@openclaw-cloud/agent-controller 2.0.0 → 2.2.0

package/dist/providers/claude-code/login-flow.js

@@ -0,0 +1,135 @@
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { logCollector } from '../../connection.js';
+import { toErrorMessage } from '../../utils/response.js';
+const AUTH_URL_RE = /https:\/\/claude\.ai\/oauth\/authorize\?\S+/;
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000; // 10 min
+/**
+ * Drive the `claude setup-token` subscription login flow.
+ *
+ * Flow:
+ * 1. Spawn `claude setup-token` and watch stdout for the `claude.ai/oauth/authorize?...` URL.
+ * 2. Push the URL to chat via `deps.publishLoginUrl`.
+ * 3. Await `deps.waitForCode()` — resolves with the code the user submitted.
+ * 4. Write `code + "\n"` to subprocess stdin, wait for exit.
+ * 5. Verify `~/.claude/.credentials.json` was created/updated → success.
+ *
+ * Emits structured logCollector events at each milestone.
+ */
+export async function runSetupTokenFlow(deps) {
+    const spawnFn = deps.spawnFn ?? spawn;
+    const credPath = deps.credentialsPath ?? path.join(os.homedir(), '.claude', '.credentials.json');
+    const timeoutMs = deps.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const startedAt = Date.now();
+    logCollector?.push('claude_login_start', 'info', 'Starting claude setup-token flow');
+    const credMtimeBefore = safeMtime(credPath);
+    const child = spawnFn('claude', ['setup-token'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+    let stdoutBuf = '';
+    let stderrBuf = '';
+    let urlPublished = false;
+    let codeWritten = false;
+    return new Promise((resolve, reject) => {
+        const timeoutHandle = setTimeout(() => {
+            cleanup();
+            logCollector?.push('claude_login_failed', 'error', 'Claude login timed out before completion', { durationMs: Date.now() - startedAt });
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                /* ignore */
+            }
+            reject(new Error('claude setup-token timed out'));
+        }, timeoutMs);
+        const onStdout = (chunk) => {
+            const text = chunk.toString();
+            stdoutBuf += text;
+            if (!urlPublished) {
+                const match = stdoutBuf.match(AUTH_URL_RE);
+                if (match) {
+                    urlPublished = true;
+                    const url = match[0];
+                    logCollector?.push('claude_login_url_published', 'info', 'Captured OAuth URL', { url });
+                    Promise.resolve(deps.publishLoginUrl(url))
+                        .then(() => deps.waitForCode())
+                        .then((code) => {
+                        if (!code || typeof code !== 'string') {
+                            throw new Error('waitForCode returned empty value');
+                        }
+                        codeWritten = true;
+                        logCollector?.push('claude_login_code_received', 'info', 'User submitted code');
+                        child.stdin.write(code.trim() + '\n');
+                        child.stdin.end();
+                    })
+                        .catch((err) => {
+                        cleanup();
+                        logCollector?.push('claude_login_failed', 'error', `Login pre-exit step failed: ${toErrorMessage(err)}`);
+                        try {
+                            child.kill('SIGKILL');
+                        }
+                        catch {
+                            /* ignore */
+                        }
+                        reject(err instanceof Error ? err : new Error(String(err)));
+                    });
+                }
+            }
+        };
+        const onStderr = (chunk) => {
+            // We only need the last ~500 chars on failure — cap the buffer at 1000
+            // so a chatty subprocess can't grow memory unbounded over a long
+            // login wait (10-minute default timeout).
+            stderrBuf += chunk.toString();
+            if (stderrBuf.length > 1000) {
+                stderrBuf = stderrBuf.slice(-1000);
+            }
+        };
+        const onError = (err) => {
+            cleanup();
+            logCollector?.push('claude_login_failed', 'error', `spawn error: ${err.message}`);
+            reject(err);
+        };
+        const onExit = (code) => {
+            cleanup();
+            if (code === 0 && codeWritten) {
+                const credMtimeAfter = safeMtime(credPath);
+                const credChanged = credMtimeAfter !== null && credMtimeAfter !== credMtimeBefore;
+                if (credChanged) {
+                    logCollector?.push('claude_login_completed', 'info', 'Claude login succeeded', {
+                        durationMs: Date.now() - startedAt,
+                    });
+                    resolve();
+                    return;
+                }
+                logCollector?.push('claude_login_failed', 'error', 'Login exited 0 but credentials file was not updated', { credPath });
+                reject(new Error('credentials file not updated after setup-token'));
+                return;
+            }
+            logCollector?.push('claude_login_failed', 'error', `claude setup-token exited with code ${code ?? 'null'}`, { stderrTail: stderrBuf.slice(-500) });
+            reject(new Error(`claude setup-token exited with code ${code ?? 'null'}`));
+        };
+        function cleanup() {
+            clearTimeout(timeoutHandle);
+            child.stdout.off('data', onStdout);
+            child.stderr.off('data', onStderr);
+            child.off('error', onError);
+            child.off('exit', onExit);
+        }
+        child.stdout.on('data', onStdout);
+        child.stderr.on('data', onStderr);
+        child.on('error', onError);
+        child.on('exit', onExit);
+    });
+}
+function safeMtime(p) {
+    try {
+        return fs.statSync(p).mtimeMs;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=login-flow.js.map

package/dist/providers/claude-code/login-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.js","sourceRoot":"","sources":["../../../src/providers/claude-code/login-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAuC,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAClE,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AAepD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAmB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,EAAE,kCAAkC,CAAC,CAAC;IAErF,MAAM,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE;QAC/C,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAmC,CAAC;IAErC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,IAAI,CAChB,qBAAqB,EACrB,OAAO,EACP,0CAA0C,EAC1C,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CACvC,CAAC;YACF,IAAI,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACpD,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,MAAM,QAAQ,GAAG,CAAC,KAAsB,EAAQ,EAAE;YAChD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,SAAS,IAAI,IAAI,CAAC;YAClB,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,KAAK,EAAE,CAAC;oBACV,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACrB,YAAY,EAAE,IAAI,CAAC,4BAA4B,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;oBACxF,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;yBACvC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;yBAC9B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;wBACb,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;4BACtC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;wBACtD,CAAC;wBACD,WAAW,GAAG,IAAI,CAAC;wBACnB,YAAY,EAAE,IAAI,CAAC,4BAA4B,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;wBAChF,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;wBACtC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;oBACpB,CAAC,CAAC;yBACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;wBACb,OAAO,EAAE,CAAC;wBACV,YAAY,EAAE,IAAI,CAChB,qBAAqB,EACrB,OAAO,EACP,+BAA+B,cAAc,CAAC,GAAG,CAAC,EAAE,CACrD,CAAC;wBACF,IAAI,CAAC;4BACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBACxB,CAAC;wBAAC,MAAM,CAAC;4BACP,YAAY;wBACd,CAAC;wBACD,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9D,CAAC,CAAC,CAAC;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,KAAsB,EAAQ,EAAE;YAChD,uEAAuE;YACvE,iEAAiE;YACjE,0CAA0C;YAC1C,SAAS,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBAC5B,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;YACnC,OAAO,EAAE,CAAC;YACV,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,EAAE,gBAAgB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,IAAmB,EAAQ,EAAE;YAC3C,OAAO,EAAE,CAAC;YACV,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC9B,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC3C,MAAM,WAAW,GAAG,cAAc,KAAK,IAAI,IAAI,cAAc,KAAK,eAAe,CAAC;gBAClF,IAAI,WAAW,EAAE,CAAC;oBAChB,YAAY,EAAE,IAAI,CAAC,wBAAwB,EAAE,MAAM,EAAE,wBAAwB,EAAE;wBAC7E,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;qBACnC,CAAC,CAAC;oBACH,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,YAAY,EAAE,IAAI,CAChB,qBAAqB,EACrB,OAAO,EACP,qDAAqD,EACrD,EAAE,QAAQ,EAAE,CACb,CAAC;gBACF,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,YAAY,EAAE,IAAI,CAChB,qBAAqB,EACrB,OAAO,EACP,uCAAuC,IAAI,IAAI,MAAM,EAAE,EACvD,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CACtC,CAAC;YACF,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC;QAEF,SAAS,OAAO;YACd,YAAY,CAAC,aAAa,CAAC,CAAC;YAC5B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/providers/claude-code/settings-writer.d.ts

@@ -0,0 +1,29 @@
+export interface ClaudeCodeSettingsContext {
+    /** Absolute path to the Claude workspace (cwd of `claude` process) */
+    workspaceDir: string;
+    /** Anthropic API key. If prefixed with `sk-ant-oat` → treated as OAuth token. */
+    anthropicApiKey?: string;
+    /** Alternative: explicit auth token (takes precedence over anthropicApiKey) */
+    anthropicAuthToken?: string;
+    /** Backend URL for the openclaw-backend MCP server entry */
+    backendUrl?: string;
+    /** Bearer token for the openclaw-backend MCP server */
+    agentToken?: string;
+    /** Content of CLAUDE.md to write into the workspace (persona / bootstrap) */
+    claudeMdContent?: string;
+    /** Port of the local agent-memory MCP server (defaults to 3457). */
+    memoryMcpPort?: number;
+    /** Absolute path to the `agent-controller` bin. Defaults to `agent-controller` on PATH. */
+    agentControllerBin?: string;
+    /** Override the socket path (tests). */
+    channelSocketPath?: string;
+}
+/**
+ * Write `.claude/settings.json`, `.mcp.json`, and `CLAUDE.md` into the workspace.
+ *
+ * Idempotent — overwrites each call. Mirrors the logic in
+ * `src/utils/claude-env.ts` for OAuth vs API-key auth.
+ */
+export declare function writeClaudeCodeSettings(ctx: ClaudeCodeSettingsContext): Promise<void>;
+export declare function buildSettings(ctx: ClaudeCodeSettingsContext): Record<string, unknown>;
+export declare function buildMcpJson(ctx: ClaudeCodeSettingsContext): Record<string, unknown>;

package/dist/providers/claude-code/settings-writer.js

@@ -0,0 +1,94 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { config } from '../../config.js';
+import { getAgentControllerBinPath } from '../../utils/agent-controller-bin.js';
+import { classifyAnthropicAuth } from '../../utils/anthropic-auth.js';
+import { logCollector } from '../../connection.js';
+/**
+ * Write `.claude/settings.json`, `.mcp.json`, and `CLAUDE.md` into the workspace.
+ *
+ * Idempotent — overwrites each call. Mirrors the logic in
+ * `src/utils/claude-env.ts` for OAuth vs API-key auth.
+ */
+export async function writeClaudeCodeSettings(ctx) {
+    const { workspaceDir } = ctx;
+    const dotClaude = path.join(workspaceDir, '.claude');
+    await fs.mkdir(dotClaude, { recursive: true });
+    // settings.json can embed ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY — chmod
+    // 0o600 to limit exposure on multi-user VMs.
+    await fs.writeFile(path.join(dotClaude, 'settings.json'), JSON.stringify(buildSettings(ctx), null, 2) + '\n', { mode: 0o600 });
+    await fs.writeFile(path.join(workspaceDir, '.mcp.json'), JSON.stringify(buildMcpJson(ctx), null, 2) + '\n');
+    if (ctx.claudeMdContent !== undefined) {
+        await fs.writeFile(path.join(workspaceDir, 'CLAUDE.md'), ctx.claudeMdContent);
+    }
+}
+// ---------------------------------------------------------------------------
+// Builders (exported for unit tests)
+// ---------------------------------------------------------------------------
+export function buildSettings(ctx) {
+    const permissions = { allow: ['Bash(*)', 'Read(*)', 'Write(*)', 'Edit(*)', 'mcp__*'] };
+    const auth = classifyAnthropicAuth({
+        anthropicAuthToken: ctx.anthropicAuthToken,
+        anthropicApiKey: ctx.anthropicApiKey,
+    });
+    switch (auth.kind) {
+        case 'auth_token':
+            return { permissions, env: { ANTHROPIC_AUTH_TOKEN: auth.value } };
+        case 'api_key':
+            return { permissions, env: { ANTHROPIC_API_KEY: auth.value } };
+        case 'none':
+            // No static credentials: rely on ~/.claude/.credentials.json (subscription login).
+            return { permissions };
+    }
+}
+export function buildMcpJson(ctx) {
+    const memoryPort = ctx.memoryMcpPort ?? 3457;
+    const servers = {
+        'agent-memory': {
+            type: 'http',
+            url: `http://127.0.0.1:${memoryPort}/mcp`,
+        },
+    };
+    const backendUrl = ctx.backendUrl ?? config.backendUrl;
+    const token = ctx.agentToken ?? config.agentToken;
+    if (backendUrl && token) {
+        servers['openclaw-backend'] = {
+            type: 'http',
+            url: `${backendUrl.replace(/\/+$/, '')}/mcp`,
+            headers: { Authorization: `Bearer ${token}` },
+        };
+    }
+    // Channel server — spawned by Claude Code as a stdio MCP plugin. Declares
+    // the `experimental.claude/channel` capability, so Claude routes inbound
+    // chat traffic through it (and invokes the `reply`/`edit_message` tools
+    // when it wants to reply to the user).
+    //
+    // We use a plain stdio MCP entry (Option B) rather than Claude's `--channels
+    // plugin:` install mechanism — it avoids any out-of-band plugin install
+    // step and works with stock Claude Code.
+    const explicitBin = ctx.agentControllerBin?.trim();
+    let binary;
+    if (explicitBin) {
+        binary = explicitBin;
+    }
+    else {
+        const resolved = getAgentControllerBinPath();
+        if (resolved) {
+            binary = resolved;
+        }
+        else {
+            binary = 'agent-controller';
+            logCollector?.push('agent_controller_bin_unresolved', 'warn', 'Could not resolve absolute path to agent-controller bin — falling back to PATH lookup in .mcp.json', { argv1: process.argv[1] ?? null });
+        }
+    }
+    const channelArgs = ['channel-server'];
+    if (ctx.channelSocketPath) {
+        channelArgs.push('--socket-path', ctx.channelSocketPath);
+    }
+    servers['agent-controller-channel'] = {
+        command: binary,
+        args: channelArgs,
+    };
+    return { mcpServers: servers };
+}
+//# sourceMappingURL=settings-writer.js.map

package/dist/providers/claude-code/settings-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-writer.js","sourceRoot":"","sources":["../../../src/providers/claude-code/settings-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAuBnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAA8B;IAC1E,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAClD,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EACpC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAClD,CAAC;IAEF,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,MAAM,UAAU,aAAa,CAAC,GAA8B;IAC1D,MAAM,WAAW,GAAG,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEvF,MAAM,IAAI,GAAG,qBAAqB,CAAC;QACjC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;QAC1C,eAAe,EAAE,GAAG,CAAC,eAAe;KACrC,CAAC,CAAC;IAEH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACjE,KAAK,MAAM;YACT,mFAAmF;YACnF,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAA8B;IACzD,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC;IAC7C,MAAM,OAAO,GAA4B;QACvC,cAAc,EAAE;YACd,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,oBAAoB,UAAU,MAAM;SAC1C;KACF,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,CAAC;IAClD,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,kBAAkB,CAAC,GAAG;YAC5B,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,uCAAuC;IACvC,EAAE;IACF,6EAA6E;IAC7E,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,WAAW,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,MAAc,CAAC;IACnB,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,GAAG,WAAW,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,yBAAyB,EAAE,CAAC;QAC7C,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,QAAQ,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,kBAAkB,CAAC;YAC5B,YAAY,EAAE,IAAI,CAChB,iCAAiC,EACjC,MAAM,EACN,oGAAoG,EACpG,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAa,CAAC,gBAAgB,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,WAAW,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,CAAC,0BAA0B,CAAC,GAAG;QACpC,OAAO,EAAE,MAAM;QACf,IAAI,EAAE,WAAW;KAClB,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC"}

package/dist/providers/claude-code/socket-bridge.d.ts

@@ -0,0 +1,98 @@
+import { EventEmitter } from 'node:events';
+import type { ChannelReply, ChannelMessageMeta, ChannelReplyMeta } from './channel-server.js';
+/**
+ * Unix-domain-socket bridge between the main agent-controller process and the
+ * channel-server worker that holds Claude Code's stdio MCP channel.
+ *
+ * Protocol: newline-delimited JSON. Ops:
+ *   { op: "hello", pid }                                    — worker → main
+ *   { op: "reply", content, meta }                          — worker → main (Claude reply tool)
+ *   { op: "edit",  content, meta }                          — worker → main (Claude edit_message tool)
+ *   { op: "push",  content, meta }                          — main   → worker (inbound chat msg)
+ *
+ * Liberal parsing: malformed lines are logged + dropped (never crash the link).
+ */
+export declare const DEFAULT_SOCKET_PATH: string;
+/**
+ * Feed a chunk into a newline-delimited JSON accumulator. Returns the updated
+ * buffer (remaining, unterminated partial line) after invoking `onMessage`
+ * for each completed line that parses as JSON. Malformed lines invoke
+ * `onBadLine` (if provided) and are dropped.
+ *
+ * Extracted so the ChannelBridgeServer and ChannelBridgeClient can share
+ * the identical framing logic without duplication.
+ */
+export declare function ingestNdjsonLines<T>(buf: string, chunk: string, onMessage: (msg: Partial<T>) => void, onBadLine?: () => void): string;
+export type SocketOp = {
+    op: 'hello';
+    pid: number;
+} | {
+    op: 'reply';
+    content: string;
+    meta: ChannelReplyMeta;
+} | {
+    op: 'edit';
+    content: string;
+    meta: ChannelReplyMeta;
+} | {
+    op: 'push';
+    content: string;
+    meta: ChannelMessageMeta;
+};
+export interface ChannelBridgeServerEvents {
+    connect: [pid: number | null];
+    reply: [content: string, meta: ChannelReplyMeta, tool: 'reply' | 'edit_message'];
+    close: [];
+    error: [err: Error];
+}
+/**
+ * Server side — lives in the main agent-controller process.
+ *
+ * Accepts exactly one worker connection (extras are rejected + closed). Emits
+ * reply/edit ops; callers invoke `push(content, meta)` to emit an inbound
+ * chat message to the worker.
+ */
+export declare class ChannelBridgeServer extends EventEmitter {
+    private readonly opts;
+    private server;
+    private active;
+    private buf;
+    constructor(opts?: {
+        socketPath?: string;
+    });
+    get socketPath(): string;
+    listen(): Promise<void>;
+    private handleConnection;
+    private ingest;
+    private dispatch;
+    /** Push an inbound chat message to the worker (→ Claude MCP notification). */
+    push(content: string, meta: ChannelMessageMeta): void;
+    private write;
+    close(): Promise<void>;
+    isConnected(): boolean;
+}
+/**
+ * Client side — lives in the channel-server worker subprocess.
+ *
+ * Connects to the bridge socket with retry/backoff (up to 30s). Parses
+ * incoming `push` ops and forwards outgoing `reply`/`edit` ops.
+ */
+export declare class ChannelBridgeClient extends EventEmitter {
+    private readonly opts;
+    private sock;
+    private buf;
+    private closed;
+    constructor(opts?: {
+        socketPath?: string;
+        maxWaitMs?: number;
+    });
+    get socketPath(): string;
+    connect(): Promise<void>;
+    private connectOnce;
+    sendHello(pid: number): void;
+    sendReply(content: string, meta: ChannelReplyMeta, tool: 'reply' | 'edit_message'): void;
+    private ingest;
+    private write;
+    close(): void;
+}
+export type { ChannelReply, ChannelMessageMeta, ChannelReplyMeta };

package/dist/providers/claude-code/socket-bridge.js

@@ -0,0 +1,301 @@
+import net from 'node:net';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { EventEmitter } from 'node:events';
+import { logCollector } from '../../connection.js';
+import { toErrorMessage } from '../../utils/response.js';
+/**
+ * Unix-domain-socket bridge between the main agent-controller process and the
+ * channel-server worker that holds Claude Code's stdio MCP channel.
+ *
+ * Protocol: newline-delimited JSON. Ops:
+ *   { op: "hello", pid }                                    — worker → main
+ *   { op: "reply", content, meta }                          — worker → main (Claude reply tool)
+ *   { op: "edit",  content, meta }                          — worker → main (Claude edit_message tool)
+ *   { op: "push",  content, meta }                          — main   → worker (inbound chat msg)
+ *
+ * Liberal parsing: malformed lines are logged + dropped (never crash the link).
+ */
+export const DEFAULT_SOCKET_PATH = path.join(os.homedir(), '.openclaw', 'claude-channel.sock');
+/**
+ * Feed a chunk into a newline-delimited JSON accumulator. Returns the updated
+ * buffer (remaining, unterminated partial line) after invoking `onMessage`
+ * for each completed line that parses as JSON. Malformed lines invoke
+ * `onBadLine` (if provided) and are dropped.
+ *
+ * Extracted so the ChannelBridgeServer and ChannelBridgeClient can share
+ * the identical framing logic without duplication.
+ */
+export function ingestNdjsonLines(buf, chunk, onMessage, onBadLine) {
+    let updated = buf + chunk;
+    let idx;
+    while ((idx = updated.indexOf('\n')) >= 0) {
+        const line = updated.slice(0, idx).trim();
+        updated = updated.slice(idx + 1);
+        if (!line)
+            continue;
+        try {
+            onMessage(JSON.parse(line));
+        }
+        catch {
+            onBadLine?.();
+        }
+    }
+    return updated;
+}
+/**
+ * Server side — lives in the main agent-controller process.
+ *
+ * Accepts exactly one worker connection (extras are rejected + closed). Emits
+ * reply/edit ops; callers invoke `push(content, meta)` to emit an inbound
+ * chat message to the worker.
+ */
+export class ChannelBridgeServer extends EventEmitter {
+    opts;
+    server = null;
+    active = null;
+    buf = '';
+    constructor(opts = {}) {
+        super();
+        this.opts = opts;
+        // Default no-op 'error' listener so re-emitting a server error never turns
+        // into an unhandled-exception process crash if no external listener is
+        // registered. External callers can still attach their own listener.
+        this.on('error', () => {
+            /* no-op */
+        });
+    }
+    get socketPath() {
+        return this.opts.socketPath ?? DEFAULT_SOCKET_PATH;
+    }
+    async listen() {
+        const p = this.socketPath;
+        await fs.promises.mkdir(path.dirname(p), { recursive: true });
+        // Best-effort: remove stale socket file from a previous crash.
+        try {
+            await fs.promises.unlink(p);
+        }
+        catch {
+            /* not present */
+        }
+        return new Promise((resolve, reject) => {
+            const srv = net.createServer((sock) => this.handleConnection(sock));
+            let bound = false;
+            // Single error handler — before bind completes, a listen error rejects
+            // the promise; after bind, it's a runtime error emitted to listeners.
+            // This removes the previous two-listener dance (once + on) and the
+            // brittle cross-removeListener cleanup on success.
+            const onError = (err) => {
+                if (!bound) {
+                    reject(err);
+                    return;
+                }
+                logCollector?.push('channel_bridge_error', 'error', `bridge server error: ${err.message}`);
+                this.emit('error', err);
+            };
+            srv.on('error', onError);
+            srv.listen(p, () => {
+                bound = true;
+                this.server = srv;
+                logCollector?.push('channel_bridge_listening', 'info', `channel bridge on ${p}`);
+                resolve();
+            });
+        });
+    }
+    handleConnection(sock) {
+        if (this.active) {
+            // Reject extras — we expect exactly one worker.
+            logCollector?.push('channel_bridge_reject_extra', 'warn', 'extra worker connection rejected — one worker already active');
+            try {
+                sock.end();
+            }
+            catch {
+                /* ignore */
+            }
+            return;
+        }
+        this.active = sock;
+        sock.setEncoding('utf8');
+        sock.on('data', (chunk) => this.ingest(String(chunk)));
+        sock.on('close', () => {
+            this.active = null;
+            this.buf = '';
+            logCollector?.push('channel_bridge_closed', 'info', 'worker connection closed');
+            this.emit('close');
+        });
+        sock.on('error', (err) => {
+            logCollector?.push('channel_bridge_sock_error', 'warn', `worker socket error: ${err.message}`);
+        });
+    }
+    ingest(chunk) {
+        this.buf = ingestNdjsonLines(this.buf, chunk, (msg) => this.dispatch(msg), () => logCollector?.push('channel_bridge_bad_line', 'warn', 'dropped malformed bridge line'));
+    }
+    dispatch(msg) {
+        if (!msg || typeof msg !== 'object' || !msg.op)
+            return;
+        switch (msg.op) {
+            case 'hello': {
+                const pid = typeof msg.pid === 'number' ? msg.pid : null;
+                logCollector?.push('channel_bridge_hello', 'info', `worker hello pid=${pid ?? 'unknown'}`);
+                this.emit('connect', pid);
+                break;
+            }
+            case 'reply': {
+                const m = msg;
+                const content = typeof m.content === 'string' ? m.content : '';
+                const meta = (m.meta ?? {});
+                this.emit('reply', content, meta, 'reply');
+                break;
+            }
+            case 'edit': {
+                const m = msg;
+                const content = typeof m.content === 'string' ? m.content : '';
+                const meta = (m.meta ?? {});
+                this.emit('reply', content, meta, 'edit_message');
+                break;
+            }
+            default:
+                logCollector?.push('channel_bridge_unknown_op', 'warn', `unknown op: ${String(msg.op)}`);
+        }
+    }
+    /** Push an inbound chat message to the worker (→ Claude MCP notification). */
+    push(content, meta) {
+        this.write({ op: 'push', content, meta });
+    }
+    write(op) {
+        if (!this.active) {
+            logCollector?.push('channel_bridge_no_worker', 'warn', `dropped op ${op.op} — no worker`);
+            return;
+        }
+        try {
+            this.active.write(JSON.stringify(op) + '\n');
+        }
+        catch (err) {
+            logCollector?.push('channel_bridge_write_error', 'warn', `write ${op.op} failed: ${toErrorMessage(err)}`);
+        }
+    }
+    async close() {
+        try {
+            this.active?.end();
+        }
+        catch {
+            /* ignore */
+        }
+        this.active = null;
+        if (!this.server)
+            return;
+        const srv = this.server;
+        this.server = null;
+        await new Promise((resolve) => srv.close(() => resolve()));
+        try {
+            await fs.promises.unlink(this.socketPath);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    isConnected() {
+        return !!this.active;
+    }
+}
+/**
+ * Client side — lives in the channel-server worker subprocess.
+ *
+ * Connects to the bridge socket with retry/backoff (up to 30s). Parses
+ * incoming `push` ops and forwards outgoing `reply`/`edit` ops.
+ */
+export class ChannelBridgeClient extends EventEmitter {
+    opts;
+    sock = null;
+    buf = '';
+    closed = false;
+    constructor(opts = {}) {
+        super();
+        this.opts = opts;
+    }
+    get socketPath() {
+        return this.opts.socketPath ?? DEFAULT_SOCKET_PATH;
+    }
+    async connect() {
+        const maxWait = this.opts.maxWaitMs ?? 30_000;
+        const started = Date.now();
+        let attempt = 0;
+        // Retry with capped exponential backoff while the main process comes up.
+        while (true) {
+            try {
+                await this.connectOnce();
+                return;
+            }
+            catch (err) {
+                if (Date.now() - started > maxWait) {
+                    throw err instanceof Error ? err : new Error(String(err));
+                }
+                attempt += 1;
+                const delay = Math.min(2000, 100 * 2 ** Math.min(attempt, 6));
+                await new Promise((r) => setTimeout(r, delay));
+            }
+        }
+    }
+    connectOnce() {
+        return new Promise((resolve, reject) => {
+            const s = net.createConnection({ path: this.socketPath });
+            const onError = (err) => {
+                s.removeAllListeners();
+                reject(err);
+            };
+            s.once('error', onError);
+            s.once('connect', () => {
+                s.removeListener('error', onError);
+                s.setEncoding('utf8');
+                this.sock = s;
+                s.on('data', (chunk) => this.ingest(String(chunk)));
+                s.on('close', () => {
+                    this.sock = null;
+                    this.buf = '';
+                    if (!this.closed)
+                        this.emit('close');
+                });
+                s.on('error', (err) => this.emit('error', err));
+                resolve();
+            });
+        });
+    }
+    sendHello(pid) {
+        this.write({ op: 'hello', pid });
+    }
+    sendReply(content, meta, tool) {
+        this.write({ op: tool === 'edit_message' ? 'edit' : 'reply', content, meta });
+    }
+    ingest(chunk) {
+        this.buf = ingestNdjsonLines(this.buf, chunk, (msg) => {
+            if (msg && msg.op === 'push') {
+                const m = msg;
+                const content = typeof m.content === 'string' ? m.content : '';
+                const meta = (m.meta ?? {});
+                this.emit('push', content, meta);
+            }
+        });
+    }
+    write(op) {
+        if (!this.sock)
+            return;
+        try {
+            this.sock.write(JSON.stringify(op) + '\n');
+        }
+        catch {
+            /* ignore — socket will emit close/error */
+        }
+    }
+    close() {
+        this.closed = true;
+        try {
+            this.sock?.end();
+        }
+        catch {
+            /* ignore */
+        }
+        this.sock = null;
+    }
+}
+//# sourceMappingURL=socket-bridge.js.map