beeos-claw 0.6.42 → 0.6.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "beeos-claw",
-  "version": "0.6.42",
+  "version": "0.6.43",
   "description": "OpenClaw plugin that bridges the BeeOS platform with the local OpenClaw Gateway, providing file transfer, ACP bridge, and observability.",
   "license": "MIT",
   "author": "BeeOS <dev@beeos.ai>",

package/scripts/runtime-blackbox-worker-lease.mjs

@@ -16,3 +16,38 @@ export function bindRuntimeBlackboxLease(input) {
     journalGeneration: input.journalGeneration,
   };
 }
+
+/**
+ * Construct the black-box Worker through the same one-client Message SDK
+ * composition used by the production plugin. Returning the direct HTTP
+ * channel here is not equivalent: the runtime consumer is owned by
+ * MessageClient.methods and requires the SDK runtime-delivery port.
+ */
+export function createRuntimeBlackboxMessageComposition(input) {
+  const options = {
+    identityId: input.identityId,
+    serviceUrl: input.serviceUrl,
+    tokenProvider: async (requestedIdentityId) => {
+      if (requestedIdentityId !== input.identityId) {
+        throw new Error("runtime black-box MessageClient identity changed");
+      }
+      return {
+        token: input.token,
+        centrifugoUrl: input.centrifugoUrl,
+        serviceUrl: input.serviceUrl,
+        identityId: input.identityId,
+        expiresAt: input.expiresAt,
+      };
+    },
+    runtimeDelivery: {
+      scopedDeliveryKey: input.scopedDeliveryKey,
+      authority: { currentLease: input.currentLease },
+    },
+  };
+  const composition = input.compose(options);
+  if (typeof composition?.client?.methods?.consume !== "function" ||
+      typeof composition?.nodeTransport?.fetchRuntimeChannel !== "function") {
+    throw new Error("runtime black-box MessageClient composition is incomplete");
+  }
+  return composition;
+}

package/scripts/runtime-blackbox-worker-main.mjs

@@ -10,10 +10,9 @@ import { FileRuntimeLeasePort } from "../dist/runtime/runtime-operation-lease.js
 import { FileRuntimeCommandJournal } from "../dist/runtime/runtime-command-journal.js";
 import { FileRuntimePoisonDeliveryJournal } from
   "../dist/runtime/runtime-poison-delivery-journal.js";
-import { MessageServiceRuntimeAuthenticatedFetch } from
-  "../dist/runtime/message-service-runtime-authenticated-fetch.js";
 import { MessageServiceRuntimeMessageChannel } from
   "../dist/runtime/message-service-runtime-message-channel.js";
+import { composeMessageClient } from "../dist/message-client-composition.js";
 import { AgentGatewayGrantJwksReadinessAdapter, RuntimeServiceTransportReadinessAdapter,
   createRuntimeServiceProductionCandidate } from
   "../dist/runtime/runtime-service-production-candidate.js";
@@ -21,7 +20,8 @@ import { createRuntimeBlackboxReceipt } from "./runtime-security.mjs";
 import { runRuntimePoisonBlackbox } from "./runtime-poison-blackbox-lib.mjs";
 import { closeRuntimeResources, createRuntimeBlackboxCompletionGate, selectRuntimeError, startGatewayWithinDeadline, withinDeadline } from
   "./runtime-blackbox-worker-lifecycle.mjs";
-import { bindRuntimeBlackboxLease } from "./runtime-blackbox-worker-lease.mjs";
+import { bindRuntimeBlackboxLease, createRuntimeBlackboxMessageComposition } from
+  "./runtime-blackbox-worker-lease.mjs";
 
 export async function main() {
   const contractPath = requiredEnvironment("RUNTIME_BLACKBOX_CONTRACT_FILE");
@@ -61,6 +61,17 @@ export async function main() {
   const journalStoreId = nonempty(leaseClaims.journalStoreId, "runtime lease journalStoreId");
   const journalGeneration = decimal(leaseClaims.journalGeneration, "runtime lease journalGeneration");
   const messageServiceUrl = strictBaseUrl(requiredEnvironment("MESSAGE_SERVICE_URL"), "MESSAGE_SERVICE_URL");
+  const messageServiceOrigin = new URL(messageServiceUrl).origin;
+  const messageIdentityId = nonempty(authority.handlerIdentity, "authority.handlerIdentity");
+  const scopedDeliveryKey = requiredEnvironment("MESSAGE_RUNTIME_DELIVERY_KEY");
+  const runtimeLease = () => bindRuntimeBlackboxLease({
+    instanceId, leaseId: nonempty(authority.leaseId, "authority.leaseId"),
+    handlerIdentity: messageIdentityId,
+    runtimeEpoch: decimal(authority.runtimeEpoch, "authority.runtimeEpoch"),
+    runtimeLeaseCredential: nonempty(authority.runtimeLeaseCredential, "authority.runtimeLeaseCredential"),
+    leaseExpiresAt: new Date(Number(leaseClaims.exp) * 1_000).toISOString(),
+    journalStoreId, journalGeneration,
+  });
   const agentGatewayUrl = strictBaseUrl(requiredEnvironment(
     nonempty(contract.authorization?.http?.baseUrlEnvironment,
       "contract.authorization.http.baseUrlEnvironment")), "Agent Gateway base URL");
@@ -72,17 +83,23 @@ export async function main() {
 
   let httpRequests = 0;
   let terminalEvent;
-  const countedFetch = async (url, init = {}) => {
-    httpRequests += 1;
-    return await fetchWithDeadline(url, init, deadline);
+  const processFetch = globalThis.fetch;
+  globalThis.fetch = async (url, init = {}) => {
+    const requested = new URL(url instanceof Request ? url.url : url);
+    if (requested.origin === messageServiceOrigin) httpRequests += 1;
+    return await processFetch(url, init);
   };
-  const messageFetch = new MessageServiceRuntimeAuthenticatedFetch({
-    configuredServiceUrl: messageServiceUrl,
-    tokenProvider: async () => ({ token: requiredEnvironment("MESSAGE_API_KEY"),
-      identityId: nonempty(authority.handlerIdentity, "authority.handlerIdentity"),
-      serviceUrl: messageServiceUrl, expiresAt: Math.floor(deadline / 1_000) + 60 }),
-    fetcher: countedFetch,
+  const messageComposition = createRuntimeBlackboxMessageComposition({
+    compose: composeMessageClient,
+    identityId: messageIdentityId,
+    serviceUrl: messageServiceUrl,
+    token: requiredEnvironment("MESSAGE_API_KEY"),
+    centrifugoUrl: strictWebSocketUrl(requiredEnvironment("CENTRIFUGO_WS_URL"), "CENTRIFUGO_WS_URL"),
+    expiresAt: Math.floor(deadline / 1_000) + 60,
+    scopedDeliveryKey,
+    currentLease: runtimeLease,
   });
+  const messageFetch = messageComposition.nodeTransport;
   const boundAgentFetch = async (url, init = {}) => {
     const headers = new Headers(init.headers);
     headers.set("X-Instance-ID", instanceId);
@@ -99,7 +116,6 @@ export async function main() {
   // candidate.status=unavailable (message_channel_transport) — the
   // 0.6.20–0.6.22 worker false red that blocks backend#842 even when the
   // harness fixture is correct. Reused later for the post-ack renew proof.
-  const scopedDeliveryKey = requiredEnvironment("MESSAGE_RUNTIME_DELIVERY_KEY");
   const authorityChannel = new MessageServiceRuntimeMessageChannel({
     serviceUrl: messageServiceUrl,
     transport: messageFetch,
@@ -109,7 +125,7 @@ export async function main() {
     authorizationAdapter: new AgentGatewayGrantJwksReadinessAdapter({ agentGatewayUrl }),
     transportAdapter: new RuntimeServiceTransportReadinessAdapter({ agentGatewayUrl,
       messageService: messageFetch, boundAgentFetch,
-      messageClient: authorityChannel,
+      messageClient: messageComposition.client,
       configuredServiceUrl: messageServiceUrl,
       scopedDeliveryKey }),
     commandJournal,
@@ -130,14 +146,6 @@ export async function main() {
   let consumer;
   let primaryError;
   let releaseGatewayTransportObserver;
-  const runtimeLease = () => bindRuntimeBlackboxLease({
-    instanceId, leaseId: nonempty(authority.leaseId, "authority.leaseId"),
-    handlerIdentity: nonempty(authority.handlerIdentity, "authority.handlerIdentity"),
-    runtimeEpoch: decimal(authority.runtimeEpoch, "authority.runtimeEpoch"),
-    runtimeLeaseCredential: nonempty(authority.runtimeLeaseCredential, "authority.runtimeLeaseCredential"),
-    leaseExpiresAt: new Date(Number(leaseClaims.exp) * 1_000).toISOString(),
-    journalStoreId, journalGeneration,
-  });
   try {
     releaseGatewayTransportObserver = await startGatewayWithinDeadline(gateway, deadline);
     const identities = new FileRuntimeAgentIdentityRegistry(`${statePrefix}-identities.json`);
@@ -168,6 +176,7 @@ export async function main() {
   } finally {
     primaryError = selectRuntimeError(primaryError,
       await closeRuntimeResources({ consumer, gateway, releaseGatewayTransportObserver }));
+    globalThis.fetch = processFetch;
     try { completionGate.assertNoFailure(); }
     catch (error) { primaryError ??= error; }
   }
@@ -213,13 +222,6 @@ function decodeRuntimeLease(token) {
   }
   return claims;
 }
-async function fetchWithDeadline(url, init, deadline) {
-  const requested = new URL(url);
-  const response = await withinDeadline((signal) =>
-    fetch(requested, { ...init, redirect: "error", signal }), deadline);
-  if (response.url && new URL(response.url).origin !== requested.origin) throw new Error("HTTP origin changed");
-  return response;
-}
 function requiredEnvironment(name) {
   const value = process.env[name]?.trim();
   if (!value) throw new Error(`${name} is required`);
@@ -232,6 +234,13 @@ function strictBaseUrl(value, label) {
   }
   return url.toString();
 }
+function strictWebSocketUrl(value, label) {
+  const url = new URL(value);
+  if (!/^wss?:$/.test(url.protocol) || url.username || url.password || url.search || url.hash) {
+    throw new Error(`${label} must be an absolute query-free WebSocket URL`);
+  }
+  return url.toString();
+}
 function parseObject(raw, label) {
   const value = JSON.parse(raw);
   if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);