@mininglamp-oss/octo-runtime 0.0.0-stage → 1.0.0

package/apps/cli/dist/state.d.ts

@@ -0,0 +1,68 @@
+export interface RuntimeHomeConfiguration {
+    schema_version: 1;
+    default_profile: string;
+    channel: "stable" | "beta";
+}
+export interface ProfileConfiguration {
+    schema_version: 1;
+    profile: string;
+    server_url: string;
+    agent_work_url?: string;
+    octo_space_id?: string;
+    runtime_name: string;
+    agent_identity?: string;
+    agent_name?: string;
+    adapters?: Record<string, {
+        execution: {
+            provider_options: Record<string, string>;
+            credential_ref?: string;
+        };
+    }>;
+}
+export interface RuntimeIdentity {
+    schema_version: 1;
+    profile: string;
+    runtime_id: string;
+    credential_id: string;
+    octo_space_id?: string;
+    enrolled_at: string;
+}
+export interface MachineIdentity {
+    schema_version: 1;
+    machine_id: string;
+}
+export interface RuntimeCredential {
+    schema_version: 1;
+    access_token?: string;
+    issued_at: string;
+    expires_at?: string;
+}
+export interface RuntimePaths {
+    home: string;
+    rootConfig: string;
+    machine: string;
+    profileRoot: string;
+    profileConfig: string;
+    identity: string;
+    credential: string;
+    openclawRoot: string;
+    setupLock: string;
+    pid: string;
+    socket: string;
+    logs: string;
+}
+export declare function defaultRuntimeHome(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function runtimePaths(home: string, profile: string, platform?: NodeJS.Platform): RuntimePaths;
+/** Call under the Home setup lock; this label is shared by all profiles, not an authentication key. */
+export declare function ensureMachineIdentity(paths: RuntimePaths): Promise<MachineIdentity>;
+export declare function assertProfileName(profile: string): void;
+export declare function prepareRuntimeDirectories(paths: RuntimePaths): Promise<void>;
+/** Upgrade the former Home-global Runtime files and profiles/<name> layout. */
+export declare function migrateLegacyProfileLayout(paths: RuntimePaths, daemonRunning?: boolean): Promise<boolean>;
+export declare function readJsonFile<T>(path: string): Promise<T | undefined>;
+export declare function writeJsonAtomic(path: string, value: unknown): Promise<void>;
+export declare function writeTextAtomic(path: string, value: string): Promise<void>;
+export declare function removeIfPresent(path: string): Promise<void>;
+export declare function withSetupLock<T>(paths: RuntimePaths, action: () => Promise<T>): Promise<T>;
+export declare function reconcileHomeConfiguration(paths: RuntimePaths, profile: string, channel: "stable" | "beta"): Promise<RuntimeHomeConfiguration>;
+export declare function assertHomeConfiguration(configuration: RuntimeHomeConfiguration | undefined): void;

package/apps/cli/dist/state.js

@@ -0,0 +1,284 @@
+import { randomUUID } from "node:crypto";
+import { access, chmod, mkdir, open, readFile, rename, rm, rmdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+import { runtimeControlEndpoint } from "@mininglamp-oss/octo-runtime-daemon/runtime-endpoint";
+const PROFILE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const RESERVED_PROFILE_NAMES = new Set([
+    "config.json",
+    "credentials",
+    "extras",
+    "identity",
+    "machine.json",
+    "logs",
+    "octo-daemon.pid",
+    "profiles",
+    "run",
+    "setup",
+    "sockets",
+    "state.db"
+]);
+export function defaultRuntimeHome(env = process.env, platform = process.platform) {
+    if (env.OCTO_RUNTIME_HOME?.trim())
+        return resolve(env.OCTO_RUNTIME_HOME.trim());
+    if (platform === "win32") {
+        const localAppData = env.LOCALAPPDATA?.trim();
+        if (localAppData)
+            return resolve(localAppData, "OctoRuntime");
+    }
+    return resolve(env.HOME?.trim() || homedir(), ".octo-runtime");
+}
+export function runtimePaths(home, profile, platform = process.platform) {
+    assertProfileName(profile);
+    const absoluteHome = resolve(home);
+    const profileRoot = join(absoluteHome, profile);
+    return {
+        home: absoluteHome,
+        rootConfig: join(absoluteHome, "config.json"),
+        machine: join(absoluteHome, "machine.json"),
+        profileRoot,
+        profileConfig: join(profileRoot, "config.json"),
+        identity: join(profileRoot, "identity", "runtime.json"),
+        credential: join(profileRoot, "credentials", "runtime-token.json"),
+        openclawRoot: join(profileRoot, "adapters", "openclaw"),
+        setupLock: join(absoluteHome, "run", "setup.lock"),
+        pid: join(absoluteHome, "octo-daemon.pid"),
+        socket: runtimeControlEndpoint(absoluteHome, platform),
+        logs: join(absoluteHome, "logs")
+    };
+}
+/** Call under the Home setup lock; this label is shared by all profiles, not an authentication key. */
+export async function ensureMachineIdentity(paths) {
+    const existing = await readJsonFile(paths.machine);
+    if (existing !== undefined) {
+        if (!existing ||
+            existing.schema_version !== 1 ||
+            !/^machine_[0-9a-f-]{36}$/.test(existing.machine_id)) {
+            throw new Error(`invalid machine identity: ${paths.machine}`);
+        }
+        return existing;
+    }
+    const machine = { schema_version: 1, machine_id: `machine_${randomUUID()}` };
+    await writeJsonAtomic(paths.machine, machine);
+    return machine;
+}
+export function assertProfileName(profile) {
+    if (typeof profile !== "string" || !PROFILE_NAME.test(profile)) {
+        throw new Error("--profile must start with a letter or digit and contain only letters, digits, dot, underscore, or hyphen (maximum 128 characters)");
+    }
+    if (RESERVED_PROFILE_NAMES.has(profile.toLowerCase())) {
+        throw new Error(`--profile conflicts with Runtime Home infrastructure: ${profile}`);
+    }
+}
+export async function prepareRuntimeDirectories(paths) {
+    await Promise.all([
+        secureDirectory(paths.home),
+        secureDirectory(join(paths.home, "run")),
+        secureDirectory(join(paths.home, "sockets")),
+        secureDirectory(paths.logs),
+        secureDirectory(dirname(paths.profileConfig)),
+        secureDirectory(dirname(paths.identity)),
+        secureDirectory(dirname(paths.credential)),
+        secureDirectory(paths.openclawRoot)
+    ]);
+}
+/** Upgrade the former Home-global Runtime files and profiles/<name> layout. */
+export async function migrateLegacyProfileLayout(paths, daemonRunning = false) {
+    const legacyProfileRoot = join(paths.home, "profiles", basename(paths.profileRoot));
+    const legacyGlobalFiles = basename(paths.profileRoot) === "default"
+        ? [
+            [join(paths.home, "identity", "runtime.json"), paths.identity],
+            [join(paths.home, "credentials", "runtime-token.json"), paths.credential]
+        ]
+        : [];
+    const hasLegacyProfile = await pathExists(legacyProfileRoot);
+    const hasLegacyGlobal = (await Promise.all(legacyGlobalFiles.map(([source]) => pathExists(source)))).some(Boolean);
+    if (!hasLegacyProfile && !hasLegacyGlobal)
+        return false;
+    if (daemonRunning)
+        throw new Error("stop the daemon before migrating the legacy profile layout");
+    const backupRoot = join(paths.home, "run", "profile-layout-v1-backup", basename(paths.profileRoot));
+    await secureDirectory(dirname(paths.profileRoot));
+    if (hasLegacyProfile) {
+        if (await pathExists(paths.profileRoot)) {
+            await moveToBackup(legacyProfileRoot, join(backupRoot, "nested-profile"));
+        }
+        else {
+            await rename(legacyProfileRoot, paths.profileRoot);
+        }
+    }
+    await secureDirectory(paths.profileRoot);
+    for (const [source, target] of legacyGlobalFiles) {
+        if (!(await pathExists(source)))
+            continue;
+        if (await pathExists(target)) {
+            await moveToBackup(target, join(backupRoot, "overridden", target.slice(paths.profileRoot.length + 1)));
+        }
+        await secureDirectory(dirname(target));
+        await rename(source, target);
+    }
+    for (const directory of [
+        join(paths.home, "identity"),
+        join(paths.home, "credentials"),
+        join(paths.home, "setup"),
+        join(paths.home, "profiles")
+    ]) {
+        await removeEmptyDirectory(directory);
+    }
+    await writeJsonAtomic(join(paths.home, "run", "profile-layout-v1.json"), {
+        schema_version: 1,
+        profile: basename(paths.profileRoot),
+        migrated_at: new Date().toISOString(),
+        backup: backupRoot
+    });
+    return true;
+}
+export async function readJsonFile(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (isNodeError(error, "ENOENT"))
+            return undefined;
+        if (error instanceof SyntaxError)
+            throw new Error(`invalid JSON file: ${path}`, { cause: error });
+        throw error;
+    }
+}
+export async function writeJsonAtomic(path, value) {
+    await writeFileAtomic(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+export async function writeTextAtomic(path, value) {
+    await writeFileAtomic(path, value);
+}
+export async function removeIfPresent(path) {
+    await rm(path, { force: true });
+}
+export async function withSetupLock(paths, action) {
+    await secureDirectory(dirname(paths.setupLock));
+    const release = await acquireProcessLock(paths.setupLock);
+    try {
+        return await action();
+    }
+    finally {
+        await release();
+    }
+}
+export async function reconcileHomeConfiguration(paths, profile, channel) {
+    const existing = await readJsonFile(paths.rootConfig);
+    assertHomeConfiguration(existing);
+    const value = {
+        schema_version: 1,
+        default_profile: existing?.default_profile ?? profile,
+        channel
+    };
+    await writeJsonAtomic(paths.rootConfig, value);
+    return value;
+}
+export function assertHomeConfiguration(configuration) {
+    if (!configuration)
+        return;
+    if (configuration.schema_version !== 1) {
+        throw new Error("unsupported Runtime Home config schema");
+    }
+    assertProfileName(configuration.default_profile);
+}
+async function secureDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32")
+        await chmod(path, 0o700);
+}
+async function moveToBackup(source, target) {
+    if (await pathExists(target))
+        throw new Error(`profile migration backup already exists: ${target}`);
+    await secureDirectory(dirname(target));
+    await rename(source, target);
+}
+async function removeEmptyDirectory(path) {
+    try {
+        await rmdir(path);
+    }
+    catch (error) {
+        if (!isNodeError(error, "ENOENT") && !isNodeError(error, "ENOTEMPTY"))
+            throw error;
+    }
+}
+async function pathExists(path) {
+    try {
+        await access(path);
+        return true;
+    }
+    catch (error) {
+        if (isNodeError(error, "ENOENT"))
+            return false;
+        throw error;
+    }
+}
+async function writeFileAtomic(path, value) {
+    await secureDirectory(dirname(path));
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(value, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, path);
+        if (process.platform !== "win32")
+            await chmod(path, 0o600);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}
+async function acquireProcessLock(path) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            const handle = await open(path, "wx", 0o600);
+            await handle.writeFile(`${JSON.stringify({ pid: process.pid, created_at: new Date().toISOString() })}\n`, "utf8");
+            await handle.close();
+            return async () => {
+                const owner = await readLockOwner(path);
+                if (owner === process.pid)
+                    await rm(path, { force: true });
+            };
+        }
+        catch (error) {
+            if (!isNodeError(error, "EEXIST"))
+                throw error;
+            const owner = await readLockOwner(path);
+            if (owner !== undefined && processAlive(owner)) {
+                throw new Error(`another setup process is active (pid ${owner})`, { cause: error });
+            }
+            await rm(path, { force: true });
+        }
+    }
+    throw new Error("could not acquire setup lock");
+}
+async function readLockOwner(path) {
+    try {
+        const value = JSON.parse(await readFile(path, "utf8"));
+        return typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0
+            ? value.pid
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function processAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return isNodeError(error, "EPERM");
+    }
+}
+function isNodeError(error, code) {
+    return (error instanceof Error && "code" in error && error.code === code);
+}

package/apps/cli/dist/temporary-daemon.d.ts

@@ -0,0 +1,11 @@
+export declare function temporaryDaemonEndpoint(directory: string, platform?: NodeJS.Platform): string;
+export declare function startTemporaryDaemon(options: {
+    home: string;
+    profile: string;
+    manifest: string;
+    env: NodeJS.ProcessEnv;
+    signal: AbortSignal;
+}): Promise<{
+    socket: string;
+    close(): Promise<void>;
+}>;

package/apps/cli/dist/temporary-daemon.js

@@ -0,0 +1,109 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, realpath, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { reapOrphanedInvocationManifest } from "@mininglamp-oss/octo-runtime-daemon";
+import { probeDaemon } from "@mininglamp-oss/octo-runtime-daemon/runtime/runtime-contract";
+export function temporaryDaemonEndpoint(directory, platform = process.platform) {
+    return platform === "win32"
+        ? `\\\\.\\pipe\\octo-playboard-${createHash("sha256").update(directory).digest("hex").slice(0, 16)}`
+        : join(directory, "daemon.sock");
+}
+export async function startTemporaryDaemon(options) {
+    options.signal.throwIfAborted();
+    const directory = await mkdtemp(join(await realpath(tmpdir()), "octo-playboard-"));
+    const socket = temporaryDaemonEndpoint(directory);
+    const child = spawn(process.execPath, [
+        fileURLToPath(new URL("../../daemon/dist/index.js", import.meta.url)),
+        "--execution-only",
+        "--profile",
+        options.profile,
+        "--home",
+        options.home,
+        "--manifest",
+        options.manifest,
+        "--socket",
+        socket,
+        "--pid-file",
+        join(directory, "daemon.pid"),
+        "--state-directory",
+        directory
+    ], {
+        argv0: "octo-runtime-playboard-daemon",
+        env: options.env,
+        stdio: ["ignore", "pipe", "pipe", "ipc"],
+        windowsHide: true
+    });
+    // Neither daemon diagnostics nor readiness messages belong on stdout.
+    child.stdout?.on("data", (chunk) => process.stderr.write(chunk));
+    child.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+    const exited = new Promise((resolve) => {
+        child.once("error", () => resolve(1));
+        child.once("exit", (code) => resolve(code));
+    });
+    let closing;
+    const close = () => (closing ??= (async () => {
+        if (child.exitCode === null && child.signalCode === null)
+            child.kill("SIGTERM");
+        let timer;
+        let timedOut = false;
+        const code = await Promise.race([
+            exited,
+            new Promise((resolve) => {
+                timer = setTimeout(() => {
+                    timedOut = true;
+                    child.kill("SIGKILL");
+                    void exited.then(resolve);
+                }, 40_000);
+            })
+        ]).finally(() => clearTimeout(timer));
+        // Reap only this invocation's manifest, including unexpected daemon death.
+        const reap = await reapOrphanedInvocationManifest(join(directory, "invocations.json"));
+        if (reap.reason === "daemon_alive" || reap.reason === "unsupported_identity")
+            throw new Error("PLAYBOARD_DAEMON_CLEANUP_INCOMPLETE");
+        await rm(directory, { recursive: true, force: true });
+        if (timedOut)
+            throw new Error("PLAYBOARD_DAEMON_SHUTDOWN_TIMEOUT");
+        if (code !== 0)
+            throw new Error("PLAYBOARD_DAEMON_EXITED_ABNORMALLY");
+    })());
+    try {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => finish(new Error("PLAYBOARD_DAEMON_START_TIMEOUT")), 30_000);
+            const abort = () => finish(new Error("playboard daemon startup cancelled"));
+            const message = (value) => {
+                if (value && typeof value === "object" && "type" in value && value.type === "daemon.ready")
+                    finish();
+            };
+            let settled = false;
+            const finish = (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                options.signal.removeEventListener("abort", abort);
+                child.removeListener("message", message);
+                if (error)
+                    reject(error);
+                else
+                    resolve();
+            };
+            child.on("message", message);
+            options.signal.addEventListener("abort", abort, { once: true });
+            void exited.then(() => finish(new Error("PLAYBOARD_DAEMON_START_FAILED")));
+            if (options.signal.aborted)
+                abort();
+        });
+        const status = await probeDaemon(socket);
+        if (!status?.ready)
+            throw new Error("PLAYBOARD_DAEMON_NOT_READY");
+        options.signal.throwIfAborted();
+        return { socket, close };
+    }
+    catch (error) {
+        await close();
+        throw error;
+    }
+}

package/apps/daemon/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/apps/daemon/dist/index.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// CLI composition owns Provider discovery; resource ownership remains in startDaemonServer().
+import { inspect } from "node:util";
+import { resolveDaemonRuntimePaths } from "./runtime-options.js";
+import { startDaemonServer } from "./server.js";
+import { readExtraDirectory } from "@mininglamp-oss/octo-runtime-daemon";
+import { join } from "node:path";
+import { initializeCliOpenClaw, syncCliOpenClawToolEnvironment } from "./openclaw.js";
+import { access, readdir, readFile } from "node:fs/promises";
+const runtimePaths = resolveDaemonRuntimePaths();
+let app;
+let stopRequested = false;
+let starting = true;
+let closing;
+const stop = () => {
+    stopRequested = true;
+    if (starting || closing)
+        return;
+    closing = (app?.close() ?? Promise.resolve())
+        .then(() => {
+        process.exitCode ??= 0;
+    }, () => {
+        console.error("daemon shutdown failed");
+        process.exitCode = 1;
+    })
+        .finally(() => {
+        if (process.connected)
+            process.disconnect();
+    });
+};
+process.on("SIGINT", stop);
+process.on("SIGTERM", stop);
+process.on("SIGHUP", stop);
+// A temporary daemon must also stop when its owning CLI disappears.
+if (process.connected)
+    process.once("disconnect", stop);
+try {
+    const home = runtimePaths.homePath;
+    if (runtimePaths.profile.toLowerCase() === "extras" ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(runtimePaths.profile))
+        throw new Error("invalid runtime profile");
+    const profiles = new Set([runtimePaths.executionOnly ? runtimePaths.profile : "default"]);
+    for (const entry of runtimePaths.executionOnly
+        ? []
+        : await readdir(home, { withFileTypes: true }).catch((error) => {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        })) {
+        if (!entry.isDirectory() ||
+            entry.name.toLowerCase() === "extras" ||
+            !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(entry.name))
+            continue;
+        try {
+            const config = JSON.parse(await readFile(join(home, entry.name, "config.json"), "utf8"));
+            if (config &&
+                typeof config === "object" &&
+                "schema_version" in config &&
+                config.schema_version === 1 &&
+                "profile" in config &&
+                config.profile === entry.name)
+                profiles.add(entry.name);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+            try {
+                await access(join(home, entry.name, "adapters", "openclaw"));
+                profiles.add(entry.name);
+            }
+            catch (missing) {
+                if (missing.code !== "ENOENT")
+                    throw missing;
+            }
+        }
+    }
+    const localRuntimes = [];
+    for (const profile of profiles) {
+        const root = join(home, profile);
+        const configured = await initializeCliOpenClaw(root);
+        localRuntimes.push({
+            profile,
+            root,
+            adapterConfigurations: {
+                openclaw: { providerOptions: configured ? { OPENCLAW_RUNTIME_ROOT: root } : {} }
+            }
+        });
+    }
+    const extraDirectory = join(home, "extras");
+    if (runtimePaths.consoleOutput)
+        console.error("extras scanning", { directory: extraDirectory });
+    const extras = runtimePaths.executionOnly ? [] : await readExtraDirectory(extraDirectory);
+    for (const runtime of localRuntimes) {
+        try {
+            const result = await syncCliOpenClawToolEnvironment(runtime.root, extras);
+            if (result.file)
+                console.error("OpenClaw octo-cli environment", {
+                    ...result,
+                    notice: "Restart the OpenClaw Gateway manually to load dotenv changes."
+                });
+        }
+        catch {
+            console.error("OpenClaw: OPENCLAW_TOOL_ENV_SYNC_FAILED");
+            runtime.adapterConfigurations = {
+                ...runtime.adapterConfigurations,
+                openclaw: { providerOptions: {} }
+            };
+        }
+    }
+    if (runtimePaths.consoleOutput)
+        console.error("extras discovered", {
+            count: extras.length,
+            entries: extras.map(({ name, enabled }) => ({ name, enabled: enabled !== false }))
+        });
+    app = await startDaemonServer({ ...runtimePaths, localRuntimes, extras });
+    if (!stopRequested && process.connected)
+        process.send?.({ type: "daemon.ready" }, (error) => {
+            if (error)
+                stop();
+        });
+}
+catch (error) {
+    const verbose = process.argv.includes("--verbose");
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(verbose ? inspect(error, { depth: null, colors: false }) : `❌ ${message}`);
+    process.exitCode = 1;
+}
+finally {
+    starting = false;
+    if (stopRequested)
+        stop();
+    else if (!app && process.connected)
+        process.disconnect();
+}

package/apps/daemon/dist/launcher.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/apps/daemon/dist/launcher.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+// Keep process supervision outside the daemon implementation. The launcher owns
+// signal/exit propagation and reports child process startup failures.
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { daemonRuntimeArguments, resolveDaemonRuntimePaths } from "./runtime-options.js";
+const entrypoint = fileURLToPath(new URL("./index.js", import.meta.url));
+const runtimePaths = resolveDaemonRuntimePaths();
+const child = spawn(process.execPath, [
+    entrypoint,
+    ...daemonRuntimeArguments(runtimePaths),
+    ...(process.argv.includes("--verbose") ? ["--verbose"] : [])
+], {
+    argv0: "octo-runtime-daemon",
+    env: process.env,
+    stdio: "inherit"
+});
+const forward = (signal) => {
+    if (child.exitCode === null && child.signalCode === null)
+        child.kill(signal);
+};
+const forwardSigint = () => forward("SIGINT");
+const forwardSigterm = () => forward("SIGTERM");
+const forwardSighup = () => forward("SIGHUP");
+process.once("SIGINT", forwardSigint);
+process.once("SIGTERM", forwardSigterm);
+process.once("SIGHUP", forwardSighup);
+let result;
+try {
+    result = await new Promise((resolveExit, reject) => {
+        child.once("error", reject);
+        child.once("close", (code, signal) => resolveExit({ code, signal }));
+    });
+}
+catch (error) {
+    console.error("daemon child failed to spawn", {
+        error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+}
+process.removeListener("SIGINT", forwardSigint);
+process.removeListener("SIGTERM", forwardSigterm);
+process.removeListener("SIGHUP", forwardSighup);
+if (result.code !== null) {
+    process.exitCode = result.code;
+}
+else if (result.signal) {
+    console.error("daemon child exited from signal", { signal: result.signal });
+    // Re-raise the child's signal so service managers observe the original
+    // termination semantics instead of a synthetic numeric exit code.
+    process.kill(process.pid, result.signal);
+}

package/apps/daemon/dist/openclaw.d.ts

@@ -0,0 +1,15 @@
+import type { ExtraRegistration } from "@mininglamp-oss/octo-runtime-daemon";
+import { type OpenClawConnectionInput } from "@mininglamp-oss/octo-runtime-adapter-openclaw";
+export interface CliOpenClawInput extends OpenClawConnectionInput {
+    openclawHome?: string;
+}
+/** CLI composition only: resolve discovery before entering the shared execution path. */
+export declare function configureCliOpenClaw(runtimeRoot: string, input?: CliOpenClawInput, env?: NodeJS.ProcessEnv): Promise<import("@mininglamp-oss/octo-runtime-adapter-openclaw").OpenClawConnection>;
+/** Octospec F24: one instance uses the last enabled OpenClaw Bot, never another Adapter. */
+export declare function syncCliOpenClawToolEnvironment(runtimeRoot: string, extras: readonly ExtraRegistration[]): Promise<{
+    file?: string;
+    written: boolean;
+    restartRequired: boolean;
+}>;
+/** An absent optional Provider must not prevent the CLI daemon from starting. */
+export declare function initializeCliOpenClaw(runtimeRoot: string, env?: NodeJS.ProcessEnv): Promise<boolean>;