@lark-apaas/openclaw-scripts-diagnose-cli 0.1.1-alpha.24 → 0.1.1-alpha.26

package/dist/index.cjs

@@ -365,6 +365,74 @@ ConfigSyntaxRule = __decorate([Rule({
 	repairMode: "ai"
 })], ConfigSyntaxRule);
 //#endregion
+//#region src/rules/template-vars-unreplaced.ts
+/**
+* Placeholder format used by miaoda-openclaw-template and Go-side templateVars,
+* e.g. `$$__FEISHU_APP_ID__`. Double underscores on both sides act as a natural
+* boundary so split-join replacement can't accidentally overlap between keys.
+*/
+const PLACEHOLDER_RE = /\$\$__[A-Z0-9_]+__/g;
+let TemplateVarsUnreplacedRule = class TemplateVarsUnreplacedRule extends DiagnoseRule {
+	validate(ctx) {
+		const found = /* @__PURE__ */ new Set();
+		collectPlaceholders(ctx.config, found);
+		if (found.size === 0) return { pass: true };
+		return {
+			pass: false,
+			message: "存在未替换的模板占位符: " + [...found].sort().join(", ")
+		};
+	}
+	repair(ctx) {
+		const map = ctx.templateVars;
+		if (!map || Object.keys(map).length === 0) return;
+		replaceInPlace(ctx.config, Object.entries(map));
+	}
+};
+TemplateVarsUnreplacedRule = __decorate([Rule({
+	key: "template_vars_unreplaced",
+	dependsOn: ["config_syntax_check"],
+	repairMode: "standard"
+})], TemplateVarsUnreplacedRule);
+function collectPlaceholders(value, found) {
+	if (typeof value === "string") {
+		const matches = value.match(PLACEHOLDER_RE);
+		if (matches) for (const m of matches) found.add(m);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const v of value) collectPlaceholders(v, found);
+		return;
+	}
+	if (value && typeof value === "object") for (const v of Object.values(value)) collectPlaceholders(v, found);
+}
+function replaceInPlace(value, entries) {
+	if (Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) {
+			const el = value[i];
+			if (typeof el === "string") value[i] = applyVars(el, entries);
+			else replaceInPlace(el, entries);
+		}
+		return;
+	}
+	if (value && typeof value === "object") {
+		const obj = value;
+		for (const key of Object.keys(obj)) {
+			const v = obj[key];
+			if (typeof v === "string") obj[key] = applyVars(v, entries);
+			else replaceInPlace(v, entries);
+		}
+	}
+}
+/** Split-join replacement — matches the algorithm in reset.ts:120 and avoids regex-escaping `$$`. */
+function applyVars(str, entries) {
+	let out = str;
+	for (const [placeholder, value] of entries) {
+		if (!value) continue;
+		if (out.includes(placeholder)) out = out.split(placeholder).join(value);
+	}
+	return out;
+}
+//#endregion
 //#region src/rules/model-provider.ts
 var _ModelProviderRule;
 let ModelProviderRule = class ModelProviderRule extends DiagnoseRule {
@@ -894,7 +962,7 @@ function findLeftoverDirs(extensionsDir) {
 }
 let CleanupInstallBackupDirsRule = class CleanupInstallBackupDirsRule extends DiagnoseRule {
 	validate(ctx) {
-		const configPath = ctx.config.__configPath;
+		const { configPath } = ctx;
 		if (!configPath) return { pass: true };
 		const dirs = findLeftoverDirs(resolveExtensionsDir(configPath));
 		if (dirs.length === 0) return { pass: true };
@@ -904,7 +972,7 @@ let CleanupInstallBackupDirsRule = class CleanupInstallBackupDirsRule extends Di
 		};
 	}
 	repair(ctx) {
-		const configPath = ctx.config.__configPath;
+		const { configPath } = ctx;
 		if (!configPath) return;
 		const dirs = findLeftoverDirs(resolveExtensionsDir(configPath));
 		const failures = [];
@@ -1254,6 +1322,54 @@ const SECRETS_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-openclaw-s
 const CONFIG_PATH = `${WORKSPACE_DIR}/openclaw.json`;
 //#endregion
 //#region src/logger.ts
+/**
+* Shared CLI log file. Every log line the CLI emits — whether through
+* `console.error` (rules, helpers, errors) or through the per-task
+* `makeLogger` (reset worker) — is tee'd here so operators have a single
+* file to tail when diagnosing a sandbox.
+*
+* `/tmp` is ephemeral on sandbox restart; we rely on that for rotation
+* (no size-based rotation implemented).
+*/
+const CLI_LOG_FILE = "/tmp/openclaw-diagnose/cli.log";
+/** Append one line to the shared cli.log. Swallows any fs error —
+*  logging must never break the business flow. */
+function appendCliLog(line) {
+	try {
+		const dir = node_path.default.dirname(CLI_LOG_FILE);
+		if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+		node_fs.default.appendFileSync(CLI_LOG_FILE, line);
+	} catch {}
+}
+let stderrMirrorInstalled = false;
+/**
+* Install a process-wide `console.error` interceptor that mirrors each
+* line to BOTH the original stderr AND cli.log. Call once at CLI entry
+* before any subcommand dispatch; idempotent.
+*
+* Why console.error and not console.log: the CLI's stdout carries the
+* structured JSON result protocol consumed by sandbox_console and other
+* callers — any log line on stdout would corrupt JSON parsing. Rules,
+* helpers, and error paths therefore must route debug output through
+* console.error (stderr).
+*/
+function installStderrMirror() {
+	if (stderrMirrorInstalled) return;
+	stderrMirrorInstalled = true;
+	const original = console.error.bind(console);
+	console.error = (...args) => {
+		original(...args);
+		const body = args.map((a) => typeof a === "string" ? a : safeStringify(a)).join(" ");
+		appendCliLog(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${body}\n`);
+	};
+}
+function safeStringify(v) {
+	try {
+		return JSON.stringify(v);
+	} catch {
+		return String(v);
+	}
+}
 function makeLogger(logFile) {
 	try {
 		const dir = node_path.default.dirname(logFile);
@@ -1264,9 +1380,45 @@ function makeLogger(logFile) {
 		try {
 			node_fs.default.appendFileSync(logFile, line);
 		} catch {}
+		appendCliLog(line);
 	};
 }
 //#endregion
+//#region src/fs-utils.ts
+/**
+* Rename src → dst, falling back to `mv` (which handles cross-device copy)
+* when the kernel returns EXDEV.
+*
+* Sandbox filesystems can put sibling paths on different "devices" from
+* rename(2)'s point of view: bind mounts, overlayfs copy-up, and
+* mount-point children inside a single directory all trip EXDEV. Seen in
+* production when reset's atomic swap did
+*   /home/gem/.npm-global/lib/node_modules/openclaw → openclaw.bak
+* and the openclaw subdir was a bind-mounted volume.
+*
+* Behavior:
+*   - Happy path hits rename(2) — atomic, single syscall, microseconds.
+*   - EXDEV path shells out to `mv`, which does rename() then copy+unlink
+*     on failure. Non-atomic but correct; callers already have rollback
+*     logic (install-openclaw restores from .bak) so loss of atomicity
+*     only matters if the process dies mid-copy, and that's survivable.
+*   - Any other error (ENOENT, EACCES, EBUSY...) rethrows as-is so callers
+*     see the real problem instead of a misleading `mv` fallback failure.
+*/
+function moveSafe(src, dst) {
+	try {
+		node_fs.default.renameSync(src, dst);
+	} catch (e) {
+		if (e?.code !== "EXDEV") throw e;
+		(0, node_child_process.execSync)(`mv ${shellQuote(src)} ${shellQuote(dst)}`, { stdio: "ignore" });
+	}
+}
+/** POSIX single-quote shell escape. Paths with embedded quotes are rare but
+*  the token-file path conventions in sandboxes don't guarantee cleanliness. */
+function shellQuote(s) {
+	return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+//#endregion
 //#region src/reset-async.ts
 /**
 * Start an async reset task: spawn a detached child process and return the taskId.
@@ -1289,7 +1441,7 @@ function startAsyncReset(ctxBase64) {
 	const dir = node_path.default.dirname(resultFile);
 	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(initial), "utf-8");
-	node_fs.default.renameSync(tmpPath, resultFile);
+	moveSafe(tmpPath, resultFile);
 	const child = (0, node_child_process.spawn)(process.execPath, [
 		process.argv[1],
 		"reset",
@@ -1313,7 +1465,7 @@ function startAsyncReset(ctxBase64) {
 		};
 		const errTmpPath = resultFile + ".tmp";
 		node_fs.default.writeFileSync(errTmpPath, JSON.stringify(failResult));
-		node_fs.default.renameSync(errTmpPath, resultFile);
+		moveSafe(errTmpPath, resultFile);
 	});
 	child.unref();
 	log(`spawned worker pid=${child.pid}`);
@@ -1321,10 +1473,16 @@ function startAsyncReset(ctxBase64) {
 }
 //#endregion
 //#region src/oss/fetchManifest.ts
+const MANIFEST_PREFIX = "builtin/manifests/openclaw/recommended/";
+const MANIFEST_SUFFIX = ".json";
 async function fetchManifest(ossFileMap, tag) {
-	const key = `builtin/manifests/openclaw/recommended/${tag}.json`;
+	const key = `${MANIFEST_PREFIX}${tag}${MANIFEST_SUFFIX}`;
 	const url = ossFileMap[key];
-	if (!url) throw new Error(`manifest signed URL missing for ${key}`);
+	if (!url) {
+		const available = Object.keys(ossFileMap).filter((k) => k.startsWith(MANIFEST_PREFIX) && k.endsWith(MANIFEST_SUFFIX)).map((k) => k.slice(39, -5));
+		const availStr = available.length ? available.join(", ") : "(none)";
+		throw new Error(`manifest signed URL missing for tag "${tag}" (key ${key}). Available tags in ossFileMap: ${availStr}. Either pass an available tag or update the studio_server TCC openclaw_upgrade_config supported_versions.`);
+	}
 	const res = await fetch(url);
 	if (!res.ok) throw new Error(`fetch manifest failed: HTTP ${res.status} ${res.statusText}`);
 	return await res.json();
@@ -1362,7 +1520,7 @@ async function downloadWithCache(pkg, ossFileMap, opts = {}) {
 				console.error(`⚠ [downloadWithCache] INTEGRITY BYPASS for ${pkg.ossKey}: expected ${expected.slice(0, 12)}… got ${actual.slice(0, 12)}… — ${sourceLabel}. DO NOT use this flag in production.`);
 			} else throw new Error(`integrity mismatch for ${pkg.ossKey}: expected ${expected} got ${actual}`);
 		}
-		node_fs.default.renameSync(tmpFile, destFile);
+		moveSafe(tmpFile, destFile);
 		return destFile;
 	} catch (e) {
 		try {
@@ -1385,7 +1543,7 @@ async function installOpenclaw(openclawTag, ossFileMap, opts = {}) {
 		force: true
 	});
 	const hadExisting = node_fs.default.existsSync(targetDir);
-	if (hadExisting) node_fs.default.renameSync(targetDir, bakDir);
+	if (hadExisting) moveSafe(targetDir, bakDir);
 	try {
 		node_fs.default.mkdirSync(targetDir, { recursive: true });
 		(0, node_child_process.execSync)(`tar -xzf '${tarball}' -C '${targetDir}' --strip-components=1`, { stdio: "ignore" });
@@ -1397,7 +1555,7 @@ async function installOpenclaw(openclawTag, ossFileMap, opts = {}) {
 				force: true
 			});
 		} catch {}
-		if (hadExisting && node_fs.default.existsSync(bakDir)) node_fs.default.renameSync(bakDir, targetDir);
+		if (hadExisting && node_fs.default.existsSync(bakDir)) moveSafe(bakDir, targetDir);
 		throw e;
 	}
 	if (node_fs.default.existsSync(bakDir)) node_fs.default.rmSync(bakDir, {
@@ -1472,7 +1630,7 @@ function updatePluginInstalls(configPath, installedPkgs) {
 	} else skipped++;
 	const tmpPath = configPath + ".installs-tmp";
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2), "utf-8");
-	node_fs.default.renameSync(tmpPath, configPath);
+	moveSafe(tmpPath, configPath);
 	console.error(`[install-extension] plugins.installs updated: ${updated} entry(ies) in ${configPath}` + (skipped > 0 ? ` (${skipped} package(s) without installMetadata skipped)` : ""));
 }
 function installOne(pkg, tarball, homeBase) {
@@ -1498,8 +1656,8 @@ function installOne(pkg, tarball, homeBase) {
 		throw e;
 	}
 	const hadOld = node_fs.default.existsSync(destDir);
-	if (hadOld) node_fs.default.renameSync(destDir, oldDir);
-	node_fs.default.renameSync(stagingDir, destDir);
+	if (hadOld) moveSafe(destDir, oldDir);
+	moveSafe(stagingDir, destDir);
 	if (hadOld && node_fs.default.existsSync(oldDir)) node_fs.default.rmSync(oldDir, {
 		recursive: true,
 		force: true
@@ -1566,7 +1724,7 @@ function writeResultFile(resultFile, result) {
 	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
 	const tmpPath = resultFile + ".tmp";
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(result), "utf-8");
-	node_fs.default.renameSync(tmpPath, resultFile);
+	moveSafe(tmpPath, resultFile);
 }
 function updateProgress(resultFile, step, startedAt) {
 	writeResultFile(resultFile, {
@@ -1878,7 +2036,8 @@ async function runReset(input, taskId, resultFile) {
 		process.exit(1);
 	}
 	let openclawTag;
-	try {
+	if (resetData.openclawTag) openclawTag = resetData.openclawTag;
+	else try {
 		openclawTag = getOpenclawTagFromOssFileMap(ossFileMap);
 	} catch (e) {
 		const err = e.message;
@@ -2272,7 +2431,8 @@ function buildResetInput(raw, configPathOverride) {
 			secretsContent: ctx.secrets.secretsContent,
 			providerKeyContent: ctx.secrets.providerKeyContent,
 			coreBackup: ctx.reset.coreBackup,
-			ossFileMap: ctx.install.ossFileMap
+			ossFileMap: ctx.install.ossFileMap,
+			openclawTag: ctx.install.openclawTag
 		}
 	};
 }
@@ -2332,6 +2492,7 @@ function getMultiFlag(args, name) {
 	return args.filter((a) => a.startsWith(prefix)).map((a) => a.slice(prefix.length));
 }
 async function main() {
+	installStderrMirror();
 	switch (mode) {
 		case "check":
 		case "repair": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.1-alpha.24",
+  "version": "0.1.1-alpha.26",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {