@openclaw-cloud/agent-controller 3.6.2 → 3.6.3

package/dist/utils/backup-push.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup-push.js","sourceRoot":"","sources":["../../src/utils/backup-push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAa,EAAE,OAAe;IACtE,iDAAiD;IACjD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExE,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,iBAAiB;QACjB,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtE,yBAAyB;YACzB,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,uDAAuD;YACvD,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}
+{"version":3,"file":"backup-push.js","sourceRoot":"","sources":["../../src/utils/backup-push.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7C,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAa,EAAE,OAAe;IACtE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAEtE,MAAM,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC"}

package/dist/utils/claude-env.d.ts

@@ -1,11 +1,2 @@
-/**
- * Write ~/.claude/settings.json, ~/.claude/cc-notify.sh, and auth-profiles.json
- * from a flat env vars dict (ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL).
- *
- * This is a WHOLESALE rewrite of the user's Claude settings, so it is gated on
- * the install being managed ('vm'/'k8s'). The guard lives here rather than in
- * the callers deliberately: it is defense in depth that holds for every current
- * and future caller. `agent-controller bootstrap` on a developer laptop once
- * blew away ~/.claude/settings.json — that must not be re-reachable.
- */
+/** Guard wholesale Claude settings writes here, so every caller protects third-party user config. */
 export declare function writeClaudeEnv(envVars: Record<string, string>): Promise<void>;

package/dist/utils/claude-env.js

@@ -39,16 +39,7 @@ MSG="\${MSG:0:500}"
 openclaw system event --text "$MSG" --mode now 2>/dev/null &
 exit 0
 `;
-/**
- * Write ~/.claude/settings.json, ~/.claude/cc-notify.sh, and auth-profiles.json
- * from a flat env vars dict (ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL).
- *
- * This is a WHOLESALE rewrite of the user's Claude settings, so it is gated on
- * the install being managed ('vm'/'k8s'). The guard lives here rather than in
- * the callers deliberately: it is defense in depth that holds for every current
- * and future caller. `agent-controller bootstrap` on a developer laptop once
- * blew away ~/.claude/settings.json — that must not be re-reachable.
- */
+/** Guard wholesale Claude settings writes here, so every caller protects third-party user config. */
 export async function writeClaudeEnv(envVars) {
     if (!isManagedDeploy()) {
         console.log(`[claude-env] skipped: not a managed install (deployType=${getResolvedDeployType() ?? 'unknown'})`);
@@ -56,7 +47,6 @@ export async function writeClaudeEnv(envVars) {
     }
     const claudeDir = path.join(os.homedir(), '.claude');
     await fs.mkdir(claudeDir, { recursive: true });
-    // Write cc-notify.sh
     const notifyPath = path.join(claudeDir, 'cc-notify.sh');
     await fs.writeFile(notifyPath, CC_NOTIFY_SH);
     await fs.chmod(notifyPath, 0o755);
@@ -80,8 +70,7 @@ export async function writeClaudeEnv(envVars) {
     // anthropicAuthToken input); an `auth_token` classification here always
     // means "the API key was in fact an OAuth token".
     const settings = auth.kind === 'auth_token'
-        ? // OAuth token flow: ANTHROPIC_AUTH_TOKEN, no apiKeyHelper, no ANTHROPIC_BASE_URL
-            { ...buildClaudeSettings(auth), hooks }
+        ? { ...buildClaudeSettings(auth), hooks }
         : // API key flow (default): the key is NOT embedded — apiKeyHelper reads it
             // out of the VM .env at runtime — so this branch cannot use the shared
             // `env` variant. Optional ANTHROPIC_BASE_URL rides along.
@@ -95,6 +84,5 @@ export async function writeClaudeEnv(envVars) {
             };
     // Contains ANTHROPIC_AUTH_TOKEN on OAuth flow — chmod 0o600.
     await fs.writeFile(path.join(claudeDir, 'settings.json'), JSON.stringify(settings, null, 2) + '\n', { mode: 0o600 });
-    // auth-profiles.json is now written by applyBootstrapConfig from openclaw.json
 }
 //# sourceMappingURL=claude-env.js.map

package/dist/utils/claude-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"claude-env.js","sourceRoot":"","sources":["../../src/utils/claude-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE1E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCpB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA+B;IAClE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,2DAA2D,qBAAqB,EAAE,IAAI,SAAS,GAAG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,qBAAqB;IACrB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5C,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;aACnF;SACF;QACD,YAAY,EAAE;YACZ;gBACE,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;aAC3F;SACF;KACF,CAAC;IAEF,iEAAiE;IACjE,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,YAAY;QACxB,CAAC,CAAC,iFAAiF;YACjF,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE;QACzC,CAAC,CAAC,0EAA0E;YAC1E,uEAAuE;YACvE,0DAA0D;YAC1D;gBACE,WAAW,EAAE,kBAAkB;gBAC/B,YAAY,EACV,uFAAuF;gBACzF,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;gBACP,KAAK;aACN,CAAC;IAER,6DAA6D;IAC7D,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IAEF,+EAA+E;AACjF,CAAC"}
+{"version":3,"file":"claude-env.js","sourceRoot":"","sources":["../../src/utils/claude-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE1E,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCpB,CAAC;AAEF,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA+B;IAClE,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CACT,2DAA2D,qBAAqB,EAAE,IAAI,SAAS,GAAG,CACnG,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAElC,MAAM,IAAI,GAAG,qBAAqB,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAEnF,MAAM,KAAK,GAAG;QACZ,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC5C,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,EAAE;YACJ;gBACE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;aACnF;SACF;QACD,YAAY,EAAE;YACZ;gBACE,OAAO,EAAE,mBAAmB;gBAC5B,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;aAC3F;SACF;KACF,CAAC;IAEF,iEAAiE;IACjE,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,QAAQ,GACZ,IAAI,CAAC,IAAI,KAAK,YAAY;QACxB,CAAC,CAAC,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE;QACzC,CAAC,CAAC,0EAA0E;YAC1E,uEAAuE;YACvE,0DAA0D;YAC1D;gBACE,WAAW,EAAE,kBAAkB;gBAC/B,YAAY,EACV,uFAAuF;gBACzF,GAAG,CAAC,OAAO,CAAC,kBAAkB;oBAC5B,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;gBACP,KAAK;aACN,CAAC;IAER,6DAA6D;IAC7D,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACxC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC"}

package/dist/utils/config-merge-paths.d.ts

@@ -1,48 +1,10 @@
-/**
- * Allowlist of config paths from the backend bootstrap payload that are safe to
- * merge into a standalone user's existing openclaw.json.
- *
- * Each entry is a dot-separated path into `data.openclawConfig`. For dict-typed
- * values (e.g. `mcp.servers`), merging happens KEY-by-KEY — missing keys are
- * added, conflicting keys keep the local value. For leaf-ish subtrees
- * (e.g. `tools.media.audio`), the whole subtree is either written (local
- * missing) or skipped on conflict (local differs). Paths NOT in this list are
- * never touched, even if the remote bootstrap includes them.
- *
- * NOTE: `mcp.servers` is a DOTTED path — the OpenClaw CLI's modern config
- * schema nests MCP servers under `mcp.servers`, not the legacy flat
- * `mcpServers` key. Agent-controller migrates any pre-existing flat
- * `mcpServers` into `mcp.servers` and deletes the flat key (see
- * `applyMergeableConfig` in apply-config.ts and `migrateLegacyMcpServers`
- * in index.ts).
- *
- * To extend: add the path here. Keep it tight — every entry is an implicit
- * promise that merging it won't clobber user work.
- */
-/**
- * The one backend-managed section of openclaw.json. Merged REMOTE-wins per
- * server name (see `applyMergeableConfig`) and the only section whose change
- * forces a gateway restart on standalone — openclaw does not hot-reload it.
- */
+/** Only allowlisted paths may affect user-owned config. Legacy mcpServers must migrate to mcp.servers
+ * because strict schema validation rejects the flat key; see applyMergeableConfig. */
+/** Backend-managed mcp.servers is remote-wins; changed entries need a restart fallback on older builds. */
 export declare const MCP_SERVERS_PATH = "mcp.servers";
 export declare const MERGEABLE_CONFIG_PATHS: readonly string[];
 /**
- * Paths within ~/.claude/settings.json that are safe to merge from a backend
- * bootstrap payload. Everything else (apiKeyHelper, permissions, hooks, `env`,
- * user-owned keys) is left untouched.
- *
- * `env` is DELIBERATELY EXCLUDED and must never be added back. The backend's
- * `envVars` carry `ANTHROPIC_API_KEY` / `ANTHROPIC_BASE_URL`; merging them into
- * a standalone user's ~/.claude/settings.json points ALL of that user's own
- * Claude Code sessions at the platform proxy — which, when it is not running,
- * breaks Claude Code on the machine outright. That incident happened twice
- * (latest 2026-08-02) before the path was removed. Managed installs ('vm'/'k8s')
- * still get their credentials, via `writeClaudeEnv()` — not via this merge.
- *
- * NOTE: `mcp.servers` is a DOTTED path — Claude Code's modern settings.json
- * schema nests MCP servers under `mcp.servers`, not the legacy flat
- * `mcpServers` key. Agent-controller migrates any pre-existing flat
- * `mcpServers` into `mcp.servers` on first merge and deletes the flat key
- * (see `applyMergeableConfig` in apply-config.ts).
+ * Never allow env here: platform credentials would redirect the user's own Claude sessions to our proxy.
+ * Managed credentials go through writeClaudeEnv; standalone settings retain local-wins mcp.servers only.
  */
 export declare const MERGEABLE_SETTINGS_PATHS: readonly string[];

package/dist/utils/config-merge-paths.js

@@ -1,29 +1,6 @@
-/**
- * Allowlist of config paths from the backend bootstrap payload that are safe to
- * merge into a standalone user's existing openclaw.json.
- *
- * Each entry is a dot-separated path into `data.openclawConfig`. For dict-typed
- * values (e.g. `mcp.servers`), merging happens KEY-by-KEY — missing keys are
- * added, conflicting keys keep the local value. For leaf-ish subtrees
- * (e.g. `tools.media.audio`), the whole subtree is either written (local
- * missing) or skipped on conflict (local differs). Paths NOT in this list are
- * never touched, even if the remote bootstrap includes them.
- *
- * NOTE: `mcp.servers` is a DOTTED path — the OpenClaw CLI's modern config
- * schema nests MCP servers under `mcp.servers`, not the legacy flat
- * `mcpServers` key. Agent-controller migrates any pre-existing flat
- * `mcpServers` into `mcp.servers` and deletes the flat key (see
- * `applyMergeableConfig` in apply-config.ts and `migrateLegacyMcpServers`
- * in index.ts).
- *
- * To extend: add the path here. Keep it tight — every entry is an implicit
- * promise that merging it won't clobber user work.
- */
-/**
- * The one backend-managed section of openclaw.json. Merged REMOTE-wins per
- * server name (see `applyMergeableConfig`) and the only section whose change
- * forces a gateway restart on standalone — openclaw does not hot-reload it.
- */
+/** Only allowlisted paths may affect user-owned config. Legacy mcpServers must migrate to mcp.servers
+ * because strict schema validation rejects the flat key; see applyMergeableConfig. */
+/** Backend-managed mcp.servers is remote-wins; changed entries need a restart fallback on older builds. */
 export const MCP_SERVERS_PATH = 'mcp.servers';
 export const MERGEABLE_CONFIG_PATHS = [
     MCP_SERVERS_PATH,
@@ -32,23 +9,8 @@ export const MERGEABLE_CONFIG_PATHS = [
     'tools.transcription',
 ];
 /**
- * Paths within ~/.claude/settings.json that are safe to merge from a backend
- * bootstrap payload. Everything else (apiKeyHelper, permissions, hooks, `env`,
- * user-owned keys) is left untouched.
- *
- * `env` is DELIBERATELY EXCLUDED and must never be added back. The backend's
- * `envVars` carry `ANTHROPIC_API_KEY` / `ANTHROPIC_BASE_URL`; merging them into
- * a standalone user's ~/.claude/settings.json points ALL of that user's own
- * Claude Code sessions at the platform proxy — which, when it is not running,
- * breaks Claude Code on the machine outright. That incident happened twice
- * (latest 2026-08-02) before the path was removed. Managed installs ('vm'/'k8s')
- * still get their credentials, via `writeClaudeEnv()` — not via this merge.
- *
- * NOTE: `mcp.servers` is a DOTTED path — Claude Code's modern settings.json
- * schema nests MCP servers under `mcp.servers`, not the legacy flat
- * `mcpServers` key. Agent-controller migrates any pre-existing flat
- * `mcpServers` into `mcp.servers` on first merge and deletes the flat key
- * (see `applyMergeableConfig` in apply-config.ts).
+ * Never allow env here: platform credentials would redirect the user's own Claude sessions to our proxy.
+ * Managed credentials go through writeClaudeEnv; standalone settings retain local-wins mcp.servers only.
  */
 export const MERGEABLE_SETTINGS_PATHS = ['mcp.servers'];
 //# sourceMappingURL=config-merge-paths.js.map

package/dist/utils/config-merge-paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-merge-paths.js","sourceRoot":"","sources":["../../src/utils/config-merge-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;CACb,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,aAAa,CAAU,CAAC"}
+{"version":3,"file":"config-merge-paths.js","sourceRoot":"","sources":["../../src/utils/config-merge-paths.ts"],"names":[],"mappings":"AAAA;sFACsF;AACtF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,qBAAqB;CACb,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,aAAa,CAAU,CAAC"}

package/dist/utils/deploy-type.d.ts

@@ -1,16 +1,4 @@
-/**
- * Record the deployment type reported by a bootstrap payload. Ignores empty
- * values so an older backend that omits the field cannot clear a known type.
- */
 export declare function setResolvedDeployType(t?: string): void;
-/**
- * The payload-reported deployment type if one has arrived, otherwise the
- * `AGENT_DEPLOY_TYPE` env var. `undefined` means "we do not know".
- */
 export declare function getResolvedDeployType(): string | undefined;
-/**
- * True only for managed installs ('vm' / 'k8s'). Unknown deployment types
- * deliberately resolve to false — fail safe, because the expensive mistake is
- * rewriting a developer's ~/.claude/settings.json, not skipping a full apply.
- */
+/** Fail safe on unknown types: skipping full apply is safer than overwriting a user's Claude settings. */
 export declare function isManagedDeploy(): boolean;

package/dist/utils/deploy-type.js

@@ -1,32 +1,15 @@
 import { config } from '../config.js';
-/**
- * Deployment types describing a machine our platform provisioned end to end.
- * Everything else — 'standalone', 'external', or an unknown/absent type — is a
- * third-party machine whose config files we are only allowed to merge into.
- */
+/** Unknown or absent deployment types are third-party: wholesale config writes are forbidden. */
 const MANAGED_TYPES = new Set(['vm', 'k8s']);
-/** Set from the bootstrap payload; survives for the life of the process. */
 let resolvedDeployType;
-/**
- * Record the deployment type reported by a bootstrap payload. Ignores empty
- * values so an older backend that omits the field cannot clear a known type.
- */
 export function setResolvedDeployType(t) {
     if (t)
         resolvedDeployType = t;
 }
-/**
- * The payload-reported deployment type if one has arrived, otherwise the
- * `AGENT_DEPLOY_TYPE` env var. `undefined` means "we do not know".
- */
 export function getResolvedDeployType() {
     return resolvedDeployType ?? config.agentDeployType;
 }
-/**
- * True only for managed installs ('vm' / 'k8s'). Unknown deployment types
- * deliberately resolve to false — fail safe, because the expensive mistake is
- * rewriting a developer's ~/.claude/settings.json, not skipping a full apply.
- */
+/** Fail safe on unknown types: skipping full apply is safer than overwriting a user's Claude settings. */
 export function isManagedDeploy() {
     const type = getResolvedDeployType();
     return type !== undefined && MANAGED_TYPES.has(type);

package/dist/utils/deploy-type.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-type.js","sourceRoot":"","sources":["../../src/utils/deploy-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC;;;;GAIG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7C,4EAA4E;AAC5E,IAAI,kBAAsC,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC;QAAE,kBAAkB,GAAG,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,IAAI,MAAM,CAAC,eAAe,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"deploy-type.js","sourceRoot":"","sources":["../../src/utils/deploy-type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,iGAAiG;AACjG,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7C,IAAI,kBAAsC,CAAC;AAE3C,MAAM,UAAU,qBAAqB,CAAC,CAAU;IAC9C,IAAI,CAAC;QAAE,kBAAkB,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,kBAAkB,IAAI,MAAM,CAAC,eAAe,CAAC;AACtD,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,OAAO,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC"}

package/dist/utils/diagnostics.d.ts

@@ -10,11 +10,4 @@ export interface UnknownCheck {
 }
 export type DiagnosticsResult = Record<string, CheckResult | UnknownCheck>;
 export declare function isKnownCheck(key: string): boolean;
-/**
- * Run one or more diagnostic checks. Each key is looked up in ALLOWED_CHECKS;
- * unknown keys are recorded as `{ error: 'Unknown check' }` rather than
- * throwing — the WS handler and CLI both surface that to the caller.
- *
- * Pass `undefined` (or no argument) to run every allowlisted check.
- */
 export declare function runDiagnostics(checks?: string[]): Promise<DiagnosticsResult>;

package/dist/utils/diagnostics.js

@@ -1,12 +1,4 @@
 import { exec } from 'node:child_process';
-// ---------------------------------------------------------------------------
-// Shared diagnostics module — used by:
-//   - src/handlers/diagnostics.ts  (WS handler)
-//   - src/commands/diagnostics-cli.ts (CLI)
-//
-// Allowlist of diagnostic checks. Adding a new key here exposes it both via
-// WS and via the CLI automatically.
-// ---------------------------------------------------------------------------
 const DIAGNOSTICS_TIMEOUT_MS = 10_000;
 export const ALLOWED_CHECKS = {
     disk_usage: 'df -h',
@@ -32,13 +24,6 @@ function runCheck(cmd) {
         });
     });
 }
-/**
- * Run one or more diagnostic checks. Each key is looked up in ALLOWED_CHECKS;
- * unknown keys are recorded as `{ error: 'Unknown check' }` rather than
- * throwing — the WS handler and CLI both surface that to the caller.
- *
- * Pass `undefined` (or no argument) to run every allowlisted check.
- */
 export async function runDiagnostics(checks) {
     const targets = checks && checks.length > 0 ? checks : Object.keys(ALLOWED_CHECKS);
     const results = {};

package/dist/utils/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/utils/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,8EAA8E;AAC9E,uCAAuC;AACvC,gDAAgD;AAChD,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,QAAQ;IAChB,cAAc,EAAE,gCAAgC;IAChD,YAAY,EAAE,gBAAgB;IAC9B,kBAAkB,EAAE,wDAAwD;IAC5E,SAAS,EAAE,+BAA+B;CAC3C,CAAC;AAeF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvE,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,OAAO,EAAE,CAAC,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB;IACpD,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnF,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/utils/diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,UAAU,EAAE,OAAO;IACnB,WAAW,EAAE,oBAAoB;IACjC,MAAM,EAAE,QAAQ;IAChB,cAAc,EAAE,gCAAgC;IAChD,YAAY,EAAE,gBAAgB;IAC9B,kBAAkB,EAAE,wDAAwD;IAC5E,SAAS,EAAE,+BAA+B;CAC3C,CAAC;AAeF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACvE,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;gBACzB,OAAO,EAAE,CAAC,KAAK;gBACf,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAiB;IACpD,MAAM,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnF,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/exec.d.ts

@@ -1,12 +1,2 @@
-/** PATH handed to child processes: the inherited one plus {@link extraPathDirs}. */
 export declare function execPath(): string;
-/**
- * Run a command through a shell and resolve its trimmed stdout.
- *
- * `timeout` defaults to 0 (no timeout) to preserve the behaviour of existing
- * no-timeout callers (fast systemctl/launchctl/which calls); long-running
- * callers already pass an explicit timeout. The raised maxBuffer prevents
- * verbose output (e.g. `npm install -g`) from rejecting with
- * ERR_CHILD_PROCESS_STDOUT_MAXBUFFER.
- */
 export declare function execAsync(cmd: string, timeout?: number): Promise<string>;

package/dist/utils/exec.js

@@ -3,31 +3,10 @@ import path from 'node:path';
 import { config } from '../config.js';
 // 16 MB — avoid ERR_CHILD_PROCESS_STDOUT_MAXBUFFER on chatty commands like `npm install -g`.
 const DEFAULT_MAX_BUFFER = 16 * 1024 * 1024;
-/**
- * Directories APPENDED to PATH for every child process we spawn.
- *
- * Why: the binaries we shell out to (`openclaw`, `npm`) live in a global npm
- * prefix that is not on the ambient PATH in every context we run from, and a
- * missing PATH entry has cost us the fleet twice:
- *   - VM first boot: the user-data step `su - ubuntu -c "openclaw plugins
- *     install @openclaw-cloud/mcp-warmup@latest"` died with `openclaw: command
- *     not found` on a whole cohort (~/.profile exports the npm-global bin only
- *     later in the bootstrap), and the `|| echo` swallowed it.
- *   - macOS launchd: the service PATH lacks /opt/homebrew/bin, so the
- *     best-effort `openclaw gateway restart` after a config merge always failed
- *     with `/bin/sh: openclaw: command not found`.
- *
- * APPENDED, never prepended — an operator's own PATH entry still wins, so this
- * cannot hijack a deliberately pinned binary. Non-existent dirs are harmless.
- */
+/** Append missing npm/Homebrew paths for provisioner and launchd contexts; never override operator PATH priority. */
 function extraPathDirs() {
-    return [
-        path.join(config.home, '.npm-global', 'bin'), // npm prefix used by the VM provisioner
-        '/usr/local/bin',
-        '/opt/homebrew/bin', // Homebrew on Apple silicon
-    ];
+    return [path.join(config.home, '.npm-global', 'bin'), '/usr/local/bin', '/opt/homebrew/bin'];
 }
-/** PATH handed to child processes: the inherited one plus {@link extraPathDirs}. */
 export function execPath() {
     const parts = (process.env.PATH ?? '').split(path.delimiter).filter(Boolean);
     for (const dir of extraPathDirs()) {
@@ -36,15 +15,6 @@ export function execPath() {
     }
     return parts.join(path.delimiter);
 }
-/**
- * Run a command through a shell and resolve its trimmed stdout.
- *
- * `timeout` defaults to 0 (no timeout) to preserve the behaviour of existing
- * no-timeout callers (fast systemctl/launchctl/which calls); long-running
- * callers already pass an explicit timeout. The raised maxBuffer prevents
- * verbose output (e.g. `npm install -g`) from rejecting with
- * ERR_CHILD_PROCESS_STDOUT_MAXBUFFER.
- */
 export function execAsync(cmd, timeout = 0) {
     return new Promise((resolve, reject) => {
         exec(cmd, { timeout, maxBuffer: DEFAULT_MAX_BUFFER, env: { ...process.env, PATH: execPath() } }, (err, stdout) => {

package/dist/utils/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,aAAa;IACpB,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,wCAAwC;QACtF,gBAAgB;QAChB,mBAAmB,EAAE,4BAA4B;KAClD,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,OAAO,GAAG,CAAC;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CACF,GAAG,EACH,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EACrF,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/utils/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,6FAA6F;AAC7F,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5C,qHAAqH;AACrH,SAAS,aAAa;IACpB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,OAAO,GAAG,CAAC;IAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,CACF,GAAG,EACH,EAAE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,EACrF,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/utils/gateway-restart-handler.d.ts

@@ -1,10 +1,3 @@
 import type { AgentCommand, AgentResponse } from '../types.js';
-/**
- * The handler behind every command whose whole job is "restart the OpenClaw
- * gateway": `restart`, `deploy` and `onboarding_complete`. They were three
- * byte-identical copies of this wrapper.
- *
- * Emits only the domain event (`gateway_restart`) — the command lifecycle
- * events are owned by the dispatch loop in connection.ts.
- */
+/** connection.ts owns lifecycle events; emitting them here would duplicate backend log rows. */
 export declare function handleGatewayRestartCommand(command: AgentCommand): Promise<AgentResponse>;

package/dist/utils/gateway-restart-handler.js

@@ -1,13 +1,6 @@
 import { restartGateway } from './gateway-restart.js';
 import { logCollector } from '../connection.js';
-/**
- * The handler behind every command whose whole job is "restart the OpenClaw
- * gateway": `restart`, `deploy` and `onboarding_complete`. They were three
- * byte-identical copies of this wrapper.
- *
- * Emits only the domain event (`gateway_restart`) — the command lifecycle
- * events are owned by the dispatch loop in connection.ts.
- */
+/** connection.ts owns lifecycle events; emitting them here would duplicate backend log rows. */
 export async function handleGatewayRestartCommand(command) {
     logCollector?.push('gateway_restart', 'info', 'Gateway restart requested', {
         commandId: command.id,

package/dist/utils/gateway-restart-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-restart-handler.js","sourceRoot":"","sources":["../../src/utils/gateway-restart-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAqB;IACrE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,2BAA2B,EAAE;QACzE,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmD,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,OAAO;SACjB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"gateway-restart-handler.js","sourceRoot":"","sources":["../../src/utils/gateway-restart-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAqB;IACrE,YAAY,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,2BAA2B,EAAE;QACzE,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,cAAc,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SACzB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAAmD,CAAC;QAC9D,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE;YACxD,KAAK,EAAE,CAAC,CAAC,OAAO;SACjB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/gateway-restart.d.ts

@@ -2,17 +2,7 @@ export interface GatewayRestartResult {
     stdout: string;
     stderr: string;
 }
-/**
- * Restart the gateway via the configured agent provider.
- * Returns { stdout: '', stderr: '' } for interface compatibility.
- *
- * `configureProvider()` only ever runs inside the daemon's `main()`, so in
- * EVERY CLI invocation `getProvider()` is null. This used to warn and return
- * success, which made `agent-controller restart` (and the restart tail of
- * `deploy` / `agent-update` / `self-update`) a silent no-op that still exited
- * 0. We now build a throwaway provider from config instead, and throw when
- * even that is impossible so the caller can exit non-zero.
- */
+/** CLI calls lack a configured daemon provider; create a throwaway or fail instead of reporting a no-op success. */
 export declare function restartGateway(): Promise<GatewayRestartResult>;
 /**
  * @deprecated Use restartGateway() instead.

package/dist/utils/gateway-restart.js

@@ -1,16 +1,6 @@
 import { createProviderFromConfig, getProvider } from '../providers/index.js';
 import { config } from '../config.js';
-/**
- * Restart the gateway via the configured agent provider.
- * Returns { stdout: '', stderr: '' } for interface compatibility.
- *
- * `configureProvider()` only ever runs inside the daemon's `main()`, so in
- * EVERY CLI invocation `getProvider()` is null. This used to warn and return
- * success, which made `agent-controller restart` (and the restart tail of
- * `deploy` / `agent-update` / `self-update`) a silent no-op that still exited
- * 0. We now build a throwaway provider from config instead, and throw when
- * even that is impossible so the caller can exit non-zero.
- */
+/** CLI calls lack a configured daemon provider; create a throwaway or fail instead of reporting a no-op success. */
 export async function restartGateway() {
     const provider = getProvider() ?? createProviderFromConfig();
     if (!provider) {

package/dist/utils/gateway-restart.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-restart.js","sourceRoot":"","sources":["../../src/utils/gateway-restart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,WAAW,EAAE,IAAI,wBAAwB,EAAE,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,CAAC,aAAa,IAAI;YACzE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC"}
+{"version":3,"file":"gateway-restart.js","sourceRoot":"","sources":["../../src/utils/gateway-restart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,QAAQ,GAAG,WAAW,EAAE,IAAI,wBAAwB,EAAE,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,CAAC,aAAa,IAAI;YACzE,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;IACzB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC"}

package/dist/utils/knowledge-graph.d.ts

@@ -30,41 +30,18 @@ export interface MemoryDelta {
     action: MemoryDeltaAction;
     data: unknown;
 }
-/**
- * In-memory knowledge graph with atomic persistence.
- *
- * Ported from @modelcontextprotocol/server-memory with key differences:
- * - Graph stays in memory (this.graph), loaded once at init()
- * - All mutations operate on this.graph, then call persist()
- * - persist() uses atomic write: write to .tmp file, then fs.rename()
- * - Extends EventEmitter, emits 'delta' event after each mutation
- * - Query methods (readGraph, searchNodes, openNodes) are synchronous
- */
 export declare class KnowledgeGraphManager extends EventEmitter {
     private memoryFilePath;
     private graph;
     private persistQueue;
     constructor(memoryFilePath: string);
-    /** Load graph from disk into memory. Call once at startup. */
     init(): Promise<void>;
     private readGraphFromDisk;
-    /**
-     * Serialized persist: enqueues writes so concurrent calls never interleave.
-     * The queue tail swallows rejections so persistQueue is always fulfilled — a
-     * failed write never poisons the chain (the next write still runs) — while the
-     * caller of THIS write still observes its real success/failure.
-     */
+    /** Keep the queue tail fulfilled after failure so later writes run, while the failing caller still rejects. */
     private persist;
-    /**
-     * Persist after an in-memory mutation, rolling the graph back to `snapshot`
-     * if the write fails. This keeps memory consistent with disk and with the
-     * backend (which is told the mutation failed and receives no delta) instead
-     * of leaving the failed mutation in memory to land on the next write.
-     */
+    /** Roll back failed writes so memory matches disk and no unreported mutation leaks into the next persist. */
     private persistWithRollback;
-    /** Atomic persist: write to .tmp, then fs.rename(). */
     private doPersist;
-    /** Emit delta event after mutation (for sync to backend). */
     private emitDelta;
     createEntities(entities: Entity[]): Promise<Entity[]>;
     createRelations(relations: Relation[]): Promise<Relation[]>;

package/dist/utils/knowledge-graph.js

@@ -1,19 +1,6 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { EventEmitter } from 'node:events';
-// ---------------------------------------------------------------------------
-// KnowledgeGraphManager
-// ---------------------------------------------------------------------------
-/**
- * In-memory knowledge graph with atomic persistence.
- *
- * Ported from @modelcontextprotocol/server-memory with key differences:
- * - Graph stays in memory (this.graph), loaded once at init()
- * - All mutations operate on this.graph, then call persist()
- * - persist() uses atomic write: write to .tmp file, then fs.rename()
- * - Extends EventEmitter, emits 'delta' event after each mutation
- * - Query methods (readGraph, searchNodes, openNodes) are synchronous
- */
 export class KnowledgeGraphManager extends EventEmitter {
     memoryFilePath;
     graph = { entities: [], relations: [] };
@@ -22,13 +9,9 @@ export class KnowledgeGraphManager extends EventEmitter {
         super();
         this.memoryFilePath = memoryFilePath;
     }
-    /** Load graph from disk into memory. Call once at startup. */
     async init() {
         this.graph = await this.readGraphFromDisk();
     }
-    // -------------------------------------------------------------------------
-    // Disk I/O
-    // -------------------------------------------------------------------------
     async readGraphFromDisk() {
         try {
             const data = await fs.readFile(this.memoryFilePath, 'utf-8');
@@ -70,23 +53,13 @@ export class KnowledgeGraphManager extends EventEmitter {
             throw error;
         }
     }
-    /**
-     * Serialized persist: enqueues writes so concurrent calls never interleave.
-     * The queue tail swallows rejections so persistQueue is always fulfilled — a
-     * failed write never poisons the chain (the next write still runs) — while the
-     * caller of THIS write still observes its real success/failure.
-     */
+    /** Keep the queue tail fulfilled after failure so later writes run, while the failing caller still rejects. */
     persist() {
         const run = this.persistQueue.then(() => this.doPersist());
         this.persistQueue = run.then(() => undefined, () => undefined);
         return run;
     }
-    /**
-     * Persist after an in-memory mutation, rolling the graph back to `snapshot`
-     * if the write fails. This keeps memory consistent with disk and with the
-     * backend (which is told the mutation failed and receives no delta) instead
-     * of leaving the failed mutation in memory to land on the next write.
-     */
+    /** Roll back failed writes so memory matches disk and no unreported mutation leaks into the next persist. */
     async persistWithRollback(snapshot) {
         try {
             await this.persist();
@@ -96,7 +69,6 @@ export class KnowledgeGraphManager extends EventEmitter {
             throw err;
         }
     }
-    /** Atomic persist: write to .tmp, then fs.rename(). */
     async doPersist() {
         const lines = [
             ...this.graph.entities.map((e) => JSON.stringify({
@@ -112,13 +84,9 @@ export class KnowledgeGraphManager extends EventEmitter {
         await fs.writeFile(tmpPath, lines.join('\n'));
         await fs.rename(tmpPath, this.memoryFilePath);
     }
-    /** Emit delta event after mutation (for sync to backend). */
     emitDelta(action, data) {
         this.emit('delta', { action, data });
     }
-    // -------------------------------------------------------------------------
-    // Mutations — operate on this.graph, persist, emit delta
-    // -------------------------------------------------------------------------
     async createEntities(entities) {
         const newEntities = entities.filter((e) => !this.graph.entities.some((existing) => existing.name === e.name));
         const snapshot = structuredClone(this.graph);
@@ -184,9 +152,6 @@ export class KnowledgeGraphManager extends EventEmitter {
         await this.persistWithRollback(snapshot);
         this.emitDelta('relations_deleted', relations);
     }
-    // -------------------------------------------------------------------------
-    // Queries — read from this.graph in-memory, no disk I/O
-    // -------------------------------------------------------------------------
     readGraph() {
         return this.graph;
     }