@alfe.ai/integrations 0.4.0 → 0.4.2

package/dist/index.d.ts

@@ -1223,6 +1223,29 @@ declare class OpenClawApplier implements RuntimeApplier {
    * the lock is NOT re-entrant, so this stays an `*Unlocked` internal.
    */
   private dropSubtreeKeysUnlocked;
+  /**
+   * `openclaw config unset <leafPath>`, UNLOCKED, with a fallback for custom
+   * model providers. Unsetting a single leaf under a custom provider (e.g.
+   * `models.providers.zhipu.baseUrl`) is REJECTED by schema validation — a
+   * custom provider without baseUrl is an invalid partial — so the leaf is
+   * never removed and stale/broken config leaks on every removal cycle. On that
+   * specific validation failure, fall back to unsetting the IMMEDIATE parent
+   * subtree (`models.providers.zhipu`), which validates cleanly and removes the
+   * provider whole. The rejection is itself the signal that our key is
+   * STRUCTURAL to the provider (the object can't validly survive without it), so
+   * removing the provider node is the correct terminal state — and we only ever
+   * escalate to the immediate parent, never a wider path.
+   *
+   * `unsetParents` dedupes across the sibling leaves of one removal pass: once
+   * the provider subtree is unset for `models.providers.zhipu.baseUrl`, the
+   * follow-up `.apiKey` / `.models` leaves skip re-issuing the parent unset.
+   *
+   * Warn-tolerant (a failed unset of an already-gone key must never fail the
+   * caller) and assumes the shared CLI lock is held — stays an `*Unlocked`
+   * internal since the lock is NOT re-entrant. Shared by `removeConfig`
+   * (whole-integration teardown) and `applyConfig`'s stale-leaf diff.
+   */
+  private unsetLeafPathUnlocked;
   /**
    * Raw single-key config write — `openclaw config set <key> <value>`.
    *

package/dist/index.js

@@ -1302,15 +1302,27 @@ var IntegrationManager = class {
 				}
 				if (pluginFailures.length > 0 && pluginFailures.length === plugins.length) throw new Error(`All plugins failed to install: ${pluginFailures.join(", ")}`);
 				if (pluginFailures.length > 0) this.log.warn(`Continuing activation with ${String(pluginFailures.length)} failed plugin(s): ${pluginFailures.join(", ")}`);
-				for (const skill of skills) if (skill.clawhub) {
-					this.log.info(`Installing ClawHub skill ${skill.clawhub} to ${runtimeName}`);
-					await applier.applyClawHubSkill(skill.clawhub);
-				} else if (skill.path) {
-					const skillName = skill.path.split("/").pop() ?? skill.path;
-					const srcPath = join(installPath, skill.path);
-					this.log.info(`Applying skill ${skillName} to ${runtimeName}`);
-					await applier.applySkill(skillName, srcPath);
+				const skillFailures = [];
+				for (const skill of skills) {
+					const skillLabel = skill.clawhub ?? skill.path ?? "unknown";
+					try {
+						if (skill.clawhub) {
+							this.log.info(`Installing ClawHub skill ${skill.clawhub} to ${runtimeName}`);
+							await applier.applyClawHubSkill(skill.clawhub);
+						} else if (skill.path) {
+							const skillName = skill.path.split("/").pop() ?? skill.path;
+							const srcPath = join(installPath, skill.path);
+							this.log.info(`Applying skill ${skillName} to ${runtimeName}`);
+							await applier.applySkill(skillName, srcPath);
+						}
+					} catch (err) {
+						const msg = err instanceof Error ? err.message : String(err);
+						this.log.error(`Failed to apply skill ${skillLabel}: ${msg}`);
+						skillFailures.push(skillLabel);
+					}
 				}
+				if (skillFailures.length > 0 && skillFailures.length === skills.length) throw new Error(`All skills failed to install: ${skillFailures.join(", ")}`);
+				if (skillFailures.length > 0) this.log.warn(`Continuing activation with ${String(skillFailures.length)} failed skill(s): ${skillFailures.join(", ")}`);
 				let runtimeConfigApplied = false;
 				if (runtimeConfig && Object.keys(runtimeConfig).length > 0) {
 					const agentConfig = entry.config;
@@ -2113,6 +2125,22 @@ const BUNDLED_BASELINE_ALLOW = ["browser"];
 const CONFIG_SET_RETRIES$1 = 3;
 const CONFIG_SET_RETRY_DELAY_MS$1 = 750;
 /**
+* Boot-safe exec timeout for the OUT-OF-BAND `setConfigRaw` write (the daemon's
+* config-reconcile pass / `alfe.config_set`). Unlike integration `applyConfig`,
+* which runs under the gateway RuntimeGate with the runtime SUSPENDED (no CPU
+* contention, so the 10s execFile default is plenty), `setConfigRaw` fires while
+* `openclaw gateway run` is live and — on a fresh managed box — still BOOTING.
+* On a 2-vCPU Hetzner cx-class instance the `openclaw config set` CLI cold-start
+* takes >10s under that boot contention, so the 10s default SIGKILLs the child
+* mid-write and every retry lands inside the same ~30s boot window and times out
+* identically (observed in prod: two `config set agents.defaults.model` attempts
+* logged exactly 10s apart with no exit line, then a 3rd succeeded once load
+* eased). 60s clears the cold-start-under-contention worst case while still
+* bounding a genuinely hung CLI. This is ONLY for `setConfigRaw` — the
+* integration `applyConfig` paths keep the 10s default (they're not contended).
+*/
+const CONFIG_SET_RAW_TIMEOUT_MS = 6e4;
+/**
 * Max `openclaw config get` spawns in flight at once during the batch
 * verify-after-write. A naive `Promise.all(leaves.map(...))` fires one CLI
 * process per leaf simultaneously — a 36-leaf model-provider batch on a 2-vCPU
@@ -2166,6 +2194,22 @@ function isMalformedStateDbError(err) {
 	const e = err;
 	return `${e.message}\n${e.stderr ?? ""}\n${e.stdout ?? ""}`.toLowerCase().includes(MALFORMED_STATE_DB_PHRASE);
 }
+/**
+* OpenClaw rejects `config unset` of a single leaf under a CUSTOM model provider
+* when the removal would leave a schema-invalid partial — e.g. unsetting
+* `models.providers.zhipu.baseUrl` fails with "custom model providers must
+* declare baseUrl; provider overlays without baseUrl are only supported for
+* bundled providers." Unsetting the WHOLE provider subtree
+* (`models.providers.zhipu`) validates cleanly. Detect this failure so the
+* removal path can fall back to unsetting the parent subtree instead of leaving
+* stale/broken config behind. The phrase is stable and specific enough to match
+* directly (case-insensitive); it covers baseUrl and any other required
+* structural field ("...must declare <field>").
+*/
+const INVALID_PARTIAL_PROVIDER_PHRASE = "custom model providers must declare";
+function isInvalidPartialProviderUnset(err) {
+	return (err instanceof Error ? err.message : String(err)).toLowerCase().includes(INVALID_PARTIAL_PROVIDER_PHRASE);
+}
 const delay$1 = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
@@ -2650,23 +2694,39 @@ var OpenClawApplier = class {
 	async ensurePluginsAllowUnlocked(pkgs) {
 		const wanted = Array.isArray(pkgs) ? pkgs : [pkgs];
 		let currentAllow = [];
+		let readTrustworthy = true;
 		try {
 			const { stdout } = await execFileAsync$1("openclaw", [
 				"config",
 				"get",
 				"plugins.allow"
 			], { timeout: 1e4 });
-			const parsed = JSON.parse(stdout.trim());
-			if (Array.isArray(parsed)) currentAllow = parsed;
-		} catch {}
+			const trimmed = stdout.trim();
+			if (trimmed === "") {} else try {
+				const parsed = JSON.parse(trimmed);
+				if (Array.isArray(parsed)) currentAllow = parsed;
+				else if (parsed === null) {} else readTrustworthy = false;
+			} catch {
+				readTrustworthy = false;
+			}
+		} catch {
+			readTrustworthy = false;
+		}
 		const missing = [...new Set([...wanted, ...BUNDLED_BASELINE_ALLOW])].filter((id) => !currentAllow.includes(id));
 		if (missing.length === 0) return;
+		if (!readTrustworthy) {
+			log$3.warn({
+				pkgs: wanted,
+				missing
+			}, "plugins.allow read was not trustworthy (non-empty parse failure or command error) — skipping the allow-list write to avoid replacing a value not proven to be a superset");
+			return;
+		}
 		const updated = [...currentAllow, ...missing];
 		try {
 			await this.runConfigSetUnlocked([
 				"plugins.allow",
 				JSON.stringify(updated),
-				"--merge"
+				"--replace"
 			]);
 		} catch (err) {
 			log$3.warn({
@@ -2811,6 +2871,7 @@ var OpenClawApplier = class {
 					slug,
 					err: msg
 				}, "ClawHub skill install failed");
+				throw new Error(`ClawHub skill install failed for "${slug}": ${msg}`);
 			}
 		});
 	}
@@ -2851,14 +2912,8 @@ var OpenClawApplier = class {
 			const prev = partitionEntries(flattenConfig(previous));
 			const nextLeafPaths = new Set(leaves.map((l) => l.path));
 			const staleLeaves = prev.leaves.filter((l) => !nextLeafPaths.has(l.path));
-			for (const { path } of staleLeaves) try {
-				await this.runConfigCommandUnlocked(["unset", path]);
-			} catch (err) {
-				log$3.warn({
-					err: err instanceof Error ? err.message : String(err),
-					path
-				}, "Failed to unset stale config leaf during applyConfig diff");
-			}
+			const unsetParents = /* @__PURE__ */ new Set();
+			for (const { path } of staleLeaves) await this.unsetLeafPathUnlocked(path, unsetParents);
 			for (const [parentPath, prevKvs] of prev.subtreesByParent) {
 				const nextKvs = subtreesByParent.get(parentPath);
 				const goneKeys = [...prevKvs.keys()].filter((k) => !nextKvs?.has(k));
@@ -2926,14 +2981,8 @@ var OpenClawApplier = class {
 		if (!(integrationId in integrations)) return;
 		const integrationConfig = integrations[integrationId];
 		const { leaves, subtreesByParent } = partitionEntries(flattenConfig(integrationConfig));
-		for (const { path } of leaves) try {
-			await this.runConfigCommandUnlocked(["unset", path]);
-		} catch (err) {
-			log$3.warn({
-				err: err instanceof Error ? err.message : String(err),
-				path
-			}, "Failed to unset config via openclaw config unset");
-		}
+		const unsetParents = /* @__PURE__ */ new Set();
+		for (const { path } of leaves) await this.unsetLeafPathUnlocked(path, unsetParents);
 		for (const [parentPath, dottedKvs] of subtreesByParent) await this.dropSubtreeKeysUnlocked(parentPath, new Set(dottedKvs.keys()));
 		tracking._integrations = Object.fromEntries(Object.entries(integrations).filter(([key]) => key !== integrationId));
 		this.writeTracking(tracking);
@@ -2968,6 +3017,56 @@ var OpenClawApplier = class {
 		}
 	}
 	/**
+	* `openclaw config unset <leafPath>`, UNLOCKED, with a fallback for custom
+	* model providers. Unsetting a single leaf under a custom provider (e.g.
+	* `models.providers.zhipu.baseUrl`) is REJECTED by schema validation — a
+	* custom provider without baseUrl is an invalid partial — so the leaf is
+	* never removed and stale/broken config leaks on every removal cycle. On that
+	* specific validation failure, fall back to unsetting the IMMEDIATE parent
+	* subtree (`models.providers.zhipu`), which validates cleanly and removes the
+	* provider whole. The rejection is itself the signal that our key is
+	* STRUCTURAL to the provider (the object can't validly survive without it), so
+	* removing the provider node is the correct terminal state — and we only ever
+	* escalate to the immediate parent, never a wider path.
+	*
+	* `unsetParents` dedupes across the sibling leaves of one removal pass: once
+	* the provider subtree is unset for `models.providers.zhipu.baseUrl`, the
+	* follow-up `.apiKey` / `.models` leaves skip re-issuing the parent unset.
+	*
+	* Warn-tolerant (a failed unset of an already-gone key must never fail the
+	* caller) and assumes the shared CLI lock is held — stays an `*Unlocked`
+	* internal since the lock is NOT re-entrant. Shared by `removeConfig`
+	* (whole-integration teardown) and `applyConfig`'s stale-leaf diff.
+	*/
+	async unsetLeafPathUnlocked(path, unsetParents) {
+		try {
+			await this.runConfigCommandUnlocked(["unset", path]);
+		} catch (err) {
+			const parentPath = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : void 0;
+			if (parentPath && isInvalidPartialProviderUnset(err)) {
+				if (unsetParents.has(parentPath)) return;
+				unsetParents.add(parentPath);
+				try {
+					await this.runConfigCommandUnlocked(["unset", parentPath]);
+					log$3.warn({
+						path,
+						parentPath
+					}, "Leaf unset rejected as an invalid partial custom provider — unset the parent subtree instead");
+				} catch (parentErr) {
+					log$3.warn({
+						err: parentErr instanceof Error ? parentErr.message : String(parentErr),
+						parentPath
+					}, "Failed to unset parent subtree after an invalid-partial leaf unset");
+				}
+				return;
+			}
+			log$3.warn({
+				err: err instanceof Error ? err.message : String(err),
+				path
+			}, "Failed to unset config via openclaw config unset");
+		}
+	}
+	/**
 	* Raw single-key config write — `openclaw config set <key> <value>`.
 	*
 	* Deliberately bypasses the `_integrations` tracking that `applyConfig`
@@ -2978,7 +3077,7 @@ var OpenClawApplier = class {
 	* config writes trigger.
 	*/
 	setConfigRaw(key, value) {
-		return this.cliLock.run(() => this.runConfigSetUnlocked([key, value]));
+		return this.cliLock.run(() => this.runConfigSetUnlocked([key, value], { timeout: CONFIG_SET_RAW_TIMEOUT_MS }));
 	}
 	/**
 	* Read a single config key back — `openclaw config get <key>` — and normalize

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/integrations",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Integration lifecycle management for Alfe — registry, resolution, installation, and state",
   "type": "module",
   "main": "./dist/index.js",
@@ -15,7 +15,7 @@
     "@auriclabs/logger": "^0.1.1",
     "yaml": ">=2.8.3",
     "@alfe.ai/integration-manifest": "^0.3.1",
-    "@alfe.ai/mcp-bundler": "^0.3.0"
+    "@alfe.ai/mcp-bundler": "^0.3.1"
   },
   "files": [
     "dist"