@synap-core/cli 1.10.0 → 1.12.2

package/dist/lib/pod.js

@@ -1,11 +1,11 @@
 /**
  * Synap pod connection and management utilities.
  */
+import { readJsonStrict, writeFileAtomic, ensureSecretDir } from "./atomic-file.js";
 import { execSync } from "child_process";
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-const CP_URL = process.env.SYNAP_CP_URL ?? "https://api.synap.live";
 // ─── Local CLI config (persists pod connections) ──────────────────────────────
 const CONFIG_DIR = path.join(os.homedir(), ".synap");
 const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
@@ -18,45 +18,49 @@ export const SURFACE_NAMES = [
     "claude-desktop",
     "cursor",
     "codex",
+    "chatgpt",
+    "chatgpt-oauth",
     "opencode",
     "aider",
     "windsurf",
     "goose",
     "zed",
     "vscode",
+    "grok",
     "discord",
+    "proton",
+    "generic",
 ];
 /**
- * agentTypes already owned by OTHER doors — `POST /setup/agent` treats agentType
- * as a POD-WIDE SINGLETON, so `agents create` deriving a slug that collides with
- * one of these would silently hijack that door's agent + key. Superset of the
- * surfaces above plus the non-surface provisioning types (generic/openwebui MCP
- * mappings; openclaw/cli/memory). Single source of truth for the collision guard.
+ * agentTypes already owned by OTHER doors — provisioning is singleton per
+ * (createdByUserId, agentType), so `agents create` deriving a slug that collides
+ * with one of these would reuse that surface's agent for this user. Superset of
+ * the surfaces above plus the non-surface provisioning types (generic/openwebui
+ * MCP mappings; cli/memory, and the retired "openclaw", which pods may still
+ * hold an agent of). Single source of truth for the collision guard.
  */
 export const RESERVED_AGENT_TYPES = new Set([
     ...SURFACE_NAMES,
-    "generic",
     "openwebui",
     "openclaw",
     "cli",
     "memory",
 ]);
 function ensureConfigDir() {
-    if (!fs.existsSync(CONFIG_DIR)) {
-        fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
-    }
+    ensureSecretDir(CONFIG_DIR);
 }
 function readMultiConfig() {
-    // Read new format
-    try {
-        if (fs.existsSync(CONFIG_FILE)) {
-            const parsed = JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
+    // Read new format. A file that exists but does not parse THROWS
+    // (`ConfigUnreadableError`): read as "no pods", the next write would have
+    // persisted that and wiped every profile.
+    {
+        const parsed = readJsonStrict(CONFIG_FILE);
+        if (parsed) {
             if (parsed.pods)
-                return { activePod: parsed.activePod ?? "", pods: parsed.pods, activeWorkspaceId: parsed.activeWorkspaceId, activeProjectId: parsed.activeProjectId, activeProject: parsed.activeProject, surfaces: parsed.surfaces, agentKeys: parsed.agentKeys, agentWorkspaceRouting: parsed.agentWorkspaceRouting };
+                return { activePod: parsed.activePod ?? "", pods: parsed.pods, activeWorkspaceId: parsed.activeWorkspaceId, activeWorkspace: parsed.activeWorkspace, activeProjectId: parsed.activeProjectId, activeProject: parsed.activeProject, surfaces: parsed.surfaces, agentKeys: parsed.agentKeys, agentKeysByPod: parsed.agentKeysByPod, pendingAgentKeys: parsed.pendingAgentKeys, agentWorkspaceRouting: parsed.agentWorkspaceRouting };
             // File exists but has old/unrecognized shape — fall through to migration
         }
     }
-    catch { /* fall through */ }
     // Migrate from legacy flat format
     try {
         if (fs.existsSync(LEGACY_CONFIG_FILE)) {
@@ -75,14 +79,10 @@ function writeMultiConfig(config) {
     ensureConfigDir();
     // Merge with existing file so fields managed by other modules (e.g. `agents`)
     // are preserved when pod.ts only updates its own subset.
-    let existing = {};
-    try {
-        if (fs.existsSync(CONFIG_FILE)) {
-            existing = JSON.parse(fs.readFileSync(CONFIG_FILE, "utf-8"));
-        }
-    }
-    catch { /* start fresh */ }
-    fs.writeFileSync(CONFIG_FILE, JSON.stringify({ ...existing, ...config }, null, 2), { mode: 0o600 });
+    // An unreadable file throws here — never "start fresh" over someone's profiles.
+    const existing = readJsonStrict(CONFIG_FILE) ?? {};
+    // temp + fsync + rename: a crash mid-write never leaves a truncated config.
+    writeFileAtomic(CONFIG_FILE, JSON.stringify({ ...existing, ...config }, null, 2), { mode: 0o600 });
 }
 // ─── Public API ───────────────────────────────────────────────────────────────
 /**
@@ -162,12 +162,17 @@ export function setPodOverrideByName(name) {
     return pod;
 }
 /** Top-level commands that declare their OWN `--pod <name>` — their native handling must win. */
-const NATIVE_POD_FLAG_COMMANDS = new Set(["agents", "bridge-setup"]);
+// bridge-setup owns a command-local --pod with custom prompt UX — leave it alone.
+// agents used to be here too, but commander root also registers --pod and the
+// flag never reached `agents create` (opts.pod stayed undefined), so create
+// fell through to env agent keys → SURFACE_AGENT_TYPE_REQUIRED. Agents now
+// rely on this bootstrap override like every other command.
+const NATIVE_POD_FLAG_COMMANDS = new Set(["bridge-setup"]);
 /**
  * Consume a position-independent `--pod <name>` (or `--pod=<name>`) from argv and
  * register it as the per-invocation override. Mutates `argv` in place so commander
  * never sees the flag (it isn't registered per-command). No-op when the argv
- * targets a command that owns `--pod` itself (agents, bridge-setup). Throws with a
+ * targets a command that owns `--pod` itself (bridge-setup). Throws with a
  * helpful message when the named profile is unknown.
  */
 export function bootstrapPodOverride(argv) {
@@ -210,18 +215,111 @@ export function setActivePod(name) {
     writeMultiConfig(config);
     return config.pods[name];
 }
-/** Get the active workspace ID: explicit override first, then the pod default. */
-export function getActiveWorkspaceId() {
+/** The active pod's profile NAME (not its config), or undefined if none is set. */
+export function getActivePodName() {
+    const config = readMultiConfig();
+    return config.activePod && config.pods[config.activePod] ? config.activePod : undefined;
+}
+/** Find a saved pod profile NAME by its URL (trailing slashes ignored). */
+export function findPodNameByUrl(url) {
+    if (!url)
+        return undefined;
+    const norm = (u) => u.replace(/\/+$/, "");
+    const target = norm(url);
+    const config = readMultiConfig();
+    for (const [name, p] of Object.entries(config.pods)) {
+        if (norm(p.podUrl) === target)
+            return name;
+    }
+    return undefined;
+}
+/**
+ * Resolve the workspace to use for a specific pod — PURE (no disk, no network),
+ * so the cross-pod rule is unit-testable.
+ *
+ * A workspace lives on exactly one pod, but `activeWorkspaceId` is a single
+ * pod-agnostic global. Sending it to the wrong pod is the "Access denied to
+ * workspace" 403. The rule: only honor the global override for the pod it
+ * actually belongs to; otherwise fall back to THAT pod's own default workspace.
+ *
+ *   1. No override set → the target pod's own default.
+ *   2. Override has a pod binding → honor it only for its bound pod; for any
+ *      other pod, use that pod's default.
+ *   3. Legacy override (no binding) that equals ANOTHER saved pod's default →
+ *      it clearly belongs to that pod → use the target's default.
+ *   4. Otherwise no evidence it's foreign → assume it's the target pod's (the
+ *      legacy `synap use <custom-ws-on-this-pod>` case) → honor it.
+ */
+export function resolveWorkspaceForPod(config, podName) {
+    const targetPod = podName ? config.pods[podName] : undefined;
+    const override = config.activeWorkspaceId;
+    const binding = config.activeWorkspace;
+    // Prefer a binding that matches the target pod even when activeWorkspaceId
+    // drifted to a foreign UUID (common after dual-pod work).
+    if (binding && binding.podName === podName) {
+        return binding.workspaceId;
+    }
+    if (binding && binding.podName !== podName) {
+        // Binding is for another pod — never use its workspace; only the target
+        // profile default if it doesn't look stolen from another profile.
+        return safePodDefaultWorkspace(config, podName, targetPod?.workspaceId);
+    }
+    if (!override) {
+        return safePodDefaultWorkspace(config, podName, targetPod?.workspaceId);
+    }
+    const belongsToAnotherPod = Object.entries(config.pods).some(([name, p]) => name !== podName && p.workspaceId === override);
+    if (belongsToAnotherPod) {
+        return safePodDefaultWorkspace(config, podName, targetPod?.workspaceId);
+    }
+    return override;
+}
+/**
+ * Profile `workspaceId` can drift to a UUID that belongs on another pod
+ * (dual-pod dogfood). Never return a default that is another profile's
+ * configured workspaceId. If the default is still suspect and differs from
+ * every other profile default, we cannot prove it's foreign without the
+ * server — return it only when unique among profile defaults.
+ */
+function safePodDefaultWorkspace(config, podName, defaultWs) {
+    if (!defaultWs || !podName)
+        return defaultWs || undefined;
+    const stolenAsOtherDefault = Object.entries(config.pods).some(([name, p]) => name !== podName && p.workspaceId === defaultWs);
+    if (stolenAsOtherDefault)
+        return undefined;
+    return defaultWs;
+}
+/**
+ * Get the active workspace ID for a pod (by profile NAME). Applies the cross-pod
+ * rule in {@link resolveWorkspaceForPod}. Omit `podName` for the active pod.
+ */
+export function getActiveWorkspaceIdForPod(podName) {
     const config = readMultiConfig();
-    if (config.activeWorkspaceId)
-        return config.activeWorkspaceId;
-    const pod = config.activePod ? config.pods[config.activePod] : undefined;
-    return pod?.workspaceId || undefined;
+    return resolveWorkspaceForPod(config, podName ?? (config.activePod || undefined));
 }
-/** Persist a workspace as the active context for all subsequent commands. */
-export function setActiveWorkspaceId(workspaceId) {
+/**
+ * Get the active workspace ID for the ACTIVE pod: explicit override first (only
+ * if it belongs to this pod), then the pod default. Cross-pod-safe: a global
+ * override left over from another pod is ignored rather than sent (avoids the
+ * "Access denied to workspace" 403).
+ */
+export function getActiveWorkspaceId() {
+    return getActiveWorkspaceIdForPod();
+}
+/**
+ * Persist a workspace as the active context for all subsequent commands.
+ * Records the pod the workspace belongs to (defaults to the active pod) so
+ * later cross-pod resolution can tell whether the override applies.
+ */
+export function setActiveWorkspaceId(workspaceId, podName) {
     const config = readMultiConfig();
     config.activeWorkspaceId = workspaceId;
+    const boundPod = podName ?? config.activePod;
+    if (boundPod && config.pods[boundPod]) {
+        config.activeWorkspace = { workspaceId, podName: boundPod };
+    }
+    else {
+        delete config.activeWorkspace;
+    }
     writeMultiConfig(config);
 }
 /** Get the active project ID: durable override set by `synap project use`. */
@@ -229,10 +327,22 @@ export function getActiveProjectId() {
     const config = readMultiConfig();
     return config.activeProjectId || undefined;
 }
-/** Persist a project as the active context for all subsequent commands. */
-export function setActiveProjectId(projectId) {
+/**
+ * Persist a project as the active context for all subsequent commands.
+ * Records the pod it was set against (defaults to the active pod) so
+ * {@link resolveHubConfig} can refuse to send it to a foreign pod.
+ * Peer of {@link setActiveWorkspaceId}.
+ */
+export function setActiveProjectId(projectId, podName) {
     const config = readMultiConfig();
     config.activeProjectId = projectId;
+    const boundPod = podName ?? config.activePod;
+    if (boundPod && config.pods[boundPod]) {
+        config.activeProject = { projectId, podName: boundPod };
+    }
+    else {
+        delete config.activeProject;
+    }
     writeMultiConfig(config);
 }
 /**
@@ -254,20 +364,74 @@ export function getActiveProjectBinding() {
 export function clearActiveProjectId() {
     const config = readMultiConfig();
     delete config.activeProjectId;
+    delete config.activeProject;
     writeMultiConfig(config);
 }
 // ─── Surface agent keys ───────────────────────────────────────────────────────
-/** Store a dedicated agent key for a specific surface (e.g. "raycast", "claude-code"). */
+/** Normalize a pod URL for map keys (strip trailing slashes). */
+function normalizePodUrl(url) {
+    return url.replace(/\/+$/, "");
+}
+/**
+ * Store a dedicated agent key for a specific surface (e.g. "raycast", "claude-code").
+ * Always writes `agentKeys[surface]` (last-write, backward compat). When `key.podUrl`
+ * is set, also stores under `agentKeysByPod[surface][normalizedPodUrl]` so multi-pod
+ * surfaces can look up the key for the pod they are actually talking to.
+ */
 export function setSurfaceAgentKey(surface, key) {
     const config = readMultiConfig();
     config.agentKeys = config.agentKeys ?? {};
-    config.agentKeys[surface] = key;
+    config.agentKeys[surface] = key; // last write for backward compat
+    if (key.podUrl) {
+        config.agentKeysByPod = config.agentKeysByPod ?? {};
+        const bySurface = config.agentKeysByPod[surface] ?? {};
+        bySurface[normalizePodUrl(key.podUrl)] = key;
+        config.agentKeysByPod[surface] = bySurface;
+    }
     writeMultiConfig(config);
 }
-/** Read back the stored agent key for a surface. Returns null if not provisioned. */
-export function getSurfaceAgentKey(surface) {
+/**
+ * Read back the stored agent key for a surface.
+ * When `podUrl` is provided, prefer `agentKeysByPod` for that pod; if only a legacy
+ * `agentKeys[surface]` entry exists, return it only when its podUrl matches (or is
+ * unset). Never return a key known to belong to a different pod.
+ */
+export function getSurfaceAgentKey(surface, podUrl) {
     const config = readMultiConfig();
-    return config.agentKeys?.[surface] ?? null;
+    if (podUrl && config.agentKeysByPod?.[surface]) {
+        const hit = config.agentKeysByPod[surface][normalizePodUrl(podUrl)];
+        if (hit)
+            return hit;
+    }
+    const legacy = config.agentKeys?.[surface] ?? null;
+    if (podUrl && legacy?.podUrl && normalizePodUrl(legacy.podUrl) !== normalizePodUrl(podUrl)) {
+        return null; // do not return wrong-pod key
+    }
+    return legacy;
+}
+export function getPendingAgentKey(surface, podUrl) {
+    return readMultiConfig().pendingAgentKeys?.[surface]?.[normalizePodUrl(podUrl)] ?? null;
+}
+export function setPendingAgentKey(surface, key) {
+    const config = readMultiConfig();
+    config.pendingAgentKeys = config.pendingAgentKeys ?? {};
+    const bySurface = config.pendingAgentKeys[surface] ?? {};
+    bySurface[normalizePodUrl(key.podUrl)] = key;
+    config.pendingAgentKeys[surface] = bySurface;
+    writeMultiConfig(config);
+}
+export function clearPendingAgentKey(surface, podUrl) {
+    const config = readMultiConfig();
+    const bySurface = config.pendingAgentKeys?.[surface];
+    if (!bySurface || !(normalizePodUrl(podUrl) in bySurface))
+        return;
+    delete bySurface[normalizePodUrl(podUrl)];
+    if (Object.keys(bySurface).length === 0)
+        delete config.pendingAgentKeys[surface];
+    // writeMultiConfig MERGES over the file, so an emptied map must be written
+    // as an empty object, never dropped (a dropped key would keep the old value).
+    config.pendingAgentKeys = config.pendingAgentKeys ?? {};
+    writeMultiConfig(config);
 }
 export function setAgentWorkspaceRouting(routing) {
     const config = readMultiConfig();
@@ -281,6 +445,7 @@ export function getAgentWorkspaceRouting() {
 export function clearActiveWorkspaceId() {
     const config = readMultiConfig();
     delete config.activeWorkspaceId;
+    delete config.activeWorkspace;
     writeMultiConfig(config);
 }
 export function removePodProfile(name) {
@@ -294,15 +459,6 @@ export function removePodProfile(name) {
     }
     writeMultiConfig(config);
 }
-/** @deprecated Use addPodProfile("default", config) */
-export function saveLocalPodConfig(podConfig) {
-    const config = readMultiConfig();
-    const name = config.activePod || "default";
-    config.pods[name] = podConfig;
-    if (!config.activePod)
-        config.activePod = name;
-    writeMultiConfig(config);
-}
 /**
  * Check if a Synap pod is healthy.
  */
@@ -329,366 +485,4 @@ export async function checkPodHealth(podUrl) {
 export function startSelfHostedPod() {
     execSync('curl -fsSL https://raw.githubusercontent.com/Synap-core/backend/main/install.sh | bash', { stdio: "inherit" });
 }
-/**
- * Install the synap skill into OpenClaw.
- */
-/**
- * Open a Pod session for the CP-authenticated user.
- * Calls the issuer for a short-lived generic assertion, then exchanges that
- * assertion directly with the Pod. The issuer never receives a Pod session.
- *
- * Returns the Kratos session token the Pod mints after its own membership check.
- * That token authenticates subsequent pod tRPC calls (e.g.
- * `apiKeys.connectIntegration`) as the pod user, via the X-Session-Token header.
- * `sessionToken` is null only if the pod handshake returned no token (e.g. 409).
- */
-export async function provisionUserOnPod(podUrl, cpToken) {
-    // Step 1: get an issuer assertion for this Pod.
-    const assertionRes = await fetch(`${CP_URL}/pods/federation/assertion`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${cpToken}`,
-        },
-        body: JSON.stringify({ podUrl }),
-        signal: AbortSignal.timeout(10000),
-    });
-    if (!assertionRes.ok) {
-        const body = await assertionRes.text().catch(() => "");
-        throw new Error(`Could not get Pod issuer assertion (HTTP ${assertionRes.status}): ${body.slice(0, 200)}`);
-    }
-    const { assertion } = (await assertionRes.json());
-    if (!assertion) {
-        throw new Error("Control Plane did not return a Pod issuer assertion");
-    }
-    // Step 2: exchange only with the Pod. It derives the issuer from `iss` and
-    // verifies its own trusted-issuer registry and local membership.
-    const exchangeRes = await fetch(`${podUrl}/api/federation/exchange`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ assertion }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!exchangeRes.ok) {
-        const body = await exchangeRes.text().catch(() => "");
-        throw new Error(`Pod issuer assertion exchange failed (HTTP ${exchangeRes.status}): ${body.slice(0, 200)}`);
-    }
-    // The pod returns the Kratos session token in the handshake body (the same
-    // value the browser receives as the ory_kratos_session cookie).
-    let sessionToken = null;
-    try {
-        const data = (await exchangeRes.json());
-        sessionToken = data.session_token ?? null;
-    }
-    catch {
-        // 409 or an empty body — no token to capture.
-    }
-    return { sessionToken };
-}
-/**
- * Issue a scoped Hub Protocol API key on the pod for an authenticated user.
- *
- * Canonical path: the pod's `apiKeys.connectIntegration` tRPC procedure — the
- * same one the pod-admin `/connect` page and the browser's LocalCliRow use.
- * Auth is the Kratos session token minted by {@link provisionUserOnPod},
- * forwarded as the `X-Session-Token` header. (Replaces the removed CP relay
- * `POST /pods/setup-agent`, which now returns 410.)
- *
- * Backend tRPC uses the superjson transformer, so the input rides in a
- * `{ json: ... }` envelope and the output is unwrapped from `result.data.json`.
- */
-export async function setupAgentViaPod(podUrl, sessionToken, integration = "openclaw") {
-    const res = await fetch(`${podUrl}/trpc/apiKeys.connectIntegration`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "X-Session-Token": sessionToken,
-        },
-        // strategy: "replace_existing" makes re-running `synap init` idempotent —
-        // it revokes any prior key for this integration and mints a fresh one.
-        body: JSON.stringify({
-            json: { integration, strategy: "replace_existing" },
-        }),
-        signal: AbortSignal.timeout(15000),
-    });
-    const body = (await res.json().catch(() => null));
-    if (!res.ok || !body || body.error) {
-        const msg = body?.error?.message ?? `HTTP ${res.status}`;
-        throw new Error(`Pod key issuance failed: ${msg}`);
-    }
-    const data = body.result?.data?.json;
-    if (!data?.apiKey) {
-        throw new Error("Pod returned no API key from connectIntegration");
-    }
-    return {
-        hubApiKey: data.apiKey,
-        // The connectIntegration key is owned by the human pod user directly — there
-        // is no separate agent user in this model (same as the browser flow). Left
-        // empty; the hub client resolves the acting user via /users/me at runtime.
-        agentUserId: "",
-        workspaceId: data.workspaceId ?? "",
-    };
-}
-/**
- * Enable OpenClaw as a free addon on a SELF-HOSTED pod.
- * Uses the PROVISIONING_TOKEN directly against the pod.
- *
- * Routes through the shared `provisionAgentKey()` wrapper (dynamic import to
- * avoid a circular pod.ts <-> targets.ts static import). `workspaceId` is no
- * longer part of the response — agents are pod-wide singletons now; scope is
- * granted separately via `enrollAgentIfNeeded()`, not returned from setup.
- */
-export async function enableOpenClawAddon(podUrl, provisioningToken) {
-    const { provisionAgentKey } = await import("./targets.js");
-    const { hubApiKey, agentUserId } = await provisionAgentKey(podUrl, provisioningToken, "openclaw");
-    return { hubApiKey, agentUserId, workspaceId: "" };
-}
-/**
- * Enable OpenClaw as an addon on a MANAGED pod via the Control Plane.
- * Calls POST /openclaw/provision on the CP (requires CP session token).
- * Returns the podId so the caller can poll status if needed.
- */
-export async function enableOpenClawAddonManaged(cpToken, podUrl) {
-    // Find the pod ID from the CP
-    const podsRes = await fetch(`${CP_URL}/pods`, {
-        headers: { Authorization: `Bearer ${cpToken}` },
-        signal: AbortSignal.timeout(10000),
-    });
-    if (!podsRes.ok)
-        throw new Error(`Could not fetch pods (HTTP ${podsRes.status})`);
-    const { pods } = (await podsRes.json());
-    const appDomain = "synap.live";
-    const pod = pods.find((p) => {
-        const url = p.customDomain ? `https://${p.customDomain}` : `https://${p.subdomain}.${appDomain}`;
-        return url === podUrl || podUrl.includes(p.subdomain);
-    });
-    // Not a local profile miss — this is a lookup against the pods the Control
-    // Plane says you own, so podNotFoundError's "synap pods add" is the wrong fix.
-    if (!pod) {
-        const owned = pods.map((p) => p.customDomain ?? `${p.subdomain}.${appDomain}`).join(", ") || "(none)";
-        throw new Error(`No pod matching ${podUrl} on your account. Pods on this account: ${owned}.`);
-    }
-    const provRes = await fetch(`${CP_URL}/openclaw/provision`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${cpToken}`,
-        },
-        body: JSON.stringify({ podId: pod.id }),
-        signal: AbortSignal.timeout(15000),
-    });
-    if (!provRes.ok) {
-        const body = await provRes.text().catch(() => "");
-        throw new Error(`OpenClaw provision failed (HTTP ${provRes.status}): ${body.slice(0, 200)}`);
-    }
-    return { podId: pod.id };
-}
-/**
- * Check server resources (RAM, disk).
- */
-export function checkServerResources() {
-    let ramTotal = 0;
-    let ramFree = 0;
-    let diskFree = "unknown";
-    try {
-        const mem = execSync("free -m 2>/dev/null || sysctl -n hw.memsize 2>/dev/null", {
-            encoding: "utf-8",
-            timeout: 3000,
-        });
-        const lines = mem.trim().split("\n");
-        if (lines.length > 1) {
-            const parts = lines[1].split(/\s+/);
-            ramTotal = parseInt(parts[1], 10) || 0;
-            ramFree = parseInt(parts[6] || parts[3], 10) || 0;
-        }
-        else {
-            const bytes = parseInt(lines[0], 10);
-            if (bytes > 0) {
-                ramTotal = Math.round(bytes / 1024 / 1024);
-                ramFree = Math.round(ramTotal * 0.5);
-            }
-        }
-    }
-    catch { /* can't detect */ }
-    try {
-        const df = execSync("df -h / 2>/dev/null | tail -1", {
-            encoding: "utf-8",
-            timeout: 3000,
-        });
-        diskFree = df.trim().split(/\s+/)[3] || "unknown";
-    }
-    catch { /* can't detect */ }
-    return { ramTotal, ramFree, diskFree };
-}
-/**
- * Start OpenClaw as a Docker addon on the local server.
- * Writes env vars to the pod's .env file and runs docker compose --profile openclaw.
- * Only works when the CLI is running ON the pod server.
- */
-/**
- * Find the Synap deploy directory — where the .env and docker-compose files live.
- *
- * Strategy (most reliable first):
- *   1. Docker label — inspect any running synap container for
- *      com.docker.compose.project.working_dir (always accurate, zero guessing)
- *   2. Walk up from cwd — works when running from inside the repo
- *   3. Common install paths as a last resort
- */
-export function findSynapDeployDir() {
-    // ── 1. Ask Docker itself ───────────────────────────────────────────────
-    try {
-        // Find any container that belongs to a synap compose project
-        const psOut = execSync("docker ps --format '{{.Names}}' 2>/dev/null", { encoding: "utf-8", timeout: 4000 });
-        const synapContainer = psOut
-            .split("\n")
-            .map((l) => l.trim())
-            .find((n) => /synap|openclaw/i.test(n));
-        if (synapContainer) {
-            const workDir = execSync(`docker inspect --format '{{index .Config.Labels "com.docker.compose.project.working_dir"}}' ${synapContainer} 2>/dev/null`, { encoding: "utf-8", timeout: 4000 }).trim();
-            if (workDir && workDir !== "<no value>" && fs.existsSync(workDir)) {
-                // compose project.working_dir is the folder containing docker-compose.yml
-                // but the .env may be in a "deploy" subdirectory
-                if (hasSynapCompose(workDir))
-                    return workDir;
-                const deploySub = path.join(workDir, "deploy");
-                if (hasSynapCompose(deploySub))
-                    return deploySub;
-                return workDir; // trust Docker even if compose check fails
-            }
-        }
-    }
-    catch {
-        // Docker not available or no containers — fall through
-    }
-    // ── 2. Walk up from cwd ────────────────────────────────────────────────
-    let dir = process.cwd();
-    for (let i = 0; i < 6; i++) {
-        if (hasSynapCompose(dir))
-            return dir;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    // ── 3. Common install paths ────────────────────────────────────────────
-    const home = os.homedir();
-    const fallbacks = [
-        "/srv/synap",
-        "/opt/synap",
-        path.join(home, "synap-backend", "deploy"),
-        path.join(home, "synap-backend"),
-        path.join(home, "synap"),
-    ];
-    for (const d of fallbacks) {
-        if (hasSynapCompose(d))
-            return d;
-    }
-    return null;
-}
-function hasSynapCompose(dir) {
-    try {
-        for (const name of ["docker-compose.standalone.yml", "docker-compose.yml"]) {
-            const f = path.join(dir, name);
-            if (fs.existsSync(f)) {
-                const content = fs.readFileSync(f, "utf-8");
-                if (/ghcr\.io\/synap-core\/backend|synap-backend/i.test(content))
-                    return true;
-            }
-        }
-    }
-    catch {
-        // unreadable
-    }
-    return false;
-}
-/**
- * Write OpenClaw env vars into the deploy dir .env and start the container.
- * Does NOT wait for health — OpenClaw can take several minutes to initialize
- * (first run pulls ~1GB image + runs setup). Caller should tell user to run
- * `synap finish` once it's up.
- *
- * Returns the deploy dir used.
- */
-export function startOpenClawOnServer(hubApiKey, agentUserId, workspaceId, podUrl, projectId) {
-    const deployDir = findSynapDeployDir();
-    if (!deployDir) {
-        throw new Error("Could not find your Synap deploy directory.\n" +
-            "Run from inside the synap-backend folder, or set SYNAP_DEPLOY_DIR env var.");
-    }
-    // ── Write env vars ───────────────────────────────────────────────────────
-    const envFile = path.join(deployDir, ".env");
-    const envVars = {
-        OPENCLAW_HUB_API_KEY: hubApiKey,
-        SYNAP_AGENT_USER_ID: agentUserId,
-        SYNAP_WORKSPACE_ID: workspaceId,
-        SYNAP_POD_URL: podUrl,
-    };
-    // Project is a peer lens to workspace — only injected when one is resolved.
-    if (projectId)
-        envVars.SYNAP_PROJECT_ID = projectId;
-    let envContent = "";
-    try {
-        envContent = fs.existsSync(envFile) ? fs.readFileSync(envFile, "utf-8") : "";
-    }
-    catch { /* start fresh */ }
-    for (const [key, value] of Object.entries(envVars)) {
-        const regex = new RegExp(`^${key}=.*`, "m");
-        const line = `${key}=${value}`;
-        envContent = regex.test(envContent)
-            ? envContent.replace(regex, line)
-            : (envContent.endsWith("\n") || envContent === ""
-                ? envContent + line + "\n"
-                : envContent + "\n" + line + "\n");
-    }
-    fs.writeFileSync(envFile, envContent, { mode: 0o600 });
-    // ── Start container ──────────────────────────────────────────────────────
-    const composeFile = fs.existsSync(path.join(deployDir, "docker-compose.standalone.yml"))
-        ? "docker-compose.standalone.yml"
-        : "docker-compose.yml";
-    // pipe stderr to /dev/null to suppress WARN lines about unset env vars
-    // (those warnings are cosmetic — other services' vars not needed by openclaw)
-    execSync(`docker compose -f ${composeFile} --profile openclaw up -d openclaw 2>/dev/null`, { stdio: ["ignore", "inherit", "ignore"], cwd: deployDir, timeout: 300_000 });
-    return deployDir;
-}
-/**
- * Install the synap skill into OpenClaw.
- */
-const SKILL_SLUG = "synap";
-/**
- * Install the synap skill into OpenClaw.
- * Automatically chooses the right execution path:
- *   - Local install: runs `openclaw skills install synap` directly
- *   - Docker container: runs `docker exec <container> openclaw skills install synap`
- */
-export function installSynapSkill(containerName) {
-    const cmd = containerName
-        ? `docker exec ${containerName} openclaw skills install ${SKILL_SLUG}`
-        : `openclaw skills install ${SKILL_SLUG}`;
-    try {
-        execSync(cmd, { stdio: "inherit", timeout: 60000 });
-    }
-    catch {
-        if (containerName) {
-            throw new Error(`Could not install skill via docker exec.\n` +
-                `Run manually: docker exec ${containerName} openclaw skills install ${SKILL_SLUG}`);
-        }
-        else {
-            throw new Error(`openclaw not found in PATH.\n` +
-                `Run manually: openclaw skills install ${SKILL_SLUG}\n` +
-                `Or if OpenClaw is in Docker: docker exec openclaw openclaw skills install ${SKILL_SLUG}`);
-        }
-    }
-}
-/**
- * Check whether the synap skill is installed inside a Docker container.
- */
-export function isSynapSkillInstalledInDocker(containerName) {
-    try {
-        const out = execSync(`docker exec ${containerName} openclaw skills list 2>/dev/null`, { encoding: "utf-8", timeout: 10000 });
-        return /synap/i.test(out);
-    }
-    catch {
-        return false;
-    }
-}
 //# sourceMappingURL=pod.js.map