@phnx-labs/agents-cli 1.20.72 → 1.20.73

package/dist/lib/hq/floor.js

@@ -0,0 +1,226 @@
+import { mailboxIdForActiveSession } from '../mailbox-target.js';
+function slug(s) {
+    return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '') || 'unknown';
+}
+function roomIdForTeam(team) {
+    return `team:${slug(team)}`;
+}
+function roomIdForMachine(machine) {
+    return `machine:${slug(machine)}`;
+}
+function agentDisplayName(session) {
+    return session.name || session.label || session.agentId || session.sessionId?.slice(0, 8) || session.kind;
+}
+function sessionMachine(session) {
+    return session.machine || session.provenance?.host || session.host || 'local';
+}
+function teamForSession(session, teammatesById) {
+    if (session.teamName)
+        return session.teamName;
+    if (session.agentId && teammatesById.has(session.agentId))
+        return teammatesById.get(session.agentId).team;
+    return undefined;
+}
+function teammateName(session, teammatesById) {
+    if (session.agentId && teammatesById.has(session.agentId)) {
+        return teammatesById.get(session.agentId).name || session.agentId.slice(0, 8);
+    }
+    return session.agentId;
+}
+function moodForSession(session, hasOpenBlock) {
+    if (session.status === 'input_required' || session.activity === 'waiting_input' || hasOpenBlock)
+        return 'waiting';
+    if (session.rateLimited)
+        return 'blocked';
+    if (session.pr)
+        return 'celebrating';
+    if (session.status === 'running' || session.activity === 'working')
+        return 'working';
+    return 'idle';
+}
+function action(id, label, command, target, extra = {}) {
+    return { id, label, command, target, ...extra };
+}
+function agentActions(agentId, session, mailboxId, team, teammate) {
+    const actions = [];
+    if (mailboxId) {
+        actions.push(action(`agent:${agentId}:message`, 'Message', ['message', mailboxId, '{message}', '--surface', 'hq'], { kind: 'agent', id: agentId }, { input: [{ name: 'message', label: 'Message', placeholder: 'What should this agent do next?', required: true }] }));
+        actions.push(action(`agent:${agentId}:stop`, 'Stop', ['feed', '--kill', mailboxId], { kind: 'agent', id: agentId }, { destructive: true }));
+    }
+    if (team && teammate) {
+        actions.push(action(`agent:${agentId}:team-stop`, 'Stop teammate', ['teams', 'stop', team, teammate], { kind: 'agent', id: agentId }, { destructive: true }));
+    }
+    if (session.sessionId) {
+        actions.push(action(`agent:${agentId}:transcript`, 'Transcript', ['sessions', session.sessionId, '--markdown'], { kind: 'agent', id: agentId }));
+    }
+    return actions;
+}
+function spawnActionForRoom(roomId, team) {
+    if (team) {
+        return action(`room:${roomId}:spawn-teammate`, 'Spawn teammate', ['teams', 'add', team, '{agent}', '{task}', '--name', '{name}', '--mode', 'edit'], { kind: 'room', id: roomId }, {
+            input: [
+                { name: 'agent', label: 'Agent', placeholder: 'claude', required: true },
+                { name: 'name', label: 'Name', placeholder: 'frontend', required: true },
+                { name: 'task', label: 'Task', placeholder: 'Implement the next scoped task', required: true },
+            ],
+        });
+    }
+    return action(`room:${roomId}:spawn-run`, 'Run agent', ['run', '{agent}', '{task}', '--name', '{name}'], { kind: 'room', id: roomId }, {
+        input: [
+            { name: 'agent', label: 'Agent', placeholder: 'claude', required: true },
+            { name: 'name', label: 'Name', placeholder: 'investigate', required: true },
+            { name: 'task', label: 'Task', placeholder: 'Investigate this room', required: true },
+        ],
+    });
+}
+export function buildHqFloor(input) {
+    const generatedAt = (input.generatedAt ?? new Date()).toISOString();
+    const teammatesById = new Map();
+    for (const [team, teammates] of input.teammatesByTeam) {
+        for (const teammate of teammates)
+            teammatesById.set(teammate.agent_id, { ...teammate, team });
+    }
+    const openBlocksByMailbox = new Map();
+    for (const block of input.blocks) {
+        const blocks = openBlocksByMailbox.get(block.mailboxId) || [];
+        blocks.push(block);
+        openBlocksByMailbox.set(block.mailboxId, blocks);
+    }
+    const rooms = new Map();
+    const ensureRoom = (room) => {
+        const existing = rooms.get(room.id);
+        if (existing)
+            return existing;
+        const created = {
+            ...room,
+            counts: { agents: 0, needsInput: 0, running: 0, failed: 0 },
+            actions: [spawnActionForRoom(room.id, room.team)],
+        };
+        rooms.set(room.id, created);
+        return created;
+    };
+    for (const team of input.teams) {
+        ensureRoom({ id: roomIdForTeam(team.task_name), kind: 'team', name: team.task_name, team: team.task_name });
+    }
+    const agents = [];
+    for (const session of input.sessions) {
+        const team = teamForSession(session, teammatesById);
+        const machine = sessionMachine(session);
+        const room = team
+            ? ensureRoom({ id: roomIdForTeam(team), kind: 'team', name: team, team })
+            : ensureRoom({ id: roomIdForMachine(machine), kind: 'machine', name: machine, machine });
+        const mailboxId = mailboxIdForActiveSession(session);
+        const blocks = mailboxId ? openBlocksByMailbox.get(mailboxId) || [] : [];
+        const id = session.agentId || session.sessionId || `${session.kind}:${agents.length + 1}`;
+        const mood = moodForSession(session, blocks.length > 0);
+        const teammate = teammateName(session, teammatesById);
+        room.counts.agents++;
+        if (mood === 'waiting')
+            room.counts.needsInput++;
+        if (session.status === 'running')
+            room.counts.running++;
+        if (mood === 'blocked')
+            room.counts.failed++;
+        agents.push({
+            id,
+            label: agentDisplayName(session),
+            agent: session.kind,
+            roomId: room.id,
+            mood,
+            status: session.status,
+            activity: session.activity,
+            preview: session.preview || session.question?.text,
+            machine,
+            team,
+            teammate,
+            sessionId: session.sessionId,
+            mailboxId,
+            pid: session.pid,
+            prUrl: session.pr?.url,
+            ticketId: session.ticket?.id,
+            actions: agentActions(id, session, mailboxId, team, teammate),
+        });
+    }
+    const ambientEvents = [];
+    for (const agent of agents) {
+        if (agent.mood === 'waiting') {
+            ambientEvents.push({
+                id: `needs-input:${agent.id}`,
+                kind: 'needs_input',
+                roomId: agent.roomId,
+                agentId: agent.id,
+                label: `${agent.label} needs input`,
+                intensity: 'high',
+            });
+        }
+        else if (agent.mood === 'blocked') {
+            ambientEvents.push({
+                id: `blocked:${agent.id}`,
+                kind: 'error',
+                roomId: agent.roomId,
+                agentId: agent.id,
+                label: `${agent.label} is blocked`,
+                intensity: 'high',
+            });
+        }
+        else if (agent.mood === 'celebrating' && agent.prUrl) {
+            ambientEvents.push({
+                id: `pr:${agent.id}`,
+                kind: 'pr',
+                roomId: agent.roomId,
+                agentId: agent.id,
+                label: `${agent.label} opened a PR`,
+                intensity: 'medium',
+            });
+        }
+    }
+    for (const room of rooms.values()) {
+        if (room.kind === 'team' && room.counts.running > 0) {
+            ambientEvents.push({
+                id: `team-active:${room.id}`,
+                kind: 'team_active',
+                roomId: room.id,
+                label: `${room.name} has ${room.counts.running} active teammate${room.counts.running === 1 ? '' : 's'}`,
+                intensity: 'low',
+            });
+        }
+        if (room.counts.agents > 0 && room.counts.running === 0 && room.counts.needsInput === 0) {
+            ambientEvents.push({
+                id: `idle:${room.id}`,
+                kind: 'idle_scene',
+                roomId: room.id,
+                label: `${room.name} is calm`,
+                intensity: 'low',
+            });
+        }
+    }
+    const floorActions = [
+        action('floor:create-team', 'Create team room', ['teams', 'create', '{team}', '--description', '{description}'], { kind: 'floor', id: 'floor' }, {
+            input: [
+                { name: 'team', label: 'Team', placeholder: 'release-squad', required: true },
+                { name: 'description', label: 'Description', placeholder: 'What this room owns' },
+            ],
+        }),
+    ];
+    const roomList = [...rooms.values()].sort((a, b) => {
+        if (a.kind !== b.kind)
+            return a.kind === 'team' ? -1 : 1;
+        return a.name.localeCompare(b.name);
+    });
+    return {
+        version: 1,
+        generatedAt,
+        counters: {
+            rooms: roomList.length,
+            agents: agents.length,
+            teams: input.teams.length,
+            needsInput: agents.filter((agent) => agent.mood === 'waiting').length,
+            failed: agents.filter((agent) => agent.mood === 'blocked').length,
+            prs: agents.filter((agent) => agent.prUrl).length,
+        },
+        rooms: roomList,
+        agents,
+        ambientEvents,
+        actions: floorActions,
+    };
+}

package/dist/lib/menubar/install-menubar.js

@@ -20,7 +20,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { getRuntimeStateDir, getHelpersDir } from '../state.js';
-import { getCliVersion } from '../version.js';
+import { getCliVersion, resolveAgentsBin, resolveInstalledLayout } from '../version.js';
 const APP_BUNDLE_NAME = 'MenubarHelper.app';
 const INSTALL_DIR_NAME = 'agents-cli';
 const SERVICE_LABEL = 'com.phnx-labs.agents-menubar';
@@ -78,6 +78,10 @@ export function menubarServiceInstalled() {
  *   1. dist/lib/menubar/MenubarHelper.app — npm install layout (sibling of this file)
  *   2. <repo>/bin/MenubarHelper.app       — raw working tree (tsx/dev)
  *   3. apps/cli/menubar/dist/MenubarHelper.app — fresh local build
+ *   4. <on-disk install>/dist/lib/menubar/MenubarHelper.app — Bun single-file
+ *      binary: `import.meta.url` is a virtual `/$bunfs/` path, so the sibling
+ *      candidates above can't see the on-disk bundle; recover it via the
+ *      `agents` launcher symlink.
  */
 function sourceAppPath() {
     const candidates = [];
@@ -94,25 +98,15 @@ function sourceAppPath() {
         if (fs.existsSync(c))
             return c;
     }
-    return null;
-}
-/** Resolve the `agents` launcher binary on PATH-less GUI processes. */
-function resolveAgentsBin() {
-    const home = os.homedir();
-    const candidates = [
-        path.join(home, '.local', 'bin', 'agents'),
-        '/opt/homebrew/bin/agents',
-        '/usr/local/bin/agents',
-        path.join(home, '.npm-global', 'bin', 'agents'),
-    ];
-    for (const c of candidates) {
-        try {
-            fs.accessSync(c, fs.constants.X_OK);
-            return c;
-        }
-        catch {
-            /* try next */
-        }
+    // Candidate 4 — only reached when the sibling candidates miss (the Bun
+    // single-file binary, whose `import.meta.url` is a virtual `/$bunfs/` path).
+    // Resolve the launcher symlink lazily so the common Node path pays no extra
+    // filesystem probe.
+    const layout = resolveInstalledLayout();
+    if (layout) {
+        const p = path.join(layout.distDir, 'lib', 'menubar', APP_BUNDLE_NAME);
+        if (fs.existsSync(p))
+            return p;
     }
     return null;
 }

package/dist/lib/notify.d.ts

@@ -11,6 +11,7 @@ export interface NotifyResult {
     skipped?: boolean;
     error?: string;
 }
+export declare function formatUrgentBlockMessage(block: OpenBlock): string;
 /** Build openclaw argv for urgent notify (exported for tests). */
 export declare function buildOpenClawNotifyArgs(text: string, options?: Pick<NotifyOptions, 'channel' | 'account' | 'target'>): string[];
 export declare function notifyUrgentBlock(block: OpenBlock, options?: NotifyOptions): Promise<NotifyResult>;

package/dist/lib/notify.js

@@ -9,14 +9,14 @@
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 const execFileAsync = promisify(execFile);
-function formatBlock(block) {
+export function formatUrgentBlockMessage(block) {
     const q = block.questions[0];
     const header = q?.header ? `[${q.header}] ` : '';
     const text = q?.text ?? 'Agent needs input';
     const host = block.host ? ` on ${block.host}` : '';
     const cls = block.blockClass ?? 'approval';
     const cost = block.costOfDelay ?? 'low';
-    return `🚨 ${cls.toUpperCase()}${host} — ${header}${text} (cost: ${cost}, id: ${block.blockId})`;
+    return `URGENT ${cls.toUpperCase()}${host}: ${header}${text} (cost: ${cost}, id: ${block.blockId})`;
 }
 /** Build openclaw argv for urgent notify (exported for tests). */
 export function buildOpenClawNotifyArgs(text, options = {}) {
@@ -50,7 +50,7 @@ export async function notifyUrgentBlock(block, options = {}) {
     catch {
         return { ok: false, error: 'openclaw CLI not found on PATH' };
     }
-    const text = formatBlock(block);
+    const text = formatUrgentBlockMessage(block);
     try {
         await execFileAsync('openclaw', buildOpenClawNotifyArgs(text, options));
         return { ok: true };

package/dist/lib/open-url.d.ts

@@ -0,0 +1,2 @@
+/** Best-effort: open a URL in the user's default browser. Never throws. */
+export declare function openUrl(url: string): void;

package/dist/lib/open-url.js

@@ -0,0 +1,19 @@
+/**
+ * Open a URL in the user's default browser, cross-platform. Best-effort and
+ * detached — never throws and never blocks the caller. Shared by `agents lease`
+ * (Hetzner console) and `agents fleet login` (the local login dashboard).
+ */
+import { spawn } from 'child_process';
+/** Best-effort: open a URL in the user's default browser. Never throws. */
+export function openUrl(url) {
+    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const p = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        p.on('error', () => { });
+        p.unref();
+    }
+    catch {
+        /* best-effort */
+    }
+}

package/dist/lib/openclaw-keychain.d.ts

@@ -0,0 +1,56 @@
+import { type SpawnSyncOptions } from 'child_process';
+export declare const OPENCLAW_KEYCHAIN_ACCOUNT = "openclaw";
+export declare const OPENCLAW_KEYCHAIN_PROVIDER = "agents_keychain";
+export declare const OPENCLAW_KEYCHAIN_ENV_SERVICES: Record<string, string>;
+export interface OpenClawSecretRef {
+    source: 'exec';
+    provider: string;
+    id: string;
+}
+export interface OpenClawKeychainMigrationOptions {
+    account?: string;
+    provider?: string;
+    agentsBin?: string;
+}
+export interface OpenClawKeychainMigrationResult {
+    services: Array<{
+        envKey: string;
+        service: string;
+        value: string;
+    }>;
+    replacedPaths: string[];
+    removedEnvPaths: string[];
+    unsupportedEnvKeys: string[];
+    changed: boolean;
+}
+interface JsonObject {
+    [key: string]: unknown;
+}
+export declare function migrateOpenClawConfigToKeychainRefs(config: JsonObject, opts?: OpenClawKeychainMigrationOptions): OpenClawKeychainMigrationResult;
+export declare function buildOpenClawKeychainStoreInvocation(service: string, value: string, account?: string): {
+    command: string;
+    args: string[];
+    options: SpawnSyncOptions & {
+        input: string;
+        detached: boolean;
+    };
+};
+export declare function storeOpenClawKeychainServices(services: Array<{
+    service: string;
+    value: string;
+}>, account?: string): void;
+export declare function readOpenClawKeychainService(service: string, account?: string): string;
+export interface OpenClawExecResolverRequest {
+    protocolVersion?: number;
+    provider?: string;
+    ids?: unknown;
+}
+export interface OpenClawExecResolverResponse {
+    protocolVersion: 1;
+    values: Record<string, string>;
+    errors?: Record<string, {
+        code: string;
+    }>;
+}
+export declare function resolveOpenClawKeychainRequest(request: OpenClawExecResolverRequest, lookup: (service: string) => string): OpenClawExecResolverResponse;
+export {};

package/dist/lib/openclaw-keychain.js

@@ -0,0 +1,236 @@
+import { execFileSync, spawnSync } from 'child_process';
+import { getCliLaunch } from './cli-entry.js';
+import { buildAddGenericPasswordArgs, buildAddGenericPasswordSpawnOptions, } from './secrets/index.js';
+export const OPENCLAW_KEYCHAIN_ACCOUNT = 'openclaw';
+export const OPENCLAW_KEYCHAIN_PROVIDER = 'agents_keychain';
+export const OPENCLAW_KEYCHAIN_ENV_SERVICES = {
+    OPENROUTER_API_KEY: 'openrouter-api-key',
+    LINEAR_API_KEY: 'linear-api-key',
+    GRAFANA_API_KEY: 'grafana-api-key',
+    POSTHOG_API_KEY: 'posthog-api-key',
+};
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function secretRef(provider, service) {
+    return { source: 'exec', provider, id: service };
+}
+function openClawPath(parts) {
+    return parts.join('.');
+}
+function collectOpenClawEnv(config) {
+    const env = isRecord(config.env) ? config.env : null;
+    const out = new Map();
+    if (!env)
+        return out;
+    for (const [key, service] of Object.entries(OPENCLAW_KEYCHAIN_ENV_SERVICES)) {
+        void service;
+        const top = env[key];
+        if (typeof top === 'string' && top.trim()) {
+            out.set(key, { path: ['env', key], value: top });
+            continue;
+        }
+        const vars = isRecord(env.vars) ? env.vars : null;
+        const nested = vars?.[key];
+        if (typeof nested === 'string' && nested.trim()) {
+            out.set(key, { path: ['env', 'vars', key], value: nested });
+        }
+    }
+    return out;
+}
+function deletePath(config, parts) {
+    let current = config;
+    for (const part of parts.slice(0, -1)) {
+        if (!isRecord(current))
+            return false;
+        current = current[part];
+    }
+    if (!isRecord(current))
+        return false;
+    const key = parts[parts.length - 1];
+    if (!(key in current))
+        return false;
+    delete current[key];
+    return true;
+}
+function normalizeObject(value) {
+    return isRecord(value) ? value : {};
+}
+function ensureOpenClawKeychainProvider(config, opts, agentsBin) {
+    const launch = getCliLaunch(['secrets', 'openclaw-keychain', 'resolve', '--account', opts.account], agentsBin);
+    const secrets = normalizeObject(config.secrets);
+    const providers = normalizeObject(secrets.providers);
+    providers[opts.provider] = {
+        source: 'exec',
+        command: launch.command,
+        args: launch.args,
+        jsonOnly: true,
+    };
+    secrets.providers = providers;
+    config.secrets = secrets;
+}
+function providerEnvKeyForPath(parts) {
+    if (parts.length === 8 &&
+        parts[0] === 'plugins' &&
+        parts[1] === 'entries' &&
+        parts[3] === 'config' &&
+        parts[4] === 'mcpServers' &&
+        parts[6] === 'env') {
+        return parts[7];
+    }
+    return null;
+}
+function serviceForSupportedPath(parts) {
+    const envKey = providerEnvKeyForPath(parts);
+    if (envKey)
+        return OPENCLAW_KEYCHAIN_ENV_SERVICES[envKey] ?? null;
+    if (parts.length === 4 && parts[0] === 'models' && parts[1] === 'providers' && parts[3] === 'apiKey') {
+        if (parts[2] === 'openrouter')
+            return OPENCLAW_KEYCHAIN_ENV_SERVICES.OPENROUTER_API_KEY;
+    }
+    return null;
+}
+function envKeyForService(service) {
+    return Object.entries(OPENCLAW_KEYCHAIN_ENV_SERVICES).find(([, known]) => known === service)?.[0] ?? service;
+}
+function assertSameOpenClawSecretValue(envKey, service, existingPath, existingValue, nextPath, nextValue) {
+    if (existingValue === nextValue)
+        return;
+    throw new Error(`OpenClaw credential value mismatch for ${envKey} (${service}): ${existingPath} and ${nextPath} differ. ` +
+        `Resolve the plaintext values before migrating to Keychain.`);
+}
+function canReplaceByValue(parts) {
+    if (parts.length === 4 && parts[0] === 'models' && parts[1] === 'providers' && parts[3] === 'apiKey')
+        return true;
+    if (parts.length === 6 && parts[0] === 'plugins' && parts[1] === 'entries' && parts[3] === 'config' && parts[4] === 'webSearch' && parts[5] === 'apiKey')
+        return true;
+    if (parts.length === 5 && parts[0] === 'tools' && parts[1] === 'web' && parts[2] === 'search' && parts[4] === 'apiKey')
+        return true;
+    if (parts.length === 4 && parts[0] === 'tools' && parts[1] === 'web' && parts[2] === 'search' && parts[3] === 'apiKey')
+        return true;
+    return providerEnvKeyForPath(parts) !== null;
+}
+function replaceSupportedSecrets(current, parts, provider, envByValue, env, services, servicePaths, replacedPaths) {
+    if (!isRecord(current) && !Array.isArray(current))
+        return;
+    const entries = Array.isArray(current)
+        ? current.map((value, index) => [String(index), value])
+        : Object.entries(current);
+    for (const [key, value] of entries) {
+        const childParts = [...parts, key];
+        if (typeof value === 'string' && value.trim() && canReplaceByValue(childParts)) {
+            const directService = serviceForSupportedPath(childParts);
+            const matchedService = directService ?? envByValue.get(value);
+            if (matchedService) {
+                const envKey = envKeyForService(matchedService);
+                const childPath = openClawPath(childParts);
+                const existingService = services.get(matchedService);
+                if (existingService) {
+                    assertSameOpenClawSecretValue(envKey, matchedService, servicePaths.get(matchedService) ?? matchedService, existingService.value, childPath, value);
+                }
+                if (directService) {
+                    const envEntry = env.get(envKey);
+                    if (envEntry) {
+                        assertSameOpenClawSecretValue(envKey, matchedService, openClawPath(envEntry.path), envEntry.value, childPath, value);
+                    }
+                }
+                services.set(matchedService, { envKey, service: matchedService, value });
+                servicePaths.set(matchedService, childPath);
+                current[key] = secretRef(provider, matchedService);
+                replacedPaths.push(childPath);
+                continue;
+            }
+        }
+        replaceSupportedSecrets(value, childParts, provider, envByValue, env, services, servicePaths, replacedPaths);
+    }
+}
+export function migrateOpenClawConfigToKeychainRefs(config, opts = {}) {
+    const account = opts.account ?? OPENCLAW_KEYCHAIN_ACCOUNT;
+    const provider = opts.provider ?? OPENCLAW_KEYCHAIN_PROVIDER;
+    const env = collectOpenClawEnv(config);
+    const envByValue = new Map();
+    for (const [envKey, entry] of env) {
+        envByValue.set(entry.value, OPENCLAW_KEYCHAIN_ENV_SERVICES[envKey]);
+    }
+    const services = new Map();
+    const servicePaths = new Map();
+    const replacedPaths = [];
+    replaceSupportedSecrets(config, [], provider, envByValue, env, services, servicePaths, replacedPaths);
+    const removedEnvPaths = [];
+    const unsupportedEnvKeys = [];
+    for (const [envKey, entry] of env) {
+        const service = OPENCLAW_KEYCHAIN_ENV_SERVICES[envKey];
+        const mappedService = services.get(service);
+        if (!mappedService) {
+            unsupportedEnvKeys.push(envKey);
+            continue;
+        }
+        assertSameOpenClawSecretValue(envKey, service, servicePaths.get(service) ?? service, mappedService.value, openClawPath(entry.path), entry.value);
+        if (deletePath(config, entry.path))
+            removedEnvPaths.push(openClawPath(entry.path));
+    }
+    if (services.size > 0) {
+        ensureOpenClawKeychainProvider(config, { account, provider }, opts.agentsBin);
+    }
+    return {
+        services: [...services.values()],
+        replacedPaths,
+        removedEnvPaths,
+        unsupportedEnvKeys,
+        changed: services.size > 0 || replacedPaths.length > 0 || removedEnvPaths.length > 0,
+    };
+}
+export function buildOpenClawKeychainStoreInvocation(service, value, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
+    return {
+        command: '/usr/bin/security',
+        args: buildAddGenericPasswordArgs(account, service),
+        options: buildAddGenericPasswordSpawnOptions(value),
+    };
+}
+export function storeOpenClawKeychainServices(services, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
+    if (process.platform !== 'darwin') {
+        throw new Error('OpenClaw Keychain migration must run on macOS.');
+    }
+    for (const { service, value } of services) {
+        const write = buildOpenClawKeychainStoreInvocation(service, value, account);
+        const result = spawnSync(write.command, write.args, write.options);
+        if (result.status !== 0) {
+            const msg = result.stderr?.toString().trim();
+            throw new Error(msg || `Failed to write OpenClaw Keychain service '${service}'.`);
+        }
+    }
+}
+function stripSecurityTrailingNewline(value) {
+    return value.replace(/\r?\n$/, '');
+}
+export function readOpenClawKeychainService(service, account = OPENCLAW_KEYCHAIN_ACCOUNT) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$/.test(service)) {
+        throw new Error(`Invalid OpenClaw Keychain service id '${service}'.`);
+    }
+    if (process.platform !== 'darwin') {
+        throw new Error('OpenClaw Keychain resolver must run on macOS.');
+    }
+    const value = execFileSync('/usr/bin/security', ['find-generic-password', '-s', service, '-a', account, '-w'], {
+        encoding: 'utf-8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return stripSecurityTrailingNewline(value);
+}
+export function resolveOpenClawKeychainRequest(request, lookup) {
+    const ids = Array.isArray(request.ids) ? request.ids.filter((id) => typeof id === 'string') : [];
+    const values = {};
+    const errors = {};
+    for (const id of ids) {
+        try {
+            values[id] = lookup(id);
+        }
+        catch {
+            errors[id] = { code: 'NOT_FOUND' };
+        }
+    }
+    return {
+        protocolVersion: 1,
+        values,
+        ...(Object.keys(errors).length > 0 ? { errors } : {}),
+    };
+}

package/dist/lib/overdue.js

@@ -93,6 +93,11 @@ export function notifyOverdue(jobs) {
             const safeTitle = title.replace(/"/g, '\\"');
             const safeBody = body.replace(/"/g, '\\"');
             const child = spawn('osascript', ['-e', `display notification "${safeBody}" with title "${safeTitle}"`], { detached: true, stdio: 'ignore' });
+            // A missing binary surfaces as an async 'error' event, NOT a synchronous
+            // throw the try/catch would catch. Without a listener Node re-throws it as
+            // an uncaught exception and takes the whole daemon down. Swallow it — the
+            // notification is best-effort.
+            child.on('error', () => { });
             child.unref();
         }
         else if (platform === 'linux') {
@@ -100,6 +105,11 @@ export function notifyOverdue(jobs) {
                 detached: true,
                 stdio: 'ignore',
             });
+            // Headless Linux boxes have no `notify-send` (libnotify-bin); its ENOENT
+            // arrives as an async 'error' event, not a throw. Without this listener
+            // the daemon crashes on every overdue routine and systemd restart-loops it
+            // (which also tears down the browser IPC socket). Swallow — best-effort.
+            child.on('error', () => { });
             child.unref();
         }
     }