@clawscarf/cli 0.1.0-alpha.1 → 0.1.0-alpha.10

package/scripts/installation/setup.js

@@ -46,6 +46,7 @@ export function recipeConfiguration(context, recipeId) {
     return {
         schemaVersion: 1,
         name: "team",
+        agentName: recipe.defaults.agentName,
         releaseFile: context.releaseFile,
         stateDirectory: "./state",
         exposure: { mode: "local", applicationPort: 18800, widgetPort: 18802 },
@@ -57,6 +58,7 @@ export function recipeConfiguration(context, recipeId) {
         },
         resources: structuredClone(recipe.defaults.resources),
         browser: structuredClone(recipe.defaults.browser),
+        publicWeb: recipe.defaults.publicWeb,
         connections: {
             mode: recipe.defaults.connections?.enabled ? "hosted" : "disabled",
             cloudUrl: context.cloudUrl,

package/scripts/release/create.js

@@ -5,9 +5,10 @@ import { copyFile, lstat, mkdir, readFile, rm, writeFile, } from "node:fs/promis
 import { fileURLToPath } from "node:url";
 import { dirname, join, resolve } from "node:path";
 import { z } from "zod";
-import { releaseSchema } from "./definition.js";
+import { releaseSchema, hostPlatformSchema } from "./definition.js";
 // Build inputs use the release contract, replacing tool digests with source paths.
 const inputSchema = releaseSchema.extend({
+    platforms: z.tuple([hostPlatformSchema]),
     tools: z.strictObject({
         openshell: releaseSchema.shape.tools.shape.openshell.extend({
             cli: z.string().min(1),
@@ -43,8 +44,12 @@ export async function createDevelopmentRelease(options) {
             tools: {
                 openshell: {
                     ...input.tools.openshell,
-                    cli: await tool(resolve(directory, input.tools.openshell.cli), join(output, "tools/openshell"), "tools/openshell"),
-                    gateway: await tool(resolve(directory, input.tools.openshell.gateway), join(output, "tools/openshell-gateway"), "tools/openshell-gateway"),
+                    cli: {
+                        [input.platforms[0]]: await tool(resolve(directory, input.tools.openshell.cli), join(output, "tools/openshell"), "tools/openshell"),
+                    },
+                    gateway: {
+                        [input.platforms[0]]: await tool(resolve(directory, input.tools.openshell.gateway), join(output, "tools/openshell-gateway"), "tools/openshell-gateway"),
+                    },
                 },
             },
         });

package/scripts/release/definition.js

@@ -15,12 +15,18 @@ const file = z.strictObject({
     }, "Tool downloads require HTTPS without credentials.")
         .optional(),
 });
+export const hostPlatformSchema = z.enum([
+    "darwin-arm64",
+    "linux-arm64",
+    "linux-x64",
+]);
+const tool = z.partialRecord(hostPlatformSchema, file);
 /** Pinned runtime metadata, independent of recipe defaults and deployment state. */
 export const releaseSchema = z.strictObject({
     schemaVersion: z.literal(1),
     version: z.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
     sourceRevision: z.string().regex(/^[a-f0-9]{40}$/),
-    platforms: z.array(z.literal("darwin-arm64")).min(1).max(1),
+    platforms: z.array(hostPlatformSchema).min(1),
     images: z
         .strictObject({
         postgres: z.literal(postgresImage),
@@ -44,8 +50,33 @@ export const releaseSchema = z.strictObject({
     tools: z.strictObject({
         openshell: z.strictObject({
             version: z.string().min(1),
-            cli: file,
-            gateway: file,
+            cli: tool,
+            gateway: tool,
         }),
     }),
 });
+/** Published manifests must work without checkout-local images or executables. */
+export function assertPublishedRuntime(runtime) {
+    if (JSON.stringify(runtime.images).includes('"sha256:') ||
+        runtime.platforms.some((platform) => {
+            const tools = releaseTools(runtime, platform);
+            return !tools.cli.url || !tools.gateway.url;
+        }))
+        throw Error("Published runtimes require registry digests and downloadable tools.");
+}
+/** Single-platform development bundles and multi-platform published bundles share resolution. */
+export function releaseTools(release, platform = `${process.platform}-${process.arch}`) {
+    const host = hostPlatformSchema.parse(platform);
+    if (!release.platforms.includes(host))
+        throw new Error(`Runtime ${release.version} does not include ${host}.`);
+    const select = (value) => {
+        const selected = value[host];
+        if (!selected)
+            throw new Error(`Missing runtime tool for ${host}.`);
+        return selected;
+    };
+    return {
+        cli: select(release.tools.openshell.cli),
+        gateway: select(release.tools.openshell.gateway),
+    };
+}

package/scripts/telemetry.js

@@ -0,0 +1,279 @@
+import packageInfo from "../package.json" with { type: "json" };
+import { randomUUID } from "node:crypto";
+import { mkdir, open, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { PostHog } from "posthog-node";
+import { Agent, fetch } from "undici";
+import { z } from "zod";
+const destinationSchema = z.strictObject({
+    host: z.url().refine((value) => {
+        const url = new URL(value);
+        return (!url.username &&
+            !url.password &&
+            !url.search &&
+            !url.hash &&
+            url.pathname === "/" &&
+            (url.protocol === "https:" ||
+                (url.protocol === "http:" && url.hostname === "127.0.0.1")));
+    }),
+    projectToken: z.string().regex(/^phc_[A-Za-z0-9_-]+$/),
+});
+// Deliberately finite: remote errors and OperatorError.code can contain arbitrary text.
+const errorCodeSchema = z.enum([
+    "invalid_configuration",
+    "unsupported_platform",
+    "release_mismatch",
+    "stale_plan",
+    "change_unsupported",
+    "unavailable",
+    "operation_failed",
+    "invalid_arguments",
+    "operation_busy",
+    "invalid_team_configuration",
+    "runtime_binding_changed",
+    "runtime_binding_unavailable",
+    "administrator_unverified",
+    "bootstrap_outcome_unknown",
+    "browser_unavailable",
+    "command_failed",
+    "configuration_changed",
+    "database_start_failed",
+    "executable_unavailable",
+    "incomplete_certificate",
+    "invalid_certificate",
+    "invalid_model_setup",
+    "model_credential_pending",
+    "invalid_connections_setup",
+    "connections_catalog_blocked",
+    "connections_configuration_pending",
+    "connections_configuration_refused",
+    "connections_configuration_unavailable",
+    "invalid_runtime_policy",
+    "native_unavailable",
+    "network_identity_changed",
+    "network_lookup_incomplete",
+    "network_outcome_unknown",
+    "network_unprepared",
+    "platform_unqualified",
+    "port_check_failed",
+    "port_in_use",
+    "private_directory_required",
+    "runtime_failed",
+    "runtime_identity_changed",
+    "runtime_lookup_incomplete",
+    "runtime_outcome_unknown",
+    "runtime_start_failed",
+    "runtime_stop_pending",
+    "startup_interrupted",
+    "startup_timed_out",
+    "unowned_directory",
+    "ownership_conflict",
+    "runtime_credentials_changed",
+    "database_setup_failed",
+    "outcome_unknown",
+    "unauthorized",
+    "forbidden",
+    "ENOENT",
+    "ENOTDIR",
+    "EACCES",
+    "EPERM",
+    "EEXIST",
+    "ELOOP",
+    "ENOSPC",
+]);
+/** One CLI invocation. No runtime, server, browser, or automatic exception instrumentation. */
+export class CliTelemetry {
+    environment;
+    destinationFile;
+    client;
+    dispatcher;
+    started;
+    startTime = 0;
+    distinctId = "";
+    command = "";
+    action;
+    interactive = false;
+    version = "";
+    invocationId = randomUUID();
+    outcome = "success";
+    mode;
+    configuration;
+    constructor(environment = process.env, destinationFile = new URL("../release/telemetry.json", import.meta.url)) {
+        this.environment = environment;
+        this.destinationFile = destinationFile;
+    }
+    async start(command) {
+        if (this.environment.CLAWSCARF_TELEMETRY_DISABLED === "1")
+            return;
+        try {
+            const destination = destinationSchema
+                .nullable()
+                .parse(JSON.parse(await readFile(this.destinationFile, "utf8")));
+            if (!destination)
+                return;
+            const manifest = z
+                .object({
+                version: z.string().regex(/^\d+\.\d+\.\d+(?:-[A-Za-z0-9.-]+)?$/),
+            })
+                .parse(packageInfo);
+            this.version = manifest.version;
+            const directory = join(this.environment.XDG_CONFIG_HOME || homedir(), this.environment.XDG_CONFIG_HOME ? "clawscarf" : ".config/clawscarf");
+            await mkdir(directory, { recursive: true, mode: 0o700 });
+            const file = join(directory, "telemetry-id");
+            try {
+                const handle = await open(file, "wx", 0o600);
+                try {
+                    await handle.writeFile(randomUUID() + "\n");
+                }
+                finally {
+                    await handle.close();
+                }
+                process.stderr.write("ClawScarf reports CLI usage and failure codes to PostHog. Disable with CLAWSCARF_TELEMETRY_DISABLED=1. Details: https://github.com/clawscarf/clawscarf/blob/main/deploy/deployment/installation.md#telemetry\n");
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    "code" in error &&
+                    error.code === "EEXIST"))
+                    throw error;
+            }
+            // A concurrent creator may still be writing. Skip this invocation if incomplete.
+            this.distinctId = z.uuid().parse((await readFile(file, "utf8")).trim());
+            const names = [];
+            for (let current = command; current.parent; current = current.parent)
+                names.unshift(current.name());
+            this.command = names.join(" ");
+            const options = command.optsWithGlobals();
+            this.interactive =
+                [process.stdin.isTTY, process.stdout.isTTY].every((isTTY) => isTTY) &&
+                    !options.nonInteractive;
+            if (this.command === "stop")
+                this.action = options.delete ? "delete" : "stop";
+            const dispatcher = new Agent({ connect: { timeout: 500 } });
+            this.dispatcher = dispatcher;
+            this.client = new PostHog(destination.projectToken, {
+                host: destination.host,
+                isServer: false,
+                disableGeoip: true,
+                enableExceptionAutocapture: false,
+                enableLocalEvaluation: false,
+                flushInterval: 0,
+                fetchRetryCount: 0,
+                requestTimeout: 500,
+                disableCompression: true,
+                fetch: async (url, options) => {
+                    // Only uncompressed event JSON is supported; never follow ingestion redirects.
+                    if (typeof options.body !== "string")
+                        throw Error("Expected event JSON");
+                    const response = await fetch(url, {
+                        method: options.method,
+                        headers: options.headers,
+                        body: options.body,
+                        dispatcher,
+                        redirect: "error",
+                        signal: AbortSignal.timeout(500),
+                    });
+                    const body = await response.text();
+                    return {
+                        status: response.status,
+                        headers: response.headers,
+                        text: () => Promise.resolve(body),
+                        json: () => Promise.resolve().then(() => JSON.parse(body)),
+                    };
+                },
+            });
+            this.startTime = performance.now();
+            this.started = this.capture("cli_command_started");
+        }
+        catch {
+            // Telemetry configuration/storage must never prevent a command from running.
+            await this.dispatcher?.destroy().catch(() => { });
+            this.client = undefined;
+        }
+    }
+    configurationMode(mode) {
+        this.mode = mode;
+    }
+    result(value) {
+        if (!value || typeof value !== "object")
+            return;
+        if ("state" in value && value.state === "cancelled")
+            this.outcome = "cancelled";
+        else if ("state" in value && value.state === "action_required")
+            this.outcome = "action_required";
+        else if (this.command === "configure" || this.command === "start") {
+            if ("ready" in value && value.ready === false)
+                this.outcome = "action_required";
+        }
+        if (this.command !== "configure")
+            return;
+        if ("ready" in value && value.ready === true)
+            this.configuration = "ready";
+        else if ("state" in value && value.state === "unchanged")
+            this.configuration = "unchanged";
+        else if ("state" in value && value.state === "prepared")
+            this.configuration = "saved";
+    }
+    async finish(exitCode, failureCode) {
+        if (!this.client)
+            return;
+        const outcome = exitCode === 130 || failureCode === "cancelled"
+            ? "cancelled"
+            : failureCode !== undefined ||
+                (exitCode !== undefined && Number(exitCode) !== 0)
+                ? "failure"
+                : this.outcome;
+        const code = errorCodeSchema.safeParse(failureCode);
+        try {
+            await Promise.all([
+                this.started,
+                this.capture("cli_command_finished", {
+                    outcome,
+                    duration_ms: Math.round(performance.now() - this.startTime),
+                    ...(outcome === "failure"
+                        ? {
+                            error_code: code.success ? code.data : "operation_failed",
+                            operation: this.command,
+                        }
+                        : {}),
+                    ...(this.mode ? { configuration_mode: this.mode } : {}),
+                    ...(this.configuration
+                        ? { configuration_outcome: this.configuration }
+                        : {}),
+                }),
+            ]);
+            await this.client.shutdown(1000);
+        }
+        catch {
+            // Best effort only: no retries, offline queue, output, or changed exit status.
+        }
+        finally {
+            await this.dispatcher?.destroy().catch(() => { });
+            this.client = undefined;
+        }
+    }
+    async capture(event, result = {}) {
+        try {
+            await this.client?.captureImmediate({
+                distinctId: this.distinctId,
+                event,
+                timestamp: new Date(),
+                properties: {
+                    command: this.command,
+                    invocation_id: this.invocationId,
+                    cli_version: this.version,
+                    os: process.platform,
+                    architecture: process.arch,
+                    interactive: this.interactive,
+                    ...(this.action ? { action: this.action } : {}),
+                    ...result,
+                    $process_person_profile: false,
+                    $ip: null,
+                },
+            });
+        }
+        catch {
+            // Never forward telemetry errors (including remote response bodies) to output.
+        }
+    }
+}

package/runtime/releases/0.1.0-alpha.1.json

@@ -1,37 +0,0 @@
-{
-  "schemaVersion": 1,
-  "version": "0.1.0-alpha.1",
-  "sourceRevision": "a53e95251321e61d8ffd6d06a6984f651c0b0db4",
-  "platforms": [
-    "darwin-arm64"
-  ],
-  "images": {
-    "postgres": "postgres@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193",
-    "gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:eaa25c8e487970176b95de657df8bf4faff605f9f265ca760197800d9a1e5fcf",
-    "companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:97cfeb78ab56ba625b30aafe2249633d9b69f7f3c75de7116453385010e6281f",
-    "openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:669f37f654926fc7714783cc8b1b76bae9666895c2a4da959580037d281ebf56",
-    "relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:5ee13e9496e3b76e076e91c59a861a10ad7a31a13b145384fba314d7f0b686b5",
-    "models": "ghcr.io/berriai/litellm:v1.100.1@sha256:a3715fa7ad8387941ab697259bd2881d68931657247a41984f90fae6d11c62bf",
-    "browser": {
-      "chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:28ca9e4007d3b7c1bb9cb8f4bbaf275d1bc36ee2744079326b151b1f9eec78fd",
-      "node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:2837d8b75df69fb39c7f7ca8fa68249d9de6e20d4e028213792de5f8f9ef1bd7",
-      "dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:9f14cb85df522014c2bfc068e2b5788568f26b6e8d948cebe1250aff7630847b",
-      "egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:bd819dffa4e1f60fbeed3b459a26b3b274300a4e5836bb90cbd080f6681d594c"
-    }
-  },
-  "tools": {
-    "openshell": {
-      "version": "0.0.116",
-      "cli": {
-        "file": "tools/openshell",
-        "sha256": "0baeeffe0e4c184b08fde910ac9e8815fb0b8cfb808e49c0e634d7db65fb03bb",
-        "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.1/openshell-darwin-arm64"
-      },
-      "gateway": {
-        "file": "tools/openshell-gateway",
-        "sha256": "298706259ef18350f334c222e981e91583558511d50bce22727c689d261203e6",
-        "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.1/openshell-gateway-darwin-arm64"
-      }
-    }
-  }
-}

package/scripts/deployment/connection-policy.js

@@ -1,80 +0,0 @@
-import { isDeepStrictEqual } from "node:util";
-import { readFile, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { z } from "zod";
-import { run } from "./process.js";
-import { resourceNames, writePrivate } from "./state.js";
-import { runtimeManager } from "./runtime.js";
-const ruleSchema = z.object({
-    name: z.string(),
-    endpoints: z.array(z.object({ host: z.string(), port: z.number(), tls: z.string() })),
-    binaries: z.array(z.object({ path: z.string() })),
-});
-const policySchema = z.looseObject({
-    network_policies: z.record(z.string(), z.unknown()),
-});
-/** Apply only the explicitly selected broker rule; never regenerate an operator's other policies. */
-export async function applyConnectionPolicy(directory, state, env, verify = false) {
-    const pending = join(directory, "private/connection-policy-change.json");
-    let text;
-    try {
-        text = await readFile(pending, "utf8");
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    const change = z
-        .strictObject({
-        ownerId: z.literal(state.ownerId),
-        rule: ruleSchema.nullable(),
-    })
-        .parse(JSON.parse(text));
-    const base = join(directory, "private/runtime-policy.json");
-    const update = (policy) => {
-        if (change.rule)
-            policy.network_policies.connections_broker = change.rule;
-        else
-            delete policy.network_policies.connections_broker;
-        return policy;
-    };
-    const matches = (rule) => {
-        if (change.rule === null)
-            return rule === undefined;
-        const parsed = ruleSchema.safeParse(rule);
-        return parsed.success && isDeepStrictEqual(parsed.data, change.rule);
-    };
-    const name = resourceNames(state).sandbox;
-    if (!(await runtimeManager(directory, state, env, run).recorded()).receipt) {
-        if (verify)
-            throw Error("The configured runtime has not been recorded.");
-        await writePrivate(base, JSON.stringify(update(policySchema.parse(JSON.parse(await readFile(base, "utf8"))))));
-        return;
-    }
-    const observed = z
-        .object({
-        sandbox: z.literal(name),
-        policy_source: z.literal("sandbox"),
-        policy: policySchema,
-    })
-        .parse(JSON.parse(await run(state.input.openshellCli, [
-        "policy",
-        "get",
-        name,
-        "--gateway",
-        name,
-        "--base",
-        "--output",
-        "json",
-    ], { env })));
-    if (matches(observed.policy.network_policies.connections_broker)) {
-        if (verify)
-            await rm(pending);
-        return;
-    }
-    if (verify)
-        throw Error("The Connections network permission was not confirmed. The installation remains unavailable.");
-    await writePrivate(base, JSON.stringify(update(observed.policy)));
-    await run(state.input.openshellCli, ["policy", "set", name, "--gateway", name, "--policy", base], { env });
-}

package/scripts/deployment/upgrade-rpc.py

@@ -1,148 +0,0 @@
-"""Pinned public OpenShell protobuf RPCs absent from its high-level SandboxClient.
-
-Operator-only: private mTLS material and snapshots never enter the runtime image.
-The published SDK supplies generated messages; no private client attributes are used.
-"""
-import base64
-import json
-import pathlib
-import sys
-
-import grpc
-from openshell._proto import openshell_pb2 as api, openshell_pb2_grpc, sandbox_pb2 as policy
-
-
-class Refused(Exception):
-    pass
-
-
-def encode(message):
-    return base64.b64encode(message.SerializeToString(deterministic=True)).decode("ascii")
-
-
-def decode(value, kind):
-    result = kind()
-    result.ParseFromString(base64.b64decode(value, validate=True))
-    return result
-
-
-def current(stub, request):
-    result = stub.GetSandbox(api.GetSandboxRequest(name=request["name"], workspace="default"), timeout=15).sandbox
-    if result.metadata.id != request["id"] or result.metadata.labels.get("clawscarf.installation") != request["ownerId"]:
-        raise Refused("identity_changed")
-    return result
-
-
-def config(stub, sandbox):
-    return stub.GetSandboxConfig(policy.GetSandboxConfigRequest(sandbox_id=sandbox.metadata.id), timeout=15)
-
-
-def no_globals(stub, effective):
-    global_settings = stub.GetGatewayConfig(policy.GetGatewayConfigRequest(), timeout=15)
-    if any(value.WhichOneof("value") is not None for value in global_settings.settings.values()) or effective.policy_source != policy.POLICY_SOURCE_SANDBOX:
-        raise Refused("global_overrides_unsupported")
-
-
-def snapshot(stub, request):
-    sandbox = current(stub, request)
-    if sandbox.status.phase != api.SANDBOX_PHASE_STOPPED:
-        raise Refused("runtime_not_stopped")
-    effective = config(stub, sandbox)
-    no_globals(stub, effective)
-    revision = stub.GetSandboxPolicyStatus(api.GetSandboxPolicyStatusRequest(name=request["name"], workspace="default"), timeout=15)
-    if revision.revision.status != api.POLICY_STATUS_LOADED or revision.active_version != revision.revision.version:
-        raise Refused("policy_not_loaded")
-    spec = api.SandboxSpec()
-    spec.CopyFrom(sandbox.spec)
-    spec.policy.CopyFrom(revision.revision.policy)
-    if list(spec.command) != ["/app/clawscarf/bin/openclaw", "gateway"]:
-        raise Refused("runtime_command_unsupported")
-    create = api.CreateSandboxRequest(spec=spec, name=request["name"], workspace="default",
-                                     labels=sandbox.metadata.labels, annotations=sandbox.metadata.annotations)
-    result = {"create": encode(create), "effective": encode(effective),
-              "resourceVersion": str(sandbox.metadata.resource_version)}
-    # Reads are not a transaction: reject a revision changing during the snapshot.
-    if current(stub, request).metadata.resource_version != sandbox.metadata.resource_version or encode(config(stub, sandbox)) != result["effective"]:
-        raise Refused("configuration_changed")
-    return result
-
-
-def restored(stub, request, expected):
-    sandbox = current(stub, request)
-    actual = config(stub, sandbox)
-    no_globals(stub, actual)
-    if actual.policy != expected.policy or actual.settings != expected.settings:
-        raise Refused("restoration_unverified")
-    original = decode(request["snapshot"]["create"], api.CreateSandboxRequest)
-    if list(sandbox.spec.providers) != list(original.spec.providers):
-        raise Refused("configuration_changed")
-    return {"verified": True}
-
-
-def perform(stub, request):
-    action = request["action"]
-    if action == "snapshot":
-        return snapshot(stub, request)
-    original = decode(request["snapshot"]["create"], api.CreateSandboxRequest)
-    expected = decode(request["snapshot"]["effective"], policy.GetSandboxConfigResponse)
-    if original.name != request["name"] or original.labels.get("clawscarf.installation") != request["ownerId"]:
-        raise Refused("identity_changed")
-    if action == "create":
-        no_globals(stub, expected)
-        original.spec.template.image = request["image"]
-        original.spec.environment["CLAWSCARF_START_GATE"] = request["generation"]
-        original.labels["clawscarf.upgrade"] = request["generation"]
-        result = stub.CreateSandbox(original, timeout=120).sandbox
-        return {"id": result.metadata.id}
-    if action == "verify":
-        return restored(stub, request, expected)
-    if action == "restore":
-        sandbox = current(stub, request)
-        no_globals(stub, config(stub, sandbox))
-        for key, setting in expected.settings.items():
-            if setting.scope != policy.SETTING_SCOPE_SANDBOX or setting.value.WhichOneof("value") is None:
-                continue
-            sandbox = current(stub, request)
-            observed = config(stub, sandbox).settings.get(key)
-            if observed is not None and observed == setting:
-                continue
-            if observed is not None and observed.value.WhichOneof("value") is not None:
-                raise Refused("configuration_changed")
-            # The pinned setting-update API has no atomic revision precondition.
-            # Explicit resume skips observed matches and reapplies only unset values;
-            # exclusive operator control prevents concurrent edits.
-            stub.UpdateConfig(api.UpdateConfigRequest(name=request["name"], workspace="default", setting_key=key,
-                setting_value=setting.value), timeout=15)
-        return restored(stub, request, expected)
-    raise Refused("invalid_request")
-
-
-def main():
-    try:
-        raw = sys.stdin.buffer.read(4 * 1024 * 1024 + 1)
-        if len(raw) > 4 * 1024 * 1024:
-            raise Refused("invalid_request")
-        request = json.loads(raw)
-        directory = pathlib.Path(request["controller"])
-        settings = json.loads((directory / "controller.json").read_text())
-        if settings["name"] != request["name"]:
-            raise Refused("identity_changed")
-        tls = directory / "tls"
-        credentials = grpc.ssl_channel_credentials((tls / "ca.crt").read_bytes(),
-            (tls / "client/tls.key").read_bytes(), (tls / "client/tls.crt").read_bytes())
-        with grpc.secure_channel(f"127.0.0.1:{settings['port']}", credentials) as channel:
-            result = perform(openshell_pb2_grpc.OpenShellStub(channel), request)
-        output = json.dumps({"ok": True, "value": result})
-        if len(output.encode()) > 4 * 1024 * 1024:
-            raise Refused("response_too_large")
-        print(output)
-    except Refused as error:
-        print(json.dumps({"ok": False, "code": str(error)}))
-    except grpc.RpcError as error:
-        print(json.dumps({"ok": False, "code": error.code().name}))
-    except Exception:
-        print(json.dumps({"ok": False, "code": "unavailable"}))
-
-
-if __name__ == "__main__":
-    main()