@swarmclawai/swarmclaw 1.2.1 → 1.2.3

package/src/lib/server/openclaw/deploy.test.ts

@@ -6,6 +6,8 @@ import {
   getOpenClawLocalDeployStatus,
   getOpenClawRemoteDeployCollectionStatus,
   getOpenClawRemoteDeployStatus,
+  sanitizeLocalPort,
+  sanitizeSshConfig,
 } from './deploy'
 
 const GLOBAL_KEY = '__swarmclaw_openclaw_deploy__' as const
@@ -42,13 +44,17 @@ test('docker smart deploy bundle uses official image and provider-specific metad
 
   const envFile = bundle.files.find((file) => file.name === '.env')
   assert.ok(envFile)
-  assert.match(envFile.content, /OPENCLAW_IMAGE=openclaw:latest/)
+  assert.match(envFile.content, /OPENCLAW_IMAGE=ghcr\.io\/openclaw\/openclaw:latest/)
   assert.match(envFile.content, /OPENCLAW_GATEWAY_TOKEN=test-token/)
 
+  const dockerCompose = bundle.files.find((file) => file.name === 'docker-compose.yml')
+  assert.ok(dockerCompose)
+  assert.match(dockerCompose.content, /image: \$\{OPENCLAW_IMAGE:-ghcr\.io\/openclaw\/openclaw:latest\}/)
+
   const cloudInit = bundle.files.find((file) => file.name === 'cloud-init.yaml')
   assert.ok(cloudInit)
   assert.match(cloudInit.content, /docker\.io/)
-  assert.match(cloudInit.content, /docker pull "\$\{OPENCLAW_IMAGE:-openclaw:latest\}"/)
+  assert.match(cloudInit.content, /docker pull "\$\{OPENCLAW_IMAGE:-ghcr\.io\/openclaw\/openclaw:latest\}"/)
   assert.match(cloudInit.content, /\/opt\/openclaw\/docker-compose\.yml/)
 
   const caddyfile = bundle.files.find((file) => file.name === 'Caddyfile')
@@ -74,6 +80,39 @@ test('render bundle stays aligned with the official repo flow', () => {
   assert.match(bundle.runbook[0] || '', /official OpenClaw GitHub repo/i)
 })
 
+test('remote bundle preserves low HTTP ports below 1024', () => {
+  const bundle = buildOpenClawDeployBundle({
+    template: 'docker',
+    target: 'gateway.example.com',
+    scheme: 'http',
+    port: 81,
+  })
+
+  assert.equal(bundle.endpoint, 'http://gateway.example.com:81/v1')
+  assert.equal(bundle.wsUrl, 'ws://gateway.example.com:81')
+})
+
+test('ssh config preserves port 22', () => {
+  const config = sanitizeSshConfig({
+    host: 'gateway.example.com',
+    port: 22,
+  })
+
+  assert.deepEqual(config, {
+    host: 'gateway.example.com',
+    user: 'root',
+    port: 22,
+    keyPath: null,
+    targetDir: '/opt/openclaw',
+  })
+})
+
+test('local managed deploy ports stay clamped to unprivileged values', () => {
+  assert.equal(sanitizeLocalPort(22), 1024)
+  assert.equal(sanitizeLocalPort('443'), 1024)
+  assert.equal(sanitizeLocalPort(18789), 18789)
+})
+
 test('local deploy status exposes a sensible default endpoint before startup', () => {
   const status = getOpenClawLocalDeployStatus()
   const collection = getOpenClawLocalDeployCollectionStatus()
@@ -159,7 +198,7 @@ test('remote deploy collection preserves multiple remotes and targeted lookup',
         createdAt: 30,
         updatedAt: 40,
         lastError: null,
-        lastSummary: 'Pulling openclaw:latest and recreating the OpenClaw stack on beta.example.com.',
+        lastSummary: 'Pulling ghcr.io/openclaw/openclaw:latest and recreating the OpenClaw stack on beta.example.com.',
         lastCommandPreview: 'ssh root@beta.example.com docker compose up -d',
         lastBackupPath: null,
       },

package/src/lib/server/openclaw/deploy.ts

@@ -192,6 +192,7 @@ interface ExposureMeta {
 
 const DEFAULT_LOCAL_PORT = 18789
 const DEFAULT_REMOTE_PORT = 18789
+const DEFAULT_OPENCLAW_IMAGE = 'ghcr.io/openclaw/openclaw:latest'
 const OC_DEPLOY_KEY = '__swarmclaw_openclaw_deploy__'
 
 const REMOTE_PROVIDER_META: Record<OpenClawRemoteDeployProvider, RemoteProviderMeta> = {
@@ -604,14 +605,27 @@ function buildLocalInstallCommand(port: number, token?: string | null, localId =
   return `${parts.join(' ')} && npx openclaw gateway start`
 }
 
-function sanitizePort(value: unknown, fallback = DEFAULT_LOCAL_PORT): number {
+function parsePortNumber(value: unknown): number | null {
   const parsed = typeof value === 'number'
     ? value
     : typeof value === 'string'
       ? Number.parseInt(value, 10)
       : Number.NaN
-  if (!Number.isFinite(parsed)) return fallback
-  return Math.max(1024, Math.min(65535, Math.trunc(parsed)))
+  return Number.isFinite(parsed) ? parsed : null
+}
+
+function sanitizePortInRange(value: unknown, fallback: number, minimum: number): number {
+  const parsed = parsePortNumber(value)
+  if (parsed === null) return fallback
+  return Math.max(minimum, Math.min(65535, Math.trunc(parsed)))
+}
+
+export function sanitizeLocalPort(value: unknown, fallback = DEFAULT_LOCAL_PORT): number {
+  return sanitizePortInRange(value, fallback, 1024)
+}
+
+function sanitizeRemotePort(value: unknown, fallback = DEFAULT_REMOTE_PORT): number {
+  return sanitizePortInRange(value, fallback, 1)
 }
 
 function normalizeToken(value: unknown): string | null {
@@ -666,10 +680,10 @@ function normalizeExposurePreset(value: unknown, fallback?: OpenClawUseCaseTempl
   return useCase?.defaultExposure || 'private-lan'
 }
 
-function sanitizeSshConfig(input?: Partial<OpenClawSshConfig> | null): OpenClawSshConfig | null {
+export function sanitizeSshConfig(input?: Partial<OpenClawSshConfig> | null): OpenClawSshConfig | null {
   const host = typeof input?.host === 'string' && input.host.trim() ? input.host.trim() : ''
   if (!host) return null
-  const port = sanitizePort(input?.port, 22)
+  const port = sanitizePortInRange(input?.port, 22, 1)
   return {
     host,
     user: typeof input?.user === 'string' && input.user.trim() ? input.user.trim() : 'root',
@@ -1034,7 +1048,7 @@ export async function startOpenClawLocalDeploy(input?: {
   makePrimary?: boolean
 }): Promise<{ local: OpenClawLocalDeployStatus; locals: OpenClawLocalDeployStatus[]; token: string }> {
   const state = getRuntimeState()
-  const port = sanitizePort(input?.port, DEFAULT_LOCAL_PORT)
+  const port = sanitizeLocalPort(input?.port, DEFAULT_LOCAL_PORT)
   const requestedLocalId = typeof input?.localId === 'string' && input.localId.trim()
     ? input.localId.trim()
     : null
@@ -1238,7 +1252,7 @@ function resolveHostBindAddress(useCase: OpenClawUseCaseTemplate, exposure: Open
 function buildDockerComposeFile(options: DockerBundleOptions): string {
   return `services:
   openclaw-gateway:
-    image: \${OPENCLAW_IMAGE:-openclaw:latest}
+    image: \${OPENCLAW_IMAGE:-${DEFAULT_OPENCLAW_IMAGE}}
     environment:
       HOME: /home/node
       TERM: xterm-256color
@@ -1284,7 +1298,7 @@ function buildDockerComposeFile(options: DockerBundleOptions): string {
 }
 
 function buildDockerEnvFile(options: DockerBundleOptions): string {
-  return `OPENCLAW_IMAGE=openclaw:latest
+  return `OPENCLAW_IMAGE=${DEFAULT_OPENCLAW_IMAGE}
 OPENCLAW_GATEWAY_TOKEN=${options.token}
 OPENCLAW_GATEWAY_BIND=lan
 OPENCLAW_HOST_BIND=${resolveHostBindAddress(options.useCase, options.exposure)}
@@ -1314,7 +1328,7 @@ if ! command -v docker >/dev/null 2>&1; then
   exit 1
 fi
 
-docker pull "\${OPENCLAW_IMAGE:-openclaw:latest}"
+docker pull "\${OPENCLAW_IMAGE:-${DEFAULT_OPENCLAW_IMAGE}}"
 docker compose up -d
 if [ -f docker-compose.proxy.yml ]; then
   docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d
@@ -1365,7 +1379,7 @@ ${extraFiles ? `${extraFiles}
 ` : ''}runcmd:
   - mkdir -p /opt/openclaw/.openclaw /opt/openclaw/workspace /opt/openclaw/backups
   - systemctl enable --now docker
-  - bash -lc 'cd /opt/openclaw && docker pull "\${OPENCLAW_IMAGE:-openclaw:latest}"'
+  - bash -lc 'cd /opt/openclaw && docker pull "\${OPENCLAW_IMAGE:-${DEFAULT_OPENCLAW_IMAGE}}"'
   - bash -lc 'cd /opt/openclaw && docker compose up -d'
   - bash -lc 'cd /opt/openclaw && if [ -f docker-compose.proxy.yml ]; then docker compose -f docker-compose.yml -f docker-compose.proxy.yml up -d; fi'
 final_message: "OpenClaw gateway bootstrap complete. Run: sudo docker compose -f /opt/openclaw/docker-compose.yml ps"
@@ -1597,7 +1611,7 @@ export function buildOpenClawDeployBundle(input?: {
   const template = input?.template || 'docker'
   const token = normalizeToken(input?.token) || generateOpenClawGatewayToken()
   const scheme = input?.scheme === 'http' ? 'http' : 'https'
-  const port = sanitizePort(input?.port, DEFAULT_REMOTE_PORT)
+  const port = sanitizeRemotePort(input?.port, DEFAULT_REMOTE_PORT)
   const rawTarget = typeof input?.target === 'string' ? input.target.trim() : ''
   const endpoint = normalizeOpenClawEndpoint(ensureSchemeAndPort(rawTarget || 'openclaw.example.com', scheme, port))
   const wsUrl = deriveOpenClawWsUrl(endpoint)
@@ -1802,7 +1816,7 @@ export async function runOpenClawRemoteLifecycleAction(input?: {
   const sshConfig = sanitizeSshConfig(input?.ssh)
   if (!sshConfig) throw new Error('SSH host is required for remote lifecycle actions.')
   const remoteDir = sshConfig.targetDir || '/opt/openclaw'
-  const image = normalizeText(input?.image) || 'openclaw:latest'
+  const image = normalizeText(input?.image) || DEFAULT_OPENCLAW_IMAGE
   const action = input?.action || 'restart'
   let remoteCommand = ''
   let summary = ''

package/src/lib/server/persistence/repository-utils.ts

@@ -0,0 +1,154 @@
+import { perf } from '@/lib/server/runtime/perf'
+
+export interface RecordRepository<
+  T,
+  ListOptions = void,
+  UpsertValue = T | Record<string, unknown>,
+> {
+  get(id: string, options?: ListOptions): T | null
+  getMany(ids: string[], options?: ListOptions): Record<string, T>
+  list(options?: ListOptions): Record<string, T>
+  upsert(id: string, value: UpsertValue): void
+  upsertMany(entries: Array<[string, UpsertValue]>): void
+  patch(id: string, updater: (current: T | null) => T | null, options?: ListOptions): T | null
+  replace(data: Record<string, UpsertValue>): void
+  delete(id: string): void
+}
+
+interface RecordRepositoryOps<
+  T,
+  ListOptions = void,
+  UpsertValue = T | Record<string, unknown>,
+> {
+  get(id: string, options?: ListOptions): T | null
+  list(options?: ListOptions): Record<string, T>
+  upsert(id: string, value: UpsertValue): void
+  upsertMany?: (entries: Array<[string, UpsertValue]>) => void
+  patch?: (id: string, updater: (current: T | null) => T | null) => T | null
+  replace?: (data: Record<string, UpsertValue>) => void
+  delete?: (id: string) => void
+}
+
+export interface SingletonRepository<
+  T,
+  SaveValue = T | Record<string, unknown>,
+> {
+  get(): T
+  save(value: SaveValue): void
+  patch(updater: (current: T) => SaveValue): T
+}
+
+interface SingletonRepositoryOps<
+  T,
+  SaveValue = T | Record<string, unknown>,
+> {
+  get(): T
+  save(value: SaveValue): void
+}
+
+function uniqueIds(ids: string[]): string[] {
+  const out: string[] = []
+  const seen = new Set<string>()
+  for (const id of ids) {
+    const normalized = typeof id === 'string' ? id.trim() : ''
+    if (!normalized || seen.has(normalized)) continue
+    seen.add(normalized)
+    out.push(normalized)
+  }
+  return out
+}
+
+export function createRecordRepository<
+  T,
+  ListOptions = void,
+  UpsertValue = T | Record<string, unknown>,
+>(
+  name: string,
+  ops: RecordRepositoryOps<T, ListOptions, UpsertValue>,
+): RecordRepository<T, ListOptions, UpsertValue> {
+  return {
+    get(id, options) {
+      return perf.measureSync('repository', `${name}.get`, () => ops.get(id, options), { id })
+    },
+    getMany(ids, options) {
+      return perf.measureSync('repository', `${name}.getMany`, () => {
+        const result: Record<string, T> = {}
+        for (const id of uniqueIds(ids)) {
+          const item = ops.get(id, options)
+          if (item) result[id] = item
+        }
+        return result
+      }, { count: ids.length })
+    },
+    list(options) {
+      return perf.measureSync('repository', `${name}.list`, () => ops.list(options))
+    },
+    upsert(id, value) {
+      perf.measureSync('repository', `${name}.upsert`, () => ops.upsert(id, value), { id })
+    },
+    upsertMany(entries) {
+      perf.measureSync('repository', `${name}.upsertMany`, () => {
+        if (ops.upsertMany) {
+          ops.upsertMany(entries)
+          return
+        }
+        for (const [id, value] of entries) ops.upsert(id, value)
+      }, { count: entries.length })
+    },
+    patch(id, updater, options) {
+      return perf.measureSync('repository', `${name}.patch`, () => {
+        if (ops.patch) return ops.patch(id, updater)
+        const current = ops.get(id, options)
+        const next = updater(current)
+        if (next === null) {
+          if (!ops.delete) return null
+          ops.delete(id)
+          return null
+        }
+        ops.upsert(id, next as UpsertValue)
+        return next
+      }, { id })
+    },
+    replace(data) {
+      perf.measureSync('repository', `${name}.replace`, () => {
+        if (ops.replace) {
+          ops.replace(data)
+          return
+        }
+        const entries = Object.entries(data)
+        if (ops.upsertMany) ops.upsertMany(entries)
+        else for (const [id, value] of entries) ops.upsert(id, value)
+      }, { count: Object.keys(data).length })
+    },
+    delete(id) {
+      perf.measureSync('repository', `${name}.delete`, () => {
+        if (!ops.delete) return
+        ops.delete(id)
+      }, { id })
+    },
+  }
+}
+
+export function createSingletonRepository<
+  T,
+  SaveValue = T | Record<string, unknown>,
+>(
+  name: string,
+  ops: SingletonRepositoryOps<T, SaveValue>,
+): SingletonRepository<T, SaveValue> {
+  return {
+    get() {
+      return perf.measureSync('repository', `${name}.get`, () => ops.get())
+    },
+    save(value) {
+      perf.measureSync('repository', `${name}.save`, () => ops.save(value))
+    },
+    patch(updater) {
+      return perf.measureSync('repository', `${name}.patch`, () => {
+        const next = updater(ops.get())
+        ops.save(next)
+        return ops.get()
+      })
+    },
+  }
+}

package/src/lib/server/persistence/storage-context.ts

@@ -0,0 +1,51 @@
+import { withTransaction } from '@/lib/server/storage'
+
+import { agentRepository } from '@/lib/server/agents/agent-repository'
+import { approvalRepository } from '@/lib/server/approvals/approval-repository'
+import { chatroomRepository } from '@/lib/server/chatrooms/chatroom-repository'
+import { connectorRepository } from '@/lib/server/connectors/connector-repository'
+import { missionEventRepository, missionRepository } from '@/lib/server/missions/mission-repository'
+import { projectRepository } from '@/lib/server/projects/project-repository'
+import { scheduleRepository } from '@/lib/server/schedules/schedule-repository'
+import { sessionRepository } from '@/lib/server/sessions/session-repository'
+import { settingsRepository } from '@/lib/server/settings/settings-repository'
+import { taskRepository } from '@/lib/server/tasks/task-repository'
+import { runEventRepository, runRepository } from '@/lib/server/runtime/run-repository'
+
+export interface StorageTxContext {
+  agents: typeof agentRepository
+  approvals: typeof approvalRepository
+  chatrooms: typeof chatroomRepository
+  connectors: typeof connectorRepository
+  missions: typeof missionRepository
+  missionEvents: typeof missionEventRepository
+  projects: typeof projectRepository
+  runs: typeof runRepository
+  runEvents: typeof runEventRepository
+  schedules: typeof scheduleRepository
+  sessions: typeof sessionRepository
+  settings: typeof settingsRepository
+  tasks: typeof taskRepository
+}
+
+export function createStorageTxContext(): StorageTxContext {
+  return {
+    agents: agentRepository,
+    approvals: approvalRepository,
+    chatrooms: chatroomRepository,
+    connectors: connectorRepository,
+    missions: missionRepository,
+    missionEvents: missionEventRepository,
+    projects: projectRepository,
+    runs: runRepository,
+    runEvents: runEventRepository,
+    schedules: scheduleRepository,
+    sessions: sessionRepository,
+    settings: settingsRepository,
+    tasks: taskRepository,
+  }
+}
+
+export function withStorageTx<T>(fn: (ctx: StorageTxContext) => T): T {
+  return withTransaction(() => fn(createStorageTxContext()))
+}

package/src/lib/server/persistence/transaction.ts

@@ -0,0 +1 @@
+export { withTransaction } from '@/lib/server/storage'

package/src/lib/server/projects/project-repository.ts

@@ -0,0 +1,36 @@
+import type { Project } from '@/types'
+
+import {
+  deleteProject as deleteStoredProject,
+  loadProjects as loadStoredProjects,
+  saveProjects as saveStoredProjects,
+  upsertStoredItem,
+} from '@/lib/server/storage'
+import { createRecordRepository } from '@/lib/server/persistence/repository-utils'
+
+export const projectRepository = createRecordRepository<Project>(
+  'projects',
+  {
+    get(id) {
+      return (loadStoredProjects() as Record<string, Project>)[id] || null
+    },
+    list() {
+      return loadStoredProjects() as Record<string, Project>
+    },
+    upsert(id, value) {
+      upsertStoredItem('projects', id, value)
+    },
+    replace(data) {
+      saveStoredProjects(data)
+    },
+    delete(id) {
+      deleteStoredProject(id)
+    },
+  },
+)
+
+export const loadProjects = () => projectRepository.list()
+export const loadProject = (id: string) => projectRepository.get(id)
+export const saveProjects = (items: Record<string, Project | Record<string, unknown>>) => projectRepository.replace(items as Record<string, Project>)
+export const upsertProject = (id: string, value: Project | Record<string, unknown>) => projectRepository.upsert(id, value as Project)
+export const deleteProject = (id: string) => projectRepository.delete(id)

package/src/lib/server/projects/project-service.ts

@@ -0,0 +1,79 @@
+import type { Agent, BoardTask, Project, Schedule, Skill, StoredSecret } from '@/types'
+
+import {
+  deleteProject as deleteStoredProject,
+  loadAgents,
+  loadProjects,
+  loadSchedules,
+  loadSecrets,
+  loadSkills,
+  loadTasks,
+  saveAgents,
+  saveProjects,
+  saveSchedules,
+  saveSecrets,
+  saveSkills,
+  saveTasks,
+} from '@/lib/server/storage'
+import { ensureProjectWorkspace, normalizeProjectPatchInput } from '@/lib/server/project-utils'
+import { notify } from '@/lib/server/ws-hub'
+
+type ProjectLinkedRecord = {
+  projectId?: string
+}
+
+function clearProjectId<T extends ProjectLinkedRecord>(
+  projectId: string,
+  load: () => Record<string, T>,
+  save: (items: Record<string, T>) => void,
+  topic: string,
+): void {
+  const items = load()
+  let changed = false
+  for (const item of Object.values(items)) {
+    if (item.projectId !== projectId) continue
+    item.projectId = undefined
+    changed = true
+  }
+  if (!changed) return
+  save(items)
+  notify(topic)
+}
+
+export function getProject(id: string): Project | null {
+  return loadProjects()[id] || null
+}
+
+export function updateProject(id: string, input: Record<string, unknown>): Project | null {
+  const projects = loadProjects()
+  const existing = projects[id]
+  if (!existing) return null
+
+  const patch = normalizeProjectPatchInput(input)
+  const nextProject: Project = {
+    ...existing,
+    ...patch,
+    id,
+    updatedAt: Date.now(),
+  }
+  projects[id] = nextProject
+  saveProjects(projects)
+  ensureProjectWorkspace(id, nextProject.name)
+  notify('projects')
+  return nextProject
+}
+
+export function deleteProjectAndDetachReferences(id: string): boolean {
+  if (!getProject(id)) return false
+
+  deleteStoredProject(id)
+  notify('projects')
+
+  clearProjectId<Agent>(id, loadAgents, saveAgents, 'agents')
+  clearProjectId<BoardTask>(id, loadTasks, saveTasks, 'tasks')
+  clearProjectId<Schedule>(id, loadSchedules, saveSchedules, 'schedules')
+  clearProjectId<Skill>(id, loadSkills, saveSkills, 'skills')
+  clearProjectId<StoredSecret>(id, loadSecrets, saveSecrets, 'secrets')
+
+  return true
+}

package/src/lib/server/protocols/protocol-normalization.test.ts

@@ -3,13 +3,15 @@ import { after, before, describe, it } from 'node:test'
 
 let mod: typeof import('@/lib/server/protocols/protocol-normalization')
 
+const savedBuildMode = process.env.SWARMCLAW_BUILD_MODE
 before(async () => {
   process.env.SWARMCLAW_BUILD_MODE = '1'
   mod = await import('@/lib/server/protocols/protocol-normalization')
 })
 
 after(() => {
-  delete process.env.SWARMCLAW_BUILD_MODE
+  if (savedBuildMode === undefined) delete process.env.SWARMCLAW_BUILD_MODE
+  else process.env.SWARMCLAW_BUILD_MODE = savedBuildMode
 })
 
 describe('protocol-normalization', () => {
@@ -26,8 +28,8 @@ describe('protocol-normalization', () => {
     })
 
     it('artifact_exists with artifactKind', () => {
-      const result = mod.normalizeCondition({ type: 'artifact_exists', artifactKind: 'report' })
-      assert.deepEqual(result, { type: 'artifact_exists', artifactKind: 'report' })
+      const result = mod.normalizeCondition({ type: 'artifact_exists', artifactKind: 'summary' })
+      assert.deepEqual(result, { type: 'artifact_exists', artifactKind: 'summary' })
     })
 
     it('artifact_exists without artifactKind', () => {
@@ -53,7 +55,7 @@ describe('protocol-normalization', () => {
         type: 'all',
         conditions: [
           { type: 'summary_exists' },
-          { type: 'artifact_exists', artifactKind: 'doc' },
+          { type: 'artifact_exists', artifactKind: 'notes' },
         ],
       })
       assert.equal(result!.type, 'all')

package/src/lib/server/runtime/alert-dispatch.ts

@@ -1,4 +1,4 @@
-import { loadSettings } from '@/lib/server/storage'
+import { loadSettings } from '@/lib/server/settings/settings-repository'
 import type { AppNotification } from '@/types'
 import { errorMessage } from '@/lib/shared-utils'
 import { log } from '@/lib/server/logger'

package/src/lib/server/runtime/daemon-policy.ts

@@ -1,5 +1,5 @@
 import { DEFAULT_HEARTBEAT_INTERVAL_SEC } from '@/lib/runtime/heartbeat-defaults'
-import { loadSettings } from '@/lib/server/storage'
+import { loadSettings } from '@/lib/server/settings/settings-repository'
 import type { Session } from '@/types'
 
 const SYNTHETIC_HEALTH_SESSION_USERS = new Set(['workbench', 'comparison-bench'])