_INTEGRATION_DIR=~/.alfe/integrations/{name}/
+* - ALFE_STATE_DIR=~/.alfe/state/{name}/ (creates dir if needed)
+* - ALFE_<NAME_UPPER>_<KEY_UPPER>=value for each config entry
+* - ALFE_<NAME_UPPER>_<KEY_UPPER>=value for each secret entry
+*/
+function buildHookEnv(options, additionalEnv) {
+	const { integrationName, config, secrets } = options;
+	const nameUpper = integrationName.toUpperCase().replace(/[^A-Z0-9]/g, "_");
+	const integrationDir = join(INTEGRATIONS_BASE_DIR, integrationName);
+	const stateDir = join(STATE_BASE_DIR, integrationName);
+	mkdirSync(stateDir, {
+		recursive: true,
+		mode: 448
+	});
+	const env = {
+		...process.env,
+		ALFE_INTEGRATION_DIR: integrationDir,
+		ALFE_STATE_DIR: stateDir
+	};
+	if (config) {
+		for (const [key, value] of Object.entries(config)) if (value !== void 0 && value !== null) {
+			const envKey = `ALFE_${nameUpper}_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+			env[envKey] = typeof value === "object" ? JSON.stringify(value) : String(value);
+		}
+	}
+	if (secrets) {
+		for (const [key, value] of secrets) if (value !== void 0 && value !== null) {
+			const envKey = `ALFE_${nameUpper}_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+			env[envKey] = typeof value === "object" ? JSON.stringify(value) : String(value);
+		}
+	}
+	if (additionalEnv) Object.assign(env, additionalEnv);
+	return env;
+}
+/**
+* Run a hook script from an integration directory.
+*
+* @param integrationPath - Base path of the integration (where alfe-integration.yaml lives)
+* @param hookScript - Relative path to the hook script (e.g. "scripts/activate.sh")
+* @param env - Additional environment variables to pass to the script
+* @returns Hook execution result
+*/
+async function runHook(integrationPath, hookScript, env) {
+	const scriptPath = join(integrationPath, hookScript);
+	if (!existsSync(scriptPath)) return {
+		exitCode: 0,
+		stdout: "",
+		stderr: `Hook script not found: ${scriptPath} (skipped)`,
+		timedOut: false
+	};
+	return new Promise((resolve) => {
+		let stdout = "";
+		let stderr = "";
+		let timedOut = false;
+		const proc = spawn("bash", [scriptPath], {
+			cwd: integrationPath,
+			env: {
+				...process.env,
+				...env
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		const timer = setTimeout(() => {
+			timedOut = true;
+			proc.kill("SIGKILL");
+		}, HOOK_TIMEOUT_MS);
+		proc.stdout.on("data", (data) => {
+			stdout += data.toString();
+			if (stdout.length > 1e5) stdout = stdout.slice(0, 1e5) + "\n[truncated]";
+		});
+		proc.stderr.on("data", (data) => {
+			stderr += data.toString();
+			if (stderr.length > 1e5) stderr = stderr.slice(0, 1e5) + "\n[truncated]";
+		});
+		proc.on("close", (code) => {
+			clearTimeout(timer);
+			resolve({
+				exitCode: code ?? 1,
+				stdout: stdout.trim(),
+				stderr: stderr.trim(),
+				timedOut
+			});
+		});
+		proc.on("error", (err) => {
+			clearTimeout(timer);
+			resolve({
+				exitCode: 1,
+				stdout: "",
+				stderr: `Failed to execute hook: ${err.message}`,
+				timedOut: false
+			});
+		});
+	});
+}
+/**
+* Run a hook script with full integration context (config + secrets as env vars).
+*
+* This is the preferred method for running lifecycle hooks (activate, deactivate, health).
+* It builds the complete environment including ALFE_INTEGRATION_DIR, ALFE_STATE_DIR,
+* and all config/secret values as ALFE_<NAME>_<KEY> env vars.
+*
+* @param integrationPath - Base path of the integration
+* @param hookScript - Relative path to the hook script
+* @param options - Integration name, config, and secrets
+* @returns Hook execution result
+*/
+async function runHookWithContext(integrationPath, hookScript, options) {
+	return runHook(integrationPath, hookScript, buildHookEnv(options));
+}
+//#endregion
+//#region src/appliers/openclaw-applier.ts
+/**
+* OpenClawApplier — applies plugins, skills, and config to the OpenClaw runtime.
+*
+* Plugins are installed via `pnpm add` in the OpenClaw workspace directory.
+* Skills are copied to ~/.alfe/skills/{name}.
+* Config is deep-merged into the OpenClaw agent config, with per-integration
+* tracking so changes can be cleanly removed on deactivation.
+*/
+const execFileAsync = promisify(execFile);
+const DEFAULT_SKILLS_DIR = join(homedir(), ".alfe", "skills");
+/**
+* Deep-merge source into target, returning a new object.
+* Arrays are replaced, not concatenated.
+*/
+function deepMerge(target, source) {
+	const result = { ...target };
+	for (const key of Object.keys(source)) {
+		const srcVal = source[key];
+		const tgtVal = result[key];
+		if (srcVal !== null && typeof srcVal === "object" && !Array.isArray(srcVal) && tgtVal !== null && typeof tgtVal === "object" && !Array.isArray(tgtVal)) result[key] = deepMerge(tgtVal, srcVal);
+		else result[key] = srcVal;
+	}
+	return result;
+}
+const LLM_INTEGRATION_IDS = new Set(["anthropic", "openai"]);
+/**
+* Resolve LLM provider runtime config based on mode.
+*
+* - "alfe_credits": keep manifest config as-is (baseUrl points to local proxy,
+*   apiKey is a dummy — the proxy injects the real key)
+* - "byok": remove baseUrl (SDK uses provider default), set apiKey from
+*   decrypted secret
+*
+* Non-LLM integrations pass through unchanged.
+*/
+function resolveLlmRuntimeConfig(integrationId, runtimeConfig, integrationConfig, secrets) {
+	if (!LLM_INTEGRATION_IDS.has(integrationId)) return runtimeConfig;
+	if (integrationConfig?.mode === "byok") {
+		const apiKey = secrets?.get("api_key");
+		const config = structuredClone(runtimeConfig);
+		const providers = config.models?.providers;
+		if (providers?.[integrationId]) {
+			delete providers[integrationId].baseUrl;
+			if (apiKey) providers[integrationId].apiKey = apiKey;
+		}
+		return config;
+	}
+	return runtimeConfig;
+}
+var OpenClawApplier = class {
+	runtime = "openclaw";
+	workspace;
+	skillsDir;
+	configPath;
+	constructor(options) {
+		this.workspace = options.workspace;
+		this.skillsDir = options.skillsDir ?? DEFAULT_SKILLS_DIR;
+		this.configPath = options.configPath ?? join(this.workspace, "config.json");
+	}
+	async applyPlugin(pkg) {
+		await execFileAsync("pnpm", ["add", pkg], {
+			cwd: this.workspace,
+			timeout: 6e4
+		});
+	}
+	async removePlugin(pkg) {
+		await execFileAsync("pnpm", ["remove", pkg], {
+			cwd: this.workspace,
+			timeout: 3e4
+		});
+	}
+	applySkill(name, srcPath) {
+		if (!existsSync(srcPath)) throw new Error(`Skill source path not found: ${srcPath}`);
+		mkdirSync(this.skillsDir, { recursive: true });
+		cpSync(srcPath, join(this.skillsDir, name), { recursive: true });
+		return Promise.resolve();
+	}
+	removeSkill(name) {
+		const skillPath = join(this.skillsDir, name);
+		if (existsSync(skillPath)) rmSync(skillPath, {
+			recursive: true,
+			force: true
+		});
+		return Promise.resolve();
+	}
+	/**
+	* Deep-merge integration config into the OpenClaw agent config file.
+	*
+	* Each integration's config contribution is tracked in
+	* `_integrations.{integrationId}` within the config file so it can be
+	* cleanly removed later.
+	*/
+	applyConfig(integrationId, config) {
+		const current = this.readConfig();
+		const integrations = current._integrations ?? {};
+		integrations[integrationId] = config;
+		current._integrations = integrations;
+		const merged = deepMerge(current, config);
+		merged._integrations = current._integrations;
+		this.writeConfig(merged);
+		return Promise.resolve();
+	}
+	/**
+	* Remove config previously applied by an integration.
+	*
+	* Rebuilds the config by re-merging all remaining integrations' configs,
+	* ensuring clean removal without orphaned keys.
+	*/
+	removeConfig(integrationId) {
+		const current = this.readConfig();
+		const integrations = current._integrations ?? {};
+		if (!(integrationId in integrations)) return Promise.resolve();
+		const remainingIntegrations = Object.fromEntries(Object.entries(integrations).filter(([key]) => key !== integrationId));
+		let rebuilt = this.getBaseConfig(current);
+		for (const cfg of Object.values(remainingIntegrations)) rebuilt = deepMerge(rebuilt, cfg);
+		rebuilt._integrations = remainingIntegrations;
+		this.writeConfig(rebuilt);
+		return Promise.resolve();
+	}
+	isAvailable() {
+		return Promise.resolve(existsSync(this.workspace));
+	}
+	readConfig() {
+		if (!existsSync(this.configPath)) return {};
+		try {
+			return JSON.parse(readFileSync(this.configPath, "utf-8"));
+		} catch {
+			return {};
+		}
+	}
+	writeConfig(config) {
+		mkdirSync(join(this.configPath, ".."), { recursive: true });
+		writeFileSync(this.configPath, JSON.stringify(config, null, 2) + "\n", "utf-8");
+	}
+	/**
+	* Extract the base config by stripping all keys that were contributed
+	* by integrations. This is done by removing each integration's keys
+	* from the current config.
+	*/
+	getBaseConfig(current) {
+		const integrations = current._integrations ?? {};
+		const allIntegrationKeys = /* @__PURE__ */ new Set();
+		for (const cfg of Object.values(integrations)) for (const key of Object.keys(cfg)) allIntegrationKeys.add(key);
+		const base = {};
+		for (const [key, val] of Object.entries(current)) {
+			if (key === "_integrations") continue;
+			if (!allIntegrationKeys.has(key)) base[key] = val;
+		}
+		return base;
+	}
+};
+//#endregion
+//#region src/integration-manager.ts
+/**
+* Integration Manager — full lifecycle management for Alfe integrations.
+*
+* Handles the complete install → configure → activate → deactivate → uninstall
+* lifecycle. Uses runtime appliers to apply/remove plugins and skills to
+* specific agent runtimes during activate/deactivate.
+*
+* Key change from v1: install() only clones + validates. activate() applies
+* plugins/skills to runtimes. deactivate() removes them.
+*/
+/**
+* Merge universal installs with runtime-specific installs from the manifest.
+*/
+function resolveInstallsForRuntime(manifest, runtime) {
+	const universal = manifest.installs;
+	const runtimeSpecific = universal.runtimes?.[runtime];
+	return {
+		plugins: [...universal.plugins ?? [], ...runtimeSpecific?.plugins ?? []],
+		skills: [...universal.skills ?? [], ...runtimeSpecific?.skills ?? []],
+		config: runtimeSpecific?.config
+	};
+}
+var IntegrationManager = class {
+	log = createLogger("IntegrationManager");
+	state;
+	registry;
+	resolver;
+	installer;
+	runtimeAppliers;
+	lockManager;
+	/** In-memory secret store — NEVER persisted to disk */
+	secrets = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.state = new StateManager(options?.statePath);
+		this.registry = new Registry();
+		this.resolver = new Resolver(this.registry);
+		this.installer = new Installer(options?.integrationsDir);
+		this.runtimeAppliers = options?.runtimeAppliers ?? /* @__PURE__ */ new Map();
+		this.lockManager = new LockManager(options?.lockPath);
+	}
+	/**
+	* Install an integration from the registry.
+	*
+	* 1. Resolve from registry
+	* 2. Git clone via registry installer
+	* 3. Parse + validate alfe-integration.yaml
+	* 4. Check depends_on are already installed
+	* 5. Run pre_install hook
+	* 6. Run post_install hook
+	* 7. Persist state to integrations.json
+	*
+	* Note: Skills and plugins are NOT applied during install.
+	* They are applied during activate() via runtime appliers.
+	*/
+	async install(params) {
+		const { name, version, config } = params;
+		if (!name) return this.err("INVALID_PARAMS", "Integration name is required");
+		const existing = this.state.get(name);
+		if (existing && existing.status !== "error") return this.err("ALREADY_INSTALLED", `Integration "${name}" is already installed (status: ${existing.status})`);
+		this.log.info(`Installing integration: ${name}${version ? `@${version}` : ""}`);
+		this.state.set(name, {
+			status: "installing",
+			version: version ?? "unknown",
+			installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			config: {}
+		});
+		try {
+			const resolved = await this.resolver.resolve(name, version);
+			this.log.info(`Resolved ${name}@${resolved.version} from ${resolved.repo}`);
+			const installPath = await this.installer.install(resolved);
+			this.log.info(`Cloned to ${installPath}`);
+			const manifestPath = join(installPath, "alfe-integration.yaml");
+			if (!existsSync(manifestPath)) throw new Error(`No alfe-integration.yaml found in ${installPath}`);
+			const manifest = parseManifestFile(manifestPath);
+			this.log.info(`Manifest validated: ${manifest.id}@${manifest.version}`);
+			for (const dep of manifest.depends_on) {
+				const depState = this.state.get(dep);
+				if (!depState || depState.status === "error") throw new Error(`Dependency "${dep}" is not installed. Install it first: alfe integration install ${dep}`);
+			}
+			if (manifest.hooks.pre_install) {
+				this.log.info(`Running pre_install hook: ${manifest.hooks.pre_install}`);
+				const hookResult = await runHook(installPath, manifest.hooks.pre_install);
+				if (hookResult.exitCode !== 0) throw new Error(`pre_install hook failed (exit ${String(hookResult.exitCode)}): ${hookResult.stderr || hookResult.stdout}`);
+			}
+			if (manifest.hooks.post_install) {
+				this.log.info(`Running post_install hook: ${manifest.hooks.post_install}`);
+				const hookResult = await runHookWithContext(installPath, manifest.hooks.post_install, {
+					integrationName: name,
+					config: config ?? {},
+					secrets: this.secrets.get(name)
+				});
+				if (hookResult.exitCode !== 0) this.log.warn(`post_install hook failed (non-fatal): ${hookResult.stderr || hookResult.stdout}`);
+			}
+			this.state.set(name, {
+				status: "installed",
+				version: manifest.version,
+				installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				config: config ?? {}
+			});
+			this.log.info(`Integration "${name}" installed successfully`);
+			return {
+				ok: true,
+				payload: {
+					id: manifest.id,
+					name: manifest.name,
+					version: manifest.version,
+					status: "installed",
+					capabilities: manifest.capabilities
+				}
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.log.error(`Failed to install "${name}": ${message}`);
+			try {
+				await this.installer.remove(name);
+			} catch {}
+			this.state.setStatus(name, "error", message);
+			return this.err("INSTALL_FAILED", message);
+		}
+	}
+	/**
+	* Configure an installed integration.
+	*
+	* 1. Load manifest for this integration
+	* 2. Validate config against config_schema
+	* 3. Store non-secret values in state file
+	* 4. Store secret values in memory only (NEVER disk)
+	*/
+	configure(params) {
+		const { name, config } = params;
+		if (!name) return this.err("INVALID_PARAMS", "Integration name is required");
+		const entry = this.state.get(name);
+		if (!entry) return this.err("NOT_FOUND", `Integration "${name}" is not installed`);
+		if (entry.status !== "installed" && entry.status !== "configured" && entry.status !== "active") return this.err("INVALID_STATE", `Cannot configure integration in "${entry.status}" state`);
+		this.log.info(`Configuring integration: ${name}`);
+		try {
+			const manifest = parseManifestFile(join(this.installer.getInstallPath(name), "alfe-integration.yaml"));
+			if (manifest.config_schema.length > 0) {
+				const result = buildConfigValidationSchema(manifest.config_schema).safeParse(config);
+				if (!result.success) {
+					const issues = result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+					return this.err("INVALID_CONFIG", `Config validation failed: ${issues}`);
+				}
+			}
+			const missingRequired = manifest.config_schema.filter((f) => f.required && config[f.key] === void 0).map((f) => f.key);
+			if (missingRequired.length > 0) return this.err("MISSING_CONFIG", `Missing required config fields: ${missingRequired.join(", ")}`);
+			const nonSecretConfig = {};
+			const secretConfig = /* @__PURE__ */ new Map();
+			for (const [key, value] of Object.entries(config)) if (manifest.config_schema.find((f) => f.key === key)?.type === "secret") secretConfig.set(key, value);
+			else nonSecretConfig[key] = value;
+			this.state.update(name, {
+				status: "configured",
+				config: nonSecretConfig
+			});
+			this.secrets.set(name, secretConfig);
+			this.log.info(`Integration "${name}" configured (${String(secretConfig.size)} secrets in memory)`);
+			return {
+				ok: true,
+				payload: {
+					name,
+					status: "configured",
+					configUpdated: true,
+					secretCount: secretConfig.size
+				}
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.log.error(`Failed to configure "${name}": ${message}`);
+			return this.err("CONFIGURE_FAILED", message);
+		}
+	}
+	/**
+	* Activate an installed + configured integration.
+	*
+	* 1. Check integration is installed + configured
+	* 2. For each registered runtime applier, apply plugins + skills
+	* 3. Update lock file
+	* 4. Run health_check hook if present
+	* 5. Mark as active in state
+	*/
+	async activate(integrationId) {
+		const entry = this.state.get(integrationId);
+		if (!entry) return this.err("NOT_FOUND", `Integration "${integrationId}" is not installed`);
+		if (entry.status === "active") return {
+			ok: true,
+			payload: {
+				name: integrationId,
+				status: "active",
+				message: "Already active"
+			}
+		};
+		if (entry.status !== "configured" && entry.status !== "installed") return this.err("INVALID_STATE", `Cannot activate integration in "${entry.status}" state`);
+		this.log.info(`Activating integration: ${integrationId}`);
+		try {
+			const installPath = this.installer.getInstallPath(integrationId);
+			const manifestPath = join(installPath, "alfe-integration.yaml");
+			if (!existsSync(manifestPath)) return this.err("MANIFEST_MISSING", `Manifest not found at ${manifestPath}`);
+			const manifest = parseManifestFile(manifestPath);
+			const supportedAgents = manifest.supported_agents;
+			for (const [runtimeName, applier] of this.runtimeAppliers) {
+				if (!await applier.isAvailable()) {
+					this.log.warn(`Runtime "${runtimeName}" is not available — skipping`);
+					continue;
+				}
+				if (supportedAgents && supportedAgents.length > 0 && !supportedAgents.includes(runtimeName)) {
+					this.log.warn(`Integration "${integrationId}" does not support runtime "${runtimeName}" (supported: ${supportedAgents.join(", ")}) — skipping`);
+					continue;
+				}
+				const { plugins, skills, config: runtimeConfig } = resolveInstallsForRuntime(manifest, runtimeName);
+				for (const plugin of plugins) {
+					this.log.info(`Applying plugin ${plugin.package} to ${runtimeName}`);
+					await applier.applyPlugin(plugin.package, installPath);
+				}
+				for (const skill of skills) {
+					const skillName = skill.path.split("/").pop() ?? skill.path;
+					const srcPath = join(installPath, skill.path);
+					this.log.info(`Applying skill ${skillName} to ${runtimeName}`);
+					await applier.applySkill(skillName, srcPath);
+				}
+				if (runtimeConfig && Object.keys(runtimeConfig).length > 0) {
+					const resolvedConfig = resolveLlmRuntimeConfig(integrationId, runtimeConfig, entry.config, this.secrets.get(integrationId));
+					this.log.info(`Applying config for ${integrationId} to ${runtimeName}`);
+					await applier.applyConfig(integrationId, resolvedConfig);
+				}
+				if (plugins.length > 0 || skills.length > 0) this.lockManager.addEntries(runtimeName, integrationId, manifest.version, plugins, skills, installPath);
+			}
+			if (manifest.hooks.health_check) {
+				this.log.info(`Running health check: ${manifest.hooks.health_check}`);
+				const hookResult = await runHookWithContext(installPath, manifest.hooks.health_check, {
+					integrationName: integrationId,
+					config: entry.config,
+					secrets: this.secrets.get(integrationId)
+				});
+				if (hookResult.exitCode !== 0) {
+					this.state.setStatus(integrationId, "error", `Health check failed: ${hookResult.stderr || hookResult.stdout}`);
+					return this.err("HEALTH_CHECK_FAILED", `Health check failed (exit ${String(hookResult.exitCode)}): ${hookResult.stderr || hookResult.stdout}`);
+				}
+			}
+			this.state.setStatus(integrationId, "active");
+			this.log.info(`Integration "${integrationId}" activated`);
+			return {
+				ok: true,
+				payload: {
+					name: integrationId,
+					status: "active"
+				}
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.log.error(`Failed to activate "${integrationId}": ${message}`);
+			return this.err("ACTIVATE_FAILED", message);
+		}
+	}
+	/**
+	* Deactivate a running integration.
+	*
+	* 1. Read lock file to find all entries for this integration
+	* 2. For each runtime's applier, remove plugins + skills
+	* 3. Update lock file
+	* 4. Set state to configured
+	*/
+	async deactivate(integrationId) {
+		const entry = this.state.get(integrationId);
+		if (!entry) return this.err("NOT_FOUND", `Integration "${integrationId}" is not installed`);
+		if (entry.status !== "active") return {
+			ok: true,
+			payload: {
+				name: integrationId,
+				status: entry.status,
+				message: "Not active"
+			}
+		};
+		this.log.info(`Deactivating integration: ${integrationId}`);
+		try {
+			const removed = this.lockManager.removeEntries(integrationId);
+			for (const [runtimeName, entries] of Object.entries(removed)) {
+				const applier = this.runtimeAppliers.get(runtimeName);
+				if (!applier) {
+					this.log.warn(`No applier for runtime "${runtimeName}" — cannot remove entries`);
+					continue;
+				}
+				if (!await applier.isAvailable()) {
+					this.log.warn(`Runtime "${runtimeName}" is not available — skipping removal`);
+					continue;
+				}
+				for (const plugin of entries.plugins) {
+					this.log.info(`Removing plugin ${plugin.package} from ${runtimeName}`);
+					try {
+						await applier.removePlugin(plugin.package);
+					} catch (err) {
+						this.log.warn(`Failed to remove plugin ${plugin.package} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					}
+				}
+				for (const skill of entries.skills) {
+					this.log.info(`Removing skill ${skill.name} from ${runtimeName}`);
+					try {
+						await applier.removeSkill(skill.name);
+					} catch (err) {
+						this.log.warn(`Failed to remove skill ${skill.name} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+					}
+				}
+				this.log.info(`Removing config for ${integrationId} from ${runtimeName}`);
+				try {
+					await applier.removeConfig(integrationId);
+				} catch (err) {
+					this.log.warn(`Failed to remove config for ${integrationId} from ${runtimeName}: ${err instanceof Error ? err.message : String(err)}`);
+				}
+			}
+			this.state.setStatus(integrationId, "configured");
+			return {
+				ok: true,
+				payload: {
+					name: integrationId,
+					status: "configured"
+				}
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.log.error(`Failed to deactivate "${integrationId}": ${message}`);
+			return this.err("DEACTIVATE_FAILED", message);
+		}
+	}
+	/**
+	* Uninstall an integration completely.
+	*
+	* 1. Deactivate first (removes plugins/skills via appliers)
+	* 2. Run pre_uninstall hook
+	* 3. Run post_uninstall hook
+	* 4. Remove git clone from ~/.alfe/integrations/
+	* 5. Remove from state file
+	*/
+	async uninstall(params) {
+		const { name } = params;
+		if (!name) return this.err("INVALID_PARAMS", "Integration name is required");
+		const entry = this.state.get(name);
+		if (!entry) return this.err("NOT_FOUND", `Integration "${name}" is not installed`);
+		this.log.info(`Uninstalling integration: ${name}`);
+		try {
+			if (entry.status === "active") await this.deactivate(name);
+			const installPath = this.installer.getInstallPath(name);
+			let manifest = null;
+			const manifestPath = join(installPath, "alfe-integration.yaml");
+			if (existsSync(manifestPath)) try {
+				manifest = parseManifestFile(manifestPath);
+			} catch {
+				this.log.warn(`Could not parse manifest for "${name}" — proceeding with basic cleanup`);
+			}
+			if (manifest?.hooks.pre_uninstall) {
+				this.log.info(`Running pre_uninstall hook: ${manifest.hooks.pre_uninstall}`);
+				const hookResult = await runHookWithContext(installPath, manifest.hooks.pre_uninstall, {
+					integrationName: name,
+					config: entry.config,
+					secrets: this.secrets.get(name)
+				});
+				if (hookResult.exitCode !== 0) this.log.warn(`pre_uninstall hook failed (continuing): ${hookResult.stderr}`);
+			}
+			if (manifest?.hooks.post_uninstall) {
+				this.log.info(`Running post_uninstall hook: ${manifest.hooks.post_uninstall}`);
+				const hookResult = await runHookWithContext(installPath, manifest.hooks.post_uninstall, {
+					integrationName: name,
+					config: entry.config,
+					secrets: this.secrets.get(name)
+				});
+				if (hookResult.exitCode !== 0) this.log.warn(`post_uninstall hook failed (non-fatal): ${hookResult.stderr}`);
+			}
+			if (this.installer.isInstalled(name)) {
+				await this.installer.remove(name);
+				this.log.info(`Removed integration files from ${installPath}`);
+			}
+			this.state.remove(name);
+			this.secrets.delete(name);
+			this.log.info(`Integration "${name}" uninstalled`);
+			return {
+				ok: true,
+				payload: {
+					name,
+					status: "removed"
+				}
+			};
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			this.log.error(`Failed to uninstall "${name}": ${message}`);
+			return this.err("UNINSTALL_FAILED", message);
+		}
+	}
+	/**
+	* Run health checks for one or all integrations.
+	*/
+	async health(params) {
+		const { name } = params;
+		if (name) return {
+			ok: true,
+			payload: await this.checkHealth(name)
+		};
+		const entries = this.state.list();
+		const results = [];
+		for (const entry of entries) {
+			const result = await this.checkHealth(entry.id);
+			results.push(result);
+		}
+		return {
+			ok: true,
+			payload: {
+				overall: results.every((r) => r.healthy),
+				results,
+				checkedAt: (/* @__PURE__ */ new Date()).toISOString()
+			}
+		};
+	}
+	/**
+	* List all installed integrations.
+	*/
+	list() {
+		return this.state.list().map((entry) => ({
+			id: entry.id,
+			name: void 0,
+			version: entry.version,
+			status: entry.status,
+			installedAt: entry.installedAt,
+			config: entry.config,
+			error: entry.error
+		}));
+	}
+	/**
+	* Get a specific integration by name.
+	*/
+	get(name) {
+		const entry = this.state.get(name);
+		if (!entry) return void 0;
+		return {
+			id: name,
+			version: entry.version,
+			status: entry.status,
+			installedAt: entry.installedAt,
+			config: entry.config,
+			error: entry.error
+		};
+	}
+	/**
+	* Clear in-memory secrets (called on daemon restart).
+	*/
+	clear() {
+		this.secrets.clear();
+	}
+	async checkHealth(id) {
+		const entry = this.state.get(id);
+		if (!entry) return {
+			id,
+			healthy: false,
+			status: "error",
+			message: "Not installed"
+		};
+		const installPath = this.installer.getInstallPath(id);
+		const manifestPath = join(installPath, "alfe-integration.yaml");
+		if (!existsSync(manifestPath)) return {
+			id,
+			healthy: false,
+			status: entry.status,
+			version: entry.version,
+			message: "Manifest file missing — integration may be corrupted"
+		};
+		try {
+			const manifest = parseManifestFile(manifestPath);
+			if (!manifest.hooks.health_check) return {
+				id,
+				name: manifest.name,
+				healthy: entry.status === "active" || entry.status === "configured" || entry.status === "installed",
+				status: entry.status,
+				version: manifest.version,
+				message: "No health check hook defined"
+			};
+			const hookResult = await runHookWithContext(installPath, manifest.hooks.health_check, {
+				integrationName: id,
+				config: entry.config,
+				secrets: this.secrets.get(id)
+			});
+			return {
+				id,
+				name: manifest.name,
+				healthy: hookResult.exitCode === 0,
+				status: entry.status,
+				version: manifest.version,
+				message: hookResult.exitCode === 0 ? "Healthy" : `Health check failed (exit ${String(hookResult.exitCode)})`,
+				stdout: hookResult.stdout || void 0,
+				stderr: hookResult.stderr || void 0
+			};
+		} catch (err) {
+			return {
+				id,
+				healthy: false,
+				status: entry.status,
+				version: entry.version,
+				message: `Health check error: ${err instanceof Error ? err.message : String(err)}`
+			};
+		}
+	}
+	err(code, message) {
+		return {
+			ok: false,
+			error: {
+				code,
+				message
+			}
+		};
+	}
+};
+//#endregion
+//#region src/adapter.ts
+var IntegrationManagerAdapter = class {
+	constructor(manager) {
+		this.manager = manager;
+	}
+	getInstalledIntegrations() {
+		const integrations = this.manager.list();
+		return Promise.resolve(integrations.map((i) => ({
+			id: i.id,
+			version: i.version ?? "unknown",
+			status: i.status
+		})));
+	}
+	async install(integrationId, version, config) {
+		const result = await this.manager.install({
+			name: integrationId,
+			version,
+			config
+		});
+		if (!result.ok) throw new Error(result.error?.message ?? `Failed to install ${integrationId}`);
+	}
+	async activate(integrationId) {
+		const result = await this.manager.activate(integrationId);
+		if (!result.ok) throw new Error(result.error?.message ?? `Failed to activate ${integrationId}`);
+	}
+	async deactivate(integrationId) {
+		const result = await this.manager.deactivate(integrationId);
+		if (!result.ok) throw new Error(result.error?.message ?? `Failed to deactivate ${integrationId}`);
+	}
+	async uninstall(integrationId) {
+		const result = await this.manager.uninstall({ name: integrationId });
+		if (!result.ok) throw new Error(result.error?.message ?? `Failed to uninstall ${integrationId}`);
+	}
+};
+//#endregion
+export { Installer, InstallerError, IntegrationManager, IntegrationManagerAdapter, LockManager, OpenClawApplier, Registry, RegistryResolveError, Resolver, StateManager, buildHookEnv, resolveInstallsForRuntime, runHook, runHookWithContext };