@lark-apaas/openclaw-scripts-diagnose-cli 0.1.1-alpha.1 → 0.1.1-alpha.10

package/dist/index.cjs

@@ -30,6 +30,7 @@ node_fs = __toESM(node_fs);
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_child_process = require("node:child_process");
+let node_crypto = require("node:crypto");
 //#region src/rule-engine/base.ts
 /** Abstract base class for all diagnose rules */
 var DiagnoseRule = class {
@@ -191,7 +192,7 @@ function fileExists(filePath) {
 	return node_fs.default.existsSync(filePath);
 }
 /** Execute a shell command, return stdout. Throws on failure. */
-function shell(cmd, timeoutMs = 1e4) {
+function shell(cmd, timeoutMs = 6e4) {
 	return (0, node_child_process.execSync)(cmd, {
 		encoding: "utf-8",
 		timeout: timeoutMs
@@ -685,7 +686,9 @@ let AllowedOriginsRule = class AllowedOriginsRule extends DiagnoseRule {
 	validate(ctx) {
 		const expected = getExpectedOrigins(ctx.vars);
 		if (expected.length === 0) return { pass: true };
-		const missing = findMissing(getCurrentOrigins(ctx.config), expected);
+		const current = getCurrentOrigins(ctx.config);
+		if (hasWildcard(current)) return { pass: true };
+		const missing = findMissing(current, expected);
 		if (missing.length === 0) return { pass: true };
 		return {
 			pass: false,
@@ -695,6 +698,7 @@ let AllowedOriginsRule = class AllowedOriginsRule extends DiagnoseRule {
 	repair(ctx) {
 		const expected = getExpectedOrigins(ctx.vars);
 		const current = getCurrentOrigins(ctx.config);
+		if (hasWildcard(current)) return;
 		const missing = findMissing(current, expected);
 		if (missing.length > 0) {
 			const seen = /* @__PURE__ */ new Set();
@@ -721,13 +725,7 @@ AllowedOriginsRule = __decorate([Rule({
 	repairMode: "standard"
 })], AllowedOriginsRule);
 function getExpectedOrigins(vars) {
-	const origins = [];
-	if (vars.miaodaDomain) origins.push(vars.miaodaDomain);
-	if (vars.miaodaOrigin) origins.push(vars.miaodaOrigin);
-	if (Array.isArray(vars.miaodaOrigins)) {
-		for (const o of vars.miaodaOrigins) if (o) origins.push(o);
-	}
-	return [...new Set(origins)];
+	return Array.isArray(vars.expectedOrigins) ? vars.expectedOrigins : [];
 }
 function getCurrentOrigins(config) {
 	const controlUi = getNestedMap(config, "gateway", "controlUi");
@@ -740,6 +738,10 @@ function findMissing(current, expected) {
 	const set = new Set(current);
 	return expected.filter((o) => !set.has(o));
 }
+/** Exact "*" entry means allow-all; pattern globs like "https://*.example.com" don't count. */
+function hasWildcard(origins) {
+	return origins.includes("*");
+}
 //#endregion
 //#region src/rules/jwt-token.ts
 let JwtTokenRule = class JwtTokenRule extends DiagnoseRule {
@@ -990,19 +992,460 @@ function runRepair(input) {
 	}
 }
 //#endregion
+//#region src/backup.ts
+const BACKUP_PATH = "/home/gem/workspace/.force/openclaw/core-backup.json";
+function runBackup(input) {
+	try {
+		const { configPath } = input;
+		try {
+			const validateOutput = shell("openclaw config validate --json");
+			if (!JSON.parse(validateOutput).valid) return {
+				success: false,
+				error: "config validation failed"
+			};
+		} catch (e) {
+			return {
+				success: false,
+				error: "config validate command failed: " + e.message
+			};
+		}
+		if (!fileExists(configPath)) return {
+			success: false,
+			error: "config file not found: " + configPath
+		};
+		const config = loadJSON5().parse(readFile(configPath));
+		const backup = { _backup_meta: { created_at: (/* @__PURE__ */ new Date()).toISOString() } };
+		if (config.agents) backup.agents = config.agents;
+		if (config.bindings) backup.bindings = config.bindings;
+		const feishu = config.channels?.feishu;
+		if (feishu?.accounts) backup.channels = { feishu: { accounts: feishu.accounts } };
+		const backupDir = node_path.default.dirname(BACKUP_PATH);
+		if (!node_fs.default.existsSync(backupDir)) node_fs.default.mkdirSync(backupDir, { recursive: true });
+		const tmpPath = BACKUP_PATH + ".tmp";
+		node_fs.default.writeFileSync(tmpPath, JSON.stringify(backup, null, 2), "utf-8");
+		node_fs.default.renameSync(tmpPath, BACKUP_PATH);
+		return { success: true };
+	} catch (e) {
+		return {
+			success: false,
+			error: "backup failed: " + e.message
+		};
+	}
+}
+//#endregion
+//#region src/reset-async.ts
+/**
+* Start an async reset task: spawn a detached child process and return the taskId.
+*
+* The child process runs: node cli.js reset --worker --task-id=xxx --ctx=base64
+*/
+function startAsyncReset(ctxBase64) {
+	const taskId = (0, node_crypto.randomUUID)();
+	const resultFile = `/tmp/openclaw-reset-${taskId}.json`;
+	const initial = {
+		status: "running",
+		step: 0,
+		totalSteps: 9,
+		progress: "初始化...",
+		startedAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const tmpPath = resultFile + ".tmp";
+	const dir = node_path.default.dirname(resultFile);
+	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+	node_fs.default.writeFileSync(tmpPath, JSON.stringify(initial), "utf-8");
+	node_fs.default.renameSync(tmpPath, resultFile);
+	const child = (0, node_child_process.spawn)(process.execPath, [
+		process.argv[1],
+		"reset",
+		"--worker",
+		`--task-id=${taskId}`,
+		`--ctx=${ctxBase64}`
+	], {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.on("error", (err) => {
+		const failResult = {
+			status: "failed",
+			step: 0,
+			totalSteps: 9,
+			progress: "Worker process failed to start",
+			error: err.message,
+			startedAt: initial.startedAt,
+			completedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const errTmpPath = resultFile + ".tmp";
+		node_fs.default.writeFileSync(errTmpPath, JSON.stringify(failResult));
+		node_fs.default.renameSync(errTmpPath, resultFile);
+	});
+	child.unref();
+	return { taskId };
+}
+//#endregion
+//#region src/reset.ts
+const STEPS = [
+	"备份当前配置",
+	"生成默认配置",
+	"杀掉 openclaw 进程",
+	"等待沙箱初始化完成",
+	"重装 openclaw",
+	"合并核心备份配置",
+	"复制启动脚本",
+	"重装内置插件",
+	"启动并验证"
+];
+const TOTAL_STEPS = STEPS.length;
+const CORE_BACKUP_PATH = "/home/gem/workspace/.force/openclaw/core-backup.json";
+/**
+* Directory holding the bundled openclaw template (openclaw.json + scripts/).
+* Synced from git@code.byted.org:apaas/miaoda-openclaw-template.git via
+* scripts/sync-template.sh and published alongside dist/.
+*
+* At runtime, __dirname points to dist/, so the template lives one level up.
+*/
+const TEMPLATE_DIR = node_path.default.resolve(__dirname, "..", "template");
+function writeResultFile(resultFile, result) {
+	const dir = node_path.default.dirname(resultFile);
+	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+	const tmpPath = resultFile + ".tmp";
+	node_fs.default.writeFileSync(tmpPath, JSON.stringify(result), "utf-8");
+	node_fs.default.renameSync(tmpPath, resultFile);
+}
+function updateProgress(resultFile, step, startedAt) {
+	writeResultFile(resultFile, {
+		status: "running",
+		step,
+		totalSteps: TOTAL_STEPS,
+		progress: STEPS[step - 1],
+		startedAt
+	});
+}
+function markDone(resultFile, startedAt) {
+	writeResultFile(resultFile, {
+		status: "done",
+		step: TOTAL_STEPS,
+		totalSteps: TOTAL_STEPS,
+		progress: "重置完成",
+		startedAt,
+		completedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+function markFailed(resultFile, step, error, startedAt) {
+	writeResultFile(resultFile, {
+		status: "failed",
+		step,
+		totalSteps: TOTAL_STEPS,
+		progress: step > 0 ? STEPS[step - 1] : "初始化",
+		error,
+		startedAt,
+		completedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+/** Step 1: Backup current config as openclaw.json.bak.N */
+function backupCurrentConfig(configPath) {
+	if (!fileExists(configPath)) return;
+	const dir = node_path.default.dirname(configPath);
+	let maxN = 0;
+	try {
+		for (const f of node_fs.default.readdirSync(dir)) {
+			const match = f.match(/^openclaw\.json\.bak\.(\d+)$/);
+			if (match) {
+				const n = parseInt(match[1], 10);
+				if (n > maxN) maxN = n;
+			}
+		}
+	} catch {}
+	node_fs.default.copyFileSync(configPath, configPath + ".bak." + (maxN + 1));
+}
+/** Step 2: Replace $$__XXX__ placeholders and write default config. */
+function generateDefaultConfig(srcDir, configPath, templateVars) {
+	const srcConfigPath = node_path.default.join(srcDir, "openclaw.json");
+	if (!fileExists(srcConfigPath)) throw new Error("template openclaw.json not found at " + srcConfigPath);
+	let content = node_fs.default.readFileSync(srcConfigPath, "utf-8");
+	for (const [placeholder, value] of Object.entries(templateVars)) content = content.split(placeholder).join(value);
+	node_fs.default.writeFileSync(configPath, content, "utf-8");
+}
+/** Step 3: Kill all openclaw processes. */
+function killOpenclawProcesses() {
+	try {
+		shell("pkill -f openclaw-gateway || true", 5e3);
+	} catch {}
+	shell("sleep 2", 5e3);
+}
+/**
+* Step 4: Wait for the sandbox's own init (init_sandbox.sh / concurrent npm
+* install) to finish before we start our own npm i -g. Two npm processes
+* sharing ~/.npm cache + competing for disk/network just makes everything
+* crawl; letting init finish first is the cleanest way to get exclusive
+* access. Polls every 10s up to `maxWaitMs`. If the deadline is hit we fall
+* through anyway — better to try than to fail the reset outright.
+*/
+function waitForInitNpm(maxWaitMs) {
+	const deadline = Date.now() + maxWaitMs;
+	const ownPid = String(process.pid);
+	while (Date.now() < deadline) {
+		let running = 0;
+		try {
+			const out = shell(`pgrep -af "init_sandbox.sh|npm install|npm i " | grep -v -- "${ownPid}" | wc -l`, 1e4);
+			running = parseInt(out.trim(), 10) || 0;
+		} catch {
+			return;
+		}
+		if (running === 0) return;
+		try {
+			shell("sleep 10", 12e3);
+		} catch {}
+	}
+}
+/**
+* Step 5: Reinstall openclaw to the version specified in template.
+*
+* Simple: if already at target version, skip. Otherwise uninstall+install
+* with a generous wall-clock timeout and trust npm's exit code (0 = success,
+* anything else = real failure, bubble up and fail the reset). No retries,
+* no idle-detection heuristics — waitForInitNpm above removes the main
+* source of contention so this step should run cleanly.
+*/
+function reinstallOpenclaw(srcDir) {
+	const targetVersion = loadJSON5().parse(node_fs.default.readFileSync(node_path.default.join(srcDir, "openclaw.json"), "utf-8")).meta?.lastTouchedVersion;
+	if (targetVersion && isOpenclawAtVersion(targetVersion)) {
+		shell("openclaw doctor --fix", 12e4);
+		return;
+	}
+	try {
+		shell("npm uninstall -g openclaw 2>/dev/null || true", 6e4);
+	} catch {}
+	shell(`npm i -g openclaw@${targetVersion || "latest"} --prefer-offline --fetch-timeout=60000 --fetch-retries=2`, 15 * 6e4);
+	shell("openclaw doctor --fix", 12e4);
+}
+/** Return true if `openclaw --version` output contains `targetVersion`. */
+function isOpenclawAtVersion(targetVersion) {
+	try {
+		return shell("openclaw --version 2>&1 || true", 1e4).includes(targetVersion);
+	} catch {
+		return false;
+	}
+}
+/** Step 6: Merge core-backup.json into config + ensure allowedOrigins. */
+function mergeCoreBackupAndOrigins(configPath, vars) {
+	const JSON5 = loadJSON5();
+	if (fileExists(CORE_BACKUP_PATH)) {
+		const backup = JSON.parse(node_fs.default.readFileSync(CORE_BACKUP_PATH, "utf-8"));
+		const config = JSON5.parse(node_fs.default.readFileSync(configPath, "utf-8"));
+		if (backup.agents) config.agents = backup.agents;
+		if (backup.bindings) config.bindings = backup.bindings;
+		const backupAccounts = backup.channels?.feishu;
+		if (backupAccounts?.accounts) {
+			if (!config.channels) config.channels = {};
+			const ch = config.channels;
+			if (!ch.feishu) ch.feishu = {};
+			ch.feishu.accounts = backupAccounts.accounts;
+		}
+		node_fs.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+	}
+	const expectedOrigins = Array.isArray(vars.expectedOrigins) ? vars.expectedOrigins : [];
+	if (expectedOrigins.length > 0) {
+		const config = JSON5.parse(node_fs.default.readFileSync(configPath, "utf-8"));
+		if (!config.gateway) config.gateway = {};
+		const gw = config.gateway;
+		if (!gw.controlUi) gw.controlUi = {};
+		const cui = gw.controlUi;
+		const current = Array.isArray(cui.allowedOrigins) ? cui.allowedOrigins.filter((o) => typeof o === "string") : [];
+		if (current.includes("*")) return;
+		const seen = new Set(current);
+		const merged = [...current];
+		for (const o of expectedOrigins) if (!seen.has(o)) {
+			merged.push(o);
+			seen.add(o);
+		}
+		cui.allowedOrigins = merged;
+		node_fs.default.writeFileSync(configPath, JSON.stringify(config, null, 2), "utf-8");
+	}
+}
+/** Step 7: Copy startup scripts from template to agent dir. */
+function copyStartupScripts(srcDir, configDir) {
+	const srcScriptsDir = node_path.default.join(srcDir, "scripts");
+	const targetScriptsDir = node_path.default.join(configDir, "scripts");
+	if (!node_fs.default.existsSync(srcScriptsDir)) return;
+	if (!node_fs.default.existsSync(targetScriptsDir)) node_fs.default.mkdirSync(targetScriptsDir, { recursive: true });
+	shell(`cp -r '${srcScriptsDir}'/* '${targetScriptsDir}/'`, 1e4);
+}
+/**
+* Step 8: Reinstall all plugins via openclaw CLI.
+*
+* Simple execSync with a generous wall-clock timeout (15min). By now
+* init_sandbox's npm should have finished (Step 4 waited for it), so we
+* have exclusive npm access. Non-fatal — a plugin update failure shouldn't
+* stop the reset from restarting the gateway.
+*/
+function reinstallPlugins() {
+	try {
+		shell("openclaw plugins update --all", 15 * 6e4);
+	} catch {}
+}
+/** Step 9: Write secrets/provider key files and restart openclaw. */
+function writeSecretsAndRestart(vars, resetData, configDir) {
+	if (resetData.secretsContent && vars.secretsFilePath) writeFile(vars.secretsFilePath, resetData.secretsContent);
+	if (resetData.providerKeyContent && vars.providerFilePath) writeFile(vars.providerFilePath, resetData.providerKeyContent);
+	const restartScript = node_path.default.join(configDir, "scripts", "restart.sh");
+	if (fileExists(restartScript)) shell(`bash '${restartScript}'`, 3e4);
+}
+/**
+* Run the 9-step reset process. Called from the worker entry point.
+*
+* Each step is an independent function. The orchestrator handles progress
+* reporting, error handling, and process-level exception guards.
+*
+* The openclaw.json / scripts/*.sh template files are bundled with this CLI
+* (see TEMPLATE_DIR) and synced from the miaoda-openclaw-template repo via
+* scripts/sync-template.sh, so no runtime download is required.
+*/
+function runReset(input, taskId, resultFile) {
+	const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+	const { configPath, vars, resetData } = input;
+	const configDir = node_path.default.dirname(configPath);
+	const srcDir = TEMPLATE_DIR;
+	let currentStep = 0;
+	if (!node_fs.default.existsSync(node_path.default.join(srcDir, "openclaw.json"))) {
+		markFailed(resultFile, 0, `bundled template not found at ${srcDir}`, startedAt);
+		process.exit(1);
+	}
+	process.on("uncaughtException", (err) => {
+		markFailed(resultFile, currentStep, `uncaught exception: ${err.message}`, startedAt);
+		process.exit(1);
+	});
+	process.on("unhandledRejection", (reason) => {
+		markFailed(resultFile, currentStep, `unhandled rejection: ${reason}`, startedAt);
+		process.exit(1);
+	});
+	/** Advance to the next step, updating the progress file. */
+	const step = (n) => {
+		currentStep = n;
+		updateProgress(resultFile, n, startedAt);
+	};
+	try {
+		step(1);
+		backupCurrentConfig(configPath);
+		step(2);
+		generateDefaultConfig(srcDir, configPath, resetData.templateVars);
+		step(3);
+		killOpenclawProcesses();
+		step(4);
+		waitForInitNpm(10 * 6e4);
+		step(5);
+		reinstallOpenclaw(srcDir);
+		step(6);
+		mergeCoreBackupAndOrigins(configPath, vars);
+		step(7);
+		copyStartupScripts(srcDir, configDir);
+		step(8);
+		reinstallPlugins();
+		step(9);
+		writeSecretsAndRestart(vars, resetData, configDir);
+		markDone(resultFile, startedAt);
+	} catch (e) {
+		markFailed(resultFile, currentStep, e.message, startedAt);
+		process.exit(1);
+	}
+}
+//#endregion
+//#region src/get-reset-task.ts
+/**
+* Long-poll for a reset task result.
+* Reads the result file every 1s for up to 30s.
+* Returns immediately on terminal states (done/failed).
+*/
+function getResetTask(taskId) {
+	const resultFile = `/tmp/openclaw-reset-${taskId}.json`;
+	const deadline = Date.now() + 3e4;
+	while (Date.now() < deadline) {
+		if (!node_fs.default.existsSync(resultFile)) {
+			sleepSync(1e3);
+			continue;
+		}
+		try {
+			const content = node_fs.default.readFileSync(resultFile, "utf-8");
+			const result = JSON.parse(content);
+			if (result.status === "done" || result.status === "failed") return result;
+		} catch {}
+		sleepSync(1e3);
+	}
+	if (node_fs.default.existsSync(resultFile)) try {
+		return JSON.parse(node_fs.default.readFileSync(resultFile, "utf-8"));
+	} catch {}
+	return {
+		status: "running",
+		progress: "等待中..."
+	};
+}
+/**
+* Synchronous sleep using Atomics.wait on a shared buffer.
+*/
+function sleepSync(ms) {
+	const buf = new SharedArrayBuffer(4);
+	const arr = new Int32Array(buf);
+	Atomics.wait(arr, 0, 0, ms);
+}
+//#endregion
 //#region src/index.ts
 const args = node_process.default.argv.slice(2);
 const mode = args.find((a) => !a.startsWith("--"));
-const ctx = args.find((a) => a.startsWith("--ctx="))?.slice(6);
-if (!mode || !["check", "repair"].includes(mode)) {
-	console.error("Usage: mclaw-diagnose <check|repair> --ctx=<base64>");
-	node_process.default.exit(1);
-}
-if (!ctx) {
-	console.error("Error: --ctx=<base64> is required");
-	node_process.default.exit(1);
-}
-const input = JSON.parse(Buffer.from(ctx, "base64").toString("utf-8"));
-if (mode === "check") console.log(JSON.stringify(runCheck(input)));
-else console.log(JSON.stringify(runRepair(input)));
+switch (mode) {
+	case "check":
+	case "repair": {
+		const ctx = args.find((a) => a.startsWith("--ctx="))?.slice(6);
+		if (!ctx) {
+			console.error("Error: --ctx=<base64> is required");
+			node_process.default.exit(1);
+		}
+		const input = JSON.parse(Buffer.from(ctx, "base64").toString("utf-8"));
+		if (mode === "check") console.log(JSON.stringify(runCheck(input)));
+		else console.log(JSON.stringify(runRepair(input)));
+		break;
+	}
+	case "backup": {
+		const ctx = args.find((a) => a.startsWith("--ctx="))?.slice(6);
+		if (!ctx) {
+			console.error("Error: --ctx=<base64> is required");
+			node_process.default.exit(1);
+		}
+		const input = JSON.parse(Buffer.from(ctx, "base64").toString("utf-8"));
+		console.log(JSON.stringify(runBackup(input)));
+		break;
+	}
+	case "reset":
+		if (args.includes("--async")) {
+			const ctx = args.find((a) => a.startsWith("--ctx="))?.slice(6);
+			if (!ctx) {
+				console.error("Error: --ctx=<base64> is required");
+				node_process.default.exit(1);
+			}
+			console.log(JSON.stringify(startAsyncReset(ctx)));
+		} else if (args.includes("--worker")) {
+			const ctx = args.find((a) => a.startsWith("--ctx="))?.slice(6);
+			const taskId = args.find((a) => a.startsWith("--task-id="))?.slice(10);
+			if (!ctx || !taskId) {
+				console.error("Error: --ctx=<base64> and --task-id=<id> are required for worker");
+				node_process.default.exit(1);
+			}
+			const resultFile = `/tmp/openclaw-reset-${taskId}.json`;
+			runReset(JSON.parse(Buffer.from(ctx, "base64").toString("utf-8")), taskId, resultFile);
+		} else {
+			console.error("Usage: reset --async --ctx=<base64> | reset --worker --task-id=<id> --ctx=<base64>");
+			node_process.default.exit(1);
+		}
+		break;
+	case "get_reset_task": {
+		const taskId = args.find((a) => a.startsWith("--task-id="))?.slice(10);
+		if (!taskId) {
+			console.error("Error: --task-id=<id> is required");
+			node_process.default.exit(1);
+		}
+		console.log(JSON.stringify(getResetTask(taskId)));
+		break;
+	}
+	default:
+		console.error("Usage: mclaw-diagnose <check|repair|backup|reset|get_reset_task> [options]");
+		node_process.default.exit(1);
+}
 //#endregion

package/package.json

@@ -1,19 +1,21 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.1-alpha.1",
+  "version": "0.1.1-alpha.10",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {
     "mclaw-diagnose": "./dist/index.cjs"
   },
   "files": [
-    "dist"
+    "dist",
+    "template"
   ],
   "scripts": {
     "build": "tsdown",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:integration": "vitest run --config vitest.integration.config.ts",
+    "sync:template": "bash scripts/sync-template.sh",
     "prepublishOnly": "npm run build"
   },
   "keywords": [

package/template/openclaw.json

@@ -0,0 +1,522 @@
+{
+  "meta": {
+    "lastTouchedVersion": "2026.4.9",
+    "lastTouchedAt": "2026-04-11T09:30:21.703Z"
+  },
+  "wizard": {
+    "lastRunAt": "2026-03-30T14:54:56.160Z",
+    "lastRunVersion": "2026.3.24",
+    "lastRunCommand": "doctor",
+    "lastRunMode": "local"
+  },
+  "update": {
+    "checkOnStart": false
+  },
+  "browser": {
+    "enabled": true,
+    "color": "#00AA00",
+    "executablePath": "/usr/bin/chromium-browser",
+    "headless": true,
+    "noSandbox": true,
+    "defaultProfile": "openclaw",
+    "extraArgs": [
+      "--window-size=1920,1080",
+      "--test-type",
+      "--disable-gpu",
+      "--no-sandbox"
+    ]
+  },
+  "secrets": {
+    "providers": {
+      "miaoda-provider": {
+        "source": "file",
+        "path": "$$__MIAODA_PROVIDER_FILEPATH__",
+        "mode": "singleValue"
+      },
+      "miaoda-secret-provider": {
+        "source": "file",
+        "path": "$$__MIAODA_OPENCLAW_SECRETS_FILEPATH__",
+        "mode": "json"
+      }
+    }
+  },
+  "models": {
+    "providers": {
+      "miaoda": {
+        "baseUrl": "$$__MIAODA_PROVIDER_BASE_URL__",
+        "apiKey": {
+          "source": "file",
+          "provider": "miaoda-provider",
+          "id": "value"
+        },
+        "api": "openai-completions",
+        "headers": {
+          "x-api-key": {
+            "source": "file",
+            "provider": "miaoda-secret-provider",
+            "id": "/models_providers_miaoda_headers_x_api_key"
+          }
+        },
+        "models": [
+          {
+            "id": "miaoda-model-auto",
+            "name": "妙搭",
+            "reasoning": false,
+            "input": [
+              "text"
+            ],
+            "cost": {
+              "input": 0,
+              "output": 0,
+              "cacheRead": 0,
+              "cacheWrite": 0
+            },
+            "contextWindow": 200000,
+            "maxTokens": 8192
+          },
+          {
+            "id": "miaoda-auto-multimodal",
+            "name": "妙搭多模态",
+            "reasoning": false,
+            "input": [
+              "text",
+              "image"
+            ],
+            "cost": {
+              "input": 0,
+              "output": 0,
+              "cacheRead": 0,
+              "cacheWrite": 0
+            },
+            "contextWindow": 200000,
+            "maxTokens": 8192
+          },
+          {
+            "id": "miaoda-model-flash",
+            "name": "妙搭 Flash",
+            "reasoning": false,
+            "input": [
+              "text"
+            ],
+            "cost": {
+              "input": 0,
+              "output": 0,
+              "cacheRead": 0,
+              "cacheWrite": 0
+            },
+            "contextWindow": 200000,
+            "maxTokens": 8192
+          }
+        ]
+      }
+    }
+  },
+  "agents": {
+    "defaults": {
+      "model": {
+        "primary": "miaoda/miaoda-model-auto"
+      },
+      "imageModel": "miaoda/miaoda-auto-multimodal",
+      "imageGenerationModel": {
+        "primary": "miaoda/miaoda-image-gen"
+      },
+      "models": {
+        "miaoda/miaoda-model-auto": {
+          "alias": "Miaoda Auto"
+        },
+        "miaoda/miaoda-auto-multimodal": {
+          "alias": "Miaoda Multimodal"
+        },
+        "miaoda/miaoda-model-flash": {
+          "alias": "Miaoda Flash"
+        }
+      },
+      "workspace": "$$__MIAODA_WORKSPACE_DIR__/workspace",
+      "compaction": {
+        "mode": "safeguard",
+        "reserveTokensFloor": 50000
+      },
+      "verboseDefault": "off",
+      "blockStreamingCoalesce": {
+        "minChars": 20,
+        "maxChars": 800,
+        "idleMs": 300
+      },
+      "humanDelay": {
+        "mode": "off"
+      },
+      "heartbeat": {
+        "every": "4h",
+        "activeHours": {
+          "start": "08:00",
+          "end": "22:00"
+        },
+        "model": "miaoda/miaoda-model-flash"
+      },
+      "maxConcurrent": 4,
+      "subagents": {
+        "maxConcurrent": 8
+      }
+    }
+  },
+  "tools": {
+    "profile": "full",
+    "alsoAllow": [
+      "feishu_bitable_app",
+      "feishu_bitable_app_table",
+      "feishu_bitable_app_table_field",
+      "feishu_bitable_app_table_record",
+      "feishu_bitable_app_table_view",
+      "feishu_calendar_calendar",
+      "feishu_calendar_event",
+      "feishu_calendar_event_attendee",
+      "feishu_calendar_freebusy",
+      "feishu_chat",
+      "feishu_chat_members",
+      "feishu_create_doc",
+      "feishu_doc_comments",
+      "feishu_doc_media",
+      "feishu_drive_file",
+      "feishu_fetch_doc",
+      "feishu_get_user",
+      "feishu_im_bot_image",
+      "feishu_im_user_fetch_resource",
+      "feishu_im_user_get_messages",
+      "feishu_im_user_get_thread_messages",
+      "feishu_im_user_message",
+      "feishu_im_user_search_messages",
+      "feishu_oauth",
+      "feishu_oauth_batch_auth",
+      "feishu_search_doc_wiki",
+      "feishu_search_user",
+      "feishu_sheet",
+      "feishu_task_comment",
+      "feishu_task_subtask",
+      "feishu_task_task",
+      "feishu_task_tasklist",
+      "feishu_update_doc",
+      "feishu_wiki_space",
+      "feishu_wiki_space_node"
+    ],
+    "deny": [
+      "web_fetch",
+      "tts",
+      "agents_list",
+      "feishu_task_task",
+      "feishu_task_tasklist",
+      "feishu_task_comment",
+      "feishu_task_subtask",
+      "feishu_bitable_app_table_view",
+      "feishu_doc_comments",
+      "feishu_doc_media",
+      "feishu_drive_file",
+      "feishu_wiki_space",
+      "feishu_wiki_space_node",
+      "feishu_sheet"
+    ],
+    "web": {
+      "search": {
+        "provider": "miaoda"
+      }
+    },
+    "media": {
+      "image": {
+        "models": [
+          {
+            "provider": "miaoda"
+          }
+        ]
+      },
+      "audio": {
+        "models": [
+          {
+            "provider": "miaoda"
+          }
+        ]
+      }
+    },
+    "sessions": {
+      "visibility": "all"
+    }
+  },
+  "messages": {
+    "ackReactionScope": "group-mentions"
+  },
+  "commands": {
+    "native": "auto",
+    "nativeSkills": "auto",
+    "restart": true,
+    "ownerDisplay": "raw"
+  },
+  "session": {
+    "dmScope": "per-channel-peer"
+  },
+  "channels": {
+    "feishu": {
+      "enabled": true,
+      "appId": "$$__FEISHU_APP_ID__",
+      "appSecret": {
+        "source": "file",
+        "provider": "miaoda-secret-provider",
+        "id": "/channels_feishu_app_secret"
+      },
+      "domain": "feishu",
+      "requireMention": true,
+      "dmPolicy": "allowlist",
+      "allowFrom": [
+        "$$__FEISHU_OPEN_ID__"
+      ],
+      "groupPolicy": "allowlist",
+      "groupAllowFrom": [
+        "$$__FEISHU_OPEN_ID__"
+      ],
+      "groups": {
+        "*": {
+          "enabled": true
+        }
+      },
+      "streaming": true,
+      "threadSession": true,
+      "footer": {
+        "elapsed": false,
+        "status": false
+      }
+    }
+  },
+  "discovery": {
+    "mdns": {
+      "mode": "off"
+    }
+  },
+  "gateway": {
+    "port": 18789,
+    "mode": "local",
+    "bind": "loopback",
+    "controlUi": {
+      "allowedOrigins": [
+        "$$__MIAODA_DOMAIN__",
+        "$$__MIAODA_ORIGIN__"
+      ],
+      "dangerouslyDisableDeviceAuth": true
+    },
+    "auth": {
+      "mode": "token",
+      "token": "$$__CLAW_TOKEN__"
+    },
+    "trustedProxies": [
+      "::1",
+      "127.0.0.1"
+    ],
+    "tailscale": {
+      "mode": "off",
+      "resetOnExit": false
+    }
+  },
+  "skills": {
+    "install": {
+      "nodeManager": "npm"
+    },
+    "entries": {
+      "1password": {
+        "enabled": false
+      },
+      "apple-notes": {
+        "enabled": false
+      },
+      "apple-reminders": {
+        "enabled": false
+      },
+      "bear-notes": {
+        "enabled": false
+      },
+      "bluebubbles": {
+        "enabled": false
+      },
+      "blucli": {
+        "enabled": false
+      },
+      "camsnap": {
+        "enabled": false
+      },
+      "coding-agent": {
+        "enabled": false
+      },
+      "discord": {
+        "enabled": false
+      },
+      "eightctl": {
+        "enabled": false
+      },
+      "gemini": {
+        "enabled": false
+      },
+      "gifgrep": {
+        "enabled": false
+      },
+      "gog": {
+        "enabled": false
+      },
+      "goplaces": {
+        "enabled": false
+      },
+      "imsg": {
+        "enabled": false
+      },
+      "model-usage": {
+        "enabled": false
+      },
+      "notion": {
+        "enabled": false
+      },
+      "openai-image-gen": {
+        "enabled": false
+      },
+      "openai-whisper": {
+        "enabled": false
+      },
+      "openai-whisper-api": {
+        "enabled": false
+      },
+      "openhue": {
+        "enabled": false
+      },
+      "oracle": {
+        "enabled": false
+      },
+      "ordercli": {
+        "enabled": false
+      },
+      "peekaboo": {
+        "enabled": false
+      },
+      "sag": {
+        "enabled": false
+      },
+      "slack": {
+        "enabled": false
+      },
+      "sonoscli": {
+        "enabled": false
+      },
+      "spotify-player": {
+        "enabled": false
+      },
+      "summarize": {
+        "enabled": false
+      },
+      "things-mac": {
+        "enabled": false
+      },
+      "trello": {
+        "enabled": false
+      },
+      "voice-call": {
+        "enabled": false
+      },
+      "wacli": {
+        "enabled": false
+      },
+      "xurl": {
+        "enabled": false
+      },
+      "feishu-task": {
+        "enabled": false
+      },
+      "gh-issues": {
+        "enabled": false
+      },
+      "github": {
+        "enabled": false
+      },
+      "tmux": {
+        "enabled": false
+      },
+      "blogwatcher": {
+        "enabled": false
+      },
+      "himalaya": {
+        "enabled": false
+      },
+      "video-frames": {
+        "enabled": false
+      },
+      "obsidian": {
+        "enabled": false
+      }
+    }
+  },
+  "plugins": {
+    "allow": [
+      "openclaw-lark",
+      "openclaw-extension-miaoda",
+      "openclaw-extension-miaoda-coding",
+      "browser"
+    ],
+    "entries": {
+      "feishu": {
+        "enabled": false
+      },
+      "openclaw-extension-miaoda": {
+        "enabled": true,
+        "config": {
+          "greeting": {
+            "message": "👋 Hi，我是**$$__MIAODA_CLAW_NAME__**，一只生活在飞书里的 🦞 小龙虾，打个招呼，我们开始认识一下？",
+            "targets": [
+              "$$__FEISHU_OPEN_ID__"
+            ]
+          }
+        }
+      },
+      "openclaw-lark": {
+        "enabled": true
+      },
+      "openclaw-extension-miaoda-coding": {
+        "enabled": true
+      },
+      "browser": {
+        "enabled": true
+      }
+    },
+    "installs": {
+      "openclaw-lark": {
+        "source": "npm",
+        "spec": "@lark-apaas/openclaw-lark",
+        "installPath": "./extensions/openclaw-lark",
+        "version": "2026.4.3",
+        "resolvedName": "@lark-apaas/openclaw-lark",
+        "resolvedVersion": "2026.4.3",
+        "resolvedSpec": "@lark-apaas/openclaw-lark@2026.4.3",
+        "integrity": "sha512-1eJ2WCvAYsnM9TPwPbEoD3nJtqNSOP2zOBV/3Vb9YQRg1kJJspEly5yCjiZt1wew4UhyN8Tcrp/XV78Qn747GA==",
+        "shasum": "e8d8cf05f8cb96cf5de4bca097c527eb9116e655",
+        "resolvedAt": "2026-04-03T06:27:44.706Z",
+        "installedAt": "2026-04-03T06:28:10.547Z"
+      },
+      "openclaw-extension-miaoda": {
+        "source": "npm",
+        "installPath": "./extensions/openclaw-extension-miaoda",
+        "version": "1.0.9",
+        "installedAt": "2026-04-11T09:27:06.639Z",
+        "spec": "@lark-apaas/openclaw-extension-miaoda@1.0.9",
+        "resolvedVersion": "1.0.9",
+        "resolvedName": "@lark-apaas/openclaw-extension-miaoda",
+        "resolvedSpec": "@lark-apaas/openclaw-extension-miaoda@1.0.9",
+        "resolvedAt": "2026-04-11T09:27:06.639Z",
+        "integrity": "sha512-McNeuPAUDLrMhT3yZuwk9A7pI262r2CK1N1KNQP6VuzymkDUjx2sTcJPCEBB3bFkdXd0yUU983/OhJiaJo+JWg==",
+        "shasum": "a3c75886e40b63f39a33a2660932f8afdae6a514"
+      },
+      "openclaw-extension-miaoda-coding": {
+        "source": "npm",
+        "spec": "@lark-apaas/openclaw-extension-miaoda-coding",
+        "installPath": "./extensions/openclaw-extension-miaoda-coding",
+        "version": "1.0.8",
+        "resolvedName": "@lark-apaas/openclaw-extension-miaoda-coding",
+        "resolvedVersion": "1.0.8",
+        "resolvedSpec": "@lark-apaas/openclaw-extension-miaoda-coding@1.0.8",
+        "integrity": "sha512-uxlLtgH2CTwz56UTaZD+n/x1p2a3Q01o3Og7oLUJCm6izWHXFEI1SQhNnCPggrfSam49KFir8xB64tY4T9dt2Q==",
+        "shasum": "058eadf5bc71ae87f79b5096b9d96f4afb89a9db",
+        "resolvedAt": "2026-04-09T11:33:36.208Z",
+        "installedAt": "2026-04-09T11:33:37.171Z"
+      }
+    }
+  }
+}

package/template/scripts/restart.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+log() { echo "[restart.sh] $(date '+%Y-%m-%d %H:%M:%S') $*"; }
+
+gw_alive() {
+    pgrep -f "openclaw-gateway|openclaw gateway" | grep -vw "$$" >/dev/null 2>&1
+}
+
+if [ -d "/run/systemd/system/" ]; then
+    log "systemd detected, restarting via systemctl..."
+    sudo systemctl restart openclaw
+    log "systemctl restart exit code: $?"
+else
+    log "killing openclaw-gateway processes..."
+    PIDS_GW=$(pgrep -f "openclaw-gateway|openclaw gateway" | grep -vw "$$" || true)
+    if [ -n "$PIDS_GW" ]; then
+        log "killing gateway pids: $(echo $PIDS_GW | tr '\n' ' ')"
+        kill -9 $PIDS_GW 2>&1
+    else
+        log "no openclaw-gateway processes found"
+    fi
+
+    for i in $(seq 1 50); do
+        gw_alive || break
+        sleep 0.1
+    done
+
+    if gw_alive; then
+        log "ERROR: openclaw-gateway still alive after 5s, abort"
+        exit 1
+    fi
+    log "openclaw-gateway stopped"
+
+    log "starting openclaw gateway..."
+    nohup openclaw gateway run --port 18789 > /tmp/openclaw-gateway.log 2>&1 &
+    log "gateway started (pid=$!)"
+fi

package/template/scripts/start.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+if [ -d "/run/systemd/system/" ]; then
+    sudo systemctl start openclaw
+else
+    nohup openclaw gateway run --port 18789 > /tmp/openclaw-gateway.log 2>&1 &
+fi

package/template/scripts/stop.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+lsof -nP -iTCP:18789 -sTCP:LISTEN -t | xargs -r kill -9