@openagents-org/agent-launcher 0.2.187 → 0.2.189

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openagents-org/agent-launcher",
-  "version": "0.2.187",
+  "version": "0.2.189",
   "description": "OpenAgents Launcher \u2014 install, configure, and run AI coding agents from your terminal",
   "main": "src/index.js",
   "bin": {

package/registry.json

@@ -333,6 +333,10 @@
       "env_vars": [
         "CURSOR_API_KEY"
       ],
+      "creds_file": "~/.cursor/cli-config.json",
+      "creds_key": "authInfo",
+      "creds_no_parse": true,
+      "unverifiable": true,
       "login_command": "cursor-agent login"
     },
     "env_config": [

package/src/adapters/goose.js

@@ -42,7 +42,7 @@ const {
   buildModePrompt,
   buildPinnedSections,
 } = require('./workspace-prompt');
-const { whichBinary, getEnhancedEnv, defaultAgentWorkdir } = require('../paths');
+const { whichBinary, whereBinary, getEnhancedEnv, defaultAgentWorkdir } = require('../paths');
 
 const IS_WINDOWS = process.platform === 'win32';
 
@@ -105,10 +105,9 @@ function findGooseBinary() {
   try {
     const env = getEnhancedEnv();
     if (IS_WINDOWS) {
-      const r = execSync('where goose.exe 2>nul || where goose.cmd 2>nul || where goose 2>nul', {
-        encoding: 'utf-8', timeout: 5000, windowsHide: true, env,
-      });
-      const hit = r.split(/\r?\n/)[0].trim();
+      // In-process PATH walk, not `where`: its OEM-codepage output mangled
+      // non-ASCII profile paths into a hit that could never be spawned.
+      const hit = whereBinary(['goose'], env);
       if (hit) return hit;
     } else {
       const hit = execSync('command -v goose', {

package/src/adapters/nanoclaw-control.js

@@ -21,6 +21,7 @@ const path = require('path');
 const { execFile, execFileSync } = require('child_process');
 
 const { redactSecrets } = require('./nanoclaw-protocol');
+const { whereAll } = require('../paths');
 
 const IS_WINDOWS = process.platform === 'win32';
 
@@ -176,14 +177,7 @@ function looksLikeNanoclaw(dir) {
 /** Follow `ncl` on PATH back to the checkout root (bin/ncl → <root>). */
 function homeFromNclBinary() {
   try {
-    const which = IS_WINDOWS ? 'where' : 'which';
-    const out = execFileSync(which, ['ncl'], {
-      encoding: 'utf-8',
-      timeout: 5000,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-      .split(/\r?\n/)[0]
-      .trim();
+    const out = whichSafe('ncl');
     if (!out) return null;
     let real = out;
     try {
@@ -233,15 +227,9 @@ function findNanoclawHome(env = process.env) {
 
 function whichSafe(bin) {
   try {
-    const which = IS_WINDOWS ? 'where' : 'which';
-    const out = execFileSync(which, [bin], {
-      encoding: 'utf-8',
-      timeout: 5000,
-      stdio: ['ignore', 'pipe', 'ignore'],
-    })
-      .split(/\r?\n/)[0]
-      .trim();
-    return out || null;
+    // Walks PATH in-process: `where` prints in the OEM codepage, which
+    // mangled any non-ASCII profile path when read back as UTF-8.
+    return whereAll(bin)[0] || null;
   } catch {
     return null;
   }

package/src/adapters/openclaw.js

@@ -23,7 +23,7 @@ const { spawn } = require('../wsl');
 const BaseAdapter = require('./base');
 const { formatAttachmentsForPrompt } = require('./utils');
 const { buildOpenclawSkillMd, buildOpenclawSystemPrompt, workspaceSkillName } = require('./workspace-prompt');
-const { getRuntimePrefix } = require('../paths');
+const { getRuntimePrefix, whereBinary } = require('../paths');
 
 const IS_WINDOWS = process.platform === 'win32';
 const OPENCLAW_STATE_DIR = path.join(
@@ -31,6 +31,41 @@ const OPENCLAW_STATE_DIR = path.join(
   '.openclaw'
 );
 
+/**
+ * Archive the legacy auth-profiles.json this adapter used to write.
+ *
+ * Current OpenClaw keeps credentials in SQLite and refuses to run while a
+ * legacy JSON store sits beside an empty one ("requires legacy credential
+ * migration; run openclaw doctor --fix"); beside a populated one it silently
+ * ignores the file, so a changed key never took effect either. The key now
+ * reaches OpenClaw through the env and openclaw.json, so the file only gets
+ * in the way.
+ *
+ * Only a file made entirely of our entries is moved: the `custom` provider
+ * exists only because configureNativeAuth created it, and any other entry must
+ * carry a key we hold ourselves. A profile the user made (OpenClaw's own
+ * paste-token also names them `<provider>:manual`) keeps the file in place,
+ * for `openclaw doctor --fix` to migrate. Renamed, never deleted.
+ *
+ * @param {Array<string|undefined>} knownKeys  API keys this agent is configured with
+ */
+function retireOwnLegacyAuthProfiles(knownKeys) {
+  const file = path.join(OPENCLAW_STATE_DIR, 'agents', 'main', 'agent', 'auth-profiles.json');
+  let data;
+  try { data = JSON.parse(fs.readFileSync(file, 'utf-8')); } catch { return false; }
+  const keys = new Set((knownKeys || []).filter(Boolean));
+  const profiles = Object.values((data && data.profiles) || {});
+  const ours = profiles.every((p) => p && p.type === 'token'
+    && (p.provider === 'custom' || keys.has(p.token)));
+  if (!ours) return false;
+  try {
+    fs.renameSync(file, `${file}.openagents-retired`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 class OpenClawAdapter extends BaseAdapter {
   /**
    * @param {object} opts - BaseAdapter opts plus:
@@ -54,6 +89,14 @@ class OpenClawAdapter extends BaseAdapter {
       this._log('OpenClaw binary not found — agent will not be able to process messages');
     }
 
+    // Agents configured before the key stopped going into auth-profiles.json
+    // still have that file; clear it before the first run rather than on the
+    // next save.
+    const env = this.agentEnv || {};
+    if (retireOwnLegacyAuthProfiles([env.LLM_API_KEY, env.OPENAI_API_KEY, env.ANTHROPIC_API_KEY])) {
+      this._log('Archived the legacy auth-profiles.json this launcher wrote (OpenClaw now stores credentials in SQLite)');
+    }
+
     // Install workspace skill
     this._installWorkspaceSkill();
   }
@@ -74,31 +117,17 @@ class OpenClawAdapter extends BaseAdapter {
     const mjs = path.join(portableDir, 'node_modules', 'openclaw', 'openclaw.mjs');
     if (fs.existsSync(mjs)) return mjs;
 
-    // Fallback: check if openclaw is on PATH (system install)
-    // On Windows, resolve .cmd shim to actual .mjs path to avoid spawn issues
-    try {
-      const cmd = IS_WINDOWS ? 'where openclaw.cmd' : 'which openclaw';
-      const result = execSync(cmd, { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] })
-        .split(/\r?\n/)[0].trim();
-      if (result) {
-        const resolved = this._resolveShimToMjs(result);
-        if (resolved) return resolved;
-        // On Unix, which returns the actual binary/symlink
-        if (!IS_WINDOWS) return result;
-      }
-    } catch {}
-    // Windows: also try without .cmd extension (for system installs on PATH)
-    if (IS_WINDOWS) {
-      try {
-        const result = execSync('where openclaw', { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] })
-          .split(/\r?\n/)[0].trim();
-        if (result) {
-          // Try the .cmd variant of this path
-          const cmdPath = result.replace(/(?:\.cmd)?$/i, '.cmd');
-          const resolved = this._resolveShimToMjs(cmdPath);
-          if (resolved) return resolved;
-        }
-      } catch {}
+    // Fallback: a copy the user installed themselves (npm -g, nvm, a custom
+    // npm prefix). whereBinary searches the directories itself instead of
+    // shelling out to `where`, which prints in the OEM codepage and mangled
+    // any non-ASCII profile path (C:\Users\王…) past recognition.
+    const found = whereBinary('openclaw');
+    if (found) {
+      // Windows: resolve the .cmd shim to openclaw.mjs to avoid spawn issues.
+      // Unix: `which` hands back the binary or its symlink, either runs as is.
+      const resolved = this._resolveShimToMjs(found);
+      if (resolved) return resolved;
+      if (!IS_WINDOWS) return found;
     }
     return null;
   }
@@ -359,13 +388,7 @@ class OpenClawAdapter extends BaseAdapter {
       // Unified path first (symlink on Unix), then legacy bin/ fallback, then system node
       const nodeUnified = path.join(portableDir, IS_WINDOWS ? 'node.exe' : 'node');
       let nodeBin = fs.existsSync(nodeUnified) ? nodeUnified : path.join(portableDir, 'bin', 'node');
-      if (!fs.existsSync(nodeBin)) {
-        try {
-          const cmd = IS_WINDOWS ? 'where node.exe' : 'which node';
-          nodeBin = execSync(cmd, { encoding: 'utf-8', timeout: 5000, stdio: ['pipe', 'pipe', 'pipe'] })
-            .split(/\r?\n/)[0].trim();
-        } catch { nodeBin = 'node'; }
-      }
+      if (!fs.existsSync(nodeBin)) nodeBin = whereBinary('node') || 'node';
 
       // binary from _findOpenclawBinary() is already resolved to .mjs when possible
       let spawnBin, spawnArgs;
@@ -606,9 +629,10 @@ class OpenClawAdapter extends BaseAdapter {
    * LLM_API_KEY / LLM_BASE_URL / LLM_MODEL values.
    * Called by the Launcher's saveAgentEnv when type === 'openclaw'.
    *
-   * For standard providers (OpenAI, Anthropic), uses auth-profiles.json.
-   * For custom endpoints, uses models.providers in openclaw.json which
-   * gives full tool support via the CLI gateway mode.
+   * For standard providers (OpenAI, Anthropic), the key travels in the env
+   * and only the model is set here. For custom endpoints, uses
+   * models.providers in openclaw.json which gives full tool support via the
+   * CLI gateway mode.
    */
   static configureNativeAuth(env) {
     const apiKey = env.LLM_API_KEY;
@@ -622,26 +646,19 @@ class OpenClawAdapter extends BaseAdapter {
     const isAnthropic = baseUrl.includes('api.anthropic.com');
     const configFile = path.join(OPENCLAW_STATE_DIR, 'openclaw.json');
 
+    // The key itself never goes into auth-profiles.json any more: current
+    // OpenClaw keeps credentials in SQLite and refuses to start while a legacy
+    // JSON store sits beside an empty one ("requires legacy credential
+    // migration; run openclaw doctor --fix"). A standard provider reads the
+    // key from the OPENAI_API_KEY / ANTHROPIC_API_KEY the resolve rules put
+    // in its env; a custom one from models.providers below.
+    retireOwnLegacyAuthProfiles([apiKey]);
+
     if (isOpenAI || isAnthropic) {
-      // Standard provider — use auth-profiles.json
       const provider = isAnthropic ? 'anthropic' : 'openai';
-      const profileId = `${provider}:manual`;
-      const agentDir = path.join(OPENCLAW_STATE_DIR, 'agents', 'main', 'agent');
-
-      try {
-        fs.mkdirSync(agentDir, { recursive: true });
-        const authFile = path.join(agentDir, 'auth-profiles.json');
-        let authData = { version: 1, profiles: {} };
-        try { authData = JSON.parse(fs.readFileSync(authFile, 'utf-8')); } catch {}
-        authData.profiles = authData.profiles || {};
-        authData.profiles[profileId] = { type: 'token', provider, token: apiKey };
-        authData.lastGood = authData.lastGood || {};
-        authData.lastGood[provider] = profileId;
-        fs.writeFileSync(authFile, JSON.stringify(authData, null, 2), 'utf-8');
-      } catch {}
-
       // Set model
       try {
+        fs.mkdirSync(OPENCLAW_STATE_DIR, { recursive: true });
         let config = {};
         try { config = JSON.parse(fs.readFileSync(configFile, 'utf-8')); } catch {}
         config.agents = config.agents || {};
@@ -673,22 +690,9 @@ class OpenClawAdapter extends BaseAdapter {
 
         fs.writeFileSync(configFile, JSON.stringify(config, null, 2), 'utf-8');
       } catch {}
-
-      // Also write auth-profiles.json for the custom provider
-      try {
-        const agentDir = path.join(OPENCLAW_STATE_DIR, 'agents', 'main', 'agent');
-        fs.mkdirSync(agentDir, { recursive: true });
-        const authFile = path.join(agentDir, 'auth-profiles.json');
-        let authData = { version: 1, profiles: {} };
-        try { authData = JSON.parse(fs.readFileSync(authFile, 'utf-8')); } catch {}
-        authData.profiles = authData.profiles || {};
-        authData.profiles['custom:manual'] = { type: 'token', provider: 'custom', token: apiKey };
-        authData.lastGood = authData.lastGood || {};
-        authData.lastGood.custom = 'custom:manual';
-        fs.writeFileSync(authFile, JSON.stringify(authData, null, 2), 'utf-8');
-      } catch {}
     }
   }
 }
 
 module.exports = OpenClawAdapter;
+module.exports.retireOwnLegacyAuthProfiles = retireOwnLegacyAuthProfiles;

package/src/installer.js

@@ -14,6 +14,7 @@ const {
   resolveManagedNpmBinary,
   resolveManagedNpmPackageBin,
   isNodeShebangScript,
+  whereAll,
 } = require('./paths');
 const { isWslBinary, bridgedCommandString, wslHomeUnc } = require('./wsl');
 const { canBlock } = require('./probe-mode');
@@ -2087,18 +2088,10 @@ class Installer {
    */
   _hasSystemNode(bundledDir) {
     try {
-      const { execFileSync } = require('child_process');
-      const cmd = process.platform === 'win32' ? 'where' : 'which';
-      const args = process.platform === 'win32' ? ['node'] : ['node'];
-      const out = execFileSync(cmd, args, {
-        encoding: 'utf-8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-        timeout: 5000,
-        windowsHide: true,
-        env: { ...process.env },
-      });
+      // In-process PATH walk: `where` prints in the OEM codepage, so on a
+      // non-ASCII profile its UTF-8-decoded lines never matched bundledDir.
       const prefix = (bundledDir || '').toLowerCase();
-      for (const line of out.split(/\r?\n/).map(s => s.trim()).filter(Boolean)) {
+      for (const line of whereAll('node')) {
         if (!prefix || !line.toLowerCase().startsWith(prefix)) return true;
       }
       return false;
@@ -2446,7 +2439,10 @@ class Installer {
     const psTokens = /\b(irm|iwr|iex|Invoke-RestMethod|Invoke-WebRequest|Invoke-Expression|Expand-Archive|Get-[A-Z]\w*|Set-[A-Z]\w*)\b/;
     if (!psTokens.test(cmd)) return cmd;
     const escaped = cmd.replace(/"/g, '\\"');
-    return `powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "${escaped}"`;
+    // PowerShell writes to a pipe in the OEM codepage (936 on zh-CN) and this
+    // output is read as UTF-8, so a non-ASCII path in an installer's log or
+    // error came back garbled. Switch the console encoding first.
+    return `powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[Text.Encoding]::UTF8; ${escaped}"`;
   }
 
   _execShell(cmd, timeoutMs = 300000, envOverride = null) {

package/src/paths.js

@@ -403,6 +403,20 @@ function whereBinary(names, env) {
   return null;
 }
 
+/**
+ * Every PATH hit for a name, in PATH order — for callers that filter the list
+ * (skip the bundled node, find the first one that runs). Like whereBinary it
+ * walks PATH in-process: `where` prints in the OEM codepage, and decoding that
+ * as UTF-8 mangles any non-ASCII profile path.
+ *
+ * @param {string} name
+ * @param {object} [env]  env whose PATH to search (defaults to process.env)
+ * @returns {string[]}
+ */
+function whereAll(name, env) {
+  return _searchPath(name, env || process.env);
+}
+
 /**
  * Drop the bin-dir snapshots and every lookup answered from them — for when a
  * background probe has just learned of directories they did not include.
@@ -1304,6 +1318,7 @@ module.exports = {
   getEnhancedEnv,
   whichBinary,
   whereBinary,
+  whereAll,
   resolveManagedNpmBinary,
   resolveManagedNpmPackageBin,
   isNodeShebangScript,

package/src/update-check.js

@@ -13,8 +13,9 @@ const fs = require('fs');
 const os = require('os');
 const path = require('path');
 const readline = require('readline');
-const { execSync, spawnSync } = require('child_process');
+const { spawnSync } = require('child_process');
 const { npmUrls } = require('./mirrors');
+const { whereBinary } = require('./paths');
 
 const PKG_NAME = '@openagents-org/agent-launcher';
 const CACHE_FILE = path.join(os.homedir(), '.openagents', '.update-check.json');
@@ -187,10 +188,9 @@ function findNpmBin(opts = {}) {
   }
   // PATH fallback (injectable so tests can exercise the hard fallback
   // deterministically regardless of the host OS).
-  const lookup = opts.lookup || (() =>
-    execSync(platform === 'win32' ? 'where npm' : 'which npm', {
-      encoding: 'utf-8', timeout: 3000,
-    }).trim().split(/\r?\n/)[0]);
+  // Walked in-process rather than via `where`, whose OEM-codepage output
+  // mangled non-ASCII profile paths.
+  const lookup = opts.lookup || (() => whereBinary('npm'));
   try {
     return lookup() || (platform === 'win32' ? 'npm.cmd' : 'npm');
   } catch { return platform === 'win32' ? 'npm.cmd' : 'npm'; }