@moltbankhq/openclaw 0.1.11 → 0.1.13

package/index.ts

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from 'child_process';
 import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, type Dirent } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, basename } from 'path';
 import { homedir, userInfo } from 'os';
 const IS_WIN = process.platform === 'win32';
 
@@ -16,6 +16,7 @@ interface CredentialsOrganization {
   name?: string;
   access_token?: string;
   x402_signer_private_key?: string;
+  x402_wallet?: Record<string, unknown>;
 }
 
 interface CredentialsFile {
@@ -365,10 +366,136 @@ function getExecErrorMessage(error: unknown): string {
   return String(error);
 }
 
+function getPathEnvKey(env: NodeJS.ProcessEnv): string {
+  const existing = Object.keys(env).find((key) => key.toLowerCase() === 'path');
+  return existing ?? 'Path';
+}
+
+function splitPathEntries(value: string): string[] {
+  return value
+    .split(IS_WIN ? ';' : ':')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+}
+
+function prependPathEntries(env: NodeJS.ProcessEnv, entries: string[]): void {
+  if (entries.length === 0) return;
+
+  const pathKey = getPathEnvKey(env);
+  const existing = splitPathEntries(asString(env[pathKey]));
+  const seen = new Set<string>();
+  const ordered: string[] = [];
+
+  for (const entry of [...entries, ...existing]) {
+    const normalized = IS_WIN ? entry.toLowerCase() : entry;
+    if (seen.has(normalized)) continue;
+    seen.add(normalized);
+    ordered.push(entry);
+  }
+
+  env[pathKey] = ordered.join(IS_WIN ? ';' : ':');
+}
+
+function isExplicitCommandPath(command: string): boolean {
+  return command.includes('/') || command.includes('\\') || /^[A-Za-z]:/.test(command);
+}
+
+function getWindowsCommandExtensions(env: NodeJS.ProcessEnv): string[] {
+  const fromEnv = asString(env.PATHEXT || process.env.PATHEXT)
+    .split(';')
+    .map((value) => value.trim().toLowerCase())
+    .filter(Boolean);
+
+  const preferred = ['.exe', '.com', '.ps1', '.cmd', '.bat'];
+  const out: string[] = [];
+  for (const ext of [...preferred, ...fromEnv]) {
+    const normalized = ext.startsWith('.') ? ext : `.${ext}`;
+    if (!out.includes(normalized)) {
+      out.push(normalized);
+    }
+  }
+  return out;
+}
+
+function resolveWindowsCommandPath(command: string, env: NodeJS.ProcessEnv): string {
+  const extensions = getWindowsCommandExtensions(env);
+
+  const tryCandidates = (basePath: string): string => {
+    if (existsSync(basePath)) return basePath;
+
+    const lower = basePath.toLowerCase();
+    for (const ext of extensions) {
+      if (lower.endsWith(ext)) continue;
+      const candidate = `${basePath}${ext}`;
+      if (existsSync(candidate)) {
+        return candidate;
+      }
+    }
+
+    return '';
+  };
+
+  if (isExplicitCommandPath(command)) {
+    return tryCandidates(command);
+  }
+
+  const pathValue = asString(env[getPathEnvKey(env)]);
+  for (const entry of splitPathEntries(pathValue)) {
+    const resolved = tryCandidates(join(entry, command));
+    if (resolved) {
+      return resolved;
+    }
+  }
+
+  return '';
+}
+
+function quoteCmdArgument(value: string): string {
+  if (!value) return '""';
+
+  const escaped = value
+    .replace(/([()%!^"<>&|])/g, '^$1')
+    .replace(/\r/g, ' ')
+    .replace(/\n/g, ' ');
+
+  return /[\s()%!^"<>&|]/.test(value) ? `"${escaped}"` : escaped;
+}
+
+function prepareCommandForSpawn(command: string, args: string[], env: NodeJS.ProcessEnv): { command: string; args: string[] } {
+  if (!IS_WIN) {
+    return { command, args };
+  }
+
+  const resolved = resolveWindowsCommandPath(command, env);
+  if (!resolved) {
+    return { command, args };
+  }
+
+  const lower = resolved.toLowerCase();
+  if (lower.endsWith('.ps1')) {
+    return {
+      command: 'powershell.exe',
+      args: ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', resolved, ...args]
+    };
+  }
+
+  if (lower.endsWith('.cmd') || lower.endsWith('.bat')) {
+    const cmdExe = asString(env.ComSpec || env.COMSPEC, 'cmd.exe');
+    const commandLine = [resolved, ...args].map((value) => quoteCmdArgument(value)).join(' ');
+    return {
+      command: cmdExe,
+      args: ['/d', '/s', '/c', commandLine]
+    };
+  }
+
+  return { command: resolved, args };
+}
+
 function runCommand(command: string, args: string[], opts: RunOptions = {}): RunResult {
   try {
     const mergedEnv: NodeJS.ProcessEnv = { ...process.env, ...(opts.env ?? {}) };
-    const result = spawnSync(command, args, {
+    const prepared = prepareCommandForSpawn(command, args, mergedEnv);
+    const result = spawnSync(prepared.command, prepared.args, {
       cwd: opts.cwd,
       env: mergedEnv,
       encoding: 'utf8',
@@ -563,6 +690,122 @@ function applyRecursiveMode(rootDir: string, mode: number): void {
   });
 }
 
+function applyRecursiveModes(rootDir: string, dirMode: number, fileMode: number): void {
+  try {
+    chmodSync(rootDir, dirMode);
+  } catch {
+    // ignore
+  }
+
+  visitFiles(rootDir, (fullPath, entry) => {
+    try {
+      chmodSync(fullPath, entry.isDirectory() ? dirMode : fileMode);
+    } catch {
+      // ignore
+    }
+  });
+}
+
+type CommandSpec = {
+  command: string;
+  args: string[];
+  env?: Record<string, string | undefined>;
+};
+
+function withOptionalSudo(command: string, args: string[], env?: Record<string, string | undefined>): CommandSpec {
+  const isRoot = typeof process.getuid === 'function' ? process.getuid() === 0 : false;
+  if (isRoot || !hasBin('sudo')) {
+    return { command, args, env };
+  }
+  return { command: 'sudo', args: [command, ...args], env };
+}
+
+function getUnixJqInstallPlan(): { name: string; steps: CommandSpec[] } | null {
+  if (hasBin('apt-get')) {
+    return {
+      name: 'apt-get',
+      steps: [
+        withOptionalSudo('apt-get', ['update', '-qq'], { DEBIAN_FRONTEND: 'noninteractive' }),
+        withOptionalSudo('apt-get', ['install', '-y', 'jq'], { DEBIAN_FRONTEND: 'noninteractive' })
+      ]
+    };
+  }
+
+  if (hasBin('dnf')) {
+    return {
+      name: 'dnf',
+      steps: [withOptionalSudo('dnf', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('yum')) {
+    return {
+      name: 'yum',
+      steps: [withOptionalSudo('yum', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('pacman')) {
+    return {
+      name: 'pacman',
+      steps: [withOptionalSudo('pacman', ['-Sy', '--noconfirm', 'jq'])]
+    };
+  }
+
+  if (hasBin('apk')) {
+    return {
+      name: 'apk',
+      steps: [withOptionalSudo('apk', ['add', 'jq'])]
+    };
+  }
+
+  if (hasBin('zypper')) {
+    return {
+      name: 'zypper',
+      steps: [withOptionalSudo('zypper', ['install', '-y', 'jq'])]
+    };
+  }
+
+  if (hasBin('brew')) {
+    return {
+      name: 'brew',
+      steps: [{ command: 'brew', args: ['install', 'jq'] }]
+    };
+  }
+
+  return null;
+}
+
+function ensureUnixJq(api: LoggerApi): boolean {
+  const plan = getUnixJqInstallPlan();
+  if (!plan) {
+    return false;
+  }
+
+  api.logger.info(`[moltbank] jq not found — attempting install via ${plan.name}...`);
+
+  for (const step of plan.steps) {
+    const result = runCommand(step.command, step.args, {
+      env: step.env,
+      timeoutMs: 180000
+    });
+
+    if (!result.ok) {
+      api.logger.warn(`[moltbank] jq install via ${plan.name} failed: ${result.stderr}`);
+      return false;
+    }
+  }
+
+  if (!hasBin('jq')) {
+    api.logger.warn(`[moltbank] jq install via ${plan.name} finished, but jq is still not visible in PATH`);
+    return false;
+  }
+
+  const version = runCommand('jq', ['--version'], { silent: true });
+  api.logger.info(`[moltbank] ✓ jq installed via ${plan.name} (${version.stdout || 'unknown version'})`);
+  return true;
+}
+
 function findWindowsJqBinaryPath(): string {
   if (!IS_WIN) return '';
 
@@ -652,6 +895,7 @@ function ensureWindowsJqShim(api: LoggerApi): boolean {
       const shimBody = `@echo off\r\n"${escapedSource}" %*\r\n`;
       writeFileSync(shimPath, shimBody, 'utf8');
     }
+    prependPathEntries(process.env, [npmBinDir]);
   } catch (e) {
     api.logger.warn('[moltbank] could not create jq shim in npm global bin: ' + String(e));
     return false;
@@ -709,6 +953,77 @@ function getCredentialsPath(): string {
   return process.env.MOLTBANK_CREDENTIALS_PATH || join(homedir(), '.MoltBank', 'credentials.json');
 }
 
+function getSandboxCredentialsHostPath(skillDir: string): string {
+  return join(skillDir, '.sandbox', 'credentials.json');
+}
+
+function getSandboxCredentialsContainerPath(skillName: string): string {
+  return `/workspace/skills/${skillName}/.sandbox/credentials.json`;
+}
+
+function writeSandboxCredentialsFile(
+  skillDir: string,
+  activeOrg: string,
+  org: CredentialsOrganization,
+  privateKey: string,
+  api: LoggerApi
+): boolean {
+  const sandboxDir = dirname(getSandboxCredentialsHostPath(skillDir));
+  const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
+  const sandboxOrg: Record<string, unknown> = {
+    name: activeOrg,
+    access_token: org.access_token ?? ''
+  };
+
+  if (privateKey) {
+    sandboxOrg.x402_signer_private_key = privateKey;
+  }
+  if (isRecord(org.x402_wallet)) {
+    sandboxOrg.x402_wallet = org.x402_wallet;
+  }
+
+  const sandboxCredentials = {
+    active_organization: activeOrg,
+    organizations: [sandboxOrg]
+  };
+
+  try {
+    mkdirSync(sandboxDir, { recursive: true });
+    writeFileSync(sandboxCredentialsPath, JSON.stringify(sandboxCredentials, null, 2) + '\n', 'utf8');
+
+    if (!IS_WIN) {
+      try {
+        chmodSync(sandboxDir, 0o700);
+      } catch {
+        // ignore
+      }
+      try {
+        chmodSync(sandboxCredentialsPath, 0o600);
+      } catch {
+        // ignore
+      }
+    }
+
+    api.logger.info('[moltbank] ✓ sandbox credentials file updated');
+    return true;
+  } catch (e) {
+    api.logger.warn('[moltbank] ✗ could not write sandbox credentials file: ' + String(e));
+    return false;
+  }
+}
+
+function removeSandboxSecretEnvKeys(envObj: Record<string, string>, api: LoggerApi): boolean {
+  let changed = false;
+  for (const key of ['MOLTBANK', 'SIGNER']) {
+    if (key in envObj) {
+      delete envObj[key];
+      changed = true;
+      api.logger.info(`[moltbank] ✓ removed legacy sandbox secret env key ${key}`);
+    }
+  }
+  return changed;
+}
+
 function readOpenclawConfig(): OpenclawConfig {
   const configPath = join(homedir(), '.openclaw', 'openclaw.json');
   try {
@@ -816,6 +1131,10 @@ function ensureJq(api: LoggerApi) {
   }
 
   if (!IS_WIN) {
+    if (ensureUnixJq(api)) {
+      return;
+    }
+
     api.logger.warn('[moltbank] ✗ jq not found in PATH (required by MoltBank wrapper on host mode)');
     api.logger.warn(`[moltbank]   install jq (${getJqInstallHint()}) and rerun setup`);
     return;
@@ -1111,20 +1430,20 @@ function ensureSkillPermissions(skillDir: string, api: LoggerApi) {
   }
 
   if (existsSync(assetsDir)) {
-    applyRecursiveMode(assetsDir, 0o777);
-    api.logger.info('[moltbank] ✓ assets/ permissions → 777');
+    applyRecursiveModes(assetsDir, 0o750, 0o640);
+    api.logger.info('[moltbank] ✓ assets/ permissions → 750 dirs, 640 files');
   }
   if (existsSync(configFile)) {
     try {
-      chmodSync(configFile, 0o666);
+      chmodSync(configFile, 0o600);
     } catch {
       // ignore
     }
-    api.logger.info('[moltbank] ✓ mcporter.json permissions → 666');
+    api.logger.info('[moltbank] ✓ mcporter.json permissions → 600');
   }
   if (existsSync(scriptsDir)) {
-    applyRecursiveMode(scriptsDir, 0o755);
-    api.logger.info('[moltbank] ✓ scripts/ permissions → 755');
+    applyRecursiveModes(scriptsDir, 0o750, 0o750);
+    api.logger.info('[moltbank] ✓ scripts/ permissions → 750');
     normalizeFilesMatching(scriptsDir, () => true);
     api.logger.info('[moltbank] ✓ scripts/ line endings normalized (CRLF → LF)');
   }
@@ -1659,6 +1978,7 @@ export function ensureMcporterConfig(skillDir: string, appBaseUrl: string, api:
 
 export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
   const credsPath = getCredentialsPath();
+  const skillName = basename(skillDir);
 
   if (!existsSync(credsPath)) {
     api.logger.info('[moltbank] no credentials.json found — skipping sandbox env injection');
@@ -1686,14 +2006,7 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
     const envPath = ['agents', 'defaults', 'sandbox', 'docker', 'env'];
     setNestedValue(config, envPath, getNestedValue(config, envPath) ?? {});
     const envObj = getNestedValue(config, envPath) as Record<string, string>;
-
-    if (envObj.MOLTBANK !== org.access_token) {
-      envObj.MOLTBANK = org.access_token;
-      api.logger.info(`[moltbank] ✓ MOLTBANK injected (org: ${activeOrg})`);
-      changed = true;
-    } else {
-      api.logger.info(`[moltbank] ✓ MOLTBANK already injected (org: ${activeOrg})`);
-    }
+    changed = removeSandboxSecretEnvKeys(envObj, api) || changed;
 
     if (envObj.ACTIVE_ORG_OVERRIDE !== activeOrg) {
       envObj.ACTIVE_ORG_OVERRIDE = activeOrg;
@@ -1729,21 +2042,28 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
       }
     }
 
+    if (!writeSandboxCredentialsFile(skillDir, activeOrg, org, privateKey, api)) {
+      return false;
+    }
+
+    const sandboxCredentialsContainerPath = getSandboxCredentialsContainerPath(skillName);
+    if (envObj.MOLTBANK_CREDENTIALS_PATH !== sandboxCredentialsContainerPath) {
+      envObj.MOLTBANK_CREDENTIALS_PATH = sandboxCredentialsContainerPath;
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH injected (${sandboxCredentialsContainerPath})`);
+      changed = true;
+    } else {
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH already set (${sandboxCredentialsContainerPath})`);
+    }
+
     if (privateKey) {
-      if (envObj.SIGNER !== privateKey) {
-        envObj.SIGNER = privateKey;
-        api.logger.info('[moltbank] ✓ SIGNER injected');
-        changed = true;
-      } else {
-        api.logger.info('[moltbank] ✓ SIGNER already injected');
-      }
+      api.logger.info('[moltbank] ✓ sandbox x402 signer available via sandbox credentials file');
     } else {
-      api.logger.info('[moltbank] ℹ SIGNER not available — skipped (agent will handle on first use)');
+      api.logger.info('[moltbank] ℹ sandbox x402 signer not available yet — helper scripts will use sandbox credentials path if generated later');
     }
 
     if (changed) {
       writeOpenclawConfig(config);
-      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox env vars');
+      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox auth path only (no token/private key persisted)');
     }
 
     return changed;
@@ -1965,7 +2285,7 @@ export async function runSetup(
     api.logger.info('[moltbank] [sandbox 8/10] configuring sandbox docker settings...');
     const sandboxChanged = configureSandbox(api);
 
-    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox env vars (MOLTBANK, ACTIVE_ORG_OVERRIDE, SIGNER)...');
+    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox auth env (MOLTBANK_CREDENTIALS_PATH, ACTIVE_ORG_OVERRIDE)...');
     const envChanged = injectSandboxEnv(skillDir, api);
 
     api.logger.info('[moltbank] [sandbox 10/10] apply sandbox changes (recreate + gateway stop)...');
@@ -2132,13 +2452,18 @@ export async function runSetup(
     const finalEnv = asStringRecord(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'env']));
     const finalNetwork = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'network']));
     const finalCmd = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'setupCommand']));
+    const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
 
     api.logger.info(`[moltbank]   openclaw.json sandbox env:`);
-    api.logger.info(`[moltbank]     MOLTBANK:             ${finalEnv.MOLTBANK ? '✓ set' : '✗ missing'}`);
+    api.logger.info(
+      `[moltbank]     MOLTBANK_CREDENTIALS_PATH: ${finalEnv.MOLTBANK_CREDENTIALS_PATH ? `✓ ${finalEnv.MOLTBANK_CREDENTIALS_PATH}` : '✗ missing'}`
+    );
     api.logger.info(
       `[moltbank]     ACTIVE_ORG_OVERRIDE:  ${finalEnv.ACTIVE_ORG_OVERRIDE ? `✓ "${finalEnv.ACTIVE_ORG_OVERRIDE}"` : '✗ missing'}`
     );
-    api.logger.info(`[moltbank]     SIGNER:               ${finalEnv.SIGNER ? '✓ set' : '✗ missing (agent may generate on first use)'}`);
+    api.logger.info(
+      `[moltbank]     sandbox credentials:   ${existsSync(sandboxCredentialsPath) ? '✓ present (skill-local, 600)' : '✗ missing'}`
+    );
     api.logger.info(`[moltbank]   sandbox docker:`);
     api.logger.info(
       `[moltbank]     network:              ${finalNetwork === 'bridge' ? '✓ bridge' : `✗ "${finalNetwork}" (expected bridge)`}`

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moltbankhq/openclaw",
-    "version": "0.1.11",
+    "version": "0.1.13",
     "description": "MoltBank stablecoin treasury CLI and OpenClaw plugin",
     "main": "index.ts",
     "bin": {