@alfe.ai/integrations 0.4.0 → 0.4.1

package/dist/index.d.ts

@@ -1223,6 +1223,29 @@ declare class OpenClawApplier implements RuntimeApplier {
    * the lock is NOT re-entrant, so this stays an `*Unlocked` internal.
    */
   private dropSubtreeKeysUnlocked;
+  /**
+   * `openclaw config unset <leafPath>`, UNLOCKED, with a fallback for custom
+   * model providers. Unsetting a single leaf under a custom provider (e.g.
+   * `models.providers.zhipu.baseUrl`) is REJECTED by schema validation — a
+   * custom provider without baseUrl is an invalid partial — so the leaf is
+   * never removed and stale/broken config leaks on every removal cycle. On that
+   * specific validation failure, fall back to unsetting the IMMEDIATE parent
+   * subtree (`models.providers.zhipu`), which validates cleanly and removes the
+   * provider whole. The rejection is itself the signal that our key is
+   * STRUCTURAL to the provider (the object can't validly survive without it), so
+   * removing the provider node is the correct terminal state — and we only ever
+   * escalate to the immediate parent, never a wider path.
+   *
+   * `unsetParents` dedupes across the sibling leaves of one removal pass: once
+   * the provider subtree is unset for `models.providers.zhipu.baseUrl`, the
+   * follow-up `.apiKey` / `.models` leaves skip re-issuing the parent unset.
+   *
+   * Warn-tolerant (a failed unset of an already-gone key must never fail the
+   * caller) and assumes the shared CLI lock is held — stays an `*Unlocked`
+   * internal since the lock is NOT re-entrant. Shared by `removeConfig`
+   * (whole-integration teardown) and `applyConfig`'s stale-leaf diff.
+   */
+  private unsetLeafPathUnlocked;
   /**
    * Raw single-key config write — `openclaw config set <key> <value>`.
    *

package/dist/index.js

@@ -2166,6 +2166,22 @@ function isMalformedStateDbError(err) {
 	const e = err;
 	return `${e.message}\n${e.stderr ?? ""}\n${e.stdout ?? ""}`.toLowerCase().includes(MALFORMED_STATE_DB_PHRASE);
 }
+/**
+* OpenClaw rejects `config unset` of a single leaf under a CUSTOM model provider
+* when the removal would leave a schema-invalid partial — e.g. unsetting
+* `models.providers.zhipu.baseUrl` fails with "custom model providers must
+* declare baseUrl; provider overlays without baseUrl are only supported for
+* bundled providers." Unsetting the WHOLE provider subtree
+* (`models.providers.zhipu`) validates cleanly. Detect this failure so the
+* removal path can fall back to unsetting the parent subtree instead of leaving
+* stale/broken config behind. The phrase is stable and specific enough to match
+* directly (case-insensitive); it covers baseUrl and any other required
+* structural field ("...must declare <field>").
+*/
+const INVALID_PARTIAL_PROVIDER_PHRASE = "custom model providers must declare";
+function isInvalidPartialProviderUnset(err) {
+	return (err instanceof Error ? err.message : String(err)).toLowerCase().includes(INVALID_PARTIAL_PROVIDER_PHRASE);
+}
 const delay$1 = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
@@ -2650,23 +2666,39 @@ var OpenClawApplier = class {
 	async ensurePluginsAllowUnlocked(pkgs) {
 		const wanted = Array.isArray(pkgs) ? pkgs : [pkgs];
 		let currentAllow = [];
+		let readTrustworthy = true;
 		try {
 			const { stdout } = await execFileAsync$1("openclaw", [
 				"config",
 				"get",
 				"plugins.allow"
 			], { timeout: 1e4 });
-			const parsed = JSON.parse(stdout.trim());
-			if (Array.isArray(parsed)) currentAllow = parsed;
-		} catch {}
+			const trimmed = stdout.trim();
+			if (trimmed === "") {} else try {
+				const parsed = JSON.parse(trimmed);
+				if (Array.isArray(parsed)) currentAllow = parsed;
+				else if (parsed === null) {} else readTrustworthy = false;
+			} catch {
+				readTrustworthy = false;
+			}
+		} catch {
+			readTrustworthy = false;
+		}
 		const missing = [...new Set([...wanted, ...BUNDLED_BASELINE_ALLOW])].filter((id) => !currentAllow.includes(id));
 		if (missing.length === 0) return;
+		if (!readTrustworthy) {
+			log$3.warn({
+				pkgs: wanted,
+				missing
+			}, "plugins.allow read was not trustworthy (non-empty parse failure or command error) — skipping the allow-list write to avoid replacing a value not proven to be a superset");
+			return;
+		}
 		const updated = [...currentAllow, ...missing];
 		try {
 			await this.runConfigSetUnlocked([
 				"plugins.allow",
 				JSON.stringify(updated),
-				"--merge"
+				"--replace"
 			]);
 		} catch (err) {
 			log$3.warn({
@@ -2851,14 +2883,8 @@ var OpenClawApplier = class {
 			const prev = partitionEntries(flattenConfig(previous));
 			const nextLeafPaths = new Set(leaves.map((l) => l.path));
 			const staleLeaves = prev.leaves.filter((l) => !nextLeafPaths.has(l.path));
-			for (const { path } of staleLeaves) try {
-				await this.runConfigCommandUnlocked(["unset", path]);
-			} catch (err) {
-				log$3.warn({
-					err: err instanceof Error ? err.message : String(err),
-					path
-				}, "Failed to unset stale config leaf during applyConfig diff");
-			}
+			const unsetParents = /* @__PURE__ */ new Set();
+			for (const { path } of staleLeaves) await this.unsetLeafPathUnlocked(path, unsetParents);
 			for (const [parentPath, prevKvs] of prev.subtreesByParent) {
 				const nextKvs = subtreesByParent.get(parentPath);
 				const goneKeys = [...prevKvs.keys()].filter((k) => !nextKvs?.has(k));
@@ -2926,14 +2952,8 @@ var OpenClawApplier = class {
 		if (!(integrationId in integrations)) return;
 		const integrationConfig = integrations[integrationId];
 		const { leaves, subtreesByParent } = partitionEntries(flattenConfig(integrationConfig));
-		for (const { path } of leaves) try {
-			await this.runConfigCommandUnlocked(["unset", path]);
-		} catch (err) {
-			log$3.warn({
-				err: err instanceof Error ? err.message : String(err),
-				path
-			}, "Failed to unset config via openclaw config unset");
-		}
+		const unsetParents = /* @__PURE__ */ new Set();
+		for (const { path } of leaves) await this.unsetLeafPathUnlocked(path, unsetParents);
 		for (const [parentPath, dottedKvs] of subtreesByParent) await this.dropSubtreeKeysUnlocked(parentPath, new Set(dottedKvs.keys()));
 		tracking._integrations = Object.fromEntries(Object.entries(integrations).filter(([key]) => key !== integrationId));
 		this.writeTracking(tracking);
@@ -2968,6 +2988,56 @@ var OpenClawApplier = class {
 		}
 	}
 	/**
+	* `openclaw config unset <leafPath>`, UNLOCKED, with a fallback for custom
+	* model providers. Unsetting a single leaf under a custom provider (e.g.
+	* `models.providers.zhipu.baseUrl`) is REJECTED by schema validation — a
+	* custom provider without baseUrl is an invalid partial — so the leaf is
+	* never removed and stale/broken config leaks on every removal cycle. On that
+	* specific validation failure, fall back to unsetting the IMMEDIATE parent
+	* subtree (`models.providers.zhipu`), which validates cleanly and removes the
+	* provider whole. The rejection is itself the signal that our key is
+	* STRUCTURAL to the provider (the object can't validly survive without it), so
+	* removing the provider node is the correct terminal state — and we only ever
+	* escalate to the immediate parent, never a wider path.
+	*
+	* `unsetParents` dedupes across the sibling leaves of one removal pass: once
+	* the provider subtree is unset for `models.providers.zhipu.baseUrl`, the
+	* follow-up `.apiKey` / `.models` leaves skip re-issuing the parent unset.
+	*
+	* Warn-tolerant (a failed unset of an already-gone key must never fail the
+	* caller) and assumes the shared CLI lock is held — stays an `*Unlocked`
+	* internal since the lock is NOT re-entrant. Shared by `removeConfig`
+	* (whole-integration teardown) and `applyConfig`'s stale-leaf diff.
+	*/
+	async unsetLeafPathUnlocked(path, unsetParents) {
+		try {
+			await this.runConfigCommandUnlocked(["unset", path]);
+		} catch (err) {
+			const parentPath = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : void 0;
+			if (parentPath && isInvalidPartialProviderUnset(err)) {
+				if (unsetParents.has(parentPath)) return;
+				unsetParents.add(parentPath);
+				try {
+					await this.runConfigCommandUnlocked(["unset", parentPath]);
+					log$3.warn({
+						path,
+						parentPath
+					}, "Leaf unset rejected as an invalid partial custom provider — unset the parent subtree instead");
+				} catch (parentErr) {
+					log$3.warn({
+						err: parentErr instanceof Error ? parentErr.message : String(parentErr),
+						parentPath
+					}, "Failed to unset parent subtree after an invalid-partial leaf unset");
+				}
+				return;
+			}
+			log$3.warn({
+				err: err instanceof Error ? err.message : String(err),
+				path
+			}, "Failed to unset config via openclaw config unset");
+		}
+	}
+	/**
 	* Raw single-key config write — `openclaw config set <key> <value>`.
 	*
 	* Deliberately bypasses the `_integrations` tracking that `applyConfig`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/integrations",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Integration lifecycle management for Alfe — registry, resolution, installation, and state",
   "type": "module",
   "main": "./dist/index.js",