@drakon-systems/multi-clawd 1.8.11 → 1.9.2

package/dist/direct-sync.js

@@ -0,0 +1,335 @@
+import { classifyAccountHealth } from "./health.js";
+import { DIRECT_PROVIDER, planDirectOrder } from "./direct-route.js";
+import { parseClaudeSetupToken } from "./hermes-core.js";
+export function safeCliError(result) {
+    const text = `${result.stderr ?? ""}\n${result.stdout ?? ""}`;
+    const line = text
+        .split("\n")
+        .map((l) => l.trim())
+        .find((l) => /error|fail|refus|not found|missing|invalid|denied/i.test(l)) ??
+        text.split("\n").map((l) => l.trim()).find(Boolean) ??
+        "";
+    const masked = line.replace(/sk-ant-[A-Za-z0-9_-]+/g, "sk-ant-…").replace(/[A-Za-z0-9_-]{40,}/g, "…");
+    return `exit ${result.code}${masked ? `: ${masked.slice(0, 200)}` : ""}`;
+}
+function parseJson(stdout) {
+    const start = stdout.indexOf("{");
+    if (start < 0)
+        return undefined;
+    try {
+        return JSON.parse(stdout.slice(start));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function parseAuthList(stdout) {
+    const doc = parseJson(stdout);
+    if (!doc || !Array.isArray(doc.profiles))
+        return undefined;
+    return doc.profiles
+        .filter((p) => typeof p?.id === "string")
+        .filter((p) => p.provider === undefined || p.provider === DIRECT_PROVIDER)
+        .map((p) => ({ id: p.id, type: typeof p.type === "string" ? p.type : undefined }));
+}
+export function parseOrderGet(stdout) {
+    const doc = parseJson(stdout);
+    if (!doc || !("order" in doc))
+        return undefined;
+    if (doc.order === null || doc.order === undefined)
+        return { order: null };
+    if (!Array.isArray(doc.order))
+        return undefined;
+    return { order: doc.order.filter((v) => typeof v === "string") };
+}
+export function parseUnusableProfiles(stdout) {
+    const doc = parseJson(stdout);
+    const rows = doc?.auth?.unusableProfiles;
+    if (!Array.isArray(rows))
+        return undefined;
+    const out = [];
+    for (const row of rows) {
+        if (typeof row?.profileId !== "string" || typeof row.until !== "number")
+            continue;
+        if (row.provider !== undefined && row.provider !== DIRECT_PROVIDER)
+            continue;
+        out.push({
+            profileId: row.profileId,
+            kind: typeof row.kind === "string" ? row.kind : "cooldown",
+            reason: typeof row.reason === "string" ? row.reason : undefined,
+            until: row.until,
+        });
+    }
+    return out;
+}
+const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+export function isValidAgentId(agentId) {
+    return typeof agentId === "string" && AGENT_ID_RE.test(agentId);
+}
+export function assertAgentId(agentId) {
+    if (!AGENT_ID_RE.test(agentId))
+        throw new Error(`invalid agent id "${agentId}"`);
+    return agentId;
+}
+export function authListArgs(agentId) {
+    return ["models", "auth", "list", "--agent", assertAgentId(agentId), "--provider", DIRECT_PROVIDER, "--json"];
+}
+export function orderGetArgs(agentId) {
+    return ["models", "auth", "order", "get", "--agent", assertAgentId(agentId), "--provider", DIRECT_PROVIDER, "--json"];
+}
+export function orderSetArgs(agentId, order) {
+    if (order.length === 0)
+        throw new Error("refusing to set an empty order");
+    for (const id of order) {
+        if (!id.startsWith(`${DIRECT_PROVIDER}:`))
+            throw new Error(`"${id}" is not an ${DIRECT_PROVIDER} profile id`);
+    }
+    return ["models", "auth", "order", "set", "--agent", assertAgentId(agentId), "--provider", DIRECT_PROVIDER, ...order];
+}
+export function pasteTokenArgs(agentId, profileId) {
+    return [
+        "models",
+        "auth",
+        "paste-token",
+        "--agent",
+        assertAgentId(agentId),
+        "--provider",
+        DIRECT_PROVIDER,
+        "--profile-id",
+        profileId,
+    ];
+}
+export function buildTokenRefPlan(params) {
+    const { profileId } = params;
+    if (profileId.includes(".")) {
+        throw new Error(`profile id "${profileId}" contains "." and cannot be targeted by a secrets plan — choose a direct.profileId without dots`);
+    }
+    return {
+        version: 1,
+        protocolVersion: 1,
+        scrubEnv: false,
+        scrubAuthProfilesForProviderTargets: false,
+        targets: [
+            {
+                type: "auth-profiles.token.token",
+                path: `profiles.${profileId}.token`,
+                pathSegments: ["profiles", profileId, "token"],
+                agentId: assertAgentId(params.agentId),
+                authProfileProvider: DIRECT_PROVIDER,
+                ref: { source: params.ref.source, provider: params.ref.provider, id: params.ref.id },
+            },
+        ],
+    };
+}
+export async function syncDirectProfiles(params) {
+    const { runner, agentId } = params;
+    const list = await runner(authListArgs(agentId), { timeoutMs: 60_000 });
+    const listed = list.code === 0 ? parseAuthList(list.stdout) : undefined;
+    if (!listed)
+        return { results: [], listError: safeCliError(list) };
+    const stored = new Set(listed.map((p) => p.id));
+    const results = [];
+    for (const member of params.members) {
+        const base = { accountId: member.accountId, profileId: member.profileId };
+        const { source } = member;
+        if (source.kind === "existing") {
+            results.push({ ...base, action: stored.has(member.profileId) ? "adopted" : "adopt-missing" });
+            continue;
+        }
+        if (source.kind !== "file" && source.kind !== "ref")
+            continue;
+        if (stored.has(member.profileId) && !params.resync) {
+            results.push({ ...base, action: "present" });
+            continue;
+        }
+        if (source.kind === "file") {
+            let token;
+            try {
+                token = parseClaudeSetupToken(params.readTokenFile(source.path));
+            }
+            catch (err) {
+                results.push({ ...base, action: "failed", detail: `token file: ${err.message}` });
+                continue;
+            }
+            if (params.dryRun) {
+                results.push({ ...base, action: "would-store", detail: "paste-token from the token file" });
+                continue;
+            }
+            const r = await runner(pasteTokenArgs(agentId, member.profileId), { input: token, timeoutMs: 120_000 });
+            results.push(r.code === 0
+                ? { ...base, action: "stored", detail: "paste-token" }
+                : { ...base, action: "failed", detail: `paste-token ${safeCliError(r)}` });
+            continue;
+        }
+        let plan;
+        try {
+            plan = buildTokenRefPlan({ agentId, profileId: member.profileId, ref: source.ref });
+        }
+        catch (err) {
+            results.push({ ...base, action: "failed", detail: err.message });
+            continue;
+        }
+        const execFlag = source.ref.source === "exec" ? ["--allow-exec"] : [];
+        const file = params.writePlanFile(plan);
+        try {
+            const check = await runner(["secrets", "apply", "--from", file.path, "--dry-run", ...execFlag], {
+                timeoutMs: 120_000,
+            });
+            if (check.code !== 0) {
+                results.push({ ...base, action: "failed", detail: `secrets apply --dry-run ${safeCliError(check)}` });
+                continue;
+            }
+            if (params.dryRun) {
+                results.push({ ...base, action: "would-store", detail: "secrets apply (tokenRef, validated)" });
+                continue;
+            }
+            const apply = await runner(["secrets", "apply", "--from", file.path, ...execFlag], { timeoutMs: 120_000 });
+            results.push(apply.code === 0
+                ? { ...base, action: "stored", detail: "secrets apply (tokenRef — no copy of the secret)" }
+                : { ...base, action: "failed", detail: `secrets apply ${safeCliError(apply)}` });
+        }
+        finally {
+            file.cleanup();
+        }
+    }
+    return { results };
+}
+export async function readDirectRouteSnapshot(runner, agentId) {
+    const list = await runner(authListArgs(agentId), { timeoutMs: 60_000 });
+    const listed = list.code === 0 ? parseAuthList(list.stdout) : undefined;
+    if (!listed)
+        return { error: `auth list ${safeCliError(list)}` };
+    const order = await runner(orderGetArgs(agentId), { timeoutMs: 60_000 });
+    const parsed = order.code === 0 ? parseOrderGet(order.stdout) : undefined;
+    if (!parsed)
+        return { error: `order get ${safeCliError(order)}` };
+    return { snapshot: { stored: new Set(listed.map((p) => p.id)), storedOrder: parsed.order } };
+}
+function sameOrder(a, b) {
+    if (!a || !b)
+        return false;
+    return a.length === b.length && a.every((id, i) => id === b[i]);
+}
+export function planAgentOrder(params) {
+    const { snapshot } = params;
+    const present = params.members.filter((m) => snapshot.stored.has(m.profileId));
+    const missing = params.members.filter((m) => !snapshot.stored.has(m.profileId)).map((m) => m.profileId);
+    if (present.length === 0)
+        return { missing };
+    const explicit = snapshot.storedOrder ?? (params.configOrder?.length ? [...params.configOrder] : null);
+    const base = (explicit ?? [...snapshot.stored]).filter((id) => snapshot.stored.has(id));
+    const plan = planDirectOrder({
+        members: present,
+        currentOrder: base,
+        sticky: params.sticky,
+        nowMs: params.nowMs,
+        minDwellMs: params.minDwellMs,
+    });
+    if (!plan)
+        return { missing };
+    const inForce = snapshot.storedOrder !== null ? sameOrder(snapshot.storedOrder, plan.order) : sameOrder(explicit, plan.order);
+    return { order: inForce ? undefined : plan.order, missing, firstAccount: plan.firstAccount };
+}
+export function createDirectOrderController(deps) {
+    const reassertMs = deps.reassertMs ?? 60 * 60 * 1000;
+    const backoffMs = deps.backoffMs ?? 10 * 60 * 1000;
+    const applied = new Map();
+    const failed = new Map();
+    const warnedMissing = new Set();
+    let running = false;
+    return {
+        async tick() {
+            const nowMs = (deps.now ?? Date.now)();
+            if (running)
+                return { managedOrder: [], agents: [] };
+            running = true;
+            try {
+                const verdicts = deps.members.map((m) => ({
+                    accountId: m.accountId,
+                    profileId: m.profileId,
+                    verdict: classifyAccountHealth(deps.readHealth(m.accountId), deps.healthOptions, nowMs).verdict,
+                }));
+                const sticky = deps.readSticky();
+                const managed = planDirectOrder({ members: verdicts, sticky, nowMs, minDwellMs: deps.minDwellMs });
+                if (!managed)
+                    return { managedOrder: [], agents: [] };
+                if (JSON.stringify(managed.sticky) !== JSON.stringify(sticky))
+                    deps.writeSticky(managed.sticky);
+                const key = managed.order.join(" ");
+                const report = { managedOrder: managed.order, agents: [] };
+                for (const agentId of deps.agents) {
+                    try {
+                        const done = applied.get(agentId);
+                        if (done && done.key === key && nowMs - done.at < reassertMs) {
+                            report.agents.push({ agentId, outcome: "skipped" });
+                            continue;
+                        }
+                        const fail = failed.get(agentId);
+                        if (fail && fail.key === key && nowMs - fail.at < backoffMs) {
+                            report.agents.push({ agentId, outcome: "skipped", detail: "backing off after a failure" });
+                            continue;
+                        }
+                        const read = await readDirectRouteSnapshot(deps.runner, agentId);
+                        if (!read.snapshot) {
+                            if (!fail || fail.key !== key) {
+                                deps.logger.warn(`[multi-clawd] direct route: cannot read agent ${agentId}'s anthropic profiles (${read.error})`);
+                            }
+                            failed.set(agentId, { key, at: nowMs });
+                            report.agents.push({ agentId, outcome: "failed", detail: read.error });
+                            continue;
+                        }
+                        const plan = planAgentOrder({
+                            members: verdicts,
+                            snapshot: read.snapshot,
+                            configOrder: deps.configOrder(),
+                            sticky,
+                            nowMs,
+                            minDwellMs: deps.minDwellMs,
+                        });
+                        for (const id of plan.missing) {
+                            const k = `${agentId}:${id}`;
+                            if (warnedMissing.has(k))
+                                continue;
+                            warnedMissing.add(k);
+                            deps.logger.warn(`[multi-clawd] direct route: profile ${id} is not stored for agent ${agentId} — run \`multi-clawd direct sync\``);
+                        }
+                        if (!plan.order) {
+                            applied.set(agentId, { key, at: nowMs });
+                            failed.delete(agentId);
+                            report.agents.push({ agentId, outcome: "unchanged" });
+                            continue;
+                        }
+                        const write = await deps.runner(orderSetArgs(agentId, plan.order), { timeoutMs: 60_000 });
+                        if (write.code === 0) {
+                            applied.set(agentId, { key, at: nowMs });
+                            failed.delete(agentId);
+                            deps.logger.info(`[multi-clawd] direct route: agent ${agentId} anthropic order → ${plan.order.join(" → ")}`);
+                            report.agents.push({ agentId, outcome: "written", order: plan.order });
+                        }
+                        else {
+                            const detail = `order set ${safeCliError(write)}`;
+                            if (!fail || fail.key !== key) {
+                                deps.logger.warn(`[multi-clawd] direct route: agent ${agentId}: ${detail}`);
+                            }
+                            failed.set(agentId, { key, at: nowMs });
+                            report.agents.push({ agentId, outcome: "failed", detail });
+                        }
+                    }
+                    catch (err) {
+                        const detail = String(err?.message ?? err).slice(0, 200);
+                        const fail = failed.get(agentId);
+                        if (!fail || fail.key !== key) {
+                            deps.logger.warn(`[multi-clawd] direct route: agent ${agentId}: ${detail}`);
+                        }
+                        failed.set(agentId, { key, at: nowMs });
+                        report.agents.push({ agentId, outcome: "failed", detail });
+                    }
+                }
+                return report;
+            }
+            finally {
+                running = false;
+            }
+        },
+    };
+}

package/dist/explain-core.js

@@ -40,7 +40,7 @@ export function describeAccount(acc) {
     }
     return parts.join("; ") || "no credential source configured";
 }
-export function annotateChainRef(ref, pool) {
+export function annotateChainRef(ref, pool, direct) {
     const slash = ref.indexOf("/");
     const provider = slash > 0 ? ref.slice(0, slash) : undefined;
     if (pool && provider === pool.id) {
@@ -53,6 +53,10 @@ export function annotateChainRef(ref, pool) {
     if (provider && /^claw\d+$/.test(provider)) {
         return `pinned to only ${provider} — no cross-account failover on this rung`;
     }
+    if (provider === "anthropic" && direct && direct.members.length > 0) {
+        const order = direct.members.map((m) => m.accountId).join(", then ");
+        return `direct to Anthropic — pooled by auth-profile order (${order}), health-sorted by the plugin`;
+    }
     if (provider === "anthropic" || provider === "claude-cli") {
         return "direct to Anthropic — bypasses the pool (no cross-account failover)";
     }
@@ -94,12 +98,16 @@ export function renderExplanation(model) {
         lines.push("POOL  (no pool configured — each account is a standalone backend)");
     }
     lines.push("");
+    if (model.direct) {
+        lines.push(...renderDirectSection(model.direct, model.nowMs ?? Date.now()));
+        lines.push("");
+    }
     if (model.chain?.primary || model.chain?.fallbacks?.length) {
         lines.push("FAILOVER CHAIN  (agents.defaults)");
         const rungs = [model.chain.primary, ...(model.chain.fallbacks ?? [])].filter((r) => typeof r === "string");
         rungs.forEach((ref, i) => {
             lines.push(`  ${i + 1}. ${ref}`);
-            lines.push(`       ${annotateChainRef(ref, model.pool)}`);
+            lines.push(`       ${annotateChainRef(ref, model.pool, model.direct)}`);
         });
     }
     else {
@@ -122,3 +130,37 @@ export function renderExplanation(model) {
     }
     return lines.join("\n");
 }
+export function renderDirectSection(direct, nowMs) {
+    const lines = [];
+    lines.push("DIRECT ROUTE  anthropic/*  (gateway → Anthropic API with each account's setup-token)");
+    if (direct.members.length === 0) {
+        lines.push("  no account has a usable direct credential yet");
+    }
+    for (const m of direct.members) {
+        const bits = [m.source];
+        if (m.stored === true)
+            bits.push("stored in OpenClaw");
+        else if (m.stored === false) {
+            bits.push(m.adopted
+                ? "NOT STORED — this profile is yours to store (`openclaw models auth paste-token --provider anthropic --profile-id " +
+                    `${m.profileId}\`) or fix direct.profileId`
+                : "NOT STORED — run `multi-clawd direct sync`");
+        }
+        if (m.cooldownUntil !== undefined && m.cooldownUntil > nowMs) {
+            bits.push(`COOLING DOWN${m.cooldownReason ? ` (${m.cooldownReason})` : ""} for ${relativeUntil(m.cooldownUntil, nowMs)}`);
+        }
+        lines.push(`  ${m.accountId} → ${m.profileId}`);
+        lines.push(`      ${bits.join(" · ")}`);
+    }
+    for (const p of direct.problems) {
+        lines.push(`  ${p.accountId}: NOT on the direct route — ${p.reason}`);
+    }
+    if (direct.order) {
+        const managed = new Set(direct.members.map((m) => m.profileId));
+        const rendered = direct.order.map((id) => (managed.has(id) ? id : `${id} (not managed)`));
+        lines.push(`  order${direct.orderSource ? ` (${direct.orderSource})` : ""}: ${rendered.length > 0 ? rendered.join(" → ") : "none set — OpenClaw's round-robin decides"}`);
+    }
+    lines.push("  The plugin keeps this order in pool-health order, so a nearly-maxed account");
+    lines.push("  drops back BEFORE it errors; OpenClaw's own rotation covers the rest in-turn.");
+    return lines;
+}

package/dist/history-identity.js

@@ -0,0 +1,91 @@
+export const IDENTITY_PROFILE_SUFFIX = "multi-clawd-identity";
+export const HISTORY_IDENTITY_CONFIG_KEY = "historyIdentity";
+export function identityProfileId(backendId) {
+    return `${backendId}:${IDENTITY_PROFILE_SUFFIX}`;
+}
+export function identityAccountId(backendId) {
+    return `multi-clawd:${backendId}`;
+}
+export function buildIdentityCredential(backendId) {
+    return {
+        type: "oauth",
+        provider: backendId,
+        accountId: identityAccountId(backendId),
+        displayName: `multi-clawd history identity for ${backendId} (a name, not a credential)`,
+        access: "",
+        refresh: "",
+        expires: 1,
+    };
+}
+export function hasIdentity(existing, wanted) {
+    if (!existing || typeof existing !== "object")
+        return false;
+    const cred = existing;
+    return (cred.type === "oauth" &&
+        cred.provider === wanted.provider &&
+        cred.accountId === wanted.accountId &&
+        cred.email === undefined &&
+        cred.clientId === undefined &&
+        cred.enterpriseUrl === undefined &&
+        cred.projectId === undefined);
+}
+export async function ensureIdentityProfiles(backendIds, sdk) {
+    const result = { written: [], kept: [], failed: [] };
+    let profiles;
+    try {
+        profiles = sdk.ensureAuthProfileStore(undefined, { readOnly: true }).profiles;
+    }
+    catch (err) {
+        for (const id of backendIds) {
+            result.failed.push({ profileId: identityProfileId(id), reason: `store read failed: ${errorName(err)}` });
+        }
+        return result;
+    }
+    for (const id of backendIds) {
+        const profileId = identityProfileId(id);
+        const wanted = buildIdentityCredential(id);
+        if (hasIdentity(profiles[profileId], wanted)) {
+            result.kept.push(profileId);
+            continue;
+        }
+        try {
+            await sdk.upsertAuthProfileWithLock({ profileId, credential: wanted });
+            result.written.push(profileId);
+        }
+        catch (err) {
+            result.failed.push({ profileId, reason: `write failed: ${errorName(err)}` });
+        }
+    }
+    return result;
+}
+export function describeEnsureResult(result) {
+    const parts = [];
+    if (result.written.length)
+        parts.push(`stored ${result.written.join(", ")}`);
+    if (result.kept.length)
+        parts.push(`kept ${result.kept.join(", ")}`);
+    for (const f of result.failed)
+        parts.push(`${f.profileId}: ${f.reason}`);
+    return parts.join("; ") || "nothing to do";
+}
+function errorName(err) {
+    if (err instanceof Error)
+        return `${err.name}: ${err.message}`.slice(0, 200);
+    return String(err).slice(0, 200);
+}
+export async function loadProviderAuthSdk() {
+    try {
+        const mod = (await import("openclaw/plugin-sdk/provider-auth"));
+        if (typeof mod.ensureAuthProfileStore !== "function" ||
+            typeof mod.upsertAuthProfileWithLock !== "function") {
+            return undefined;
+        }
+        return {
+            ensureAuthProfileStore: mod.ensureAuthProfileStore,
+            upsertAuthProfileWithLock: mod.upsertAuthProfileWithLock,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}