@clawos-dev/clawd 0.2.102 → 0.2.103

package/dist/cli.cjs

@@ -5367,6 +5367,20 @@ var init_received_capability = __esm({
 });
 
 // ../protocol/src/extension.ts
+function isAllowedHostedUrl(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "https:") return true;
+  if (u.protocol === "http:" && LOCALHOST_HOSTS.has(u.hostname)) return true;
+  return false;
+}
+function manifestMode(m2) {
+  return m2.entry?.url ? "hosted" : "local";
+}
 function ownerNamespace(ownerPrincipalId) {
   let h = 2166136261;
   for (let i = 0; i < ownerPrincipalId.length; i++) {
@@ -5408,7 +5422,7 @@ function parseOrThrow(v2) {
   const [a, b2, c] = v2.split(".").map((p2) => parseInt(p2, 10));
   return [a, b2, c];
 }
-var EXT_ID_REGEX, ExtensionStateSchema, ExtensionManifestSchema, ExtensionRecordSchema, PublishedSnapshotSchema, ChannelRefSchema, SourceRefSchema, PublishedExtensionRecordSchema, PublishCheckSchema, PublishStatusResultSchema;
+var EXT_ID_REGEX, ExtensionStateSchema, LOCALHOST_HOSTS, ExtensionManifestSchema, ExtensionTargetSchema, ExtensionRecordSchema, PublishedSnapshotSchema, ChannelRefSchema, SourceRefSchema, PublishedExtensionRecordSchema, PublishCheckSchema, PublishStatusResultSchema;
 var init_extension = __esm({
   "../protocol/src/extension.ts"() {
     "use strict";
@@ -5421,18 +5435,38 @@ var init_extension = __esm({
       "crashed",
       "invalid"
     ]);
+    LOCALHOST_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
     ExtensionManifestSchema = external_exports.object({
       id: external_exports.string().regex(EXT_ID_REGEX),
       name: external_exports.string().min(1),
       version: external_exports.string().min(1),
       apiVersion: external_exports.literal("1"),
+      runtime: external_exports.object({ startCommand: external_exports.string().min(1) }).passthrough().optional(),
       entry: external_exports.object({
-        ui: external_exports.string().min(1).optional()
-      }).strict().optional(),
-      runtime: external_exports.object({
-        startCommand: external_exports.string().min(1)
-      }).passthrough()
-    }).passthrough();
+        url: external_exports.string().url().refine(isAllowedHostedUrl, {
+          message: "INVALID_URL_SCHEME: only https or http://localhost is allowed"
+        })
+      }).strict().optional()
+    }).passthrough().superRefine((m2, ctx) => {
+      const hasRuntime = !!m2.runtime;
+      const hasUrl = !!m2.entry?.url;
+      if (hasRuntime && hasUrl) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "INVALID_MANIFEST: entry.url and runtime cannot coexist"
+        });
+      }
+      if (!hasRuntime && !hasUrl) {
+        ctx.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          message: "INVALID_MANIFEST: must have either entry.url or runtime"
+        });
+      }
+    });
+    ExtensionTargetSchema = external_exports.discriminatedUnion("kind", [
+      external_exports.object({ kind: external_exports.literal("local"), port: external_exports.number().int().min(1).max(65535) }),
+      external_exports.object({ kind: external_exports.literal("hosted"), url: external_exports.string().url() })
+    ]);
     ExtensionRecordSchema = external_exports.discriminatedUnion("state", [
       external_exports.object({
         extId: external_exports.string(),
@@ -5448,7 +5482,7 @@ var init_extension = __esm({
         extId: external_exports.string(),
         manifest: ExtensionManifestSchema,
         state: external_exports.literal("running"),
-        port: external_exports.number().int().min(1).max(65535)
+        target: ExtensionTargetSchema
       }),
       external_exports.object({
         extId: external_exports.string(),
@@ -37791,12 +37825,6 @@ async function importZip(buf, root) {
   } catch (e) {
     throw new ImportError("INVALID_MANIFEST", `manifest.json: ${e.message}`);
   }
-  if (manifestJson && typeof manifestJson === "object" && "entry" in manifestJson && manifestJson.entry?.url !== void 0) {
-    throw new ImportError(
-      "REMOTE_NOT_SUPPORTED",
-      "entry.url (remote mode) is not supported in v1"
-    );
-  }
   const result = ExtensionManifestSchema.safeParse(manifestJson);
   if (!result.success) {
     throw new ImportError(
@@ -37805,6 +37833,16 @@ async function importZip(buf, root) {
     );
   }
   const manifest = result.data;
+  if (manifestMode(manifest) === "hosted") {
+    const filenames = Object.keys(zip.files).filter((n) => !zip.files[n].dir);
+    const extras = filenames.filter((n) => n !== "manifest.json");
+    if (extras.length > 0) {
+      throw new ImportError(
+        "HOSTED_ZIP_EXTRA_FILES",
+        `hosted extension may only contain manifest.json (extra: ${extras.join(", ")})`
+      );
+    }
+  }
   const destDir = import_node_path19.default.join(root, manifest.id);
   let destExists = false;
   try {
@@ -40963,10 +41001,17 @@ function pickExtId(frame) {
 }
 function composeState(rec, running, crashed, getPort) {
   if (rec.state === "invalid") return rec;
+  if (manifestMode(rec.manifest) === "hosted") {
+    return {
+      ...rec,
+      state: "running",
+      target: { kind: "hosted", url: rec.manifest.entry.url }
+    };
+  }
   if (running.has(rec.extId)) {
     const port = getPort(rec.extId);
     if (port == null) return rec;
-    return { ...rec, state: "running", port };
+    return { ...rec, state: "running", target: { kind: "local", port } };
   }
   if (crashed.has(rec.extId)) return { ...rec, state: "crashed" };
   return rec;
@@ -40988,8 +41033,8 @@ function buildExtensionHandlers(deps) {
   const open = async (frame, _client, ctx) => {
     assertOwner(ctx);
     const extId = pickExtId(frame);
-    const { port } = await deps.runtime.open(extId);
-    return { response: { port } };
+    const target = await deps.runtime.open(extId);
+    return { response: target };
   };
   const close = async (frame, _client, ctx) => {
     assertOwner(ctx);
@@ -41539,16 +41584,20 @@ var Runtime = class {
   }
   async open(extId) {
     const existing = this.handles.get(extId);
-    if (existing) return { port: existing.port };
+    if (existing) return { kind: "local", port: existing.port };
     const records = await loadAll(this.root);
     const rec = records.find((r) => r.extId === extId);
     if (!rec) throw new RuntimeError("NOT_FOUND", `extension ${extId} not installed`);
     if (rec.state === "invalid")
       throw new RuntimeError("INVALID_MANIFEST", rec.invalidReason);
+    if (manifestMode(rec.manifest) === "hosted") {
+      return { kind: "hosted", url: rec.manifest.entry.url };
+    }
     const port = await this.allocator.allocate().catch(() => {
       throw new RuntimeError("PORT_EXHAUSTED", "no free port in configured range");
     });
-    const cmd = rec.manifest.runtime.startCommand.replace(
+    const startCommand = rec.manifest.runtime.startCommand;
+    const cmd = startCommand.replace(
       /\$CLAWOS_EXT_PORT/g,
       String(port)
     );
@@ -41586,7 +41635,7 @@ var Runtime = class {
     try {
       await this.waitForHealthz(port, () => earlyExit, handle);
       this.crashed.delete(extId);
-      return { port };
+      return { kind: "local", port };
     } catch (e) {
       if (this.handles.get(extId) === handle) {
         this.handles.delete(extId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.102",
+  "version": "0.2.103",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",