@moltbankhq/openclaw 0.1.10 → 0.1.11

package/index.ts

@@ -1,7 +1,7 @@
-import { execSync, spawn } from 'child_process';
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { spawn, spawnSync } from 'child_process';
+import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, type Dirent } from 'fs';
 import { join, dirname } from 'path';
-import { homedir } from 'os';
+import { homedir, userInfo } from 'os';
 const IS_WIN = process.platform === 'win32';
 
 type OpenclawConfig = Record<string, unknown>;
@@ -32,6 +32,21 @@ interface LoggerApi {
   logger: LoggerLike;
 }
 
+type RunOptions = {
+  cwd?: string;
+  silent?: boolean;
+  env?: Record<string, string | undefined>;
+  timeoutMs?: number;
+};
+
+type RunResult = {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+};
+
 export interface SetupCommandLoggerOptions {
   verbose?: boolean;
   statusCommand?: string;
@@ -350,31 +365,65 @@ function getExecErrorMessage(error: unknown): string {
   return String(error);
 }
 
-function run(
-  cmd: string,
-  opts: { cwd?: string; silent?: boolean; env?: Record<string, string | undefined>; timeoutMs?: number } = {}
-) {
+function runCommand(command: string, args: string[], opts: RunOptions = {}): RunResult {
   try {
     const mergedEnv: NodeJS.ProcessEnv = { ...process.env, ...(opts.env ?? {}) };
-    const out = execSync(cmd, {
+    const result = spawnSync(command, args, {
       cwd: opts.cwd,
-      stdio: opts.silent ? 'pipe' : 'inherit',
       env: mergedEnv,
+      encoding: 'utf8',
       timeout: opts.timeoutMs,
-      shell: IS_WIN ? (process.env.ComSpec ?? 'cmd.exe') : '/bin/bash'
+      stdio: 'pipe',
+      windowsHide: true
     });
-    return { ok: true, stdout: out?.toString().trim() ?? '' };
+
+    const stdout = (result.stdout ?? '').toString();
+    const stderr = (result.stderr ?? '').toString();
+
+    if (!opts.silent) {
+      if (stdout) process.stdout.write(stdout);
+      if (stderr) process.stderr.write(stderr);
+    }
+
+    const errorMessage = result.error ? getExecErrorMessage(result.error) : '';
+    const trimmedStdout = stdout.trim();
+    const trimmedStderr = stderr.trim();
+    const timedOut = Boolean(
+      result.error &&
+        ((isRecord(result.error) && asString((result.error as { code?: unknown }).code) === 'ETIMEDOUT') ||
+          errorMessage.toLowerCase().includes('timed out'))
+    );
+
+    if (result.status === 0) {
+      return {
+        ok: true,
+        stdout: trimmedStdout,
+        stderr: trimmedStderr,
+        exitCode: result.status,
+        timedOut: false
+      };
+    }
+
+    return {
+      ok: false,
+      stdout: trimmedStdout,
+      stderr: trimmedStderr || errorMessage || trimmedStdout,
+      exitCode: typeof result.status === 'number' ? result.status : null,
+      timedOut
+    };
   } catch (e: unknown) {
     return {
       ok: false,
       stdout: getExecOutputText(e, 'stdout'),
-      stderr: getExecErrorMessage(e)
+      stderr: getExecErrorMessage(e),
+      exitCode: null,
+      timedOut: getExecErrorMessage(e).toLowerCase().includes('timed out')
     };
   }
 }
 
 function hasBin(bin: string) {
-  return run(IS_WIN ? `where ${bin}` : `which ${bin}`, { silent: true }).ok;
+  return runCommand(IS_WIN ? 'where' : 'which', [bin], { silent: true }).ok;
 }
 
 function getJqInstallHint(): string {
@@ -396,7 +445,7 @@ function splitNonEmptyLines(text: string): string[] {
 }
 
 function getNpmGlobalBinDir(): string {
-  const prefix = run('npm config get prefix', { silent: true });
+  const prefix = runCommand('npm', ['config', 'get', 'prefix'], { silent: true });
   if (!prefix.ok) return '';
 
   const value = prefix.stdout.trim();
@@ -412,7 +461,7 @@ function findFirstMatchingFile(rootDir: string, predicate: (name: string) => boo
     const current = queue.shift();
     if (!current) break;
 
-    let entries: ReturnType<typeof readdirSync>;
+    let entries: Dirent[] = [];
     try {
       entries = readdirSync(current.dir, { withFileTypes: true });
     } catch {
@@ -433,13 +482,94 @@ function findFirstMatchingFile(rootDir: string, predicate: (name: string) => boo
   return '';
 }
 
+function visitFiles(rootDir: string, visitor: (fullPath: string, entry: Dirent) => void, maxDepth = Number.POSITIVE_INFINITY): void {
+  if (!rootDir || !existsSync(rootDir)) return;
+
+  const queue: Array<{ dir: string; depth: number }> = [{ dir: rootDir, depth: 0 }];
+  while (queue.length) {
+    const current = queue.shift();
+    if (!current) break;
+
+    let entries: Dirent[] = [];
+    try {
+      entries = readdirSync(current.dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    for (const entry of entries) {
+      const fullPath = join(current.dir, entry.name);
+      visitor(fullPath, entry);
+      if (entry.isDirectory() && current.depth < maxDepth) {
+        queue.push({ dir: fullPath, depth: current.depth + 1 });
+      }
+    }
+  }
+}
+
+function normalizeFileLineEndings(filePath: string): void {
+  try {
+    const original = readFileSync(filePath, 'utf8');
+    const normalized = original.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    if (normalized !== original) {
+      writeFileSync(filePath, normalized, 'utf8');
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function normalizeFilesMatching(rootDir: string, matcher: (fullPath: string, entry: Dirent) => boolean, maxDepth = Number.POSITIVE_INFINITY): void {
+  visitFiles(
+    rootDir,
+    (fullPath, entry) => {
+      if (entry.isFile() && matcher(fullPath, entry)) {
+        normalizeFileLineEndings(fullPath);
+      }
+    },
+    maxDepth
+  );
+}
+
+function applyRecursiveOwnership(rootDir: string, uid: number, gid: number): void {
+  try {
+    chownSync(rootDir, uid, gid);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath) => {
+    try {
+      chownSync(fullPath, uid, gid);
+    } catch {
+      // ignore
+    }
+  });
+}
+
+function applyRecursiveMode(rootDir: string, mode: number): void {
+  try {
+    chmodSync(rootDir, mode);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath) => {
+    try {
+      chmodSync(fullPath, mode);
+    } catch {
+      // ignore
+    }
+  });
+}
+
 function findWindowsJqBinaryPath(): string {
   if (!IS_WIN) return '';
 
   const fromEnv = asString(process.env.JQ_PATH).trim();
   if (fromEnv && existsSync(fromEnv)) return fromEnv;
 
-  const whereJq = run('where jq', { silent: true });
+  const whereJq = runCommand('where', ['jq'], { silent: true });
   if (whereJq.ok) {
     for (const line of splitNonEmptyLines(whereJq.stdout)) {
       if (existsSync(line)) {
@@ -482,7 +612,7 @@ function findWindowsJqBinaryPath(): string {
 
   const wingetPackagesRoot = localAppData ? join(localAppData, 'Microsoft', 'WinGet', 'Packages') : '';
   if (wingetPackagesRoot && existsSync(wingetPackagesRoot)) {
-    let packageEntries: ReturnType<typeof readdirSync> = [];
+    let packageEntries: Dirent<string>[] = [];
     try {
       packageEntries = readdirSync(wingetPackagesRoot, { withFileTypes: true });
     } catch {
@@ -529,7 +659,7 @@ function ensureWindowsJqShim(api: LoggerApi): boolean {
 
   if (!hasBin('jq')) return false;
 
-  const v = run('jq --version', { silent: true });
+  const v = runCommand('jq', ['--version'], { silent: true });
   api.logger.info(`[moltbank] ✓ jq available via npm global bin shim (${v.stdout || 'unknown version'})`);
   return true;
 }
@@ -665,12 +795,12 @@ function cleanupStaleMoltbankPluginLoadPaths(api: LoggerApi): boolean {
 
 function ensureMcporter(api: LoggerApi) {
   if (hasBin('mcporter')) {
-    const v = run('mcporter --version', { silent: true });
+    const v = runCommand('mcporter', ['--version'], { silent: true });
     api.logger.info(`[moltbank] ✓ mcporter already installed (${v.stdout || 'unknown version'})`);
     return;
   }
   api.logger.info('[moltbank] installing mcporter globally...');
-  const result = run('npm install -g mcporter');
+  const result = runCommand('npm', ['install', '-g', 'mcporter']);
   if (result.ok) {
     api.logger.info('[moltbank] ✓ mcporter installed');
   } else {
@@ -680,7 +810,7 @@ function ensureMcporter(api: LoggerApi) {
 
 function ensureJq(api: LoggerApi) {
   if (hasBin('jq')) {
-    const v = run('jq --version', { silent: true });
+    const v = runCommand('jq', ['--version'], { silent: true });
     api.logger.info(`[moltbank] ✓ jq already installed (${v.stdout || 'unknown version'})`);
     return;
   }
@@ -698,29 +828,41 @@ function ensureJq(api: LoggerApi) {
 
   api.logger.info('[moltbank] jq not found — attempting Windows install...');
 
-  const installers: Array<{ name: string; checkCmd: string; installCmd: string }> = [
+  const installers: Array<{
+    name: string;
+    checkCommand: string;
+    checkArgs: string[];
+    installCommand: string;
+    installArgs: string[];
+  }> = [
     {
       name: 'winget',
-      checkCmd: 'where winget',
-      installCmd: 'winget install -e --id jqlang.jq --accept-package-agreements --accept-source-agreements --silent'
+      checkCommand: 'where',
+      checkArgs: ['winget'],
+      installCommand: 'winget',
+      installArgs: ['install', '-e', '--id', 'jqlang.jq', '--accept-package-agreements', '--accept-source-agreements', '--silent']
     },
     {
       name: 'scoop',
-      checkCmd: 'where scoop',
-      installCmd: 'scoop install jq'
+      checkCommand: 'where',
+      checkArgs: ['scoop'],
+      installCommand: 'scoop',
+      installArgs: ['install', 'jq']
     },
     {
       name: 'choco',
-      checkCmd: 'where choco',
-      installCmd: 'choco install jq -y'
+      checkCommand: 'where',
+      checkArgs: ['choco'],
+      installCommand: 'choco',
+      installArgs: ['install', 'jq', '-y']
     }
   ];
 
   for (const installer of installers) {
-    if (!run(installer.checkCmd, { silent: true }).ok) continue;
+    if (!runCommand(installer.checkCommand, installer.checkArgs, { silent: true }).ok) continue;
 
     api.logger.info(`[moltbank] trying jq install via ${installer.name}...`);
-    const install = run(installer.installCmd, { timeoutMs: 180000 });
+    const install = runCommand(installer.installCommand, installer.installArgs, { timeoutMs: 180000 });
     const installOutput = `${install.stdout}\n${install.stderr}`;
     const installOutputLower = installOutput.toLowerCase();
     const alreadyInstalledOrNoUpdate =
@@ -741,7 +883,7 @@ function ensureJq(api: LoggerApi) {
     }
 
     if (hasBin('jq')) {
-      const v = run('jq --version', { silent: true });
+      const v = runCommand('jq', ['--version'], { silent: true });
       api.logger.info(`[moltbank] ✓ jq installed via ${installer.name} (${v.stdout || 'unknown version'})`);
       return;
     }
@@ -821,13 +963,67 @@ function hasRequiredSkillFiles(skillDir: string): boolean {
   return SKILL_FILES.every((file) => existsSync(join(skillDir, file)));
 }
 
-function ensureSkillInstalled(
+async function installSkillBundleFiles(appBaseUrl: string, skillDir: string): Promise<RunResult> {
+  const base = appBaseUrl.endsWith('/') ? appBaseUrl.slice(0, -1) : appBaseUrl;
+  const aliases: Record<string, string[]> = {
+    'SKILL.md': ['SKILL.md', 'skill.md'],
+    'skill.md': ['skill.md', 'SKILL.md']
+  };
+
+  try {
+    for (const file of SKILL_FILES) {
+      const outPath = join(skillDir, file);
+      mkdirSync(dirname(outPath), { recursive: true });
+
+      let body: string | null = null;
+      let lastUrl = '';
+      let lastStatus = '';
+      for (const candidate of aliases[file] ?? [file]) {
+        const url = `${base}/${candidate}`;
+        lastUrl = url;
+
+        const response = await fetch(url);
+        if (response.ok) {
+          body = await response.text();
+          break;
+        }
+
+        lastStatus = String(response.status);
+      }
+
+      if (body === null) {
+        return {
+          ok: false,
+          stdout: '',
+          stderr: `download failed ${lastUrl} ${lastStatus}`.trim(),
+          exitCode: 2,
+          timedOut: false
+        };
+      }
+
+      writeFileSync(outPath, body, 'utf8');
+    }
+
+    writeFileSync(join(skillDir, '.install_success'), 'ok\n', 'utf8');
+    return { ok: true, stdout: '', stderr: '', exitCode: 0, timedOut: false };
+  } catch (e) {
+    return {
+      ok: false,
+      stdout: '',
+      stderr: String(e),
+      exitCode: null,
+      timedOut: false
+    };
+  }
+}
+
+async function ensureSkillInstalled(
   skillDir: string,
   appBaseUrl: string,
   skillName: string,
   api: LoggerApi,
   mode: 'sandbox' | 'host' = 'sandbox'
-) {
+): Promise<boolean> {
   const successFlag = join(skillDir, '.install_success');
   if (existsSync(successFlag) && hasRequiredSkillFiles(skillDir)) {
     ensureWrapperExecutable(skillDir, api);
@@ -847,11 +1043,7 @@ function ensureSkillInstalled(
   api.logger.info(`[moltbank] installing skill '${skillName}' to ${skillDir} (mode: ${mode})`);
   mkdirSync(skillDir, { recursive: true });
 
-  const filesJson = JSON.stringify(SKILL_FILES).replace(/"/g, '\\"');
-  const installNode = run(
-    `node --input-type=module -e "import fs from 'fs'; import path from 'path'; const baseRaw=process.argv[1]; const dir=process.argv[2]; const files=JSON.parse(process.argv[3]); const base=baseRaw.endsWith('/') ? baseRaw.slice(0,-1) : baseRaw; const aliases={ 'SKILL.md':['SKILL.md','skill.md'], 'skill.md':['skill.md','SKILL.md'] }; fs.mkdirSync(dir,{recursive:true}); for (const f of files){ const out=path.join(dir,f); fs.mkdirSync(path.dirname(out),{recursive:true}); let body=null; let lastUrl=''; let lastStatus=''; for (const candidate of (aliases[f] ?? [f])){ const u=base+'/'+candidate; lastUrl=u; const r=await fetch(u); if(r.ok){ body=await r.text(); break; } lastStatus=String(r.status); } if(body===null){ console.error('download failed',lastUrl,lastStatus); process.exit(2);} fs.writeFileSync(out, body,'utf8'); } fs.writeFileSync(path.join(dir,'.install_success'),'ok\\n','utf8');" "${appBaseUrl}" "${skillDir}" "${filesJson}"`,
-    { cwd: dirname(skillDir), silent: true }
-  );
+  const installNode = await installSkillBundleFiles(appBaseUrl, skillDir);
 
   if (installNode.ok) {
     ensureWrapperExecutable(skillDir, api);
@@ -906,34 +1098,42 @@ function ensureSkillPermissions(skillDir: string, api: LoggerApi) {
   const referencesDir = join(skillDir, 'references');
   const scriptsDir = join(skillDir, 'scripts');
 
-  const user = run('whoami', { silent: true }).stdout;
-  if (user && existsSync(skillDir)) {
-    run(`chown -R ${user} "${skillDir}"`, { silent: true });
-    api.logger.info(`[moltbank] ✓ ownership corrected to ${user}`);
+  let currentUserName = '';
+  try {
+    const currentUser = userInfo();
+    currentUserName = currentUser.username;
+    if (existsSync(skillDir)) {
+      applyRecursiveOwnership(skillDir, currentUser.uid, currentUser.gid);
+      api.logger.info(`[moltbank] ✓ ownership corrected to ${currentUserName}`);
+    }
+  } catch {
+    // ignore ownership correction when uid/gid are unavailable
   }
 
   if (existsSync(assetsDir)) {
-    run(`chmod 777 "${assetsDir}"`, { silent: true });
+    applyRecursiveMode(assetsDir, 0o777);
     api.logger.info('[moltbank] ✓ assets/ permissions → 777');
   }
   if (existsSync(configFile)) {
-    run(`chmod 666 "${configFile}"`, { silent: true });
+    try {
+      chmodSync(configFile, 0o666);
+    } catch {
+      // ignore
+    }
     api.logger.info('[moltbank] ✓ mcporter.json permissions → 666');
   }
   if (existsSync(scriptsDir)) {
-    run(`chmod -R 755 "${scriptsDir}"`, { silent: true });
+    applyRecursiveMode(scriptsDir, 0o755);
     api.logger.info('[moltbank] ✓ scripts/ permissions → 755');
-    run(`find "${scriptsDir}" -type f -exec sed -i 's/\r$//' {} +`, {
-      silent: true
-    });
+    normalizeFilesMatching(scriptsDir, () => true);
     api.logger.info('[moltbank] ✓ scripts/ line endings normalized (CRLF → LF)');
   }
 
   if (existsSync(skillDir)) {
-    run(`find "${skillDir}" -maxdepth 1 -type f -name "*.md" -exec sed -i 's/\r$//' {} +`, { silent: true });
+    normalizeFilesMatching(skillDir, (fullPath, entry) => entry.isFile() && fullPath.endsWith('.md'), 0);
   }
   if (existsSync(referencesDir)) {
-    run(`find "${referencesDir}" -maxdepth 1 -type f -name "*.md" -exec sed -i 's/\r$//' {} +`, { silent: true });
+    normalizeFilesMatching(referencesDir, (fullPath, entry) => entry.isFile() && fullPath.endsWith('.md'), 0);
   }
   if (existsSync(skillDir) || existsSync(referencesDir)) {
     api.logger.info('[moltbank] ✓ markdown line endings normalized (CRLF → LF)');
@@ -961,7 +1161,7 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
   }
   api.logger.info('[moltbank] installing npm deps...');
   if (mode === 'sandbox') {
-    const result = run('npm install --ignore-scripts', { cwd: skillDir });
+    const result = runCommand('npm', ['install', '--ignore-scripts'], { cwd: skillDir });
     if (result.ok) {
       api.logger.info('[moltbank] ✓ npm deps installed');
     } else {
@@ -972,20 +1172,20 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
 
   const hasLock = existsSync(join(skillDir, 'package-lock.json')) || existsSync(join(skillDir, 'npm-shrinkwrap.json'));
   if (hasLock) {
-    const ci = run('npm ci', { cwd: skillDir });
+    const ci = runCommand('npm', ['ci'], { cwd: skillDir });
     if (ci.ok) {
       api.logger.info('[moltbank] ✓ npm deps installed with npm ci');
       return;
     }
     api.logger.warn('[moltbank] npm ci failed; trying npm install: ' + ci.stderr);
   }
-  const install = run('npm install', { cwd: skillDir });
+  const install = runCommand('npm', ['install'], { cwd: skillDir });
   if (install.ok) {
     api.logger.info('[moltbank] ✓ npm deps installed with npm install');
     return;
   }
   api.logger.warn('[moltbank] npm install failed; trying safe fallback --ignore-scripts');
-  const fallback = run('npm install --ignore-scripts', { cwd: skillDir });
+  const fallback = runCommand('npm', ['install', '--ignore-scripts'], { cwd: skillDir });
   if (fallback.ok) {
     api.logger.warn('[moltbank] npm deps installed with fallback --ignore-scripts (some packages may require postinstall)');
   } else {
@@ -994,7 +1194,7 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
 }
 
 function isMoltBankRegistered(): boolean {
-  const result = run('mcporter config list', { silent: true });
+  const result = runCommand('mcporter', ['config', 'list'], { silent: true });
   return result.stdout.toLowerCase().includes('moltbank');
 }
 
@@ -1266,7 +1466,7 @@ function ensureMoltbankAuth(skillDir: string, appBaseUrl: string, api: LoggerApi
   if (!deviceCode || !userCode) {
     api.logger.info('[moltbank] no valid credentials found — starting onboarding flow...');
 
-    const requestCode = run(`"${process.execPath}" "./scripts/request-oauth-device-code.mjs"`, {
+    const requestCode = runCommand(process.execPath, ['./scripts/request-oauth-device-code.mjs'], {
       cwd: skillDir,
       silent: true,
       env: {
@@ -1341,8 +1541,9 @@ function ensureMoltbankAuth(skillDir: string, appBaseUrl: string, api: LoggerApi
   const pollIntervalSeconds = Number(process.env.MOLTBANK_OAUTH_POLL_INTERVAL_SECONDS ?? 5);
   const safePollIntervalSeconds = Number.isFinite(pollIntervalSeconds) && pollIntervalSeconds > 0 ? Math.floor(pollIntervalSeconds) : 5;
 
-  const poll = run(
-    `"${process.execPath}" "./scripts/poll-oauth-token.mjs" "${deviceCode}" ${safePollTimeoutSeconds} ${safePollIntervalSeconds} --save`,
+  const poll = runCommand(
+    process.execPath,
+    ['./scripts/poll-oauth-token.mjs', deviceCode, String(safePollTimeoutSeconds), String(safePollIntervalSeconds), '--save'],
     {
       cwd: skillDir,
       silent: true,
@@ -1506,7 +1707,7 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
 
     if (!privateKey) {
       api.logger.info('[moltbank] x402_signer_private_key not found — generating EOA signer...');
-      const initResult = run(`"${process.execPath}" "./scripts/init-openclaw-signer.mjs"`, {
+      const initResult = runCommand(process.execPath, ['./scripts/init-openclaw-signer.mjs'], {
         cwd: skillDir,
         silent: true,
         env: {
@@ -1629,39 +1830,52 @@ export function configureSandbox(api: LoggerApi): boolean {
 export function recreateSandboxAndRestart(api: LoggerApi) {
   api.logger.info('[moltbank] recreating sandbox containers...');
   api.logger.info('[moltbank] ⏳ waiting 8s before recreate (hot container protection)...');
+
+  const getGatewayPids = (): string[] => {
+    const result = runCommand('pgrep', ['-f', 'openclaw-gateway'], { silent: true });
+    if (!result.ok) return [];
+    return splitNonEmptyLines(result.stdout).filter((pid) => /^\d+$/.test(pid));
+  };
+
   setTimeout(() => {
     api.logger.info('[moltbank] stopping gateway...');
-    run('openclaw gateway stop', { silent: true });
-
-    const stillRunning = run("ps aux | grep openclaw-gateway | grep -v grep | awk '{print $2}'", { silent: true });
-    if (stillRunning.stdout.trim()) {
-      api.logger.info(`[moltbank] gateway still running (pids: ${stillRunning.stdout.trim()}) — sending SIGKILL...`);
-      run("kill -9 $(ps aux | grep openclaw-gateway | grep -v grep | awk '{print $2}') 2>/dev/null || true", { silent: true });
+    runCommand('openclaw', ['gateway', 'stop'], { silent: true });
+
+    const stillRunning = getGatewayPids();
+    if (stillRunning.length) {
+      api.logger.info(`[moltbank] gateway still running (pids: ${stillRunning.join(' ')}) — sending SIGKILL...`);
+      for (const pid of stillRunning) {
+        try {
+          process.kill(Number(pid), 'SIGKILL');
+        } catch {
+          // ignore
+        }
+      }
       api.logger.info('[moltbank] ✓ gateway process killed');
     } else {
       api.logger.info('[moltbank] ✓ gateway stopped cleanly');
     }
 
-    run('sleep 2', { silent: true });
-
-    const recreate = run('openclaw sandbox recreate --all --force', {
-      silent: false
-    });
-    if (recreate.ok) {
-      api.logger.info('[moltbank] ✓ sandbox containers recreated — new container will be created on next agent message');
-    } else {
-      api.logger.warn('[moltbank] ✗ sandbox recreate failed');
-      api.logger.warn('[moltbank]   run manually: openclaw sandbox recreate --all --force');
-    }
+    setTimeout(() => {
+      const recreate = runCommand('openclaw', ['sandbox', 'recreate', '--all', '--force'], {
+        silent: false
+      });
+      if (recreate.ok) {
+        api.logger.info('[moltbank] ✓ sandbox containers recreated — new container will be created on next agent message');
+      } else {
+        api.logger.warn('[moltbank] ✗ sandbox recreate failed');
+        api.logger.warn('[moltbank]   run manually: openclaw sandbox recreate --all --force');
+      }
 
-    api.logger.info('[moltbank] restarting gateway...');
-    run('openclaw gateway', { silent: true });
+      api.logger.info('[moltbank] restarting gateway...');
+      runCommand('openclaw', ['gateway'], { silent: true });
+    }, 2000);
   }, 8000);
 }
 
 function restartGatewayAfterHostSetup(api: LoggerApi): boolean {
   api.logger.info('[moltbank] restarting gateway to refresh host skill state...');
-  const restart = run('openclaw gateway restart', { silent: true, timeoutMs: 30000 });
+  const restart = runCommand('openclaw', ['gateway', 'restart'], { silent: true, timeoutMs: 30000 });
   if (restart.ok) {
     api.logger.info('[moltbank] ✓ gateway restarted');
     return true;
@@ -1709,7 +1923,7 @@ export async function runSetup(
     ensureJq(api);
 
     api.logger.info('[moltbank] [sandbox 1/10] installing skill files...');
-    const skillInstalled = ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'sandbox');
+    const skillInstalled = await ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'sandbox');
     if (!skillInstalled) {
       api.logger.warn('[moltbank] skill install failed — aborting sandbox setup');
       return;
@@ -1767,7 +1981,7 @@ export async function runSetup(
     ensureJq(api);
 
     api.logger.info('[moltbank] [host 2/8] installing skill files...');
-    const installed = ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'host');
+    const installed = await ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'host');
     if (!installed) {
       api.logger.warn('[moltbank] host setup aborted: skill install failed. Verify install.sh/base URL and retry.');
       return;
@@ -1811,7 +2025,7 @@ export async function runSetup(
     if (IS_WIN) {
       const mcporterConfigPath = join(skillDir, 'assets', 'mcporter.json');
       const active = parseActiveTokenFromCredentials();
-      const mcpSmoke = run(`mcporter --config "${mcporterConfigPath}" list MoltBank`, {
+      const mcpSmoke = runCommand('mcporter', ['--config', mcporterConfigPath, 'list', 'MoltBank'], {
         cwd: skillDir,
         silent: true,
         timeoutMs: smokeTimeoutMs,
@@ -1838,8 +2052,16 @@ export async function runSetup(
           );
 
           const ps1Path = join(skillDir, 'scripts', 'moltbank.ps1');
-          const fallback = run(
-            'powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \'Stop\'; if (-not (Test-Path -LiteralPath $env:MOLTBANK_WRAPPER_PATH)) { throw \'moltbank.ps1 not found\' }; if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { throw \'bash is not installed or not on PATH\' }; if (-not (Get-Command mcporter -ErrorAction SilentlyContinue)) { throw \'mcporter is not installed or not on PATH\' }; Write-Output \'ok\'"',
+          const fallback = runCommand(
+            'powershell',
+            [
+              '-NoProfile',
+              '-NonInteractive',
+              '-ExecutionPolicy',
+              'Bypass',
+              '-Command',
+              "$ErrorActionPreference = 'Stop'; if (-not (Test-Path -LiteralPath $env:MOLTBANK_WRAPPER_PATH)) { throw 'moltbank.ps1 not found' }; if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { throw 'bash is not installed or not on PATH' }; if (-not (Get-Command mcporter -ErrorAction SilentlyContinue)) { throw 'mcporter is not installed or not on PATH' }; Write-Output 'ok'"
+            ],
             {
               cwd: skillDir,
               silent: true,
@@ -1869,7 +2091,7 @@ export async function runSetup(
         }
       }
     } else {
-      const smoke = run(`"${skillDir}/scripts/moltbank.sh" list MoltBank`, {
+      const smoke = runCommand(join(skillDir, 'scripts', 'moltbank.sh'), ['list', 'MoltBank'], {
         cwd: skillDir,
         silent: true,
         timeoutMs: smokeTimeoutMs
@@ -1925,10 +2147,11 @@ export async function runSetup(
       `[moltbank]     setupCommand:         ${finalCmd.includes('node_22.x') && !finalCmd.includes('/home/') ? '✓ ok (no host paths)' : '✗ may be corrupted'}`
     );
 
-    const containerCheck = run(
-      `docker inspect $(docker ps | grep openclaw-sbx | awk '{print $1}') --format '{{.HostConfig.NetworkMode}}' 2>/dev/null`,
-      { silent: true }
-    );
+    const sandboxContainer = runCommand('docker', ['ps', '-q', '--filter', 'name=openclaw-sbx'], { silent: true });
+    const sandboxContainerId = splitNonEmptyLines(sandboxContainer.stdout)[0] || '';
+    const containerCheck = sandboxContainerId
+      ? runCommand('docker', ['inspect', sandboxContainerId, '--format', '{{.HostConfig.NetworkMode}}'], { silent: true })
+      : { ok: false, stdout: '', stderr: '', exitCode: 1, timedOut: false };
     if (!containerCheck.ok || !containerCheck.stdout) {
       api.logger.info(`[moltbank]   container: not running yet — will be created on first agent message`);
     } else if (containerCheck.stdout.trim() === 'bridge') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moltbankhq/openclaw",
-    "version": "0.1.10",
+    "version": "0.1.11",
     "description": "MoltBank stablecoin treasury CLI and OpenClaw plugin",
     "main": "index.ts",
     "bin": {