@clawscarf/cli 0.1.0-alpha.1

package/scripts/packs/openshell.js

@@ -0,0 +1,148 @@
+import { OperatorError } from "../errors.js";
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { verifyNetworkPolicy } from "./policy.js";
+import { NativeClaws } from "./native.js";
+const execute = promisify(execFile);
+const snapshotSchema = z.object({
+    id: z.uuid(),
+    name: z.string(),
+    phase: z.literal("Ready"),
+});
+export class OpenShellClaws extends NativeClaws {
+    options;
+    constructor(options) {
+        super("/app/clawscarf/bin/openclaw");
+        this.options = options;
+    }
+    async shell(args) {
+        const child = execute(this.options.executable, [...args, "--gateway", this.options.gateway], {
+            maxBuffer: 4 * 1024 * 1024,
+            timeout: 120000,
+            env: this.options.env ?? process.env,
+        });
+        child.child.stdin?.end();
+        const { stdout } = await child;
+        return stdout;
+    }
+    boundTarget;
+    async exec(command, stdin) {
+        if (!this.boundTarget)
+            await this.target();
+        if (!this.boundTarget)
+            throw new OperatorError("An observed target is required.");
+        const child = execute(this.options.python, [fileURLToPath(new URL("./transport.py", import.meta.url))], {
+            maxBuffer: 4 * 1024 * 1024,
+            timeout: 120000,
+            env: this.options.env ?? process.env,
+        });
+        child.child.stdin?.end(JSON.stringify({
+            gateway: this.options.gateway,
+            sandboxId: this.boundTarget.sandboxId,
+            command,
+            stdin: stdin?.toString("base64") ?? "",
+        }));
+        return (await child).stdout;
+    }
+    async target() {
+        const gateway = snapshotSchema.parse(JSON.parse(await this.shell([
+            "sandbox",
+            "get",
+            this.options.sandbox,
+            "--output",
+            "json",
+        ])));
+        if (gateway.name !== this.options.sandbox)
+            throw new OperatorError("Unexpected sandbox identity.");
+        const target = {
+            kind: "openshell",
+            gateway: this.options.gateway,
+            sandbox: gateway.name,
+            sandboxId: gateway.id,
+        };
+        if (this.boundTarget && this.boundTarget.sandboxId !== target.sandboxId)
+            throw new OperatorError("Sandbox identity changed; create a new pack preview.");
+        this.boundTarget = target;
+        return target;
+    }
+    async version() {
+        if ((this.options.env ?? process.env).OPENCLAW_EXPERIMENTAL_CLAWS !== "1")
+            throw new OperatorError("Set OPENCLAW_EXPERIMENTAL_CLAWS=1 to acknowledge the experimental native Claws contract.");
+        const stdout = await this.exec([
+            "/app/clawscarf/bin/openclaw",
+            "--version",
+        ]);
+        if (!/\b2026\.9\.4\b/.test(stdout))
+            throw new OperatorError("Packs require the pinned OpenClaw 2026.9.4 release.");
+    }
+    async run(args) {
+        return JSON.parse(await this.exec(["/app/clawscarf/bin/openclaw", ...args]));
+    }
+    async source(root, digest, existing) {
+        const targetRoot = existing ??
+            (await this.exec([
+                "/usr/local/bin/node",
+                "-e",
+                "process.stdout.write(require('node:fs').mkdtempSync('/home/node/.clawscarf-pack-'))",
+            ])).trim();
+        if (!/^\/home\/node\/\.clawscarf-pack-[A-Za-z0-9]+$/.test(targetRoot))
+            throw new OperatorError("Invalid pack staging directory.");
+        if (!existing) {
+            const directory = await mkdtemp(join(tmpdir(), "clawscarf-pack-upload-"));
+            try {
+                const archive = join(directory, "source.tar");
+                await execute("tar", ["-cf", archive, "-C", root, "."], {
+                    env: { ...process.env, COPYFILE_DISABLE: "1" },
+                });
+                await this.exec(["tar", "-xf", "-", "-C", targetRoot], await readFile(archive));
+            }
+            finally {
+                await rm(directory, { recursive: true, force: true });
+            }
+        }
+        const observed = z
+            .object({ digest: z.string() })
+            .parse(JSON.parse(await this.exec([
+            "/app/clawscarf/bin/packs",
+            "inspect",
+            targetRoot,
+            "--json",
+        ])));
+        if (observed.digest !== digest)
+            throw new OperatorError("Target pack differs from reviewed source; create a new preview.");
+        return targetRoot;
+    }
+    async network(requirements) {
+        if (!requirements.length)
+            return null;
+        const target = await this.target();
+        if (target.kind !== "openshell")
+            throw new OperatorError("An OpenShell target is required.");
+        for (const requirement of requirements) {
+            await this.exec([
+                "/usr/local/bin/node",
+                "-e",
+                "const fs=require('node:fs');fs.accessSync(process.argv[1],fs.constants.X_OK);if(fs.realpathSync(process.argv[1])!==process.argv[1])process.exit(1)",
+                requirement.binary,
+            ]);
+        }
+        return verifyNetworkPolicy(requirements, {
+            sandbox: target.sandbox,
+            sandboxId: target.sandboxId,
+            run: (args) => this.shell(args),
+        });
+    }
+    async binary(name) {
+        await this.exec([
+            "/usr/local/bin/node",
+            "-e",
+            "const fs=require('node:fs'),path=require('node:path');if(!process.env.PATH.split(path.delimiter).some(p=>{try{fs.accessSync(path.join(p,process.argv[1]),fs.constants.X_OK);return true}catch{return false}}))process.exit(1)",
+            name,
+        ]);
+    }
+}

package/scripts/packs/policy.js

@@ -0,0 +1,189 @@
+import { isAbsolute, normalize } from "node:path/posix";
+import { z } from "zod";
+const host = z
+    .string()
+    .max(253)
+    .regex(/^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+$/)
+    .refine((value) => !/^[0-9.]+$/.test(value) &&
+    value.split(".").every((label) => label.length <= 63), "Use an exact DNS hostname, not an IP address.");
+const binary = z
+    .string()
+    .refine((value) => isAbsolute(value) &&
+    normalize(value) === value &&
+    !/[\s*?[\]{}]/.test(value) &&
+    Array.from(value).every((character) => character.charCodeAt(0) >= 32), "Use an exact canonical executable path inside the runtime.");
+export const networkRequirementSchema = z.strictObject({
+    binary,
+    host,
+    port: z.number().int().min(1).max(65535),
+    protocol: z.literal("tcp"),
+});
+const hash = z.string().regex(/^[a-f0-9]{64}$/);
+const revision = z
+    .string()
+    .regex(/^\d+$/)
+    .refine((value) => BigInt(value) <= 18446744073709551615n);
+export const policyProofSchema = z.strictObject({
+    sandboxId: z.string().min(1),
+    version: z.number().int().positive(),
+    hash,
+    configRevision: revision,
+});
+export class PolicyVerificationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "PolicyVerificationError";
+    }
+}
+const sandboxSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    phase: z.literal("Ready"),
+    current_policy_version: z.number().int().positive(),
+});
+const effectiveSchema = z.object({
+    sandbox: z.string(),
+    version: z.number().int().positive(),
+    hash,
+    config_revision: revision,
+    status: z.literal("effective"),
+    policy_source: z.string(),
+    policy: z.object({
+        network_policies: z.record(z.string(), z.unknown()).default({}),
+        network_middlewares: z.record(z.string(), z.unknown()).default({}),
+    }),
+});
+const loadedSchema = z.object({
+    sandbox: z.string(),
+    version: z.number().int().positive(),
+    active_version: z.number().int().positive(),
+    hash,
+    status: z.string(),
+    loaded_at_ms: z.number().int().positive().optional(),
+    load_error: z.string().optional(),
+});
+const entrySchema = z.strictObject({
+    name: z.string().optional(),
+    endpoints: z.array(z.record(z.string(), z.unknown())),
+    binaries: z.array(z.strictObject({ path: z.string() })),
+});
+const endpointSchema = z.strictObject({
+    host,
+    port: z.number().int().min(1).max(65535),
+    protocol: z.literal("tcp"),
+    enforcement: z.literal("enforce").optional(),
+});
+/** JSON.parse's source context preserves the CLI's uint64 fingerprint exactly. */
+function parse(raw) {
+    return JSON.parse(raw, (key, value, context) => {
+        if (key !== "config_revision")
+            return value;
+        if (typeof value !== "number" ||
+            !context?.source ||
+            !/^\d+$/.test(context.source))
+            throw new PolicyVerificationError("policy_unverified", "OpenShell returned an invalid config revision.");
+        return context.source;
+    });
+}
+function verifyCoverage(policy, requirements) {
+    if (Object.keys(policy.network_middlewares).length)
+        throw new PolicyVerificationError("policy_unsupported", "This pack verifier cannot qualify middleware-dependent network policy. Review the native policy explicitly.");
+    const entries = Object.values(policy.network_policies).map((value) => {
+        const result = entrySchema.safeParse(value);
+        if (!result.success)
+            throw new PolicyVerificationError("policy_unsupported", "Unsupported network rule shape; this verifier supports exact executable and unconditional TCP grants only.");
+        return result.data;
+    });
+    for (const requirement of requirements) {
+        let permitted = false;
+        for (const entry of entries) {
+            for (const endpoint of entry.endpoints) {
+                if (typeof endpoint.host !== "string" ||
+                    /[*?[\]{}]/.test(endpoint.host))
+                    throw new PolicyVerificationError("policy_unsupported", "Hostless and wildcard endpoint rules require native policy review; this verifier does not infer their coverage.");
+                if (endpoint.host !== requirement.host)
+                    continue;
+                if (entry.binaries.some((value) => /[*?[\]{}]/.test(value.path)))
+                    throw new PolicyVerificationError("policy_unsupported", "Wildcard executable rules require native policy review. Use a canonical executable requirement.");
+                if (!entry.binaries.some((value) => value.path === requirement.binary))
+                    continue;
+                if (endpoint.protocol === undefined)
+                    throw new PolicyVerificationError("policy_unsupported", `Policy for ${requirement.host} permits explicit-proxy passthrough, not native TCP. This TCP requirement needs an explicit protocol: tcp grant; review the required transport without changing policy automatically.`);
+                const result = endpointSchema.safeParse(endpoint);
+                if (!result.success)
+                    throw new PolicyVerificationError("policy_unsupported", `Cannot qualify conditional, audited or non-TCP policy for ${requirement.host}; this verifier does not evaluate L7 rules.`);
+                if (result.data.port === requirement.port)
+                    permitted = true;
+            }
+        }
+        if (!permitted)
+            throw new PolicyVerificationError("network_not_permitted", `No exact loaded TCP grant for ${requirement.binary} to ${requirement.host}:${String(requirement.port)}.`);
+    }
+}
+/** Observes loaded policy coverage, never changes policy or claims a successful connection. */
+export async function verifyNetworkPolicy(requirements, target) {
+    if (!requirements.length)
+        return null;
+    const parsed = z.array(networkRequirementSchema).parse(requirements);
+    const readSandbox = async () => sandboxSchema.parse(parse(await target.run([
+        "sandbox",
+        "get",
+        target.sandbox,
+        "--output",
+        "json",
+    ])));
+    const readEffective = async () => effectiveSchema.parse(parse(await target.run([
+        "policy",
+        "get",
+        target.sandbox,
+        "--full",
+        "--output",
+        "json",
+    ])));
+    const identity = await readSandbox();
+    if (identity.id !== target.sandboxId || identity.name !== target.sandbox)
+        throw new PolicyVerificationError("policy_changed", "The target sandbox was replaced; create a new pack preview.");
+    const effective = await readEffective();
+    if (effective.sandbox !== target.sandbox ||
+        effective.policy_source !== "sandbox")
+        throw new PolicyVerificationError("policy_unsupported", "Global policy requires a per-sandbox effective-load acknowledgment this verifier cannot obtain. Use explicit native review.");
+    const loaded = loadedSchema.parse(parse(await target.run([
+        "policy",
+        "get",
+        target.sandbox,
+        "--rev",
+        String(effective.version),
+        "--output",
+        "json",
+    ])));
+    if (loaded.sandbox !== target.sandbox ||
+        loaded.status !== "loaded" ||
+        !loaded.loaded_at_ms ||
+        loaded.load_error ||
+        loaded.version !== effective.version ||
+        loaded.active_version !== effective.version ||
+        identity.current_policy_version !== effective.version)
+        throw new PolicyVerificationError("policy_unverified", "The requested policy is not confirmed loaded. Wait for native policy activation, then retry the preview.");
+    if (loaded.hash !== effective.hash)
+        throw new PolicyVerificationError("policy_unsupported", "Effective policy differs from the acknowledged revision, including possible provider composition. Native review is required.");
+    verifyCoverage(effective.policy, parsed);
+    const after = await readEffective();
+    const finalIdentity = await readSandbox();
+    if (finalIdentity.id !== identity.id ||
+        finalIdentity.name !== identity.name ||
+        finalIdentity.current_policy_version !== loaded.version ||
+        after.hash !== effective.hash ||
+        after.version !== effective.version ||
+        after.config_revision !== effective.config_revision ||
+        after.policy_source !== effective.policy_source ||
+        after.sandbox !== effective.sandbox)
+        throw new PolicyVerificationError("policy_changed", "Runtime policy changed during verification; create a new pack preview.");
+    return {
+        sandboxId: identity.id,
+        version: loaded.version,
+        hash: effective.hash,
+        configRevision: effective.config_revision,
+    };
+}

package/scripts/packs/requirements.in

@@ -0,0 +1 @@
+openshell==0.0.116

package/scripts/packs/requirements.js

@@ -0,0 +1,11 @@
+import { verifyConnections } from "./connections.js";
+export async function requirements(pack, member, native, bindingsFile, sourceRoot = "") {
+    for (const binary of pack.execution.binaries)
+        await native.binary(binary);
+    const network = await native.network(pack.execution.network);
+    const model = member.requirements.model === "configured-default"
+        ? await native.defaultModel()
+        : null;
+    const connections = await verifyConnections(member, native, sourceRoot, bindingsFile);
+    return { model, connections, network };
+}

package/scripts/packs/requirements.txt

@@ -0,0 +1,116 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile scripts/packs/requirements.in --generate-hashes --output-file scripts/packs/requirements.txt --python-version 3.12
+anyio==4.15.1 \
+    --hash=sha256:6152fdbbf9a77fdec97731721bebf7c4c44f7c29b424b0065826173efc7ed101 \
+    --hash=sha256:9f28306018cbd6d329e64a36d58256edff76dd996fe423bc957326e578b82a94
+    # via httpx
+certifi==2026.7.22 \
+    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
+    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
+    # via
+    #   httpcore
+    #   httpx
+cloudpickle==3.1.2 \
+    --hash=sha256:7fda9eb655c9c230dab534f1983763de5835249750e85fbcef43aaa30a9a2414 \
+    --hash=sha256:9acb47f6afd73f60dc1df93bb801b472f05ff42fa6c84167d25cb206be1fbf4a
+    # via openshell
+grpcio==1.84.0 \
+    --hash=sha256:026d757df86c5b7a41de8200b9a2cda454aaa5004cb0c7e3374c66eb82f61499 \
+    --hash=sha256:06619ba1515e5ee69fb2a514e95dd8be05ce74cb3928d5b34f87f87c86fe3c27 \
+    --hash=sha256:08735e3d08d24ab3132cf87e2e5dea8746cabcc7d676c2b0b7362f195feef9d9 \
+    --hash=sha256:0d532ade4486dad9b302ffa4d4683d67561051c26d17c4023322845e9fa10140 \
+    --hash=sha256:158c1c11cfb61b4849c3caf4d52de6f5ecd376e14446feb4a90dc95a90d616f5 \
+    --hash=sha256:15bb76489e337fc492685c9758e2fd4d4ab516b901ad830dc5a91987decf00be \
+    --hash=sha256:19aaf172fc2edbefccce3f6e92c5150975dbe56c45744e9e87cf72ebdf85bfbe \
+    --hash=sha256:209414080da8c20af94df1395b635da52dd57b5edc9e917e1deca0dc1c4bb55e \
+    --hash=sha256:210e4c32f907045eb8158273e60c6ab69a3947697df6245dbda381f26c59485b \
+    --hash=sha256:23e6e8e8a75cff88e0a793bfd3becea03a13e2763ae90c1ff573bc19ca5b429a \
+    --hash=sha256:27b8b36200a9fbee6e120246f4a8a41657549107ef19fb2c819c4b2fd524f39a \
+    --hash=sha256:28d2609691da93051e998495108bbddd2a9f7a561253bae94828d81290f30c15 \
+    --hash=sha256:2c024da73b296f040b8360e60bd73a659b230093684a438da0e1260f34cc724e \
+    --hash=sha256:393d8a78bff6731ecc5ad2151a821f8fbc1709b137ebb9c25a4ef399fbdcc914 \
+    --hash=sha256:3d6a82c4fc6c85f2fb7572c86bdb86f84c97b6580e5f6599f711800bac48a5d8 \
+    --hash=sha256:3de427b05f244ba2c2a9bdc67e7a6731c8340811524ecc4435466549f8af1d17 \
+    --hash=sha256:406583b4e8fb2282ebd392e12b963e601c1f82e07125a8c2cb5b144e7e024796 \
+    --hash=sha256:4119efa6519871719ad81f33bc95ab87857dcb1c5801f30a6e592f2c41164169 \
+    --hash=sha256:42959bd50dd660ffc3f2a9bec15a6da4f9aaa0dda555d59ff2d2e80b908456a8 \
+    --hash=sha256:455ed6083353b8e938f1d58c765eab2fbb165731e5b507be30fee344915a2a11 \
+    --hash=sha256:465eef3d17e59ad22a556fc0138f7c7c799df426734344daec42c797d49fda99 \
+    --hash=sha256:47ecf0d9b81d981f07b61bd89eced9d2582f5eaacc3aaa36ad27f81aef70a27f \
+    --hash=sha256:49717e857899f4136d7657bf5aded61ac479110a075438290923a4d86af7cd02 \
+    --hash=sha256:4aaeceeb7fa7d824c322d1ec3208c8495c88478a927295553235435fc49043ad \
+    --hash=sha256:57dc36a5ab0e676f5f6e171de2917fd0aef73f32a9aaf23956bfe19997a30bd1 \
+    --hash=sha256:5933a052946873d01a42119a05420d669bdca436aeba2d1851988ccb12b421c0 \
+    --hash=sha256:5deda5b4bf62769eb98c119cca43d40e1231e34846b19db5cdea821d446a2253 \
+    --hash=sha256:61386101ecaa096b694d0dd278caf99a56aeec78440cc17e918eef0b50f2d567 \
+    --hash=sha256:659728f20fc7a0933ed7b1945435e31014b97ab8a5a7edcbaa70da4794aeb191 \
+    --hash=sha256:70bb4ce8be0c5606bec259cbd7152374470396413b7863a658a08c849e6b29ff \
+    --hash=sha256:71fd60e6e426d293d0a2f685115ad0a0845117602cf13605a4be7524fb5f7bba \
+    --hash=sha256:756ea5c2da00fa65c930284892d2a9706828704ca3ba40b4c51c4834eb39fcfd \
+    --hash=sha256:800b7e00d92553313c0463c200087930aa78678ec1d528193aeb50906f55989b \
+    --hash=sha256:82da34ae4f639c73ac46e521e00c0a49bf86f717b9fb1f405f133e98731e38dc \
+    --hash=sha256:8e1a45d174b6b8589f51dce1cea804aa6c1f72c9c80cba91ae2caabeb6d90540 \
+    --hash=sha256:8e3f508d0e9e6236ba2f08d56e33355e434e785e813149a1b8477d3edf69779d \
+    --hash=sha256:986e9751d416d7a6eaa2fecdac38da63153d63a4b340ba7d624889c490451500 \
+    --hash=sha256:9b73836ba0e16fcbb57c31cf6cbc2907c8d8c790b83679df454b74bd15e0be04 \
+    --hash=sha256:9bab4cf571653a8afffb83ce21aa27b51dfe629b526b7b6adec35491fe1fc2ea \
+    --hash=sha256:a71d24f40b0cc6798feaa978c7411dc1135b7018e9fc0442db611c139bf58344 \
+    --hash=sha256:a9383401d9f116f98cacd4eba6c505a6edb80ba65badfc8e8ed8ae64983bcc44 \
+    --hash=sha256:b44f0a0fc7bc6677d38cc80bca1a32814ce6c8f200fb8b3c1a61c9d77eaefbf3 \
+    --hash=sha256:b5c6f20d657ae09ae4e30d9d3a21edd13f1219d58cc6f999b9d1bb63be9c1baa \
+    --hash=sha256:b61692f0069b3eee2fc8a3a1b7f6c044df9e03fede6ce69b3ca832e1c39f26c5 \
+    --hash=sha256:b8c62888c3e49debf37ad9773e3c02f77b0c1e811f8fb0962f2b6c3bbab5b97a \
+    --hash=sha256:bd8ea8eb3817b226057cc1c0e7ec4b378dcda52043b972b6ff12b1152178967d \
+    --hash=sha256:c5559b492007dc09b4de9b95dab05f0b5e53547aad230cf07e46c7dd017a3be5 \
+    --hash=sha256:d0fdd25faece8a1f95e8a3a8006e29701b5cf8dadb4a8132e68f3134637004a5 \
+    --hash=sha256:e094dd21f077af8194923fc263cad872eaa1802bb0156fd7e5ae18e99cd86715 \
+    --hash=sha256:e41c3993eee896c617dbd8a505085d28b6e84a0445ed9a1f40f95808473cf678 \
+    --hash=sha256:e88d304f094f4937bc27ec6a435e218a084168f11ec630c8d5d39b431d08d81d \
+    --hash=sha256:e90e3bdf7b5eac005fef631adae9cafde16f922def207b80a7c46b253c18ad20 \
+    --hash=sha256:ed2c1493c44d0932f1e55fdb5d1ead658c68288ec5d51b8c4928422d98633ef9 \
+    --hash=sha256:edb6f87fc60ff438557291501b3e16c7a77c3b01a52d782cf276dccc7c5dd89c \
+    --hash=sha256:efb29f8633bf6630dc89de4fe0353ac3d7e4b70ef7b6e29fb40f00e68c127fa5 \
+    --hash=sha256:f6c972474ce691aca74e58d17625450cef153dc4760364cadeb167983ea6d589 \
+    --hash=sha256:f6d178ba6dc8e82976c184b65fddde172d054c17237993a3e083efe4f134d55b \
+    --hash=sha256:f9a456bdbed52a01c9ab8423bdebab04a5363c78676edc55ab9b58bd13bdf9e1 \
+    --hash=sha256:fbdbcd06986ede3ce584083b1dc2afe6808e8943e5cf50ad11183c03aceda25a \
+    --hash=sha256:fc66cb50c93554b86db0b6625ab5c6e9051dbf8847c08d93c84918e02e413fb7 \
+    --hash=sha256:fff5ef3fe1bba7d6147e5f19e01e5e122ac2c076486887ddcb8d42e663400fbe
+    # via openshell
+h11==0.16.0 \
+    --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
+    --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
+    # via httpcore
+httpcore==1.0.9 \
+    --hash=sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55 \
+    --hash=sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8
+    # via httpx
+httpx==0.28.1 \
+    --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \
+    --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
+    # via openshell
+idna==3.19 \
+    --hash=sha256:5e0811a4383b21dc5838069f801c4fb62113b7447663d2530d2bd6e77b49bf15 \
+    --hash=sha256:815e7be7a7806d54abb586dc943addc79e8b2ee16915059658cbeff4b1b43bf4
+    # via
+    #   anyio
+    #   httpx
+openshell==0.0.116 \
+    --hash=sha256:5a31eb4e38d7b5d746956404145b7335557f9060ac7a987c65ea5af4d708b3fc
+    # via -r scripts/packs/requirements.in
+protobuf==7.36.1 \
+    --hash=sha256:0b53ce95272aad50ad25d7ff03373743209822e8ba42ea7fad27d2bee1547d00 \
+    --hash=sha256:39c518c05586c016d7874ff6079ee115bcec1ea5fbb1d177fbf7867ef4c67e44 \
+    --hash=sha256:3cf2ee25d006cee57294a1196ea43b37feb78e0dcd1e8af5c1aeddb777655aca \
+    --hash=sha256:43d3d37b1eb24c113b9b7d02008cac44e423f00b611b7781ae998d7623972969 \
+    --hash=sha256:51139351435d9b43d88a55eaa49fb6f737fbb478fb0cbf2cf694d1a04a9d3363 \
+    --hash=sha256:7d951e46b3f963d6c264c367c437921de9d5aedd9c3f9612b9077736b4e3ad5c \
+    --hash=sha256:97198b77e369a0abd8e262b8f6c7266c55ddb796a3a12c76d7b8881188ed83aa \
+    --hash=sha256:d0f6470f0ce2b84e3feaea2d4b816378b37ba4d4aa08a274305373de93e2d524
+    # via openshell
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \
+    --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5
+    # via
+    #   anyio
+    #   grpcio

package/scripts/packs/source.js

@@ -0,0 +1,90 @@
+import { OperatorError } from "../errors.js";
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, realpath, cp, mkdtemp, writeFile, rm, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { z } from "zod";
+import { join, relative, resolve, sep } from "node:path";
+import { packSchema } from "./model.js";
+export async function openPack(directory) {
+    const root = await realpath(directory);
+    const manifest = packSchema.parse(JSON.parse(await readFile(join(root, "pack.json"), "utf8")));
+    if (new Set(manifest.members.map((item) => item.id)).size !==
+        manifest.members.length)
+        throw new OperatorError("Pack member IDs must be unique.");
+    for (const member of manifest.members) {
+        if (new Set(member.requirements.connections.map((item) => item.slot)).size !==
+            member.requirements.connections.length)
+            throw new OperatorError("Connection slots must be unique within a member.");
+        const source = await realpath(resolve(root, member.source));
+        if (!source.startsWith(root + sep))
+            throw new OperatorError("Claw source must remain inside its pack.");
+    }
+    const digest = createHash("sha256");
+    let size = 0;
+    async function visit(path) {
+        const metadata = await lstat(path);
+        if (metadata.isSymbolicLink() ||
+            (metadata.nlink > 1 && !metadata.isDirectory()))
+            throw new OperatorError("Pack sources cannot use linked files.");
+        if (metadata.isDirectory()) {
+            for (const item of (await readdir(path)).sort())
+                await visit(join(path, item));
+            return;
+        }
+        if (!metadata.isFile() || (size += metadata.size) > 8 * 1024 * 1024)
+            throw new OperatorError("Pack source exceeds the 8 MiB limit or is not a regular file.");
+        digest.update(JSON.stringify({
+            path: relative(root, path).split(sep).join("/"),
+            executable: metadata.mode & 0o111,
+            sha256: createHash("sha256")
+                .update(await readFile(path))
+                .digest("hex"),
+        }) + "\n");
+    }
+    await visit(root);
+    return { root, manifest, digest: "sha256:" + digest.digest("hex") };
+}
+export async function prepareSource(source, member, connections, native, existing) {
+    if (!connections.length)
+        return native.source(source.root, source.digest, existing);
+    if ((await native.target()).kind !== "openshell")
+        throw new OperatorError("Connection file installation requires operator-side OpenShell execution.");
+    if (!member.connectionFile)
+        throw new OperatorError("Connection file is not declared.");
+    const directory = await mkdtemp(join(tmpdir(), "clawscarf-pack-bound-"));
+    try {
+        await cp(source.root, directory, { recursive: true });
+        await writeFile(join(directory, member.source, member.connectionFile), JSON.stringify({
+            schemaVersion: 1,
+            connections: connections.map(({ slot, connectionId, name, connectorId }) => ({
+                slot,
+                connectionId,
+                name,
+                connectorId,
+            })),
+        }, null, 2) + "\n", { mode: 0o600 });
+        const prepared = await openPack(directory);
+        const target = await native.source(directory, prepared.digest, existing);
+        const inspected = z
+            .object({
+            valid: z.literal(true),
+            manifest: z.object({
+                workspace: z.object({
+                    files: z.array(z.object({ source: z.string(), path: z.string() })),
+                }),
+            }),
+        })
+            .parse(await native.run([
+            "claws",
+            "inspect",
+            join(target, member.source),
+            "--json",
+        ]));
+        if (!inspected.manifest.workspace.files.some((file) => file.source === member.connectionFile))
+            throw new OperatorError("connectionFile must be declared in the native Claw workspace.files; its ownership cannot be inferred.");
+        return target;
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+}

package/scripts/packs/transport.py

@@ -0,0 +1,68 @@
+"""Operator-only bridge to the pinned official OpenShell SDK; no runtime secrets."""
+import base64
+import json
+import re
+import sys
+from uuid import UUID
+
+from openshell.sandbox import SandboxClient
+
+MAX_INPUT = 16 * 1024 * 1024
+MAX_OUTPUT = 4 * 1024 * 1024
+
+
+def parse_request():
+    raw = sys.stdin.buffer.read(MAX_INPUT + 1)
+    if len(raw) > MAX_INPUT:
+        raise ValueError("Operator payload too large")
+    value = json.loads(raw)
+    if not isinstance(value, dict) or set(value) != {
+        "gateway", "sandboxId", "command", "stdin"
+    }:
+        raise ValueError("Invalid operator request")
+    gateway = value["gateway"]
+    sandbox_id = value["sandboxId"]
+    command = value["command"]
+    encoded = value["stdin"]
+    if not isinstance(gateway, str) or not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}", gateway):
+        raise ValueError("Invalid gateway name")
+    if not isinstance(sandbox_id, str) or str(UUID(sandbox_id)) != sandbox_id:
+        raise ValueError("Invalid sandbox UUID")
+    if not isinstance(command, list) or not 1 <= len(command) <= 128:
+        raise ValueError("Invalid command")
+    if not all(isinstance(arg, str) and len(arg) <= 8192 and "\0" not in arg for arg in command):
+        raise ValueError("Invalid command argument")
+    if not isinstance(encoded, str):
+        raise ValueError("Invalid stdin")
+    return gateway, sandbox_id, command, base64.b64decode(encoded, validate=True)
+
+
+def main():
+    try:
+        gateway, sandbox_id, command, stdin = parse_request()
+    except (ValueError, TypeError):
+        sys.stderr.write("Invalid operator execution request.\n")
+        return 2
+    try:
+        with SandboxClient.from_active_cluster(cluster=gateway, timeout=120) as client:
+            result = client.exec(
+                sandbox_id, command,
+                env={"OPENCLAW_EXPERIMENTAL_CLAWS": "1"},
+                stdin=stdin,
+                timeout_seconds=110,
+            )
+    except Exception:
+        sys.stderr.write("OpenShell execution has no confirmed completion; inspect native state before retrying.\n")
+        return 3
+    if result.exit_code != 0:
+        sys.stderr.write(f"Native command exited with status {result.exit_code}; inspect native state before retrying.\n")
+        return 1
+    if len(result.stdout.encode("utf8")) > MAX_OUTPUT:
+        sys.stderr.write("Native response exceeded the operator output limit; inspect native state before retrying.\n")
+        return 3
+    sys.stdout.write(result.stdout)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())