clawdbot 2026.1.4-1

package/dist/infra/node-pairing.js

@@ -0,0 +1,211 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const PENDING_TTL_MS = 5 * 60 * 1000;
+function defaultBaseDir() {
+    return path.join(os.homedir(), ".clawdbot");
+}
+function resolvePaths(baseDir) {
+    const root = baseDir ?? defaultBaseDir();
+    const dir = path.join(root, "nodes");
+    return {
+        dir,
+        pendingPath: path.join(dir, "pending.json"),
+        pairedPath: path.join(dir, "paired.json"),
+    };
+}
+async function readJSON(filePath) {
+    try {
+        const raw = await fs.readFile(filePath, "utf8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeJSONAtomic(filePath, value) {
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    const tmp = `${filePath}.${randomUUID()}.tmp`;
+    await fs.writeFile(tmp, JSON.stringify(value, null, 2), "utf8");
+    await fs.rename(tmp, filePath);
+}
+function pruneExpiredPending(pendingById, nowMs) {
+    for (const [id, req] of Object.entries(pendingById)) {
+        if (nowMs - req.ts > PENDING_TTL_MS) {
+            delete pendingById[id];
+        }
+    }
+}
+let lock = Promise.resolve();
+async function withLock(fn) {
+    const prev = lock;
+    let release;
+    lock = new Promise((resolve) => {
+        release = resolve;
+    });
+    await prev;
+    try {
+        return await fn();
+    }
+    finally {
+        release?.();
+    }
+}
+async function loadState(baseDir) {
+    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    const [pending, paired] = await Promise.all([
+        readJSON(pendingPath),
+        readJSON(pairedPath),
+    ]);
+    const state = {
+        pendingById: pending ?? {},
+        pairedByNodeId: paired ?? {},
+    };
+    pruneExpiredPending(state.pendingById, Date.now());
+    return state;
+}
+async function persistState(state, baseDir) {
+    const { pendingPath, pairedPath } = resolvePaths(baseDir);
+    await Promise.all([
+        writeJSONAtomic(pendingPath, state.pendingById),
+        writeJSONAtomic(pairedPath, state.pairedByNodeId),
+    ]);
+}
+function normalizeNodeId(nodeId) {
+    return nodeId.trim();
+}
+function newToken() {
+    return randomUUID().replaceAll("-", "");
+}
+export async function listNodePairing(baseDir) {
+    const state = await loadState(baseDir);
+    const pending = Object.values(state.pendingById).sort((a, b) => b.ts - a.ts);
+    const paired = Object.values(state.pairedByNodeId).sort((a, b) => b.approvedAtMs - a.approvedAtMs);
+    return { pending, paired };
+}
+export async function getPairedNode(nodeId, baseDir) {
+    const state = await loadState(baseDir);
+    return state.pairedByNodeId[normalizeNodeId(nodeId)] ?? null;
+}
+export async function requestNodePairing(req, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const nodeId = normalizeNodeId(req.nodeId);
+        if (!nodeId) {
+            throw new Error("nodeId required");
+        }
+        const existing = Object.values(state.pendingById).find((p) => p.nodeId === nodeId);
+        if (existing) {
+            return { status: "pending", request: existing, created: false };
+        }
+        const isRepair = Boolean(state.pairedByNodeId[nodeId]);
+        const request = {
+            requestId: randomUUID(),
+            nodeId,
+            displayName: req.displayName,
+            platform: req.platform,
+            version: req.version,
+            deviceFamily: req.deviceFamily,
+            modelIdentifier: req.modelIdentifier,
+            caps: req.caps,
+            commands: req.commands,
+            permissions: req.permissions,
+            remoteIp: req.remoteIp,
+            silent: req.silent,
+            isRepair,
+            ts: Date.now(),
+        };
+        state.pendingById[request.requestId] = request;
+        await persistState(state, baseDir);
+        return { status: "pending", request, created: true };
+    });
+}
+export async function approveNodePairing(requestId, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const pending = state.pendingById[requestId];
+        if (!pending)
+            return null;
+        const now = Date.now();
+        const existing = state.pairedByNodeId[pending.nodeId];
+        const node = {
+            nodeId: pending.nodeId,
+            token: newToken(),
+            displayName: pending.displayName,
+            platform: pending.platform,
+            version: pending.version,
+            deviceFamily: pending.deviceFamily,
+            modelIdentifier: pending.modelIdentifier,
+            caps: pending.caps,
+            commands: pending.commands,
+            permissions: pending.permissions,
+            remoteIp: pending.remoteIp,
+            createdAtMs: existing?.createdAtMs ?? now,
+            approvedAtMs: now,
+        };
+        delete state.pendingById[requestId];
+        state.pairedByNodeId[pending.nodeId] = node;
+        await persistState(state, baseDir);
+        return { requestId, node };
+    });
+}
+export async function rejectNodePairing(requestId, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const pending = state.pendingById[requestId];
+        if (!pending)
+            return null;
+        delete state.pendingById[requestId];
+        await persistState(state, baseDir);
+        return { requestId, nodeId: pending.nodeId };
+    });
+}
+export async function verifyNodeToken(nodeId, token, baseDir) {
+    const state = await loadState(baseDir);
+    const normalized = normalizeNodeId(nodeId);
+    const node = state.pairedByNodeId[normalized];
+    if (!node)
+        return { ok: false };
+    return node.token === token ? { ok: true, node } : { ok: false };
+}
+export async function updatePairedNodeMetadata(nodeId, patch, baseDir) {
+    await withLock(async () => {
+        const state = await loadState(baseDir);
+        const normalized = normalizeNodeId(nodeId);
+        const existing = state.pairedByNodeId[normalized];
+        if (!existing)
+            return;
+        const next = {
+            ...existing,
+            displayName: patch.displayName ?? existing.displayName,
+            platform: patch.platform ?? existing.platform,
+            version: patch.version ?? existing.version,
+            deviceFamily: patch.deviceFamily ?? existing.deviceFamily,
+            modelIdentifier: patch.modelIdentifier ?? existing.modelIdentifier,
+            remoteIp: patch.remoteIp ?? existing.remoteIp,
+            caps: patch.caps ?? existing.caps,
+            commands: patch.commands ?? existing.commands,
+            permissions: patch.permissions ?? existing.permissions,
+        };
+        state.pairedByNodeId[normalized] = next;
+        await persistState(state, baseDir);
+    });
+}
+export async function renamePairedNode(nodeId, displayName, baseDir) {
+    return await withLock(async () => {
+        const state = await loadState(baseDir);
+        const normalized = normalizeNodeId(nodeId);
+        const existing = state.pairedByNodeId[normalized];
+        if (!existing)
+            return null;
+        const trimmed = displayName.trim();
+        if (!trimmed)
+            throw new Error("displayName required");
+        const next = { ...existing, displayName: trimmed };
+        state.pairedByNodeId[normalized] = next;
+        await persistState(state, baseDir);
+        return next;
+    });
+}

package/dist/infra/pam.js

@@ -0,0 +1,42 @@
+let pamAuth;
+let pamError = null;
+async function loadPam() {
+    if (pamAuth !== undefined)
+        return;
+    try {
+        // Vite/Vitest: avoid static analysis/bundling for optional native deps.
+        const pkgName = "authenticate-pam";
+        const mod = (await import(pkgName));
+        const candidate = typeof mod === "function"
+            ? mod
+            : typeof mod.authenticate ===
+                "function"
+                ? mod.authenticate
+                : typeof mod.default === "function"
+                    ? mod.default
+                    : null;
+        if (!candidate) {
+            throw new Error("authenticate-pam did not export an authenticate function");
+        }
+        pamAuth = candidate;
+    }
+    catch (err) {
+        pamAuth = null;
+        pamError = err instanceof Error ? err.message : String(err);
+    }
+}
+export async function getPamAvailability() {
+    await loadPam();
+    return pamAuth
+        ? { available: true }
+        : { available: false, error: pamError ?? undefined };
+}
+export async function verifyPamCredentials(username, password) {
+    await loadPam();
+    const auth = pamAuth;
+    if (!auth)
+        return false;
+    return await new Promise((resolve) => {
+        auth(username, password, (err) => resolve(!err));
+    });
+}

package/dist/infra/path-env.js

@@ -0,0 +1,92 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function isExecutable(filePath) {
+    try {
+        fs.accessSync(filePath, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isDirectory(dirPath) {
+    try {
+        return fs.statSync(dirPath).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function mergePath(params) {
+    const partsExisting = params.existing
+        .split(path.delimiter)
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const partsPrepend = params.prepend
+        .map((part) => part.trim())
+        .filter(Boolean);
+    const seen = new Set();
+    const merged = [];
+    for (const part of [...partsPrepend, ...partsExisting]) {
+        if (!seen.has(part)) {
+            seen.add(part);
+            merged.push(part);
+        }
+    }
+    return merged.join(path.delimiter);
+}
+function candidateBinDirs(opts) {
+    const execPath = opts.execPath ?? process.execPath;
+    const cwd = opts.cwd ?? process.cwd();
+    const homeDir = opts.homeDir ?? os.homedir();
+    const platform = opts.platform ?? process.platform;
+    const candidates = [];
+    // Bun bundled (macOS app): `clawdbot` lives in the Relay dir (process.execPath).
+    try {
+        const execDir = path.dirname(execPath);
+        const siblingClawdbot = path.join(execDir, "clawdbot");
+        if (isExecutable(siblingClawdbot))
+            candidates.push(execDir);
+    }
+    catch {
+        // ignore
+    }
+    // Project-local installs (best effort): if a `node_modules/.bin/clawdbot` exists near cwd,
+    // include it. This helps when running under launchd or other minimal PATH environments.
+    const localBinDir = path.join(cwd, "node_modules", ".bin");
+    if (isExecutable(path.join(localBinDir, "clawdbot")))
+        candidates.push(localBinDir);
+    const miseDataDir = process.env.MISE_DATA_DIR ?? path.join(homeDir, ".local", "share", "mise");
+    const miseShims = path.join(miseDataDir, "shims");
+    if (isDirectory(miseShims))
+        candidates.push(miseShims);
+    // Common global install locations (macOS first).
+    if (platform === "darwin") {
+        candidates.push(path.join(homeDir, "Library", "pnpm"));
+    }
+    if (process.env.XDG_BIN_HOME)
+        candidates.push(process.env.XDG_BIN_HOME);
+    candidates.push(path.join(homeDir, ".local", "bin"));
+    candidates.push(path.join(homeDir, ".local", "share", "pnpm"));
+    candidates.push(path.join(homeDir, ".bun", "bin"));
+    candidates.push(path.join(homeDir, ".yarn", "bin"));
+    candidates.push("/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin");
+    return candidates.filter(isDirectory);
+}
+/**
+ * Best-effort PATH bootstrap so skills that require the `clawdbot` CLI can run
+ * under launchd/minimal environments (and inside the macOS bun bundle).
+ */
+export function ensureClawdbotCliOnPath(opts = {}) {
+    if (process.env.CLAWDBOT_PATH_BOOTSTRAPPED === "1")
+        return;
+    process.env.CLAWDBOT_PATH_BOOTSTRAPPED = "1";
+    const existing = opts.pathEnv ?? process.env.PATH ?? "";
+    const prepend = candidateBinDirs(opts);
+    if (prepend.length === 0)
+        return;
+    const merged = mergePath({ existing, prepend });
+    if (merged)
+        process.env.PATH = merged;
+}

package/dist/infra/ports.js

@@ -0,0 +1,87 @@
+import net from "node:net";
+import { danger, info, logVerbose, shouldLogVerbose, warn, } from "../globals.js";
+import { logDebug } from "../logger.js";
+import { runExec } from "../process/exec.js";
+import { defaultRuntime } from "../runtime.js";
+class PortInUseError extends Error {
+    port;
+    details;
+    constructor(port, details) {
+        super(`Port ${port} is already in use.`);
+        this.name = "PortInUseError";
+        this.port = port;
+        this.details = details;
+    }
+}
+function isErrno(err) {
+    return Boolean(err && typeof err === "object" && "code" in err);
+}
+export async function describePortOwner(port) {
+    // Best-effort process info for a listening port (macOS/Linux).
+    try {
+        const { stdout } = await runExec("lsof", [
+            "-i",
+            `tcp:${port}`,
+            "-sTCP:LISTEN",
+            "-nP",
+        ]);
+        const trimmed = stdout.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    catch (err) {
+        logVerbose(`lsof unavailable: ${String(err)}`);
+    }
+    return undefined;
+}
+export async function ensurePortAvailable(port) {
+    // Detect EADDRINUSE early with a friendly message.
+    try {
+        await new Promise((resolve, reject) => {
+            const tester = net
+                .createServer()
+                .once("error", (err) => reject(err))
+                .once("listening", () => {
+                tester.close(() => resolve());
+            })
+                .listen(port);
+        });
+    }
+    catch (err) {
+        if (isErrno(err) && err.code === "EADDRINUSE") {
+            const details = await describePortOwner(port);
+            throw new PortInUseError(port, details);
+        }
+        throw err;
+    }
+}
+export async function handlePortError(err, port, context, runtime = defaultRuntime) {
+    // Uniform messaging for EADDRINUSE with optional owner details.
+    if (err instanceof PortInUseError ||
+        (isErrno(err) && err.code === "EADDRINUSE")) {
+        const details = err instanceof PortInUseError
+            ? err.details
+            : await describePortOwner(port);
+        runtime.error(danger(`${context} failed: port ${port} is already in use.`));
+        if (details) {
+            runtime.error(info("Port listener details:"));
+            runtime.error(details);
+            if (/clawdbot|src\/index\.ts|dist\/index\.js/.test(details)) {
+                runtime.error(warn("It looks like another clawdbot instance is already running. Stop it or pick a different port."));
+            }
+        }
+        runtime.error(info("Resolve by stopping the process using the port or passing --port <free-port>."));
+        runtime.exit(1);
+    }
+    runtime.error(danger(`${context} failed: ${String(err)}`));
+    if (shouldLogVerbose()) {
+        const stdout = err?.stdout;
+        const stderr = err?.stderr;
+        if (stdout?.trim())
+            logDebug(`stdout: ${stdout.trim()}`);
+        if (stderr?.trim())
+            logDebug(`stderr: ${stderr.trim()}`);
+    }
+    return runtime.exit(1);
+}
+export { PortInUseError };

package/dist/infra/provider-summary.js

@@ -0,0 +1,80 @@
+import chalk from "chalk";
+import { loadConfig } from "../config/config.js";
+import { resolveTelegramToken } from "../telegram/token.js";
+import { normalizeE164 } from "../utils.js";
+import { getWebAuthAgeMs, readWebSelfId, webAuthExists, } from "../web/session.js";
+export async function buildProviderSummary(cfg) {
+    const effective = cfg ?? loadConfig();
+    const lines = [];
+    const webEnabled = effective.web?.enabled !== false;
+    if (!webEnabled) {
+        lines.push(chalk.cyan("WhatsApp: disabled"));
+    }
+    else {
+        const webLinked = await webAuthExists();
+        const authAgeMs = getWebAuthAgeMs();
+        const authAge = authAgeMs === null ? "unknown" : formatAge(authAgeMs);
+        const { e164 } = readWebSelfId();
+        lines.push(webLinked
+            ? chalk.green(`WhatsApp: linked${e164 ? ` as ${e164}` : ""} (auth ${authAge})`)
+            : chalk.red("WhatsApp: not linked"));
+    }
+    const telegramEnabled = effective.telegram?.enabled !== false;
+    if (!telegramEnabled) {
+        lines.push(chalk.cyan("Telegram: disabled"));
+    }
+    else {
+        const { token: telegramToken } = resolveTelegramToken(effective);
+        const telegramConfigured = Boolean(telegramToken?.trim());
+        lines.push(telegramConfigured
+            ? chalk.green("Telegram: configured")
+            : chalk.cyan("Telegram: not configured"));
+    }
+    const signalEnabled = effective.signal?.enabled !== false;
+    if (!signalEnabled) {
+        lines.push(chalk.cyan("Signal: disabled"));
+    }
+    else {
+        const signalConfigured = Boolean(effective.signal) &&
+            Boolean(effective.signal?.account?.trim() ||
+                effective.signal?.httpUrl?.trim() ||
+                effective.signal?.cliPath?.trim() ||
+                effective.signal?.httpHost?.trim() ||
+                typeof effective.signal?.httpPort === "number" ||
+                typeof effective.signal?.autoStart === "boolean");
+        lines.push(signalConfigured
+            ? chalk.green("Signal: configured")
+            : chalk.cyan("Signal: not configured"));
+    }
+    const imessageEnabled = effective.imessage?.enabled !== false;
+    if (!imessageEnabled) {
+        lines.push(chalk.cyan("iMessage: disabled"));
+    }
+    else {
+        const imessageConfigured = Boolean(effective.imessage);
+        lines.push(imessageConfigured
+            ? chalk.green("iMessage: configured")
+            : chalk.cyan("iMessage: not configured"));
+    }
+    const allowFrom = effective.whatsapp?.allowFrom?.length
+        ? effective.whatsapp.allowFrom.map(normalizeE164).filter(Boolean)
+        : [];
+    if (allowFrom.length) {
+        lines.push(chalk.cyan(`AllowFrom: ${allowFrom.join(", ")}`));
+    }
+    return lines;
+}
+export function formatAge(ms) {
+    if (ms < 0)
+        return "unknown";
+    const minutes = Math.round(ms / 60_000);
+    if (minutes < 1)
+        return "just now";
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours}h ago`;
+    const days = Math.round(hours / 24);
+    return `${days}d ago`;
+}

package/dist/infra/restart.js

@@ -0,0 +1,29 @@
+import { spawnSync } from "node:child_process";
+const DEFAULT_LAUNCHD_LABEL = "com.clawdbot.mac";
+const DEFAULT_SYSTEMD_UNIT = "clawdbot-gateway.service";
+export function triggerClawdbotRestart() {
+    if (process.platform !== "darwin") {
+        if (process.platform === "linux") {
+            const unit = process.env.CLAWDBOT_SYSTEMD_UNIT || DEFAULT_SYSTEMD_UNIT;
+            const userRestart = spawnSync("systemctl", ["--user", "restart", unit], {
+                stdio: "ignore",
+            });
+            if (!userRestart.error && userRestart.status === 0) {
+                return "systemd";
+            }
+            const systemRestart = spawnSync("systemctl", ["restart", unit], {
+                stdio: "ignore",
+            });
+            if (!systemRestart.error && systemRestart.status === 0) {
+                return "systemd";
+            }
+            return "systemd";
+        }
+        return "supervisor";
+    }
+    const label = process.env.CLAWDBOT_LAUNCHD_LABEL || DEFAULT_LAUNCHD_LABEL;
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    const target = uid !== undefined ? `gui/${uid}/${label}` : label;
+    spawnSync("launchctl", ["kickstart", "-k", target], { stdio: "ignore" });
+    return "launchctl";
+}

package/dist/infra/retry.js

@@ -0,0 +1,16 @@
+export async function retryAsync(fn, attempts = 3, initialDelayMs = 300) {
+    let lastErr;
+    for (let i = 0; i < attempts; i += 1) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+            if (i === attempts - 1)
+                break;
+            const delay = initialDelayMs * 2 ** i;
+            await new Promise((r) => setTimeout(r, delay));
+        }
+    }
+    throw lastErr;
+}

package/dist/infra/runtime-guard.js

@@ -0,0 +1,59 @@
+import process from "node:process";
+import { defaultRuntime } from "../runtime.js";
+const MIN_NODE = { major: 22, minor: 0, patch: 0 };
+const SEMVER_RE = /(\d+)\.(\d+)\.(\d+)/;
+export function parseSemver(version) {
+    if (!version)
+        return null;
+    const match = version.match(SEMVER_RE);
+    if (!match)
+        return null;
+    const [, major, minor, patch] = match;
+    return {
+        major: Number.parseInt(major, 10),
+        minor: Number.parseInt(minor, 10),
+        patch: Number.parseInt(patch, 10),
+    };
+}
+export function isAtLeast(version, minimum) {
+    if (!version)
+        return false;
+    if (version.major !== minimum.major)
+        return version.major > minimum.major;
+    if (version.minor !== minimum.minor)
+        return version.minor > minimum.minor;
+    return version.patch >= minimum.patch;
+}
+export function detectRuntime() {
+    const kind = process.versions?.node ? "node" : "unknown";
+    const version = process.versions?.node ?? null;
+    return {
+        kind,
+        version,
+        execPath: process.execPath ?? null,
+        pathEnv: process.env.PATH ?? "(not set)",
+    };
+}
+export function runtimeSatisfies(details) {
+    const parsed = parseSemver(details.version);
+    if (details.kind === "node")
+        return isAtLeast(parsed, MIN_NODE);
+    return false;
+}
+export function assertSupportedRuntime(runtime = defaultRuntime, details = detectRuntime()) {
+    if (runtimeSatisfies(details))
+        return;
+    const versionLabel = details.version ?? "unknown";
+    const runtimeLabel = details.kind === "unknown"
+        ? "unknown runtime"
+        : `${details.kind} ${versionLabel}`;
+    const execLabel = details.execPath ?? "unknown";
+    runtime.error([
+        "clawdbot requires Node >=22.0.0.",
+        `Detected: ${runtimeLabel} (exec: ${execLabel}).`,
+        `PATH searched: ${details.pathEnv}`,
+        "Install Node: https://nodejs.org/en/download",
+        "Upgrade Node and re-run clawdbot.",
+    ].join("\n"));
+    runtime.exit(1);
+}

package/dist/infra/system-events.js

@@ -0,0 +1,44 @@
+// Lightweight in-memory queue for human-readable system events that should be
+// prefixed to the next main-session prompt/heartbeat. We intentionally avoid
+// persistence to keep events ephemeral.
+const MAX_EVENTS = 20;
+const queue = [];
+let lastText = null;
+let lastContextKey = null;
+function normalizeContextKey(key) {
+    if (!key)
+        return null;
+    const trimmed = key.trim();
+    if (!trimmed)
+        return null;
+    return trimmed.toLowerCase();
+}
+export function isSystemEventContextChanged(contextKey) {
+    const normalized = normalizeContextKey(contextKey);
+    return normalized !== lastContextKey;
+}
+export function enqueueSystemEvent(text, options) {
+    const cleaned = text.trim();
+    if (!cleaned)
+        return;
+    lastContextKey = normalizeContextKey(options?.contextKey);
+    if (lastText === cleaned)
+        return; // skip consecutive duplicates
+    lastText = cleaned;
+    queue.push({ text: cleaned, ts: Date.now() });
+    if (queue.length > MAX_EVENTS)
+        queue.shift();
+}
+export function drainSystemEvents() {
+    const out = queue.map((e) => e.text);
+    queue.length = 0;
+    lastText = null;
+    lastContextKey = null;
+    return out;
+}
+export function peekSystemEvents() {
+    return queue.map((e) => e.text);
+}
+export function hasSystemEvents() {
+    return queue.length > 0;
+}