@moltbankhq/openclaw 0.1.10 → 0.1.12

package/index.ts

@@ -1,7 +1,7 @@
-import { execSync, spawn } from 'child_process';
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
+import { spawn, spawnSync } from 'child_process';
+import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, type Dirent } from 'fs';
 import { join, dirname } from 'path';
-import { homedir } from 'os';
+import { homedir, userInfo } from 'os';
 const IS_WIN = process.platform === 'win32';
 
 type OpenclawConfig = Record<string, unknown>;
@@ -32,6 +32,21 @@ interface LoggerApi {
   logger: LoggerLike;
 }
 
+type RunOptions = {
+  cwd?: string;
+  silent?: boolean;
+  env?: Record<string, string | undefined>;
+  timeoutMs?: number;
+};
+
+type RunResult = {
+  ok: boolean;
+  stdout: string;
+  stderr: string;
+  exitCode: number | null;
+  timedOut: boolean;
+};
+
 export interface SetupCommandLoggerOptions {
   verbose?: boolean;
   statusCommand?: string;
@@ -350,31 +365,191 @@ function getExecErrorMessage(error: unknown): string {
   return String(error);
 }
 
-function run(
-  cmd: string,
-  opts: { cwd?: string; silent?: boolean; env?: Record<string, string | undefined>; timeoutMs?: number } = {}
-) {
+function getPathEnvKey(env: NodeJS.ProcessEnv): string {
+  const existing = Object.keys(env).find((key) => key.toLowerCase() === 'path');
+  return existing ?? 'Path';
+}
+
+function splitPathEntries(value: string): string[] {
+  return value
+    .split(IS_WIN ? ';' : ':')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function prependPathEntries(env: NodeJS.ProcessEnv, entries: string[]): void {
+  if (entries.length === 0) return;
+
+  const pathKey = getPathEnvKey(env);
+  const existing = splitPathEntries(asString(env[pathKey]));
+  const seen = new Set<string>();
+  const ordered: string[] = [];
+
+  for (const entry of [...entries, ...existing]) {
+    const normalized = IS_WIN ? entry.toLowerCase() : entry;
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    ordered.push(entry);
+  }
+
+  env[pathKey] = ordered.join(IS_WIN ? ';' : ':');
+}
+
+function isExplicitCommandPath(command: string): boolean {
+  return command.includes('/') || command.includes('\\') || /^[A-Za-z]:/.test(command);
+}
+
+function getWindowsCommandExtensions(env: NodeJS.ProcessEnv): string[] {
+  const fromEnv = asString(env.PATHEXT || process.env.PATHEXT)
+    .split(';')
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean);
+
+  const preferred = ['.exe', '.com', '.ps1', '.cmd', '.bat'];
+  const out: string[] = [];
+  for (const ext of [...preferred, ...fromEnv]) {
+    const normalized = ext.startsWith('.') ? ext : `.${ext}`;
+    if (!out.includes(normalized)) {
+      out.push(normalized);
+    }
+  }
+  return out;
+}
+
+function resolveWindowsCommandPath(command: string, env: NodeJS.ProcessEnv): string {
+  const extensions = getWindowsCommandExtensions(env);
+
+  const tryCandidates = (basePath: string): string => {
+    if (existsSync(basePath)) return basePath;
+
+    const lower = basePath.toLowerCase();
+    for (const ext of extensions) {
+      if (lower.endsWith(ext)) continue;
+      const candidate = `${basePath}${ext}`;
+      if (existsSync(candidate)) {
+        return candidate;
+      }
+    }
+
+    return '';
+  };
+
+  if (isExplicitCommandPath(command)) {
+    return tryCandidates(command);
+  }
+
+  const pathValue = asString(env[getPathEnvKey(env)]);
+  for (const entry of splitPathEntries(pathValue)) {
+    const resolved = tryCandidates(join(entry, command));
+    if (resolved) {
+      return resolved;
+    }
+  }
+
+  return '';
+}
+
+function quoteCmdArgument(value: string): string {
+  if (!value) return '""';
+
+  const escaped = value
+    .replace(/([()%!^"<>&|])/g, '^$1')
+    .replace(/\r/g, ' ')
+    .replace(/\n/g, ' ');
+
+  return /[\s()%!^"<>&|]/.test(value) ? `"${escaped}"` : escaped;
+}
+
+function prepareCommandForSpawn(command: string, args: string[], env: NodeJS.ProcessEnv): { command: string; args: string[] } {
+  if (!IS_WIN) {
+    return { command, args };
+  }
+
+  const resolved = resolveWindowsCommandPath(command, env);
+  if (!resolved) {
+    return { command, args };
+  }
+
+  const lower = resolved.toLowerCase();
+  if (lower.endsWith('.ps1')) {
+    return {
+      command: 'powershell.exe',
+      args: ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', resolved, ...args]
+    };
+  }
+
+  if (lower.endsWith('.cmd') || lower.endsWith('.bat')) {
+    const cmdExe = asString(env.ComSpec || env.COMSPEC, 'cmd.exe');
+    const commandLine = [resolved, ...args].map((value) => quoteCmdArgument(value)).join(' ');
+    return {
+      command: cmdExe,
+      args: ['/d', '/s', '/c', commandLine]
+    };
+  }
+
+  return { command: resolved, args };
+}
+
+function runCommand(command: string, args: string[], opts: RunOptions = {}): RunResult {
   try {
     const mergedEnv: NodeJS.ProcessEnv = { ...process.env, ...(opts.env ?? {}) };
-    const out = execSync(cmd, {
+    const prepared = prepareCommandForSpawn(command, args, mergedEnv);
+    const result = spawnSync(prepared.command, prepared.args, {
       cwd: opts.cwd,
-      stdio: opts.silent ? 'pipe' : 'inherit',
       env: mergedEnv,
+      encoding: 'utf8',
       timeout: opts.timeoutMs,
-      shell: IS_WIN ? (process.env.ComSpec ?? 'cmd.exe') : '/bin/bash'
+      stdio: 'pipe',
+      windowsHide: true
     });
-    return { ok: true, stdout: out?.toString().trim() ?? '' };
+
+    const stdout = (result.stdout ?? '').toString();
+    const stderr = (result.stderr ?? '').toString();
+
+    if (!opts.silent) {
+      if (stdout) process.stdout.write(stdout);
+      if (stderr) process.stderr.write(stderr);
+    }
+
+    const errorMessage = result.error ? getExecErrorMessage(result.error) : '';
+    const trimmedStdout = stdout.trim();
+    const trimmedStderr = stderr.trim();
+    const timedOut = Boolean(
+      result.error &&
+        ((isRecord(result.error) && asString((result.error as { code?: unknown }).code) === 'ETIMEDOUT') ||
+          errorMessage.toLowerCase().includes('timed out'))
+    );
+
+    if (result.status === 0) {
+      return {
+        ok: true,
+        stdout: trimmedStdout,
+        stderr: trimmedStderr,
+        exitCode: result.status,
+        timedOut: false
+      };
+    }
+
+    return {
+      ok: false,
+      stdout: trimmedStdout,
+      stderr: trimmedStderr || errorMessage || trimmedStdout,
+      exitCode: typeof result.status === 'number' ? result.status : null,
+      timedOut
+    };
   } catch (e: unknown) {
     return {
       ok: false,
       stdout: getExecOutputText(e, 'stdout'),
-      stderr: getExecErrorMessage(e)
+      stderr: getExecErrorMessage(e),
+      exitCode: null,
+      timedOut: getExecErrorMessage(e).toLowerCase().includes('timed out')
     };
   }
 }
 
 function hasBin(bin: string) {
-  return run(IS_WIN ? `where ${bin}` : `which ${bin}`, { silent: true }).ok;
+  return runCommand(IS_WIN ? 'where' : 'which', [bin], { silent: true }).ok;
 }
 
 function getJqInstallHint(): string {
@@ -396,7 +571,7 @@ function splitNonEmptyLines(text: string): string[] {
 }
 
 function getNpmGlobalBinDir(): string {
-  const prefix = run('npm config get prefix', { silent: true });
+  const prefix = runCommand('npm', ['config', 'get', 'prefix'], { silent: true });
   if (!prefix.ok) return '';
 
   const value = prefix.stdout.trim();
@@ -412,7 +587,7 @@ function findFirstMatchingFile(rootDir: string, predicate: (name: string) => boo
     const current = queue.shift();
     if (!current) break;
 
-    let entries: ReturnType<typeof readdirSync>;
+    let entries: Dirent[] = [];
     try {
       entries = readdirSync(current.dir, { withFileTypes: true });
     } catch {
@@ -433,13 +608,210 @@ function findFirstMatchingFile(rootDir: string, predicate: (name: string) => boo
   return '';
 }
 
+function visitFiles(rootDir: string, visitor: (fullPath: string, entry: Dirent) => void, maxDepth = Number.POSITIVE_INFINITY): void {
+  if (!rootDir || !existsSync(rootDir)) return;
+
+  const queue: Array<{ dir: string; depth: number }> = [{ dir: rootDir, depth: 0 }];
+  while (queue.length) {
+    const current = queue.shift();
+    if (!current) break;
+
+    let entries: Dirent[] = [];
+    try {
+      entries = readdirSync(current.dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+
+    for (const entry of entries) {
+      const fullPath = join(current.dir, entry.name);
+      visitor(fullPath, entry);
+      if (entry.isDirectory() && current.depth < maxDepth) {
+        queue.push({ dir: fullPath, depth: current.depth + 1 });
+      }
+    }
+  }
+}
+
+function normalizeFileLineEndings(filePath: string): void {
+  try {
+    const original = readFileSync(filePath, 'utf8');
+    const normalized = original.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    if (normalized !== original) {
+      writeFileSync(filePath, normalized, 'utf8');
+    }
+  } catch {
+    // ignore
+  }
+}
+
+function normalizeFilesMatching(rootDir: string, matcher: (fullPath: string, entry: Dirent) => boolean, maxDepth = Number.POSITIVE_INFINITY): void {
+  visitFiles(
+    rootDir,
+    (fullPath, entry) => {
+      if (entry.isFile() && matcher(fullPath, entry)) {
+        normalizeFileLineEndings(fullPath);
+      }
+    },
+    maxDepth
+  );
+}
+
+function applyRecursiveOwnership(rootDir: string, uid: number, gid: number): void {
+  try {
+    chownSync(rootDir, uid, gid);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath) => {
+    try {
+      chownSync(fullPath, uid, gid);
+    } catch {
+      // ignore
+    }
+  });
+}
+
+function applyRecursiveMode(rootDir: string, mode: number): void {
+  try {
+    chmodSync(rootDir, mode);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath) => {
+    try {
+      chmodSync(fullPath, mode);
+    } catch {
+      // ignore
+    }
+  });
+}
+
+function applyRecursiveModes(rootDir: string, dirMode: number, fileMode: number): void {
+  try {
+    chmodSync(rootDir, dirMode);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath, entry) => {
+    try {
+      chmodSync(fullPath, entry.isDirectory() ? dirMode : fileMode);
+    } catch {
+      // ignore
+    }
+  });
+}
+
+type CommandSpec = {
+  command: string;
+  args: string[];
+  env?: Record<string, string | undefined>;
+};
+
+function withOptionalSudo(command: string, args: string[], env?: Record<string, string | undefined>): CommandSpec {
+  const isRoot = typeof process.getuid === 'function' ? process.getuid() === 0 : false;
+  if (isRoot || !hasBin('sudo')) {
+    return { command, args, env };
+  }
+  return { command: 'sudo', args: [command, ...args], env };
+}
+
+function getUnixJqInstallPlan(): { name: string; steps: CommandSpec[] } | null {
+  if (hasBin('apt-get')) {
+    return {
+      name: 'apt-get',
+      steps: [
+        withOptionalSudo('apt-get', ['update', '-qq'], { DEBIAN_FRONTEND: 'noninteractive' }),
+        withOptionalSudo('apt-get', ['install', '-y', 'jq'], { DEBIAN_FRONTEND: 'noninteractive' })
+      ]
+    };
+  }
+
+  if (hasBin('dnf')) {
+    return {
+      name: 'dnf',
+      steps: [withOptionalSudo('dnf', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('yum')) {
+    return {
+      name: 'yum',
+      steps: [withOptionalSudo('yum', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('pacman')) {
+    return {
+      name: 'pacman',
+      steps: [withOptionalSudo('pacman', ['-Sy', '--noconfirm', 'jq'])]
+    };
+  }
+
+  if (hasBin('apk')) {
+    return {
+      name: 'apk',
+      steps: [withOptionalSudo('apk', ['add', 'jq'])]
+    };
+  }
+
+  if (hasBin('zypper')) {
+    return {
+      name: 'zypper',
+      steps: [withOptionalSudo('zypper', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('brew')) {
+    return {
+      name: 'brew',
+      steps: [{ command: 'brew', args: ['install', 'jq'] }]
+    };
+  }
+
+  return null;
+}
+
+function ensureUnixJq(api: LoggerApi): boolean {
+  const plan = getUnixJqInstallPlan();
+  if (!plan) {
+    return false;
+  }
+
+  api.logger.info(`[moltbank] jq not found — attempting install via ${plan.name}...`);
+
+  for (const step of plan.steps) {
+    const result = runCommand(step.command, step.args, {
+      env: step.env,
+      timeoutMs: 180000
+    });
+
+    if (!result.ok) {
+      api.logger.warn(`[moltbank] jq install via ${plan.name} failed: ${result.stderr}`);
+      return false;
+    }
+  }
+
+  if (!hasBin('jq')) {
+    api.logger.warn(`[moltbank] jq install via ${plan.name} finished, but jq is still not visible in PATH`);
+    return false;
+  }
+
+  const version = runCommand('jq', ['--version'], { silent: true });
+  api.logger.info(`[moltbank] ✓ jq installed via ${plan.name} (${version.stdout || 'unknown version'})`);
+  return true;
+}
+
 function findWindowsJqBinaryPath(): string {
   if (!IS_WIN) return '';
 
   const fromEnv = asString(process.env.JQ_PATH).trim();
   if (fromEnv && existsSync(fromEnv)) return fromEnv;
 
-  const whereJq = run('where jq', { silent: true });
+  const whereJq = runCommand('where', ['jq'], { silent: true });
   if (whereJq.ok) {
     for (const line of splitNonEmptyLines(whereJq.stdout)) {
       if (existsSync(line)) {
@@ -482,7 +854,7 @@ function findWindowsJqBinaryPath(): string {
 
   const wingetPackagesRoot = localAppData ? join(localAppData, 'Microsoft', 'WinGet', 'Packages') : '';
   if (wingetPackagesRoot && existsSync(wingetPackagesRoot)) {
-    let packageEntries: ReturnType<typeof readdirSync> = [];
+    let packageEntries: Dirent<string>[] = [];
     try {
       packageEntries = readdirSync(wingetPackagesRoot, { withFileTypes: true });
     } catch {
@@ -522,6 +894,7 @@ function ensureWindowsJqShim(api: LoggerApi): boolean {
       const shimBody = `@echo off\r\n"${escapedSource}" %*\r\n`;
       writeFileSync(shimPath, shimBody, 'utf8');
     }
+    prependPathEntries(process.env, [npmBinDir]);
   } catch (e) {
     api.logger.warn('[moltbank] could not create jq shim in npm global bin: ' + String(e));
     return false;
@@ -529,7 +902,7 @@ function ensureWindowsJqShim(api: LoggerApi): boolean {
 
   if (!hasBin('jq')) return false;
 
-  const v = run('jq --version', { silent: true });
+  const v = runCommand('jq', ['--version'], { silent: true });
   api.logger.info(`[moltbank] ✓ jq available via npm global bin shim (${v.stdout || 'unknown version'})`);
   return true;
 }
@@ -665,12 +1038,12 @@ function cleanupStaleMoltbankPluginLoadPaths(api: LoggerApi): boolean {
 
 function ensureMcporter(api: LoggerApi) {
   if (hasBin('mcporter')) {
-    const v = run('mcporter --version', { silent: true });
+    const v = runCommand('mcporter', ['--version'], { silent: true });
     api.logger.info(`[moltbank] ✓ mcporter already installed (${v.stdout || 'unknown version'})`);
     return;
   }
   api.logger.info('[moltbank] installing mcporter globally...');
-  const result = run('npm install -g mcporter');
+  const result = runCommand('npm', ['install', '-g', 'mcporter']);
   if (result.ok) {
     api.logger.info('[moltbank] ✓ mcporter installed');
   } else {
@@ -680,12 +1053,16 @@ function ensureMcporter(api: LoggerApi) {
 
 function ensureJq(api: LoggerApi) {
   if (hasBin('jq')) {
-    const v = run('jq --version', { silent: true });
+    const v = runCommand('jq', ['--version'], { silent: true });
     api.logger.info(`[moltbank] ✓ jq already installed (${v.stdout || 'unknown version'})`);
     return;
   }
 
   if (!IS_WIN) {
+    if (ensureUnixJq(api)) {
+      return;
+    }
+
     api.logger.warn('[moltbank] ✗ jq not found in PATH (required by MoltBank wrapper on host mode)');
     api.logger.warn(`[moltbank]   install jq (${getJqInstallHint()}) and rerun setup`);
     return;
@@ -698,29 +1075,41 @@ function ensureJq(api: LoggerApi) {
 
   api.logger.info('[moltbank] jq not found — attempting Windows install...');
 
-  const installers: Array<{ name: string; checkCmd: string; installCmd: string }> = [
+  const installers: Array<{
+    name: string;
+    checkCommand: string;
+    checkArgs: string[];
+    installCommand: string;
+    installArgs: string[];
+  }> = [
     {
       name: 'winget',
-      checkCmd: 'where winget',
-      installCmd: 'winget install -e --id jqlang.jq --accept-package-agreements --accept-source-agreements --silent'
+      checkCommand: 'where',
+      checkArgs: ['winget'],
+      installCommand: 'winget',
+      installArgs: ['install', '-e', '--id', 'jqlang.jq', '--accept-package-agreements', '--accept-source-agreements', '--silent']
     },
     {
       name: 'scoop',
-      checkCmd: 'where scoop',
-      installCmd: 'scoop install jq'
+      checkCommand: 'where',
+      checkArgs: ['scoop'],
+      installCommand: 'scoop',
+      installArgs: ['install', 'jq']
     },
     {
       name: 'choco',
-      checkCmd: 'where choco',
-      installCmd: 'choco install jq -y'
+      checkCommand: 'where',
+      checkArgs: ['choco'],
+      installCommand: 'choco',
+      installArgs: ['install', 'jq', '-y']
     }
   ];
 
   for (const installer of installers) {
-    if (!run(installer.checkCmd, { silent: true }).ok) continue;
+    if (!runCommand(installer.checkCommand, installer.checkArgs, { silent: true }).ok) continue;
 
     api.logger.info(`[moltbank] trying jq install via ${installer.name}...`);
-    const install = run(installer.installCmd, { timeoutMs: 180000 });
+    const install = runCommand(installer.installCommand, installer.installArgs, { timeoutMs: 180000 });
     const installOutput = `${install.stdout}\n${install.stderr}`;
     const installOutputLower = installOutput.toLowerCase();
     const alreadyInstalledOrNoUpdate =
@@ -741,7 +1130,7 @@ function ensureJq(api: LoggerApi) {
     }
 
     if (hasBin('jq')) {
-      const v = run('jq --version', { silent: true });
+      const v = runCommand('jq', ['--version'], { silent: true });
       api.logger.info(`[moltbank] ✓ jq installed via ${installer.name} (${v.stdout || 'unknown version'})`);
       return;
     }
@@ -821,13 +1210,67 @@ function hasRequiredSkillFiles(skillDir: string): boolean {
   return SKILL_FILES.every((file) => existsSync(join(skillDir, file)));
 }
 
-function ensureSkillInstalled(
+async function installSkillBundleFiles(appBaseUrl: string, skillDir: string): Promise<RunResult> {
+  const base = appBaseUrl.endsWith('/') ? appBaseUrl.slice(0, -1) : appBaseUrl;
+  const aliases: Record<string, string[]> = {
+    'SKILL.md': ['SKILL.md', 'skill.md'],
+    'skill.md': ['skill.md', 'SKILL.md']
+  };
+
+  try {
+    for (const file of SKILL_FILES) {
+      const outPath = join(skillDir, file);
+      mkdirSync(dirname(outPath), { recursive: true });
+
+      let body: string | null = null;
+      let lastUrl = '';
+      let lastStatus = '';
+      for (const candidate of aliases[file] ?? [file]) {
+        const url = `${base}/${candidate}`;
+        lastUrl = url;
+
+        const response = await fetch(url);
+        if (response.ok) {
+          body = await response.text();
+          break;
+        }
+
+        lastStatus = String(response.status);
+      }
+
+      if (body === null) {
+        return {
+          ok: false,
+          stdout: '',
+          stderr: `download failed ${lastUrl} ${lastStatus}`.trim(),
+          exitCode: 2,
+          timedOut: false
+        };
+      }
+
+      writeFileSync(outPath, body, 'utf8');
+    }
+
+    writeFileSync(join(skillDir, '.install_success'), 'ok\n', 'utf8');
+    return { ok: true, stdout: '', stderr: '', exitCode: 0, timedOut: false };
+  } catch (e) {
+    return {
+      ok: false,
+      stdout: '',
+      stderr: String(e),
+      exitCode: null,
+      timedOut: false
+    };
+  }
+}
+
+async function ensureSkillInstalled(
   skillDir: string,
   appBaseUrl: string,
   skillName: string,
   api: LoggerApi,
   mode: 'sandbox' | 'host' = 'sandbox'
-) {
+): Promise<boolean> {
   const successFlag = join(skillDir, '.install_success');
   if (existsSync(successFlag) && hasRequiredSkillFiles(skillDir)) {
     ensureWrapperExecutable(skillDir, api);
@@ -847,11 +1290,7 @@ function ensureSkillInstalled(
   api.logger.info(`[moltbank] installing skill '${skillName}' to ${skillDir} (mode: ${mode})`);
   mkdirSync(skillDir, { recursive: true });
 
-  const filesJson = JSON.stringify(SKILL_FILES).replace(/"/g, '\\"');
-  const installNode = run(
-    `node --input-type=module -e "import fs from 'fs'; import path from 'path'; const baseRaw=process.argv[1]; const dir=process.argv[2]; const files=JSON.parse(process.argv[3]); const base=baseRaw.endsWith('/') ? baseRaw.slice(0,-1) : baseRaw; const aliases={ 'SKILL.md':['SKILL.md','skill.md'], 'skill.md':['skill.md','SKILL.md'] }; fs.mkdirSync(dir,{recursive:true}); for (const f of files){ const out=path.join(dir,f); fs.mkdirSync(path.dirname(out),{recursive:true}); let body=null; let lastUrl=''; let lastStatus=''; for (const candidate of (aliases[f] ?? [f])){ const u=base+'/'+candidate; lastUrl=u; const r=await fetch(u); if(r.ok){ body=await r.text(); break; } lastStatus=String(r.status); } if(body===null){ console.error('download failed',lastUrl,lastStatus); process.exit(2);} fs.writeFileSync(out, body,'utf8'); } fs.writeFileSync(path.join(dir,'.install_success'),'ok\\n','utf8');" "${appBaseUrl}" "${skillDir}" "${filesJson}"`,
-    { cwd: dirname(skillDir), silent: true }
-  );
+  const installNode = await installSkillBundleFiles(appBaseUrl, skillDir);
 
   if (installNode.ok) {
     ensureWrapperExecutable(skillDir, api);
@@ -906,34 +1345,42 @@ function ensureSkillPermissions(skillDir: string, api: LoggerApi) {
   const referencesDir = join(skillDir, 'references');
   const scriptsDir = join(skillDir, 'scripts');
 
-  const user = run('whoami', { silent: true }).stdout;
-  if (user && existsSync(skillDir)) {
-    run(`chown -R ${user} "${skillDir}"`, { silent: true });
-    api.logger.info(`[moltbank] ✓ ownership corrected to ${user}`);
+  let currentUserName = '';
+  try {
+    const currentUser = userInfo();
+    currentUserName = currentUser.username;
+    if (existsSync(skillDir)) {
+      applyRecursiveOwnership(skillDir, currentUser.uid, currentUser.gid);
+      api.logger.info(`[moltbank] ✓ ownership corrected to ${currentUserName}`);
+    }
+  } catch {
+    // ignore ownership correction when uid/gid are unavailable
   }
 
   if (existsSync(assetsDir)) {
-    run(`chmod 777 "${assetsDir}"`, { silent: true });
-    api.logger.info('[moltbank] ✓ assets/ permissions → 777');
+    applyRecursiveModes(assetsDir, 0o750, 0o640);
+    api.logger.info('[moltbank] ✓ assets/ permissions → 750 dirs, 640 files');
   }
   if (existsSync(configFile)) {
-    run(`chmod 666 "${configFile}"`, { silent: true });
-    api.logger.info('[moltbank] ✓ mcporter.json permissions → 666');
+    try {
+      chmodSync(configFile, 0o600);
+    } catch {
+      // ignore
+    }
+    api.logger.info('[moltbank] ✓ mcporter.json permissions → 600');
   }
   if (existsSync(scriptsDir)) {
-    run(`chmod -R 755 "${scriptsDir}"`, { silent: true });
-    api.logger.info('[moltbank] ✓ scripts/ permissions → 755');
-    run(`find "${scriptsDir}" -type f -exec sed -i 's/\r$//' {} +`, {
-      silent: true
-    });
+    applyRecursiveModes(scriptsDir, 0o750, 0o750);
+    api.logger.info('[moltbank] ✓ scripts/ permissions → 750');
+    normalizeFilesMatching(scriptsDir, () => true);
     api.logger.info('[moltbank] ✓ scripts/ line endings normalized (CRLF → LF)');
   }
 
   if (existsSync(skillDir)) {
-    run(`find "${skillDir}" -maxdepth 1 -type f -name "*.md" -exec sed -i 's/\r$//' {} +`, { silent: true });
+    normalizeFilesMatching(skillDir, (fullPath, entry) => entry.isFile() && fullPath.endsWith('.md'), 0);
   }
   if (existsSync(referencesDir)) {
-    run(`find "${referencesDir}" -maxdepth 1 -type f -name "*.md" -exec sed -i 's/\r$//' {} +`, { silent: true });
+    normalizeFilesMatching(referencesDir, (fullPath, entry) => entry.isFile() && fullPath.endsWith('.md'), 0);
   }
   if (existsSync(skillDir) || existsSync(referencesDir)) {
     api.logger.info('[moltbank] ✓ markdown line endings normalized (CRLF → LF)');
@@ -961,7 +1408,7 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
   }
   api.logger.info('[moltbank] installing npm deps...');
   if (mode === 'sandbox') {
-    const result = run('npm install --ignore-scripts', { cwd: skillDir });
+    const result = runCommand('npm', ['install', '--ignore-scripts'], { cwd: skillDir });
     if (result.ok) {
       api.logger.info('[moltbank] ✓ npm deps installed');
     } else {
@@ -972,20 +1419,20 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
 
   const hasLock = existsSync(join(skillDir, 'package-lock.json')) || existsSync(join(skillDir, 'npm-shrinkwrap.json'));
   if (hasLock) {
-    const ci = run('npm ci', { cwd: skillDir });
+    const ci = runCommand('npm', ['ci'], { cwd: skillDir });
     if (ci.ok) {
       api.logger.info('[moltbank] ✓ npm deps installed with npm ci');
       return;
     }
     api.logger.warn('[moltbank] npm ci failed; trying npm install: ' + ci.stderr);
   }
-  const install = run('npm install', { cwd: skillDir });
+  const install = runCommand('npm', ['install'], { cwd: skillDir });
   if (install.ok) {
     api.logger.info('[moltbank] ✓ npm deps installed with npm install');
     return;
   }
   api.logger.warn('[moltbank] npm install failed; trying safe fallback --ignore-scripts');
-  const fallback = run('npm install --ignore-scripts', { cwd: skillDir });
+  const fallback = runCommand('npm', ['install', '--ignore-scripts'], { cwd: skillDir });
   if (fallback.ok) {
     api.logger.warn('[moltbank] npm deps installed with fallback --ignore-scripts (some packages may require postinstall)');
   } else {
@@ -994,7 +1441,7 @@ function ensureNpmDeps(skillDir: string, api: LoggerApi, mode: 'sandbox' | 'host
 }
 
 function isMoltBankRegistered(): boolean {
-  const result = run('mcporter config list', { silent: true });
+  const result = runCommand('mcporter', ['config', 'list'], { silent: true });
   return result.stdout.toLowerCase().includes('moltbank');
 }
 
@@ -1266,7 +1713,7 @@ function ensureMoltbankAuth(skillDir: string, appBaseUrl: string, api: LoggerApi
   if (!deviceCode || !userCode) {
     api.logger.info('[moltbank] no valid credentials found — starting onboarding flow...');
 
-    const requestCode = run(`"${process.execPath}" "./scripts/request-oauth-device-code.mjs"`, {
+    const requestCode = runCommand(process.execPath, ['./scripts/request-oauth-device-code.mjs'], {
       cwd: skillDir,
       silent: true,
       env: {
@@ -1341,8 +1788,9 @@ function ensureMoltbankAuth(skillDir: string, appBaseUrl: string, api: LoggerApi
   const pollIntervalSeconds = Number(process.env.MOLTBANK_OAUTH_POLL_INTERVAL_SECONDS ?? 5);
   const safePollIntervalSeconds = Number.isFinite(pollIntervalSeconds) && pollIntervalSeconds > 0 ? Math.floor(pollIntervalSeconds) : 5;
 
-  const poll = run(
-    `"${process.execPath}" "./scripts/poll-oauth-token.mjs" "${deviceCode}" ${safePollTimeoutSeconds} ${safePollIntervalSeconds} --save`,
+  const poll = runCommand(
+    process.execPath,
+    ['./scripts/poll-oauth-token.mjs', deviceCode, String(safePollTimeoutSeconds), String(safePollIntervalSeconds), '--save'],
     {
       cwd: skillDir,
       silent: true,
@@ -1506,7 +1954,7 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
 
     if (!privateKey) {
       api.logger.info('[moltbank] x402_signer_private_key not found — generating EOA signer...');
-      const initResult = run(`"${process.execPath}" "./scripts/init-openclaw-signer.mjs"`, {
+      const initResult = runCommand(process.execPath, ['./scripts/init-openclaw-signer.mjs'], {
         cwd: skillDir,
         silent: true,
         env: {
@@ -1629,39 +2077,52 @@ export function configureSandbox(api: LoggerApi): boolean {
 export function recreateSandboxAndRestart(api: LoggerApi) {
   api.logger.info('[moltbank] recreating sandbox containers...');
   api.logger.info('[moltbank] ⏳ waiting 8s before recreate (hot container protection)...');
+
+  const getGatewayPids = (): string[] => {
+    const result = runCommand('pgrep', ['-f', 'openclaw-gateway'], { silent: true });
+    if (!result.ok) return [];
+    return splitNonEmptyLines(result.stdout).filter((pid) => /^\d+$/.test(pid));
+  };
+
   setTimeout(() => {
     api.logger.info('[moltbank] stopping gateway...');
-    run('openclaw gateway stop', { silent: true });
-
-    const stillRunning = run("ps aux | grep openclaw-gateway | grep -v grep | awk '{print $2}'", { silent: true });
-    if (stillRunning.stdout.trim()) {
-      api.logger.info(`[moltbank] gateway still running (pids: ${stillRunning.stdout.trim()}) — sending SIGKILL...`);
-      run("kill -9 $(ps aux | grep openclaw-gateway | grep -v grep | awk '{print $2}') 2>/dev/null || true", { silent: true });
+    runCommand('openclaw', ['gateway', 'stop'], { silent: true });
+
+    const stillRunning = getGatewayPids();
+    if (stillRunning.length) {
+      api.logger.info(`[moltbank] gateway still running (pids: ${stillRunning.join(' ')}) — sending SIGKILL...`);
+      for (const pid of stillRunning) {
+        try {
+          process.kill(Number(pid), 'SIGKILL');
+        } catch {
+          // ignore
+        }
+      }
       api.logger.info('[moltbank] ✓ gateway process killed');
     } else {
       api.logger.info('[moltbank] ✓ gateway stopped cleanly');
     }
 
-    run('sleep 2', { silent: true });
-
-    const recreate = run('openclaw sandbox recreate --all --force', {
-      silent: false
-    });
-    if (recreate.ok) {
-      api.logger.info('[moltbank] ✓ sandbox containers recreated — new container will be created on next agent message');
-    } else {
-      api.logger.warn('[moltbank] ✗ sandbox recreate failed');
-      api.logger.warn('[moltbank]   run manually: openclaw sandbox recreate --all --force');
-    }
+    setTimeout(() => {
+      const recreate = runCommand('openclaw', ['sandbox', 'recreate', '--all', '--force'], {
+        silent: false
+      });
+      if (recreate.ok) {
+        api.logger.info('[moltbank] ✓ sandbox containers recreated — new container will be created on next agent message');
+      } else {
+        api.logger.warn('[moltbank] ✗ sandbox recreate failed');
+        api.logger.warn('[moltbank]   run manually: openclaw sandbox recreate --all --force');
+      }
 
-    api.logger.info('[moltbank] restarting gateway...');
-    run('openclaw gateway', { silent: true });
+      api.logger.info('[moltbank] restarting gateway...');
+      runCommand('openclaw', ['gateway'], { silent: true });
+    }, 2000);
   }, 8000);
 }
 
 function restartGatewayAfterHostSetup(api: LoggerApi): boolean {
   api.logger.info('[moltbank] restarting gateway to refresh host skill state...');
-  const restart = run('openclaw gateway restart', { silent: true, timeoutMs: 30000 });
+  const restart = runCommand('openclaw', ['gateway', 'restart'], { silent: true, timeoutMs: 30000 });
   if (restart.ok) {
     api.logger.info('[moltbank] ✓ gateway restarted');
     return true;
@@ -1709,7 +2170,7 @@ export async function runSetup(
     ensureJq(api);
 
     api.logger.info('[moltbank] [sandbox 1/10] installing skill files...');
-    const skillInstalled = ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'sandbox');
+    const skillInstalled = await ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'sandbox');
     if (!skillInstalled) {
       api.logger.warn('[moltbank] skill install failed — aborting sandbox setup');
       return;
@@ -1767,7 +2228,7 @@ export async function runSetup(
     ensureJq(api);
 
     api.logger.info('[moltbank] [host 2/8] installing skill files...');
-    const installed = ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'host');
+    const installed = await ensureSkillInstalled(skillDir, skillBundleBaseUrl, skillName, api, 'host');
     if (!installed) {
       api.logger.warn('[moltbank] host setup aborted: skill install failed. Verify install.sh/base URL and retry.');
       return;
@@ -1811,7 +2272,7 @@ export async function runSetup(
     if (IS_WIN) {
       const mcporterConfigPath = join(skillDir, 'assets', 'mcporter.json');
       const active = parseActiveTokenFromCredentials();
-      const mcpSmoke = run(`mcporter --config "${mcporterConfigPath}" list MoltBank`, {
+      const mcpSmoke = runCommand('mcporter', ['--config', mcporterConfigPath, 'list', 'MoltBank'], {
         cwd: skillDir,
         silent: true,
         timeoutMs: smokeTimeoutMs,
@@ -1838,8 +2299,16 @@ export async function runSetup(
           );
 
           const ps1Path = join(skillDir, 'scripts', 'moltbank.ps1');
-          const fallback = run(
-            'powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference = \'Stop\'; if (-not (Test-Path -LiteralPath $env:MOLTBANK_WRAPPER_PATH)) { throw \'moltbank.ps1 not found\' }; if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { throw \'bash is not installed or not on PATH\' }; if (-not (Get-Command mcporter -ErrorAction SilentlyContinue)) { throw \'mcporter is not installed or not on PATH\' }; Write-Output \'ok\'"',
+          const fallback = runCommand(
+            'powershell',
+            [
+              '-NoProfile',
+              '-NonInteractive',
+              '-ExecutionPolicy',
+              'Bypass',
+              '-Command',
+              "$ErrorActionPreference = 'Stop'; if (-not (Test-Path -LiteralPath $env:MOLTBANK_WRAPPER_PATH)) { throw 'moltbank.ps1 not found' }; if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { throw 'bash is not installed or not on PATH' }; if (-not (Get-Command mcporter -ErrorAction SilentlyContinue)) { throw 'mcporter is not installed or not on PATH' }; Write-Output 'ok'"
+            ],
             {
               cwd: skillDir,
               silent: true,
@@ -1869,7 +2338,7 @@ export async function runSetup(
         }
       }
     } else {
-      const smoke = run(`"${skillDir}/scripts/moltbank.sh" list MoltBank`, {
+      const smoke = runCommand(join(skillDir, 'scripts', 'moltbank.sh'), ['list', 'MoltBank'], {
         cwd: skillDir,
         silent: true,
         timeoutMs: smokeTimeoutMs
@@ -1925,10 +2394,11 @@ export async function runSetup(
       `[moltbank]     setupCommand:         ${finalCmd.includes('node_22.x') && !finalCmd.includes('/home/') ? '✓ ok (no host paths)' : '✗ may be corrupted'}`
     );
 
-    const containerCheck = run(
-      `docker inspect $(docker ps | grep openclaw-sbx | awk '{print $1}') --format '{{.HostConfig.NetworkMode}}' 2>/dev/null`,
-      { silent: true }
-    );
+    const sandboxContainer = runCommand('docker', ['ps', '-q', '--filter', 'name=openclaw-sbx'], { silent: true });
+    const sandboxContainerId = splitNonEmptyLines(sandboxContainer.stdout)[0] || '';
+    const containerCheck = sandboxContainerId
+      ? runCommand('docker', ['inspect', sandboxContainerId, '--format', '{{.HostConfig.NetworkMode}}'], { silent: true })
+      : { ok: false, stdout: '', stderr: '', exitCode: 1, timedOut: false };
     if (!containerCheck.ok || !containerCheck.stdout) {
       api.logger.info(`[moltbank]   container: not running yet — will be created on first agent message`);
     } else if (containerCheck.stdout.trim() === 'bridge') {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moltbankhq/openclaw",
-    "version": "0.1.10",
+    "version": "0.1.12",
     "description": "MoltBank stablecoin treasury CLI and OpenClaw plugin",
     "main": "index.ts",
     "bin": {