@lark-apaas/openclaw-scripts-diagnose-cli 0.1.1-alpha.25 → 0.1.1-alpha.27

package/dist/index.cjs

@@ -365,6 +365,74 @@ ConfigSyntaxRule = __decorate([Rule({
 	repairMode: "ai"
 })], ConfigSyntaxRule);
 //#endregion
+//#region src/rules/template-vars-unreplaced.ts
+/**
+* Placeholder format used by miaoda-openclaw-template and Go-side templateVars,
+* e.g. `$$__FEISHU_APP_ID__`. Double underscores on both sides act as a natural
+* boundary so split-join replacement can't accidentally overlap between keys.
+*/
+const PLACEHOLDER_RE = /\$\$__[A-Z0-9_]+__/g;
+let TemplateVarsUnreplacedRule = class TemplateVarsUnreplacedRule extends DiagnoseRule {
+	validate(ctx) {
+		const found = /* @__PURE__ */ new Set();
+		collectPlaceholders(ctx.config, found);
+		if (found.size === 0) return { pass: true };
+		return {
+			pass: false,
+			message: "存在未替换的模板占位符: " + [...found].sort().join(", ")
+		};
+	}
+	repair(ctx) {
+		const map = ctx.templateVars;
+		if (!map || Object.keys(map).length === 0) return;
+		replaceInPlace(ctx.config, Object.entries(map));
+	}
+};
+TemplateVarsUnreplacedRule = __decorate([Rule({
+	key: "template_vars_unreplaced",
+	dependsOn: ["config_syntax_check"],
+	repairMode: "standard"
+})], TemplateVarsUnreplacedRule);
+function collectPlaceholders(value, found) {
+	if (typeof value === "string") {
+		const matches = value.match(PLACEHOLDER_RE);
+		if (matches) for (const m of matches) found.add(m);
+		return;
+	}
+	if (Array.isArray(value)) {
+		for (const v of value) collectPlaceholders(v, found);
+		return;
+	}
+	if (value && typeof value === "object") for (const v of Object.values(value)) collectPlaceholders(v, found);
+}
+function replaceInPlace(value, entries) {
+	if (Array.isArray(value)) {
+		for (let i = 0; i < value.length; i++) {
+			const el = value[i];
+			if (typeof el === "string") value[i] = applyVars(el, entries);
+			else replaceInPlace(el, entries);
+		}
+		return;
+	}
+	if (value && typeof value === "object") {
+		const obj = value;
+		for (const key of Object.keys(obj)) {
+			const v = obj[key];
+			if (typeof v === "string") obj[key] = applyVars(v, entries);
+			else replaceInPlace(v, entries);
+		}
+	}
+}
+/** Split-join replacement — matches the algorithm in reset.ts:120 and avoids regex-escaping `$$`. */
+function applyVars(str, entries) {
+	let out = str;
+	for (const [placeholder, value] of entries) {
+		if (!value) continue;
+		if (out.includes(placeholder)) out = out.split(placeholder).join(value);
+	}
+	return out;
+}
+//#endregion
 //#region src/rules/model-provider.ts
 var _ModelProviderRule;
 let ModelProviderRule = class ModelProviderRule extends DiagnoseRule {
@@ -614,6 +682,27 @@ FeishuChannelRule = _FeishuChannelRule = __decorate([Rule({
 	repairMode: "standard"
 })], FeishuChannelRule);
 //#endregion
+//#region src/rules/feishu-default-account.ts
+let FeishuDefaultAccountRule = class FeishuDefaultAccountRule extends DiagnoseRule {
+	validate(ctx) {
+		const feishu = getNestedMap(ctx.config, "channels", "feishu");
+		if (feishu && "defaultAccount" in feishu) return {
+			pass: false,
+			message: "channels.feishu.defaultAccount should be removed"
+		};
+		return { pass: true };
+	}
+	repair(ctx) {
+		const feishu = getNestedMap(ctx.config, "channels", "feishu");
+		if (feishu && "defaultAccount" in feishu) delete feishu.defaultAccount;
+	}
+};
+FeishuDefaultAccountRule = __decorate([Rule({
+	key: "feishu_default_account",
+	dependsOn: ["config_syntax_check"],
+	repairMode: "standard"
+})], FeishuDefaultAccountRule);
+//#endregion
 //#region src/rules/gateway.ts
 var _GatewayRule;
 let GatewayRule = class GatewayRule extends DiagnoseRule {
@@ -877,74 +966,6 @@ SecretsRule = __decorate([Rule({
 	skipWhen: ({ hasMiaoda, deps }) => !hasMiaoda || !deps.usesMiaodaSecretProvider
 })], SecretsRule);
 //#endregion
-//#region src/rules/template-vars-unreplaced.ts
-/**
-* Placeholder format used by miaoda-openclaw-template and Go-side templateVars,
-* e.g. `$$__FEISHU_APP_ID__`. Double underscores on both sides act as a natural
-* boundary so split-join replacement can't accidentally overlap between keys.
-*/
-const PLACEHOLDER_RE = /\$\$__[A-Z0-9_]+__/g;
-let TemplateVarsUnreplacedRule = class TemplateVarsUnreplacedRule extends DiagnoseRule {
-	validate(ctx) {
-		const found = /* @__PURE__ */ new Set();
-		collectPlaceholders(ctx.config, found);
-		if (found.size === 0) return { pass: true };
-		return {
-			pass: false,
-			message: "存在未替换的模板占位符: " + [...found].sort().join(", ")
-		};
-	}
-	repair(ctx) {
-		const map = ctx.templateVars;
-		if (!map || Object.keys(map).length === 0) return;
-		replaceInPlace(ctx.config, Object.entries(map));
-	}
-};
-TemplateVarsUnreplacedRule = __decorate([Rule({
-	key: "template_vars_unreplaced",
-	dependsOn: ["config_syntax_check"],
-	repairMode: "standard"
-})], TemplateVarsUnreplacedRule);
-function collectPlaceholders(value, found) {
-	if (typeof value === "string") {
-		const matches = value.match(PLACEHOLDER_RE);
-		if (matches) for (const m of matches) found.add(m);
-		return;
-	}
-	if (Array.isArray(value)) {
-		for (const v of value) collectPlaceholders(v, found);
-		return;
-	}
-	if (value && typeof value === "object") for (const v of Object.values(value)) collectPlaceholders(v, found);
-}
-function replaceInPlace(value, entries) {
-	if (Array.isArray(value)) {
-		for (let i = 0; i < value.length; i++) {
-			const el = value[i];
-			if (typeof el === "string") value[i] = applyVars(el, entries);
-			else replaceInPlace(el, entries);
-		}
-		return;
-	}
-	if (value && typeof value === "object") {
-		const obj = value;
-		for (const key of Object.keys(obj)) {
-			const v = obj[key];
-			if (typeof v === "string") obj[key] = applyVars(v, entries);
-			else replaceInPlace(v, entries);
-		}
-	}
-}
-/** Split-join replacement — matches the algorithm in reset.ts:120 and avoids regex-escaping `$$`. */
-function applyVars(str, entries) {
-	let out = str;
-	for (const [placeholder, value] of entries) {
-		if (!value) continue;
-		if (out.includes(placeholder)) out = out.split(placeholder).join(value);
-	}
-	return out;
-}
-//#endregion
 //#region src/rules/cleanup-install-backup-dirs.ts
 const DIR_PREFIX = ".openclaw-install-";
 function resolveExtensionsDir(configPath) {
@@ -962,7 +983,7 @@ function findLeftoverDirs(extensionsDir) {
 }
 let CleanupInstallBackupDirsRule = class CleanupInstallBackupDirsRule extends DiagnoseRule {
 	validate(ctx) {
-		const configPath = ctx.config.__configPath;
+		const { configPath } = ctx;
 		if (!configPath) return { pass: true };
 		const dirs = findLeftoverDirs(resolveExtensionsDir(configPath));
 		if (dirs.length === 0) return { pass: true };
@@ -972,7 +993,7 @@ let CleanupInstallBackupDirsRule = class CleanupInstallBackupDirsRule extends Di
 		};
 	}
 	repair(ctx) {
-		const configPath = ctx.config.__configPath;
+		const { configPath } = ctx;
 		if (!configPath) return;
 		const dirs = findLeftoverDirs(resolveExtensionsDir(configPath));
 		const failures = [];
@@ -1322,6 +1343,54 @@ const SECRETS_FILE_PATH = "/home/gem/workspace/.force/openclaw/miaoda-openclaw-s
 const CONFIG_PATH = `${WORKSPACE_DIR}/openclaw.json`;
 //#endregion
 //#region src/logger.ts
+/**
+* Shared CLI log file. Every log line the CLI emits — whether through
+* `console.error` (rules, helpers, errors) or through the per-task
+* `makeLogger` (reset worker) — is tee'd here so operators have a single
+* file to tail when diagnosing a sandbox.
+*
+* `/tmp` is ephemeral on sandbox restart; we rely on that for rotation
+* (no size-based rotation implemented).
+*/
+const CLI_LOG_FILE = "/tmp/openclaw-diagnose/cli.log";
+/** Append one line to the shared cli.log. Swallows any fs error —
+*  logging must never break the business flow. */
+function appendCliLog(line) {
+	try {
+		const dir = node_path.default.dirname(CLI_LOG_FILE);
+		if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
+		node_fs.default.appendFileSync(CLI_LOG_FILE, line);
+	} catch {}
+}
+let stderrMirrorInstalled = false;
+/**
+* Install a process-wide `console.error` interceptor that mirrors each
+* line to BOTH the original stderr AND cli.log. Call once at CLI entry
+* before any subcommand dispatch; idempotent.
+*
+* Why console.error and not console.log: the CLI's stdout carries the
+* structured JSON result protocol consumed by sandbox_console and other
+* callers — any log line on stdout would corrupt JSON parsing. Rules,
+* helpers, and error paths therefore must route debug output through
+* console.error (stderr).
+*/
+function installStderrMirror() {
+	if (stderrMirrorInstalled) return;
+	stderrMirrorInstalled = true;
+	const original = console.error.bind(console);
+	console.error = (...args) => {
+		original(...args);
+		const body = args.map((a) => typeof a === "string" ? a : safeStringify(a)).join(" ");
+		appendCliLog(`[${(/* @__PURE__ */ new Date()).toISOString()}] ${body}\n`);
+	};
+}
+function safeStringify(v) {
+	try {
+		return JSON.stringify(v);
+	} catch {
+		return String(v);
+	}
+}
 function makeLogger(logFile) {
 	try {
 		const dir = node_path.default.dirname(logFile);
@@ -1332,9 +1401,70 @@ function makeLogger(logFile) {
 		try {
 			node_fs.default.appendFileSync(logFile, line);
 		} catch {}
+		appendCliLog(line);
 	};
 }
 //#endregion
+//#region src/fs-utils.ts
+/**
+* Rename src → dst, falling back to `mv` (which handles cross-device copy)
+* when the kernel returns EXDEV.
+*
+* Sandbox filesystems can put sibling paths on different "devices" from
+* rename(2)'s point of view: bind mounts, overlayfs copy-up, and
+* mount-point children inside a single directory all trip EXDEV. Seen in
+* production when reset's atomic swap did
+*   /home/gem/.npm-global/lib/node_modules/openclaw → openclaw.bak
+* and the openclaw subdir was a bind-mounted volume.
+*
+* Behavior:
+*   - Happy path hits rename(2) — atomic, single syscall, microseconds.
+*   - EXDEV path shells out to `mv`, which does rename() then copy+unlink
+*     on failure. Non-atomic but correct; callers already have rollback
+*     logic (install-openclaw restores from .bak) so loss of atomicity
+*     only matters if the process dies mid-copy, and that's survivable.
+*   - Any other error (ENOENT, EACCES, EBUSY...) rethrows as-is so callers
+*     see the real problem instead of a misleading `mv` fallback failure.
+*/
+function moveSafe(src, dst) {
+	try {
+		node_fs.default.renameSync(src, dst);
+	} catch (e) {
+		if (e?.code !== "EXDEV") throw e;
+		execCaptureErr(`mv ${shellQuote(src)} ${shellQuote(dst)}`);
+	}
+}
+/**
+* Run a shell command, re-throwing with stderr attached on failure.
+*
+* Node's `execSync(..., { stdio: 'ignore' })` swallows stderr entirely —
+* callers only see "Command failed: <cmd>" with no hint of the real error
+* (ENOSPC, EROFS, "unrecognized option", etc.). Production debugging on
+* sandboxed boxes is painful without the underlying message, so we pipe
+* stderr, capture it, and embed it in the thrown Error. stdout stays
+* suppressed because the commands we run here (tar/mv) are silent on
+* success.
+*/
+function execCaptureErr(cmd) {
+	try {
+		(0, node_child_process.execSync)(cmd, { stdio: [
+			"ignore",
+			"ignore",
+			"pipe"
+		] });
+	} catch (e) {
+		const stderr = e?.stderr;
+		const stderrStr = (typeof stderr === "string" ? stderr : stderr?.toString("utf8") ?? "").trim();
+		const base = e?.message ?? "command failed";
+		throw new Error(stderrStr ? `${base}\nstderr: ${stderrStr}` : base);
+	}
+}
+/** POSIX single-quote shell escape. Paths with embedded quotes are rare but
+*  the token-file path conventions in sandboxes don't guarantee cleanliness. */
+function shellQuote(s) {
+	return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+//#endregion
 //#region src/reset-async.ts
 /**
 * Start an async reset task: spawn a detached child process and return the taskId.
@@ -1357,7 +1487,7 @@ function startAsyncReset(ctxBase64) {
 	const dir = node_path.default.dirname(resultFile);
 	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(initial), "utf-8");
-	node_fs.default.renameSync(tmpPath, resultFile);
+	moveSafe(tmpPath, resultFile);
 	const child = (0, node_child_process.spawn)(process.execPath, [
 		process.argv[1],
 		"reset",
@@ -1381,7 +1511,7 @@ function startAsyncReset(ctxBase64) {
 		};
 		const errTmpPath = resultFile + ".tmp";
 		node_fs.default.writeFileSync(errTmpPath, JSON.stringify(failResult));
-		node_fs.default.renameSync(errTmpPath, resultFile);
+		moveSafe(errTmpPath, resultFile);
 	});
 	child.unref();
 	log(`spawned worker pid=${child.pid}`);
@@ -1389,10 +1519,16 @@ function startAsyncReset(ctxBase64) {
 }
 //#endregion
 //#region src/oss/fetchManifest.ts
+const MANIFEST_PREFIX = "builtin/manifests/openclaw/recommended/";
+const MANIFEST_SUFFIX = ".json";
 async function fetchManifest(ossFileMap, tag) {
-	const key = `builtin/manifests/openclaw/recommended/${tag}.json`;
+	const key = `${MANIFEST_PREFIX}${tag}${MANIFEST_SUFFIX}`;
 	const url = ossFileMap[key];
-	if (!url) throw new Error(`manifest signed URL missing for ${key}`);
+	if (!url) {
+		const available = Object.keys(ossFileMap).filter((k) => k.startsWith(MANIFEST_PREFIX) && k.endsWith(MANIFEST_SUFFIX)).map((k) => k.slice(39, -5));
+		const availStr = available.length ? available.join(", ") : "(none)";
+		throw new Error(`manifest signed URL missing for tag "${tag}" (key ${key}). Available tags in ossFileMap: ${availStr}. Either pass an available tag or update the studio_server TCC openclaw_upgrade_config supported_versions.`);
+	}
 	const res = await fetch(url);
 	if (!res.ok) throw new Error(`fetch manifest failed: HTTP ${res.status} ${res.statusText}`);
 	return await res.json();
@@ -1430,7 +1566,7 @@ async function downloadWithCache(pkg, ossFileMap, opts = {}) {
 				console.error(`⚠ [downloadWithCache] INTEGRITY BYPASS for ${pkg.ossKey}: expected ${expected.slice(0, 12)}… got ${actual.slice(0, 12)}… — ${sourceLabel}. DO NOT use this flag in production.`);
 			} else throw new Error(`integrity mismatch for ${pkg.ossKey}: expected ${expected} got ${actual}`);
 		}
-		node_fs.default.renameSync(tmpFile, destFile);
+		moveSafe(tmpFile, destFile);
 		return destFile;
 	} catch (e) {
 		try {
@@ -1453,10 +1589,10 @@ async function installOpenclaw(openclawTag, ossFileMap, opts = {}) {
 		force: true
 	});
 	const hadExisting = node_fs.default.existsSync(targetDir);
-	if (hadExisting) node_fs.default.renameSync(targetDir, bakDir);
+	if (hadExisting) moveSafe(targetDir, bakDir);
 	try {
 		node_fs.default.mkdirSync(targetDir, { recursive: true });
-		(0, node_child_process.execSync)(`tar -xzf '${tarball}' -C '${targetDir}' --strip-components=1`, { stdio: "ignore" });
+		execCaptureErr(`tar -xzf '${tarball}' -C '${targetDir}' --strip-components=1`);
 		if (!node_fs.default.existsSync(node_path.default.join(targetDir, "package.json"))) throw new Error("extracted tarball missing package.json");
 	} catch (e) {
 		try {
@@ -1465,7 +1601,7 @@ async function installOpenclaw(openclawTag, ossFileMap, opts = {}) {
 				force: true
 			});
 		} catch {}
-		if (hadExisting && node_fs.default.existsSync(bakDir)) node_fs.default.renameSync(bakDir, targetDir);
+		if (hadExisting && node_fs.default.existsSync(bakDir)) moveSafe(bakDir, targetDir);
 		throw e;
 	}
 	if (node_fs.default.existsSync(bakDir)) node_fs.default.rmSync(bakDir, {
@@ -1540,7 +1676,7 @@ function updatePluginInstalls(configPath, installedPkgs) {
 	} else skipped++;
 	const tmpPath = configPath + ".installs-tmp";
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(config, null, 2), "utf-8");
-	node_fs.default.renameSync(tmpPath, configPath);
+	moveSafe(tmpPath, configPath);
 	console.error(`[install-extension] plugins.installs updated: ${updated} entry(ies) in ${configPath}` + (skipped > 0 ? ` (${skipped} package(s) without installMetadata skipped)` : ""));
 }
 function installOne(pkg, tarball, homeBase) {
@@ -1554,7 +1690,7 @@ function installOne(pkg, tarball, homeBase) {
 	});
 	node_fs.default.mkdirSync(stagingDir);
 	try {
-		(0, node_child_process.execSync)(`tar -xzf '${tarball}' -C '${stagingDir}' --strip-components=1`, { stdio: "ignore" });
+		execCaptureErr(`tar -xzf '${tarball}' -C '${stagingDir}' --strip-components=1`);
 		if (!node_fs.default.existsSync(node_path.default.join(stagingDir, "package.json"))) throw new Error(`extension tarball missing package.json: ${pkg.name}`);
 	} catch (e) {
 		try {
@@ -1566,8 +1702,8 @@ function installOne(pkg, tarball, homeBase) {
 		throw e;
 	}
 	const hadOld = node_fs.default.existsSync(destDir);
-	if (hadOld) node_fs.default.renameSync(destDir, oldDir);
-	node_fs.default.renameSync(stagingDir, destDir);
+	if (hadOld) moveSafe(destDir, oldDir);
+	moveSafe(stagingDir, destDir);
 	if (hadOld && node_fs.default.existsSync(oldDir)) node_fs.default.rmSync(oldDir, {
 		recursive: true,
 		force: true
@@ -1592,7 +1728,7 @@ async function downloadResource(tag, ossFileMap, opts) {
 	const format = (pkg.format ?? "").toLowerCase();
 	const lower = pkg.ossKey.toLowerCase();
 	if (format === "tgz" || lower.endsWith(".tgz") || lower.endsWith(".tar.gz")) {
-		(0, node_child_process.execSync)(`tar -xzf '${file}' -C '${extractDir}'`, { stdio: "ignore" });
+		execCaptureErr(`tar -xzf '${file}' -C '${extractDir}'`);
 		console.error(`[download-resource] ${opts.role}/${opts.name}: extracted to ${extractDir}`);
 	} else {
 		const basename = node_path.default.posix.basename(pkg.ossKey);
@@ -1634,7 +1770,7 @@ function writeResultFile(resultFile, result) {
 	if (!node_fs.default.existsSync(dir)) node_fs.default.mkdirSync(dir, { recursive: true });
 	const tmpPath = resultFile + ".tmp";
 	node_fs.default.writeFileSync(tmpPath, JSON.stringify(result), "utf-8");
-	node_fs.default.renameSync(tmpPath, resultFile);
+	moveSafe(tmpPath, resultFile);
 }
 function updateProgress(resultFile, step, startedAt) {
 	writeResultFile(resultFile, {
@@ -1946,7 +2082,8 @@ async function runReset(input, taskId, resultFile) {
 		process.exit(1);
 	}
 	let openclawTag;
-	try {
+	if (resetData.openclawTag) openclawTag = resetData.openclawTag;
+	else try {
 		openclawTag = getOpenclawTagFromOssFileMap(ossFileMap);
 	} catch (e) {
 		const err = e.message;
@@ -2340,7 +2477,8 @@ function buildResetInput(raw, configPathOverride) {
 			secretsContent: ctx.secrets.secretsContent,
 			providerKeyContent: ctx.secrets.providerKeyContent,
 			coreBackup: ctx.reset.coreBackup,
-			ossFileMap: ctx.install.ossFileMap
+			ossFileMap: ctx.install.ossFileMap,
+			openclawTag: ctx.install.openclawTag
 		}
 	};
 }
@@ -2400,6 +2538,7 @@ function getMultiFlag(args, name) {
 	return args.filter((a) => a.startsWith(prefix)).map((a) => a.slice(prefix.length));
 }
 async function main() {
+	installStderrMirror();
 	switch (mode) {
 		case "check":
 		case "repair": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lark-apaas/openclaw-scripts-diagnose-cli",
-  "version": "0.1.1-alpha.25",
+  "version": "0.1.1-alpha.27",
   "description": "CLI for OpenClaw config diagnose and repair with JSON5 support",
   "main": "dist/index.cjs",
   "bin": {