clawdi 0.12.10-beta.48 → 0.12.10-beta.49

package/dist/index.js

@@ -519,7 +519,7 @@ ${G.map((Y)=>`- ${Y.target}: ${Y.reason}`).join(`
 		};
 	}
 })();
-`,XI$=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]),QI$=new Set(["forwarded","x-forwarded","x-forwarded-for","x-forwarded-host","x-forwarded-port","x-forwarded-proto","x-forwarded-server","x-real-ip"]);ZI$=_.object({v:_.literal(1),sub:_.literal(JI$),deployment_id:_.string().min(1),runtime:_.enum(["openclaw","hermes"]),jti:_.string().min(1).max(128),iat:_.number().int().nonnegative(),exp:_.number().int().nonnegative()}).strict()});var L6=!1;import{createHash as nI$}from"node:crypto";import{join as Hp}from"node:path";function AE($,J){if(!J)return $;let W=pI$(J.channels),Q=rI$($.manifest,W),X={...$.localSecretValues??{},...GR$(W,Q.projection?.channelCredentials)};return{...$,manifest:Q,sourceManifest:$.sourceManifest??$.manifest,localSecretValues:Object.keys(X).length>0?X:void 0}}function pI$($){let J=[];for(let W of $){if(W.status!=="active")continue;for(let Q of W.runtime_links){if(Q.status!=="active"||!Q.agent_token)continue;let X=VR$(W);J.push({account:W,accountKey:X,linkId:Q.id,agentId:Q.agent_id,agentToken:Q.agent_token,secretRef:zR$(W.provider,X),placeholderSecretRef:HR$(W.provider,X),credentials:(W.runtime_credentials??[]).filter((G)=>G.agent_link_id===Q.id)})}}return J.sort((W,Q)=>`${W.account.provider}:${W.accountKey}`.localeCompare(`${Q.account.provider}:${Q.accountKey}`))}function rI$($,J){let W=WR$(J,$.controlPlane.apiUrl),Q=wR$($),X=aI$(J,Q,BR$($)),G={...$,projection:{...$.projection??{},channels:oI$(J,$.controlPlane.apiUrl,Q),channelCredentials:X},egressProfiles:XR$($.egressProfiles,W)};return sI$(tI$(G,J),J)}function oI$($,J,W){let Q={};for(let X of $){let G=X.account.provider;if(G==="whatsapp"&&!L6)continue;if(G==="telegram"){let Y=FE(Q,"telegram",X.accountKey);Y.accounts[X.accountKey]={enabled:!0,botToken:KE(X),dmPolicy:"open",groupPolicy:"open",allowFrom:["*"],capabilities:{inlineButtons:"all"},groups:{"*":{requireMention:!1}}};continue}if(G==="discord"){let Y=FE(Q,"discord",X.accountKey);Y.accounts[X.accountKey]={enabled:!0,token:KE(X),dmPolicy:"open",groupPolicy:"open",allowFrom:["*"],guilds:{"*":{requireMention:!1,users:["*"]}}};continue}if(G==="whatsapp"){let Y=FE(Q,"whatsapp",X.accountKey),z=Bp(X,W,{openclaw:!0,hermes:!1});Y.accounts[X.accountKey]={enabled:!0,wsUrl:`${LR$(Vp(J))}/v1/channels/whatsapp/${X.account.id}/baileys`,token:KE(X),...z?{authDir:z.authDir}:{}}}}return Q}function aI$($,J,W){return $.map((Q)=>Bp(Q,J,W)).filter((Q)=>Q!==null).sort((Q,X)=>`${Q.provider}:${Q.accountKey}:${Q.credentialId}`.localeCompare(`${X.provider}:${X.accountKey}:${X.credentialId}`))}function tI$($,J){let W=$.runtimes.openclaw;if(!W?.enabled)return $;let Q=W.run??{env:{},prependPath:[]},X=eI$(Q.secretEnv??{});for(let G of J){if(G.account.provider==="whatsapp"&&!L6)continue;X[Dp(G)]=G.placeholderSecretRef}if(!W.run&&Object.keys(X).length===0)return $;return{...$,runtimes:{...$.runtimes,openclaw:{...W,run:{...Q,secretEnv:X}}}}}function sI$($,J){let W=$.runtimes.hermes;if(!W?.enabled)return $;let Q=_E(J,"telegram"),X=_E(J,"discord"),G=L6?_E(J,"whatsapp"):null,z=(G?bE(G):[]).find((D)=>jE(D)!==null),H=W.run??{env:{},prependPath:[]},q=zp(H.env??{},dI$),U=zp(H.secretEnv??{},iI$);if(Q)q.TELEGRAM_ALLOW_ALL_USERS="true",q.HERMES_TELEGRAM_DISABLE_FALLBACK_IPS="true",U.TELEGRAM_BOT_TOKEN=Q.placeholderSecretRef;if(X)q.DISCORD_ALLOW_ALL_USERS="true",U.DISCORD_BOT_TOKEN=X.placeholderSecretRef;if(G&&z)q.WHATSAPP_ENABLED="true",q.WHATSAPP_MODE="bot",q.WHATSAPP_ALLOWED_USERS="*",U.HERMES_WA_CREDS_JSON=IE(G,z);return{...$,runtimes:{...$.runtimes,hermes:{...W,run:{...H,env:q,secretEnv:U}}}}}function _E($,J){return $.find((W)=>W.account.provider===J)??null}function KE($){return{source:"env",provider:"default",id:Dp($)}}function Dp($){return`${qp}${Yp($.account.provider)}_${Yp($.accountKey)}${Up}`}function Yp($){return $.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"CHANNEL"}function eI$($){return Object.fromEntries(Object.entries($).filter(([J])=>!$R$(J)))}function $R$($){return $.startsWith(qp)&&$.endsWith(Up)}function zp($,J){let W=new Set(J),Q={};for(let[X,G]of Object.entries($))if(!W.has(X))Q[X]=G;return Q}function FE($,J,W){let Q=$[J];if(JR$(Q))return Q;let X={enabled:!0,defaultAccount:W,accounts:{}};return $[J]=X,X}function JR$($){return typeof $==="object"&&$!==null&&!Array.isArray($)&&typeof $.accounts==="object"&&$.accounts!==null&&!Array.isArray($.accounts)}function WR$($,J){let W=Vp(J),Q=[];for(let X of $){let G=`${X.account.provider}-${X.accountKey}`;if(X.account.provider==="telegram")Q.push({id:`native-${G}-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"api.telegram.org",pathPrefix:"/bot",path:{type:"secretRefPrefix",secretRef:X.placeholderSecretRef,prefix:"/bot",suffix:"/"},headers:{},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/telegram`,preservePath:!0,pathReplace:{type:"secretRefPrefix",secretRef:X.placeholderSecretRef,replacementSecretRef:X.secretRef,prefix:"/bot",suffix:"/"},setHeaders:{}},logging:{redactHeaders:["authorization"],redactUrlPatterns:["/bot[^/]+"]},priority:100,owner:"clawdi-native-channels"});if(X.account.provider==="discord")Q.push({id:`native-${G}-rest-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"discord.com",pathPrefix:"/api/",headers:{authorization:{type:"secretRefEquals",secretRef:X.placeholderSecretRef,prefix:"Bot "}},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/discord`,preservePath:!0,setHeaders:{authorization:{type:"secretRef",secretRef:X.secretRef,prefix:"Bot "}}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:101,owner:"clawdi-native-channels"}),Q.push({id:`native-${G}-gateway-passthrough`,enabled:!0,kind:"passthrough",match:{scheme:"wss",host:"gateway.discord.gg",pathPrefix:"/",headers:{},query:{}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:201,owner:"clawdi-native-channels"});if(X.account.provider==="whatsapp")Q.push({id:`native-${G}-graph-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"graph.facebook.com",pathPrefix:"/v",headers:{authorization:{type:"secretRefEquals",secretRef:X.placeholderSecretRef,prefix:"Bearer "}},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/whatsapp/graph`,preservePath:!0,setHeaders:{authorization:{type:"secretRef",secretRef:X.secretRef,prefix:"Bearer "}}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:102,owner:"clawdi-native-channels"})}return Q}function XR$($,J){let W=[...$?.profiles??[]],Q=new Set(J.map((X)=>X.id));return{profiles:[...W.filter((X)=>!Q.has(X.id)&&!QR$(X)),...J]}}function QR$($){return $.owner==="clawdi-native-channels"||$.id==="direct-provider-passthrough"||$.id.startsWith("direct-provider-passthrough-")}function GR$($,J){let W={},Q=YR$(J);for(let X of $){ME(W,X.secretRef,X.agentToken),ME(W,X.placeholderSecretRef,qR$(X.account.provider,X.accountKey));for(let G of bE(X)){let Y=jE(G);if(Y===null)continue;let z=IE(X,G);if(!Q.has(z))continue;ME(W,z,JSON.stringify(Y))}}return W}function YR$($){let J=new Set;if(!Array.isArray($))return J;for(let W of $){let Q=aw(W);if(Q?.provider!=="whatsapp"||Q.kind!=="whatsapp_baileys_auth_state")continue;let X=Array.isArray(Q.files)?Q.files:[];for(let G of X){let Y=aw(G),z=wp(Y?.secretRef);if(Y?.path==="creds.json"&&z)J.add(z)}}return J}function ME($,J,W){$[J]=W,$[J.replace(/^secret:\/\//,"")]=W}function zR$($,J){return`secret://channels/${$}/${J}/agent-token`}function HR$($,J){return`secret://channels/${$}/${J}/placeholder-token`}function qR$($,J){let W=nI$("sha256").update(`${$}:${J}`).digest("hex").slice(0,32);if($==="telegram")return`999999999:${W}`;return`clawdi_${W}`}function Bp($,J,W){if(!L6)return null;let Q=bE($)[0];if(!Q||jE(Q)===null)return null;let X=UR$(J,$.accountKey),G={};if(W.openclaw)G.openclaw={authDir:X};if(W.hermes)G.hermes={sessionDir:DR$(J),credsJsonEnv:"HERMES_WA_CREDS_JSON"};if(!G.openclaw&&!G.hermes)return null;return{provider:"whatsapp",kind:"whatsapp_baileys_auth_state",accountId:$.account.id,accountKey:$.accountKey,linkId:$.linkId,credentialId:Q.id,authDir:X,files:[{path:"creds.json",secretRef:IE($,Q)}],targets:G}}function bE($){if($.account.provider!=="whatsapp")return[];return $.credentials.filter((J)=>J.provider==="whatsapp"&&J.kind==="whatsapp_baileys_auth_state")}function jE($){let J=aw($.material);if(J?.schemaVersion!=="clawdi.whatsappBaileysAuthState.v1")return null;let W=J.creds;if(!W||typeof W!=="object"||Array.isArray(W))return null;return W}function IE($,J){return`secret://channels/whatsapp/${$.accountKey}/credentials/${J.id}/creds-json`}function UR$($,J){return Hp($,".openclaw","credentials","whatsapp",J)}function DR$($){return Hp($,".hermes","platforms","whatsapp","session")}function BR$($){return{openclaw:$.runtimes.openclaw?.enabled===!0,hermes:$.runtimes.hermes?.enabled===!0}}function wR$($){let J=aw($.projection?.system);return(J?wp(J.home):null)??process.env.HOME??"/home/clawdi"}function aw($){if(!$||typeof $!=="object"||Array.isArray($))return null;return $}function wp($){return typeof $==="string"&&$.trim().length>0?$.trim():null}function VR$($){return`clawdi_${$.id.replace(/[^a-zA-Z0-9]/g,"").slice(0,12).toLowerCase()||OR$($.name)}`}function OR$($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"").slice(0,24)||"channel"}function Vp($){return $.replace(/\/+$/,"")}function LR$($){if($.startsWith("https://"))return`wss://${$.slice(8)}`;if($.startsWith("http://"))return`ws://${$.slice(7)}`;return $}var dI$,iI$,qp="CLAWDI_CHANNEL_",Up="_AGENT_TOKEN";var Op=K(()=>{dI$=["TELEGRAM_ALLOW_ALL_USERS","DISCORD_ALLOW_ALL_USERS","HERMES_TELEGRAM_DISABLE_FALLBACK_IPS","WHATSAPP_ENABLED","WHATSAPP_MODE","WHATSAPP_ALLOWED_USERS"],iI$=["TELEGRAM_BOT_TOKEN","DISCORD_BOT_TOKEN","HERMES_WA_CREDS_JSON"]});import{spawnSync as ew}from"node:child_process";import{createHash as Lp}from"node:crypto";import{accessSync as NR$,constants as _R$,existsSync as Np,mkdirSync as tw,readdirSync as KR$,readFileSync as _p,readlinkSync as FR$,renameSync as MR$,rmSync as RE,symlinkSync as AR$}from"node:fs";import{dirname as sY,join as PX}from"node:path";function Kp($,J,W={}){let Q=$.clawdiCli?.packageSpec?.trim();if(!Q)return tY("not_requested",J,{packageSpec:null,registry:null,activeTarget:null,version:null});PR$(Q);let X=ER$($),G=ZR$(J.cliBootstrapStatus);if(SR$(G,J,Q,X))return tY("current",J,{packageSpec:Q,registry:X,npmPrefix:G.npmPrefix??eY(G.activeTarget),activeTarget:G.activeTarget??null,version:G.version??null});let Y=CR$(J,Q,X);if(Y)return EE(J,{packageSpec:Q,registry:X,npmPrefix:Y.npmPrefix,activeTarget:Y.activeTarget,version:Y.version}),tY("current",J,{packageSpec:Q,registry:X,npmPrefix:Y.npmPrefix,activeTarget:Y.activeTarget,version:Y.version});if(W.deferInstall)return tY("deferred",J,{packageSpec:Q,registry:X,npmPrefix:G?.npmPrefix??J.cliNpmPrefix,activeTarget:G?.activeTarget??null,version:G?.version??null,error:W.deferReason??"CLI install retry is in backoff"});let z=G?.activeTarget??Ip(J.cliManagedBin),H=z?eY(z):null,q=vR$(J,Q,X);return Pp(J.cliManagedBin,q.activeTarget),EE(J,{packageSpec:Q,registry:X,npmPrefix:q.npmPrefix,activeTarget:q.activeTarget,version:q.version}),fR$(J,{packageSpec:Q,registry:X,installed:q,previousStatus:G,previousActiveTarget:z,manifestIdentity:W.manifestIdentity}),Rp(J,[q.npmPrefix,H]),tY("installed",J,{packageSpec:Q,registry:X,npmPrefix:q.npmPrefix,activeTarget:q.activeTarget,version:q.version})}function tY($,J,W){return{status:$,...W,npmPrefix:W.npmPrefix??J.cliNpmPrefix,npmCache:W.npmCache??J.cliNpmCache,activePath:J.cliManagedBin}}function ER$($){let J=$.clawdiCli?.registry;if(typeof J!=="string"||!J.trim())return null;let W=J.trim(),Q;try{let X=new URL(W);X.pathname=X.pathname.replace(/\/+$/,""),X.search="",X.hash="",Q=X.toString().replace(/\/$/,"")}catch{throw Error(`unsupported clawdi CLI registry: ${W}`)}if(Q!=="https://registry.npmjs.org")throw Error(`unsupported clawdi CLI registry: ${W}`);return"https://registry.npmjs.org"}function PR$($){if($==="clawdi")return;if(/^clawdi@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/.test($))return;if(/^clawdi@[A-Za-z0-9._-]+$/.test($))return;if(/^\/usr\/local\/share\/clawdi\/bootstrap\/[^/]+\.tgz$/.test($)&&!$.includes(".."))return;throw Error(`clawdi CLI packageSpec must be clawdi, clawdi@<version-or-tag>, or a managed bootstrap tarball: ${$}`)}function ZR$($){if(!Np($))return null;try{let J=JSON.parse(_p($,"utf-8"));if(typeof J!=="object"||J===null||Array.isArray(J))return null;return J}catch{return null}}function SR$($,J,W,Q){if(!$)return!1;if($.status!=="installed"||$.source!=="npm")return!1;if($.packageSpec!==W)return!1;if(($.registry??null)!==Q)return!1;if($.activePath!==J.cliManagedBin)return!1;if(!$.activeTarget||!dQ($.activeTarget))return!1;if(!Fp(J,$,W,Q))return!1;return dQ(J.cliManagedBin)}function CR$($,J,W){let Q=PE($,J,W);if(!Q)return null;let X=jp($,Q),G=gR$($,J,W),Y=Ip($.cliManagedBin);if(Y!==PX(X,"bin","clawdi")&&Y!==PX(G,"bin","clawdi"))return null;if(!dQ(Y)||!dQ($.cliManagedBin))return null;let z=Ep(Y);if(!Fp($,{version:z},J,W))return null;return{npmPrefix:eY(Y),activeTarget:Y,version:z}}function Fp($,J,W,Q){let X=Ap(W);if(X)return!J.version||J.version===X;if(!Mp(W))return!0;if(!J.version)return!1;let G=PE($,W,Q);return G===null||J.version===G}function Mp($){let J=/^clawdi@(.+)$/.exec($);if(!J)return!1;let W=J[1]??"";if(!/^(alpha|beta|canary|next|rc)$/.test(W))return!1;return!bp(W)}function PE($,J,W){let Q=Ap(J);if(Q)return Q;if(!Mp(J))return null;return TR$($,J,W)}function Ap($){let J=/^clawdi@(.+)$/.exec($);if(!J)return null;let W=J[1]??"";return bp(W)?W:null}function bp($){return/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/.test($)}function TR$($,J,W){let Q=ew("npm",["view",J,"version","--json","--cache",$.cliNpmCache,...W?["--registry",W]:[]],{encoding:"utf8",timeout:jR$,env:{...process.env,NO_UPDATE_NOTIFIER:"1",NPM_CONFIG_UPDATE_NOTIFIER:"false"}});if(Q.status!==0)return null;let X=Q.stdout.trim();if(!X)return null;try{let G=JSON.parse(X);return typeof G==="string"&&G.trim()?G.trim():null}catch{return X}}function vR$($,J,W){let Q=kR$($,J,W);if(yR$($,J,W,Q.version))throw Error(`clawdi CLI ${Q.version} is marked bad after rollback; waiting for a newer resolved version`);let X=Q.npmPrefix;tw(sY($.cliManagedBin),{recursive:!0}),tw(X,{recursive:!0}),tw($.cliNpmCache,{recursive:!0}),T8(sY($.cliManagedBin),493),T8($.cliNpmPrefix,493),T8(X,493),T8($.cliNpmCache,493);let G=["install","-g","--prefix",X,"--cache",$.cliNpmCache,"--ignore-scripts","--fetch-retries","2","--fetch-retry-mintimeout","1000","--fetch-retry-maxtimeout","10000","--fetch-timeout","60000","--omit=dev","--no-audit","--no-fund","--no-update-notifier",...W?["--registry",W]:[],Q.installPackageSpec],Y=ew("npm",G,{encoding:"utf8",timeout:bR$,env:{...process.env,NO_UPDATE_NOTIFIER:"1",NPM_CONFIG_UPDATE_NOTIFIER:"false"}});if(Y.status!==0)throw Error(`npm install ${Q.installPackageSpec} failed${Y.status===null?"":` (${Y.status})`}${Y.error?`: ${Y.error.message}`:""}${sw(Y.stdout,Y.stderr)}`);let z=`${X}/bin/clawdi`;if(!dQ(z))throw Error(`npm install completed but clawdi bin is missing: ${z}`);let H=Ep(z);return xR$(z),{npmPrefix:X,activeTarget:z,version:H}}function kR$($,J,W){let Q=PE($,J,W);if(Q)return{installPackageSpec:`clawdi@${Q}`,npmPrefix:jp($,Q),version:Q};let X=Lp("sha256").update(JSON.stringify({packageSpec:J,registry:W})).digest("hex").slice(0,16);return{installPackageSpec:J,npmPrefix:PX($.cliNpmPrefix,"packages",`tarball-${X}`),version:`tarball-${X}`}}function jp($,J){if(!/^[0-9A-Za-z._+-]+$/.test(J))throw Error(`resolved clawdi CLI version contains unsafe path characters: ${J}`);return PX($.cliNpmPrefix,"packages",J)}function gR$($,J,W){let Q=Lp("sha256").update(JSON.stringify({packageSpec:J,registry:W})).digest("hex").slice(0,16);return PX($.cliNpmPrefix,"packages",Q)}function eY($){return sY(sY($))}function Ip($){try{return FR$($)}catch{return null}}function Rp($,J){let W=PX($.cliNpmPrefix,"packages"),Q=new Set(J.filter((X)=>Boolean(X)));try{for(let X of KR$(W,{withFileTypes:!0})){if(!X.isDirectory())continue;let G=PX(W,X.name);if(!Q.has(G))RE(G,{recursive:!0,force:!0})}}catch{}}function sw($,J){let W=[$,J].filter(Boolean).join(`
+`,XI$=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","proxy-connection","te","trailer","transfer-encoding","upgrade"]),QI$=new Set(["forwarded","x-forwarded","x-forwarded-for","x-forwarded-host","x-forwarded-port","x-forwarded-proto","x-forwarded-server","x-real-ip"]);ZI$=_.object({v:_.literal(1),sub:_.literal(JI$),deployment_id:_.string().min(1),runtime:_.enum(["openclaw","hermes"]),jti:_.string().min(1).max(128),iat:_.number().int().nonnegative(),exp:_.number().int().nonnegative()}).strict()});var L6=!1;import{createHash as nI$}from"node:crypto";import{join as Hp}from"node:path";function AE($,J){if(!J)return $;let W=pI$(J.channels),Q=rI$($.manifest,W),X={...$.localSecretValues??{},...GR$(W,Q.projection?.channelCredentials)};return{...$,manifest:Q,sourceManifest:$.sourceManifest??$.manifest,localSecretValues:Object.keys(X).length>0?X:void 0}}function pI$($){let J=[];for(let W of $){if(W.status!=="active")continue;for(let Q of W.runtime_links){if(Q.status!=="active"||!Q.agent_token)continue;let X=VR$(W);J.push({account:W,accountKey:X,linkId:Q.id,agentId:Q.agent_id,agentToken:Q.agent_token,secretRef:zR$(W.provider,X),placeholderSecretRef:HR$(W.provider,X),credentials:(W.runtime_credentials??[]).filter((G)=>G.agent_link_id===Q.id)})}}return J.sort((W,Q)=>`${W.account.provider}:${W.accountKey}`.localeCompare(`${Q.account.provider}:${Q.accountKey}`))}function rI$($,J){let W=WR$(J,$.controlPlane.apiUrl),Q=wR$($),X=aI$(J,Q,BR$($)),G={...$,projection:{...$.projection??{},channels:oI$(J,$.controlPlane.apiUrl,Q),channelCredentials:X},egressProfiles:XR$($.egressProfiles,W)};return sI$(tI$(G,J),J)}function oI$($,J,W){let Q={};for(let X of $){let G=X.account.provider;if(G==="whatsapp"&&!L6)continue;if(G==="telegram"){let Y=FE(Q,"telegram",X.accountKey);Y.accounts[X.accountKey]={enabled:!0,botToken:KE(X),dmPolicy:"open",groupPolicy:"open",allowFrom:["*"],capabilities:{inlineButtons:"all"},groups:{"*":{requireMention:!1}}};continue}if(G==="discord"){let Y=FE(Q,"discord",X.accountKey);Y.accounts[X.accountKey]={enabled:!0,token:KE(X),dmPolicy:"open",groupPolicy:"open",allowFrom:["*"],guilds:{"*":{requireMention:!1,users:["*"]}}};continue}if(G==="whatsapp"){let Y=FE(Q,"whatsapp",X.accountKey),z=Bp(X,W,{openclaw:!0,hermes:!1});Y.accounts[X.accountKey]={enabled:!0,wsUrl:`${LR$(Vp(J))}/v1/channels/whatsapp/${X.account.id}/baileys`,token:KE(X),...z?{authDir:z.authDir}:{}}}}return Q}function aI$($,J,W){return $.map((Q)=>Bp(Q,J,W)).filter((Q)=>Q!==null).sort((Q,X)=>`${Q.provider}:${Q.accountKey}:${Q.credentialId}`.localeCompare(`${X.provider}:${X.accountKey}:${X.credentialId}`))}function tI$($,J){let W=$.runtimes.openclaw;if(!W?.enabled)return $;let Q=W.run??{env:{},prependPath:[]},X=eI$(Q.secretEnv??{});for(let G of J){if(G.account.provider==="whatsapp"&&!L6)continue;X[Dp(G)]=G.placeholderSecretRef}if(!W.run&&Object.keys(X).length===0)return $;return{...$,runtimes:{...$.runtimes,openclaw:{...W,run:{...Q,secretEnv:X}}}}}function sI$($,J){let W=$.runtimes.hermes;if(!W?.enabled)return $;let Q=_E(J,"telegram"),X=_E(J,"discord"),G=L6?_E(J,"whatsapp"):null,z=(G?bE(G):[]).find((D)=>jE(D)!==null),H=W.run??{env:{},prependPath:[]},q=zp(H.env??{},dI$),U=zp(H.secretEnv??{},iI$);if(Q)q.TELEGRAM_ALLOW_ALL_USERS="true",q.HERMES_TELEGRAM_DISABLE_FALLBACK_IPS="true",U.TELEGRAM_BOT_TOKEN=Q.placeholderSecretRef;if(X)q.DISCORD_ALLOW_ALL_USERS="true",U.DISCORD_BOT_TOKEN=X.placeholderSecretRef;if(G&&z)q.WHATSAPP_ENABLED="true",q.WHATSAPP_MODE="bot",q.WHATSAPP_ALLOWED_USERS="*",U.HERMES_WA_CREDS_JSON=IE(G,z);return{...$,runtimes:{...$.runtimes,hermes:{...W,run:{...H,env:q,secretEnv:U}}}}}function _E($,J){return $.find((W)=>W.account.provider===J)??null}function KE($){return{source:"env",provider:"default",id:Dp($)}}function Dp($){return`${qp}${Yp($.account.provider)}_${Yp($.accountKey)}${Up}`}function Yp($){return $.toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/^_+|_+$/g,"")||"CHANNEL"}function eI$($){return Object.fromEntries(Object.entries($).filter(([J])=>!$R$(J)))}function $R$($){return $.startsWith(qp)&&$.endsWith(Up)}function zp($,J){let W=new Set(J),Q={};for(let[X,G]of Object.entries($))if(!W.has(X))Q[X]=G;return Q}function FE($,J,W){let Q=$[J];if(JR$(Q))return Q;let X={enabled:!0,defaultAccount:W,accounts:{}};return $[J]=X,X}function JR$($){return typeof $==="object"&&$!==null&&!Array.isArray($)&&typeof $.accounts==="object"&&$.accounts!==null&&!Array.isArray($.accounts)}function WR$($,J){let W=Vp(J),Q=[];for(let X of $){let G=`${X.account.provider}-${X.accountKey}`;if(X.account.provider==="telegram")Q.push({id:`native-${G}-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"api.telegram.org",pathPrefix:"/bot",path:{type:"secretRefPrefix",secretRef:X.placeholderSecretRef,prefix:"/bot",suffix:"/"},headers:{},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/telegram`,preservePath:!0,pathReplace:{type:"secretRefPrefix",secretRef:X.placeholderSecretRef,replacementSecretRef:X.secretRef,prefix:"/bot",suffix:"/"},setHeaders:{}},logging:{redactHeaders:["authorization"],redactUrlPatterns:["/bot[^/]+"]},priority:100,owner:"clawdi-native-channels"});if(X.account.provider==="discord")Q.push({id:`native-${G}-rest-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"discord.com",pathPrefix:"/api/",headers:{authorization:{type:"secretRefEquals",secretRef:X.placeholderSecretRef,prefix:"Bot "}},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/discord`,preservePath:!0,setHeaders:{authorization:{type:"secretRef",secretRef:X.secretRef,prefix:"Bot "}}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:101,owner:"clawdi-native-channels"}),Q.push({id:`native-${G}-gateway-passthrough`,enabled:!0,kind:"passthrough",match:{scheme:"wss",host:"gateway.discord.gg",pathPrefix:"/",headers:{},query:{}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:201,owner:"clawdi-native-channels"});if(X.account.provider==="whatsapp")Q.push({id:`native-${G}-graph-managed`,enabled:!0,kind:"http",match:{scheme:"https",host:"graph.facebook.com",pathPrefix:"/v",headers:{authorization:{type:"secretRefEquals",secretRef:X.placeholderSecretRef,prefix:"Bearer "}},query:{}},rewrite:{upstreamBaseUrl:`${W}/v1/channels/whatsapp/graph`,preservePath:!0,setHeaders:{authorization:{type:"secretRef",secretRef:X.secretRef,prefix:"Bearer "}}},logging:{redactHeaders:["authorization"],redactUrlPatterns:[]},priority:102,owner:"clawdi-native-channels"})}return Q}function XR$($,J){let W=[...$?.profiles??[]],Q=new Set(J.map((X)=>X.id));return{profiles:[...W.filter((X)=>!Q.has(X.id)&&!QR$(X)),...J]}}function QR$($){return $.owner==="clawdi-native-channels"||$.id==="direct-provider-passthrough"||$.id.startsWith("direct-provider-passthrough-")}function GR$($,J){let W={},Q=YR$(J);for(let X of $){ME(W,X.secretRef,X.agentToken),ME(W,X.placeholderSecretRef,qR$(X.account.provider,X.accountKey));for(let G of bE(X)){let Y=jE(G);if(Y===null)continue;let z=IE(X,G);if(!Q.has(z))continue;ME(W,z,JSON.stringify(Y))}}return W}function YR$($){let J=new Set;if(!Array.isArray($))return J;for(let W of $){let Q=aw(W);if(Q?.provider!=="whatsapp"||Q.kind!=="whatsapp_baileys_auth_state")continue;let X=Array.isArray(Q.files)?Q.files:[];for(let G of X){let Y=aw(G),z=wp(Y?.secretRef);if(Y?.path==="creds.json"&&z)J.add(z)}}return J}function ME($,J,W){$[J]=W,$[J.replace(/^secret:\/\//,"")]=W}function zR$($,J){return`secret://channels/${$}/${J}/agent-token`}function HR$($,J){return`secret://channels/${$}/${J}/placeholder-token`}function qR$($,J){let W=nI$("sha256").update(`${$}:${J}`).digest("hex").slice(0,32);if($==="telegram")return`999999999:${W}`;return`clawdi_${W}`}function Bp($,J,W){if(!L6)return null;let Q=bE($)[0];if(!Q||jE(Q)===null)return null;let X=UR$(J,$.accountKey),G={};if(W.openclaw)G.openclaw={authDir:X};if(W.hermes)G.hermes={sessionDir:DR$(J),credsJsonEnv:"HERMES_WA_CREDS_JSON"};if(!G.openclaw&&!G.hermes)return null;return{provider:"whatsapp",kind:"whatsapp_baileys_auth_state",accountId:$.account.id,accountKey:$.accountKey,linkId:$.linkId,credentialId:Q.id,authDir:X,files:[{path:"creds.json",secretRef:IE($,Q)}],targets:G}}function bE($){if($.account.provider!=="whatsapp")return[];return $.credentials.filter((J)=>J.provider==="whatsapp"&&J.kind==="whatsapp_baileys_auth_state")}function jE($){let J=aw($.material);if(J?.schemaVersion!=="clawdi.whatsappBaileysAuthState.v1")return null;let W=J.creds;if(!W||typeof W!=="object"||Array.isArray(W))return null;return W}function IE($,J){return`secret://channels/whatsapp/${$.accountKey}/credentials/${J.id}/creds-json`}function UR$($,J){return Hp($,".openclaw","credentials","whatsapp",J)}function DR$($){return Hp($,".hermes","platforms","whatsapp","session")}function BR$($){return{openclaw:$.runtimes.openclaw?.enabled===!0,hermes:$.runtimes.hermes?.enabled===!0}}function wR$($){let J=aw($.projection?.system);return(J?wp(J.home):null)??process.env.HOME??"/home/clawdi"}function aw($){if(!$||typeof $!=="object"||Array.isArray($))return null;return $}function wp($){return typeof $==="string"&&$.trim().length>0?$.trim():null}function VR$($){return`clawdi_${$.id.replace(/[^a-zA-Z0-9]/g,"").slice(0,12).toLowerCase()||OR$($.name)}`}function OR$($){return $.toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"").slice(0,24)||"channel"}function Vp($){return $.replace(/\/+$/,"")}function LR$($){if($.startsWith("https://"))return`wss://${$.slice(8)}`;if($.startsWith("http://"))return`ws://${$.slice(7)}`;return $}var dI$,iI$,qp="CLAWDI_CHANNEL_",Up="_AGENT_TOKEN";var Op=K(()=>{dI$=["TELEGRAM_ALLOW_ALL_USERS","DISCORD_ALLOW_ALL_USERS","HERMES_TELEGRAM_DISABLE_FALLBACK_IPS","WHATSAPP_ENABLED","WHATSAPP_MODE","WHATSAPP_ALLOWED_USERS"],iI$=["TELEGRAM_BOT_TOKEN","DISCORD_BOT_TOKEN","HERMES_WA_CREDS_JSON"]});import{spawnSync as ew}from"node:child_process";import{createHash as Lp}from"node:crypto";import{accessSync as NR$,constants as _R$,existsSync as Np,mkdirSync as tw,readdirSync as KR$,readFileSync as _p,readlinkSync as FR$,renameSync as MR$,rmSync as RE,symlinkSync as AR$}from"node:fs";import{dirname as sY,join as PX}from"node:path";function Kp($,J,W={}){let Q=$.clawdiCli?.packageSpec?.trim();if(!Q)return tY("not_requested",J,{packageSpec:null,registry:null,activeTarget:null,version:null});PR$(Q);let X=ER$($),G=ZR$(J.cliBootstrapStatus);if(SR$(G,J,Q,X))return tY("current",J,{packageSpec:Q,registry:X,npmPrefix:G.npmPrefix??eY(G.activeTarget),activeTarget:G.activeTarget??null,version:G.version??null});let Y=CR$(J,Q,X);if(Y)return EE(J,{packageSpec:Q,registry:X,npmPrefix:Y.npmPrefix,activeTarget:Y.activeTarget,version:Y.version}),tY("current",J,{packageSpec:Q,registry:X,npmPrefix:Y.npmPrefix,activeTarget:Y.activeTarget,version:Y.version});if(W.deferInstall)return tY("deferred",J,{packageSpec:Q,registry:X,npmPrefix:G?.npmPrefix??J.cliNpmPrefix,activeTarget:G?.activeTarget??null,version:G?.version??null,error:W.deferReason??"CLI install retry is in backoff"});let z=G?.activeTarget??Ip(J.cliManagedBin),H=z?eY(z):null,q=vR$(J,Q,X);return Pp(J.cliManagedBin,q.activeTarget),EE(J,{packageSpec:Q,registry:X,npmPrefix:q.npmPrefix,activeTarget:q.activeTarget,version:q.version}),fR$(J,{packageSpec:Q,registry:X,installed:q,previousStatus:G,previousActiveTarget:z,manifestIdentity:W.manifestIdentity}),Rp(J,[q.npmPrefix,H]),tY("installed",J,{packageSpec:Q,registry:X,npmPrefix:q.npmPrefix,activeTarget:q.activeTarget,version:q.version})}function tY($,J,W){return{status:$,...W,npmPrefix:W.npmPrefix??J.cliNpmPrefix,npmCache:W.npmCache??J.cliNpmCache,activePath:J.cliManagedBin}}function ER$($){let J=$.clawdiCli?.registry;if(typeof J!=="string"||!J.trim())return null;let W=J.trim(),Q;try{let X=new URL(W);X.pathname=X.pathname.replace(/\/+$/,""),X.search="",X.hash="",Q=X.toString().replace(/\/$/,"")}catch{throw Error(`unsupported clawdi CLI registry: ${W}`)}if(Q!=="https://registry.npmjs.org")throw Error(`unsupported clawdi CLI registry: ${W}`);return"https://registry.npmjs.org"}function PR$($){if($==="clawdi")return;if(/^clawdi@[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/.test($))return;if(/^clawdi@[A-Za-z0-9._-]+$/.test($))return;if(/^\/usr\/local\/share\/clawdi\/bootstrap\/[^/]+\.tgz$/.test($)&&!$.includes(".."))return;throw Error(`clawdi CLI packageSpec must be clawdi, clawdi@<version-or-tag>, or a managed bootstrap tarball: ${$}`)}function ZR$($){if(!Np($))return null;try{let J=JSON.parse(_p($,"utf-8"));if(typeof J!=="object"||J===null||Array.isArray(J))return null;return J}catch{return null}}function SR$($,J,W,Q){if(!$)return!1;if($.status!=="installed"||$.source!=="npm")return!1;if($.packageSpec!==W)return!1;if(($.registry??null)!==Q)return!1;if($.activePath!==J.cliManagedBin)return!1;if(!$.activeTarget||!dQ($.activeTarget))return!1;if(!Fp(J,$,W,Q))return!1;return dQ(J.cliManagedBin)}function CR$($,J,W){let Q=PE($,J,W);if(!Q)return null;let X=jp($,Q),G=gR$($,J,W),Y=Ip($.cliManagedBin);if(Y!==PX(X,"bin","clawdi")&&Y!==PX(G,"bin","clawdi"))return null;if(!dQ(Y)||!dQ($.cliManagedBin))return null;let z=Ep(Y);if(!Fp($,{version:z},J,W))return null;return{npmPrefix:eY(Y),activeTarget:Y,version:z}}function Fp($,J,W,Q){let X=Ap(W);if(X)return!J.version||J.version===X;if(!Mp(W))return!0;if(!J.version)return!1;let G=PE($,W,Q);return G===null||J.version===G}function Mp($){let J=/^clawdi@(.+)$/.exec($);if(!J)return!1;let W=J[1]??"";if(!/^(agent-v2|alpha|beta|canary|next|rc)$/.test(W))return!1;return!bp(W)}function PE($,J,W){let Q=Ap(J);if(Q)return Q;if(!Mp(J))return null;return TR$($,J,W)}function Ap($){let J=/^clawdi@(.+)$/.exec($);if(!J)return null;let W=J[1]??"";return bp(W)?W:null}function bp($){return/^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/.test($)}function TR$($,J,W){let Q=ew("npm",["view",J,"version","--json","--cache",$.cliNpmCache,...W?["--registry",W]:[]],{encoding:"utf8",timeout:jR$,env:{...process.env,NO_UPDATE_NOTIFIER:"1",NPM_CONFIG_UPDATE_NOTIFIER:"false"}});if(Q.status!==0)return null;let X=Q.stdout.trim();if(!X)return null;try{let G=JSON.parse(X);return typeof G==="string"&&G.trim()?G.trim():null}catch{return X}}function vR$($,J,W){let Q=kR$($,J,W);if(yR$($,J,W,Q.version))throw Error(`clawdi CLI ${Q.version} is marked bad after rollback; waiting for a newer resolved version`);let X=Q.npmPrefix;tw(sY($.cliManagedBin),{recursive:!0}),tw(X,{recursive:!0}),tw($.cliNpmCache,{recursive:!0}),T8(sY($.cliManagedBin),493),T8($.cliNpmPrefix,493),T8(X,493),T8($.cliNpmCache,493);let G=["install","-g","--prefix",X,"--cache",$.cliNpmCache,"--ignore-scripts","--fetch-retries","2","--fetch-retry-mintimeout","1000","--fetch-retry-maxtimeout","10000","--fetch-timeout","60000","--omit=dev","--no-audit","--no-fund","--no-update-notifier",...W?["--registry",W]:[],Q.installPackageSpec],Y=ew("npm",G,{encoding:"utf8",timeout:bR$,env:{...process.env,NO_UPDATE_NOTIFIER:"1",NPM_CONFIG_UPDATE_NOTIFIER:"false"}});if(Y.status!==0)throw Error(`npm install ${Q.installPackageSpec} failed${Y.status===null?"":` (${Y.status})`}${Y.error?`: ${Y.error.message}`:""}${sw(Y.stdout,Y.stderr)}`);let z=`${X}/bin/clawdi`;if(!dQ(z))throw Error(`npm install completed but clawdi bin is missing: ${z}`);let H=Ep(z);return xR$(z),{npmPrefix:X,activeTarget:z,version:H}}function kR$($,J,W){let Q=PE($,J,W);if(Q)return{installPackageSpec:`clawdi@${Q}`,npmPrefix:jp($,Q),version:Q};let X=Lp("sha256").update(JSON.stringify({packageSpec:J,registry:W})).digest("hex").slice(0,16);return{installPackageSpec:J,npmPrefix:PX($.cliNpmPrefix,"packages",`tarball-${X}`),version:`tarball-${X}`}}function jp($,J){if(!/^[0-9A-Za-z._+-]+$/.test(J))throw Error(`resolved clawdi CLI version contains unsafe path characters: ${J}`);return PX($.cliNpmPrefix,"packages",J)}function gR$($,J,W){let Q=Lp("sha256").update(JSON.stringify({packageSpec:J,registry:W})).digest("hex").slice(0,16);return PX($.cliNpmPrefix,"packages",Q)}function eY($){return sY(sY($))}function Ip($){try{return FR$($)}catch{return null}}function Rp($,J){let W=PX($.cliNpmPrefix,"packages"),Q=new Set(J.filter((X)=>Boolean(X)));try{for(let X of KR$(W,{withFileTypes:!0})){if(!X.isDirectory())continue;let G=PX(W,X.name);if(!Q.has(G))RE(G,{recursive:!0,force:!0})}}catch{}}function sw($,J){let W=[$,J].filter(Boolean).join(`
 `).trim();return W?`: ${W.slice(0,1000)}`:""}function Ep($){let J=ew($,["--version"],{encoding:"utf8",timeout:IR$,env:{...process.env,CLAWDI_NO_AUTO_UPDATE:"1",CLAWDI_NO_UPDATE_CHECK:"1"}});if(J.status!==0)throw Error(`installed clawdi did not pass --version smoke check${J.status===null?"":` (${J.status})`}${J.error?`: ${J.error.message}`:""}${sw(J.stdout,J.stderr)}`);let W=J.stdout.trim().split(/\r?\n/,1)[0]?.trim();if(!W)throw Error("installed clawdi --version returned empty output");return W}function xR$($){let J=ew($,["runtime","verify","--json"],{encoding:"utf8",timeout:RR$,env:{...process.env,CLAWDI_NO_AUTO_UPDATE:"1",CLAWDI_NO_UPDATE_CHECK:"1"}});if(J.status!==0)throw Error(`installed clawdi did not pass runtime verify self-check${J.status===null?"":` (${J.status})`}${J.error?`: ${J.error.message}`:""}${sw(J.stdout,J.stderr)}`);let W=J.stdout.trim();if(!W)throw Error("installed clawdi runtime verify self-check returned empty output");try{let Q=JSON.parse(W);if(!Q||typeof Q!=="object"||Array.isArray(Q)||Q.status!=="ok")throw Error("status was not ok")}catch(Q){throw Error(`installed clawdi runtime verify self-check returned invalid JSON: ${Q instanceof Error?Q.message:String(Q)}${sw(J.stdout,J.stderr)}`)}}function Pp($,J){let W=sY($);tw(W,{recursive:!0});let Q=`${W}/.clawdi.next.${process.pid}.${Date.now()}`;try{RE(Q,{force:!0}),AR$(J,Q),MR$(Q,$)}catch(X){throw RE(Q,{force:!0}),X}}function EE($,J){O$($.cliBootstrapStatus,`${JSON.stringify({schemaVersion:"clawdi.cliNpmBootstrapStatus.v1",generatedAt:new Date().toISOString(),status:"installed",source:"npm",packageSpec:J.packageSpec,registry:J.registry,npmPrefix:J.npmPrefix,npmCache:$.cliNpmCache,activePath:$.cliManagedBin,activeTarget:J.activeTarget,version:J.version,error:null},null,2)}
 `,{mode:420,dirMode:493})}function Zp($,J,W={}){let Q=$V($),X=Q.pendingUpgrade??null;if(!X)return{status:"not_pending",version:null,previousVersion:null,activeTarget:null,previousActiveTarget:null};if(!X.rollbackEligible)return{status:"not_pending",version:X.version,previousVersion:X.previousVersion,activeTarget:X.activeTarget,previousActiveTarget:X.previousActiveTarget};if(!Cp(X,W))return{status:"not_pending",version:X.version,previousVersion:X.previousVersion,activeTarget:X.activeTarget,previousActiveTarget:X.previousActiveTarget};if(!X.previousActiveTarget||!dQ(X.previousActiveTarget))return{status:"error",version:X.version,previousVersion:X.previousVersion,activeTarget:X.activeTarget,previousActiveTarget:X.previousActiveTarget,error:"previous clawdi CLI target is missing or not executable"};try{if(Pp($.cliManagedBin,X.previousActiveTarget),X.previousStatus?.packageSpec&&X.previousStatus.activeTarget)EE($,{packageSpec:X.previousStatus.packageSpec,registry:X.previousStatus.registry??null,npmPrefix:X.previousStatus.npmPrefix??eY(X.previousActiveTarget),activeTarget:X.previousActiveTarget,version:X.previousStatus.version??X.previousVersion??"unknown"});let G=JV(Q);return G.pendingUpgrade=null,G.badVersions=uR$(G.badVersions??[],{packageSpec:X.packageSpec,registry:X.registry,version:X.version,reason:J,markedAt:new Date().toISOString()}),ZE($,G),Rp($,[X.previousNpmPrefix]),{status:"rolled_back",version:X.version,previousVersion:X.previousVersion,activeTarget:X.activeTarget,previousActiveTarget:X.previousActiveTarget,error:null}}catch(G){return{status:"error",version:X.version,previousVersion:X.previousVersion,activeTarget:X.activeTarget,previousActiveTarget:X.previousActiveTarget,error:G instanceof Error?G.message:String(G)}}}function Sp($,J,W={}){let Q=$V($),X=Q.pendingUpgrade??null;if(!X)return;if(X.version!==J)return;if(!Cp(X,W))return;let G=JV(Q);G.pendingUpgrade=null,ZE($,G)}function fR$($,J){let W=JV($V($));W.pendingUpgrade={packageSpec:J.packageSpec,registry:J.registry,version:J.installed.version,npmPrefix:J.installed.npmPrefix,activeTarget:J.installed.activeTarget,previousStatus:J.previousStatus,previousActiveTarget:J.previousActiveTarget,previousNpmPrefix:J.previousActiveTarget?eY(J.previousActiveTarget):null,previousVersion:J.previousStatus?.version??null,manifestGeneration:J.manifestIdentity?.generation??null,manifestEtag:J.manifestIdentity?.etag??null,rollbackEligible:J.manifestIdentity?.previouslyApplied===!0,installedAt:new Date().toISOString()},ZE($,W)}function yR$($,J,W,Q){return($V($).badVersions??[]).some((G)=>G.packageSpec===J&&(G.registry??null)===W&&G.version===Q)}function $V($){if(!Np($.cliUpgradeState))return{schemaVersion:"clawdi.cliUpgradeState.v1"};try{let J=JSON.parse(_p($.cliUpgradeState,"utf-8"));if(typeof J!=="object"||J===null||Array.isArray(J))return{schemaVersion:"clawdi.cliUpgradeState.v1"};return J}catch{return{schemaVersion:"clawdi.cliUpgradeState.v1"}}}function ZE($,J){O$($.cliUpgradeState,`${JSON.stringify(JV(J),null,2)}
 `,{mode:420,dirMode:493})}function JV($){return{schemaVersion:"clawdi.cliUpgradeState.v1",pendingUpgrade:$.pendingUpgrade??null,badVersions:$.badVersions??[]}}function uR$($,J){let W=$.filter((Q)=>Q.packageSpec!==J.packageSpec||(Q.registry??null)!==J.registry||Q.version!==J.version);return W.push(J),W}function Cp($,J){if($.manifestEtag&&J.etag&&$.manifestEtag!==J.etag)return!1;if($.manifestGeneration!==null&&J.generation!==void 0&&J.generation!==null&&$.manifestGeneration!==J.generation)return!1;return!0}function dQ($){try{return NR$($,_R$.X_OK),!0}catch{return!1}}var bR$=180000,jR$=30000,IR$=20000,RR$=20000;var Tp=K(()=>{G1()});function gp($){return`${$.replace(/\/+$/,"")}/models`}function xp($){if(!kp($)||!Array.isArray($.data))return[];let J=[],W=new Set;for(let Q of $.data){if(!kp(Q))continue;let X=QV(Q.id);if(!X||W.has(X))continue;W.add(X),J.push(X)}return J}function fp($){let J=QV($.seedModel);if($.liveModelIds===null)return{resolvedModel:J,reason:J?"kept_seed_after_fetch_failure":"no_candidate_model"};let W=yp($.liveModelIds);if(J&&W.includes(J))return{resolvedModel:J,reason:"kept_valid_seed"};let Q=J?XV(J):null,X=hR$(W,Q);if(X)return{resolvedModel:X,reason:"upgraded_to_latest"};if(J)return{resolvedModel:J,reason:"kept_seed_without_live_models"};return{resolvedModel:null,reason:"no_candidate_model"}}function hR$($,J){let W=yp($);if(W.length===0)return null;let Q=lR$(J),X=Q===null?W:W.filter((z)=>XV(z)===Q);return[...X.length>0?X:W].sort(mR$)[0]??null}function mR$($,J){let W=XV($),Q=XV(J),X=cR$(vp($,W),vp(J,Q));if(X!==0)return X;let G=W.localeCompare(Q);if(G!==0)return G;return $.localeCompare(J)}function vp($,J){let W=$.slice(J.length);if(W.startsWith("/"))W=W.slice(1);W=W.replace(/^-+/,"").trim();let Q=[],X="",G="start",Y="";for(let U of W){if(G==="start"){if(U==="v"||U==="V"){G="in_version";continue}if(SE(U)){G="in_version",Y+=U;continue}if(U==="-"||U==="_"||U===".")continue;G="in_suffix",X+=U;continue}if(G==="in_version"){if(SE(U)){Y+=U;continue}if(U==="."){if(Y.includes("."))WV(Q,Y),Y="";else Y+=U;continue}if(U==="-"||U==="_"||U==="."){WV(Q,Y),Y="",G="between";continue}WV(Q,Y),Y="",G="in_suffix",X+=U;continue}if(G==="between"){if(SE(U)){G="in_version",Y=U;continue}if(U==="v"||U==="V"){G="in_version";continue}if(U==="-"||U==="_"||U===".")continue;G="in_suffix",X+=U;continue}X+=U}if(G==="in_version")WV(Q,Y);let z=Q.map((U)=>-U),H=X.toLowerCase().replace(/^[-_.]+|[-_.]+$/g,"").trim(),q=H&&nR$[H]===0?0:1;return[...z,q,H]}function cR$($,J){let W=Math.min($.length,J.length);for(let Q=0;Q<W;Q+=1){let X=$[Q],G=J[Q];if(X===G)continue;if(typeof X==="number"&&typeof G==="number")return X-G;return String(X).localeCompare(String(G))}return $.length-J.length}function XV($){let J=QV($);if(!J)return"";let W=J.lastIndexOf("/"),Q=W>=0?J.slice(0,W+1):"",X=W>=0?J.slice(W+1):J,G=X.search(/[0-9]/);if(G<=0)return J;let Y=X.slice(0,G).replace(/[-_.]+$/g,"");return`${Q}${Y||X}`}function yp($){let J=[],W=new Set;for(let Q of $){let X=QV(Q);if(!X||W.has(X))continue;W.add(X),J.push(X)}return J}function QV($){if(typeof $!=="string")return null;let J=$.trim();return J.length>0?J:null}function lR$($){let J=$?.trim();return J?J:null}function WV($,J){let W=J.replace(/\.+$/g,"");if(!W)return;let Q=Number.parseFloat(W);if(Number.isFinite(Q))$.push(Q)}function SE($){return $>="0"&&$<="9"}function kp($){return typeof $==="object"&&$!==null&&!Array.isArray($)}var nR$;var up=K(()=>{nR$={max:0,plus:0,pro:0,turbo:0}});import{existsSync as pQ,readFileSync as dR$}from"node:fs";import{isAbsolute as GV,join as iR$}from"node:path";function rQ($){return JSON.parse(dR$($,"utf-8"))}function eR$($){if(!$||typeof $!=="object"||Array.isArray($))return null;return $}function $E$($){return mp.safeParse($).success}function $z($){return $.issues.map((J)=>{return`${J.path.length>0?`${J.path.join(".")}: `:""}${J.message}`})}function JE$($){return XW.parse($)}function WE$($){let J=XW.safeParse($);return J.success?J.data:null}function CE($){let J=XW.safeParse($);if(J.success)return{manifest:J.data};let W=si.safeParse($);if(W.success)return{manifest:zE$(W.data.manifest),secretValues:JW(W.data.secretValues)};if(XE$($))throw W.error;throw J.error}function XE$($){if(typeof $!=="object"||$===null||Array.isArray($))return!1;let J=$.manifest;if(typeof J!=="object"||J===null||Array.isArray(J))return!1;return J.schemaVersion==="clawdi.hosted-runtime.manifest.v1"}function TE($){if(typeof $!=="object"||$===null||Array.isArray($))return null;let J=$,W=J.manifest,Q=typeof W==="object"&&W!==null&&!Array.isArray(W)?W.generation:J.generation;return typeof Q==="number"&&Number.isInteger(Q)?Q:null}function lp($){return cQ($),QE($)}function np($){let J=process.env.CLAWDI_RUNTIME_MANIFEST_URL?.trim();if(J){let W;try{W=new URL(J)}catch{throw Error("invalid CLAWDI_RUNTIME_MANIFEST_URL: expected an absolute URL")}if(W.protocol!=="https:"&&W.protocol!=="http:")throw Error("invalid CLAWDI_RUNTIME_MANIFEST_URL: protocol must be http or https");if(W.username||W.password||W.hash)throw Error("invalid CLAWDI_RUNTIME_MANIFEST_URL: credentials and fragments are forbidden");if($.mode==="hosted"&&!W.pathname.endsWith("/v1/runtime/manifest"))throw Error("invalid CLAWDI_RUNTIME_MANIFEST_URL: hosted manifest path must end with /v1/runtime/manifest");return{schemaVersion:"clawdi.runtimeSource.v1",type:"http",url:J}}if($.mode==="hosted")throw Error("missing CLAWDI_RUNTIME_MANIFEST_URL");return QE$($)}function QE$($){if(!pQ($.runtimeSource))throw Error(`runtime source config does not exist: ${$.runtimeSource}`);let J=cp.safeParse(rQ($.runtimeSource));if(!J.success)throw Error(`invalid runtime source config at ${$.runtimeSource}: ${$z(J.error).join("; ")}`);return J.data}async function dp($,J={}){let W=np($),Q=lp($);if(!Q)throw Error(`missing ${nY($)}`);let X=W.url,G=Number.parseInt(process.env.CLAWDI_RUNTIME_MANIFEST_TIMEOUT_MS??"",10)||W.timeoutMs||15000,Y=new AbortController,z=setTimeout(()=>Y.abort(),G);try{let H=await fetch(X,{method:"GET",headers:{accept:"application/json",authorization:`Bearer ${Q}`,...J.ifNoneMatch?{"if-none-match":J.ifNoneMatch}:{}},signal:Y.signal}),q=H.headers.get("etag")??void 0;if(H.status===304)return{url:X,notModified:!0,etag:q};if(!H.ok){let U=await H.text().catch(()=>"");if(H.status===401||H.status===403)throw new YV("manifest",H.status,U);throw Error(`runtime manifest request failed: HTTP ${H.status}${U?` ${U.slice(0,200)}`:""}`)}return{url:X,raw:await H.json(),etag:q}}finally{clearTimeout(z)}}function GE$($){let J=new URL($.url),W=J.searchParams.get("environment_id"),Q=J.pathname.replace(/\/+$/,""),X="/v1/runtime/manifest";if(Q.endsWith("/v1/runtime/manifest")){let G=Q.slice(0,-20);J.pathname=`${G}/v1/channels`}else J.pathname=new URL("v1/channels",J).pathname;if(J.search="",W)J.searchParams.set("environment_id",W);return J.hash="",J.toString()}async function YE$($,J={}){let W=np($),Q=lp($);if(!Q)throw Error(`missing ${nY($)}`);let X=GE$(W),G=Number.parseInt(process.env.CLAWDI_RUNTIME_CHANNELS_TIMEOUT_MS??"",10)||W.timeoutMs||15000,Y=new AbortController,z=setTimeout(()=>Y.abort(),G);try{let H=await fetch(X,{method:"GET",headers:{accept:"application/json",authorization:`Bearer ${Q}`,...J.ifNoneMatch?{"if-none-match":J.ifNoneMatch}:{}},signal:Y.signal}),q=H.headers.get("etag")??void 0;if(H.status===304)return{url:X,notModified:!0,etag:q};if(!H.ok){let U=await H.text().catch(()=>"");if(H.status===401||H.status===403)throw new YV("channels",H.status,U);throw Error(`runtime channels request failed: HTTP ${H.status}${U?` ${U.slice(0,200)}`:""}`)}return{url:X,raw:await H.json(),etag:q}}finally{clearTimeout(z)}}async function gE($,J={}){let W;try{W=await dp($,J)}catch(G){return{mode:"repair",stage:ip(G),errors:[`could not fetch runtime manifest: ${G instanceof Error?G.message:String(G)}`]}}if("notModified"in W)return{source:"remote-datasource",sourcePath:W.url,notModified:!0,etag:W.etag??J.ifNoneMatch};let Q;try{Q=CE(W.raw)}catch(G){return{mode:"manifest-rejected",stage:"network",errors:G instanceof _.ZodError?$z(G):[String(G)],rejectedGeneration:TE(W.raw),activeGeneration:iQ($).generation??null}}let X=kE(Q,$,"remote-datasource",W.url);if("manifest"in X)return{...X,etag:W.etag};return X}async function zV($,J={}){let W;try{W=await YE$($,J)}catch(X){return{mode:"repair",stage:ip(X),errors:[`could not fetch runtime channels: ${X instanceof Error?X.message:String(X)}`]}}if("notModified"in W)return{source:"remote-datasource",sourcePath:W.url,notModified:!0,etag:W.etag??J.ifNoneMatch};let Q=sR$.safeParse(W.raw);if(!Q.success)return{mode:"repair",stage:"network",errors:$z(Q.error)};return{channels:Q.data,source:"remote-datasource",sourcePath:W.url,etag:W.etag}}function ip($){return $ instanceof YV?"auth":"network"}function zE$($){let J=$.system?.home||"/home/clawdi",W=$.system?.workspace||iR$(J,"clawdi"),Q=$.runtime,X=$.runtimes[Q];return{schemaVersion:DE,deploymentId:$.deploymentId,environmentId:$.environmentId||$.appId||$.deploymentId,instanceId:$.instanceId,generation:$.generation,minimumCliVersion:$.minimumCliVersion,issuedAt:$.issuedAt,expiresAt:$.expiresAt,workspaceRoot:W,runtime:Q,controlPlane:{apiUrl:UE$($)},clawdiCli:$.clawdiCli?{...pw,...$.clawdiCli,source:$.clawdiCli.source??pw.source}:{...pw},egressEngine:$.egressEngine,runtimes:{[Q]:{enabled:X.enabled,updateChannel:X.install?.channel,install:X.enabled&&X.install&&iw[Q]?{authority:"official",method:"official-installer",url:iw[Q]??"",home:X.paths?.home||J,args:X.install?.args??di[Q]??[]}:void 0,run:pp(X.run,X.paths?.workspace,W),services:Object.fromEntries(Object.entries(X.services??{}).map(([G,Y])=>[G,qE$(Y,X.paths?.workspace,W)])),...HE$(X)}},bridge:$.bridge,projection:{sourceSchemaVersion:$.schemaVersion,system:$.system??null,providers:$.providers??{},...$.mcp===void 0?{}:{mcp:$.mcp},...$.tools===void 0?{}:{tools:$.tools}},liveSync:$.liveSync,egressProfiles:Jh($),recovery:{cacheManifest:$.recovery?.cacheManifest??!0,allowOfflineBoot:$.recovery?.allowOfflineBoot??!0}}}function HE$($){let J=$.provider_ids??$.providerIds,W=$.primary_model??$.primaryModel,Q=typeof W==="object"&&W!==null&&!Array.isArray(W)?W:null,X=typeof Q?.provider_id==="string"?Q.provider_id:typeof Q?.providerId==="string"?Q.providerId:void 0,G=typeof Q?.model==="string"?Q.model:typeof W==="string"?W:void 0,Y=J?.filter((H)=>H.trim().length>0),z=X&&!Y?.includes(X)?[...Y??[],X]:Y;return{...z&&z.length>0?{provider_ids:z}:{},...X&&G?{primary_model:{provider_id:X,model:G}}:{}}}function pp($,J,W){if(!$&&!J)return;let Q=$?.cwd??J??W,X={env:$?.env??{},cwd:Q,prependPath:$?.prependPath??[]};if($?.command!==void 0)X.command=$.command;if($?.args!==void 0)X.args=$.args;if($?.secretEnv!==void 0)X.secretEnv=$.secretEnv;return X}function qE$($,J,W){return pp($,J,W)??{args:[],env:{},cwd:J??W,prependPath:[]}}function UE$($){let J=$.controlPlane.cloudApiUrl;if(J)return J;let W=$.controlPlane.manifestUrl;if(!W)return new URL(hp()).origin;try{return new URL(W).origin}catch{return new URL(hp()).origin}}function hp(){let $=process.env.CLAWDI_RUNTIME_MANIFEST_URL?.trim();if($)return $;if(process.env.CLAWDI_RUNTIME_MODE?.trim().toLowerCase()==="hosted")throw Error("missing CLAWDI_RUNTIME_MANIFEST_URL");let J=process.env.CLAWDI_RUNTIME_SOURCE_PATH?.trim()||"/etc/clawdi/runtime-source.json";if(pQ(J)){let W=cp.safeParse(rQ(J));if(W.success)return W.data.url}return"https://runtime.invalid/manifest"}function iQ($){if(!pQ($.manifestLastGood))return{};let J=WE$(rQ($.manifestLastGood));if(!J)return{};return{instanceId:J.instanceId,generation:J.generation}}function rp($){if(!$.expiresAt)return null;let J=Date.parse($.expiresAt);if(!Number.isFinite(J))return`manifest expiresAt is not a valid timestamp: ${$.expiresAt}`;if(J<=Date.now())return`manifest expired at ${$.expiresAt}`;return null}function DE$($,J){let W=[],Q=rp($);if(Q)W.push(Q);if(!GV(J.userHome))W.push(`runtime HOME must be absolute: ${J.userHome}`);if($.workspaceRoot&&!GV($.workspaceRoot))W.push(`runtime workspaceRoot must be absolute: ${$.workspaceRoot}`);if($.runtime){let X=$.runtime,G=Object.keys($.runtimes);if(!G.includes(X))W.push(`manifest runtime ${X} must have a matching runtimes.${X} entry`);for(let z of G)if(z!==X)W.push(`single-runtime manifest must not declare runtimes.${z}`);if($.runtimes[X]?.enabled!==!0)W.push(`manifest runtime ${X} must be enabled`);let Y=$.bridge?.surfaces??[];if(X==="openclaw"&&Y.length>0){let z=Y[0];if(Y.length!==1||!z||z.name!=="openclaw"||z.kind!=="control-ui"||z.listenPort!==28789||z.upstreamHost!=="127.0.0.1"||z.upstreamPort!==18789)W.push("openclaw bridge surface must be openclaw control-ui 28789 -> 127.0.0.1:18789")}if(X==="hermes"){let z=Y[0];if(Y.length!==1||!z||z.name!=="hermes"||z.kind!=="control-ui"||z.listenPort!==28793||z.upstreamHost!=="127.0.0.1"||z.upstreamPort!==9119)W.push("hermes runtime must declare bridge surface 28793 -> 127.0.0.1:9119")}}for(let[X,G]of Object.entries($.runtimes)){if(!G.enabled)continue;let Y=G.run?.command?.trim();if(!RX(X)){if(G.install)W.push(`runtime ${X} install metadata is not supported by this Clawdi CLI; provide run.command or upgrade the CLI`);if(!Y)W.push(`runtime ${X} is not supported by this Clawdi CLI; provide run.command or upgrade the CLI`);continue}if(!G.install&&!Y&&!RX(X)){W.push(`runtime ${X} is enabled but missing install metadata`);continue}if(!G.install)continue;let z=iw[X];if(G.install.url!==z)W.push(`runtime ${X} must use official installer ${z}`);if(G.install.home!==J.userHome)W.push(`runtime ${X} install.home must match runtime HOME ${J.userHome}`);if(!GV(G.install.home))W.push(`runtime ${X} install.home must be absolute`);if(G.install.args.includes("--dir"))W.push(`runtime ${X} install args must not include --dir`);if(G.install.args.includes("--prefix"))W.push(`runtime ${X} install args must not include --prefix`)}return W}function op(){let $=process.env.CLAWDI_RUNTIME_MANIFEST_PATH?.trim();return $?$:void 0}async function xE($,J={}){let W=J.manifestPath??op();if(!W){let Y;try{let q=await dp($);if("notModified"in q)throw Error("runtime manifest datasource returned 304 without If-None-Match");Y=q}catch(q){let U=BE$($);if("manifest"in U)return U;return{mode:"repair",stage:"network",errors:[`could not fetch runtime manifest: ${q instanceof Error?q.message:String(q)}`,...U.errors]}}let z;try{z=CE(Y.raw)}catch(q){return{mode:"manifest-rejected",stage:"network",errors:q instanceof _.ZodError?$z(q):[String(q)],rejectedGeneration:TE(Y.raw),activeGeneration:iQ($).generation??null}}let H=kE(z,$,"remote-datasource",Y.url);if("manifest"in H)return{...H,etag:Y.etag};return H}if(!GV(W))return{mode:"repair",stage:"local",errors:[`CLAWDI_RUNTIME_MANIFEST_PATH must be absolute: ${W}`]};if(!pQ(W))return{mode:"repair",stage:"local",errors:[`runtime manifest fixture does not exist: ${W}`]};let Q;try{Q=rQ(W)}catch(Y){return{mode:"manifest-rejected",stage:"local",errors:[`could not read runtime manifest fixture at ${W}: ${Y instanceof Error?Y.message:String(Y)}`],activeGeneration:iQ($).generation??null}}let X;try{X=CE(Q)}catch(Y){return{mode:"manifest-rejected",stage:"local",errors:Y instanceof _.ZodError?$z(Y):[String(Y)],rejectedGeneration:TE(Q),activeGeneration:iQ($).generation??null}}let G=tp(X.manifest,X.secretValues);if(G.length>0)return{mode:"manifest-rejected",stage:"local",errors:[`runtime manifest fixture references secretValues (${G.join(", ")}); refusing fixture without inline secretValues`],rejectedGeneration:X.manifest.generation,activeGeneration:iQ($).generation??null};return kE(X,$,"fixture-file",W)}function BE$($){if(!pQ($.manifestLastGood))return{mode:"repair",stage:"local",errors:["last-good runtime manifest does not exist"]};try{let J=JE$(rQ($.manifestLastGood));if(J.recovery.allowOfflineBoot!==!0)return{mode:"repair",stage:"local",errors:["cached manifest does not allow offline boot"]};let W=rp(J);if(W)return{mode:"repair",stage:"local",errors:[`cached ${W}`]};if(ap(J).length>0){let X=wE$($);if("errors"in X)return X;let G=tp(J,X.secretValues);if(G.length===0)return{manifest:J,source:"last-good-cache",sourcePath:$.manifestLastGood,offline:!0,secretValues:X.secretValues};return{mode:"repair",stage:"local",errors:[`cached manifest references secretValues (${G.join(", ")}); refusing offline boot because cached secret values are missing`]}}return{manifest:J,source:"last-good-cache",sourcePath:$.manifestLastGood,offline:!0}}catch(J){return{mode:"repair",stage:"local",errors:[`could not read last-good runtime manifest at ${$.manifestLastGood}: ${J instanceof Error?J.message:String(J)}`]}}}function wE$($){if(!pQ($.managedSecretCacheFile))return{secretValues:{}};try{let J=rQ($.managedSecretCacheFile);if(!J||typeof J!=="object"||Array.isArray(J))throw Error("cached secret values must be a JSON object");let W={};for(let[Q,X]of Object.entries(J)){if(typeof X!=="string")throw Error(`cached secret value for ${Q} must be a string`);W[Q]=X}return{secretValues:JW(W)}}catch(J){return{mode:"repair",stage:"local",errors:[`could not read cached runtime secret values at ${$.managedSecretCacheFile}: ${J instanceof Error?J.message:String(J)}`]}}}function ap($){let J=new Set;return vE($,J),[...J].sort()}function tp($,J){let W=JW(J??{});return ap($).filter((Q)=>{let X=mw(Q);if(X)return!process.env[X]?.trim();return W[Q]===void 0})}function vE($,J){if(!$||typeof $!=="object")return;if(Array.isArray($)){for(let W of $)vE(W,J);return}for(let[W,Q]of Object.entries($)){if(typeof Q==="string"&&(W==="secretRef"||W.endsWith("SecretRef")))J.add(Q);if(W==="secretEnv"&&Q&&typeof Q==="object"&&!Array.isArray(Q)){for(let X of Object.values(Q))if(typeof X==="string")J.add(X)}vE(Q,J)}}function kE($,J,W,Q){let X=iQ(J),G=$.manifest,Y=DE$(G,J);if(X.instanceId&&X.instanceId!==G.instanceId)Y.push(`manifest instanceId ${G.instanceId} does not match last-good instanceId ${X.instanceId}`);if(Y.length>0)return{mode:"manifest-rejected",stage:W==="remote-datasource"?"network":"local",errors:Y,rejectedGeneration:G.generation,activeGeneration:X.generation??null};return{manifest:G,source:W,sourcePath:Q,offline:!1,secretValues:$.secretValues}}var pR$,mp,rR$,cp,YV,oR$,aR$,tR$,sR$;var fE=K(()=>{C8();hw();iG();oY();rY();cw();pR$=["telegram","discord","whatsapp"],mp=_.enum(pR$),rR$=_.object({type:_.literal("bearer-env"),env:_.string().min(1).default("CLAWDI_AUTH_TOKEN")}).strict(),cp=_.object({schemaVersion:_.literal("clawdi.runtimeSource.v1"),type:_.literal("http"),url:_.string().url(),auth:rR$.optional(),timeoutMs:_.number().int().positive().optional()}).strict().transform(({auth:$,...J})=>J);YV=class YV extends Error{resource;status;constructor($,J,W){super(`runtime ${$} authentication failed: HTTP ${J}${W?` ${W.slice(0,200)}`:""}`);this.resource=$;this.status=J}};oR$=_.object({id:_.string().min(1),account_id:_.string().min(1),agent_id:_.string().min(1),status:_.string().min(1),agent_token:_.string().min(1).nullable().optional()}).transform(($)=>({...$,agent_token:$.agent_token??null})),aR$=_.object({id:_.string().min(1),account_id:_.string().min(1),agent_link_id:_.string().min(1),agent_id:_.string().min(1),provider:_.string().min(1),kind:_.string().min(1),created_at:_.string().min(1).optional(),jid:_.string().min(1).nullable().optional(),identity_pub_key_hex:_.string().min(1).nullable().optional(),material:_.unknown().optional()}),tR$=_.object({id:_.string().min(1),provider:mp,name:_.string().min(1),status:_.string().min(1),visibility:_.enum(["private","public"]).default("private"),runtime_links:_.array(oR$).default([]),runtime_credentials:_.array(aR$).default([])}),sR$=_.array(_.unknown()).transform(($,J)=>{let W=[];for(let[Q,X]of $.entries()){let G=eR$(X)?.provider;if(typeof G==="string"&&!$E$(G))continue;let Y=tR$.safeParse(X);if(!Y.success){for(let z of Y.error.issues)J.addIssue({...z,path:[Q,...z.path]});continue}W.push(Y.data)}return W})});import{spawnSync as Jr}from"node:child_process";import{createHash as VE$}from"node:crypto";import{chmodSync as Wr,chownSync as OE$,copyFileSync as Xr,mkdirSync as sp,mkdtempSync as LE$,readdirSync as NE$,readFileSync as _E$,rmSync as KE$,statSync as yE}from"node:fs";import{tmpdir as FE$}from"node:os";import{basename as Qr,join as ZX}from"node:path";function Gr($,J,W={}){if(!$)return $r(null,"mitmproxy artifact pin is missing");let Q=$.sha256.toLowerCase();try{ME$($,W);let X=ZX(J.egressEngineMaintainedRoot,$.version,Q),G=ZX(X,"mitmdump");if(RE$(G))return ep($,X,G);let Y=LE$(ZX(FE$(),"clawdi-egress-engine-"));try{let z=ZX(Y,Qr(new URL($.url).pathname)||"mitmproxy.tar.gz");AE$($.url,z,W);let H=IE$(z);if(H!==Q)throw Error(`mitmproxy checksum mismatch: expected ${Q}, got ${H}`);let q=ZX(Y,"extract");sp(q,{recursive:!0,mode:493}),bE$(z,q);let U=jE$(q);if(!U)throw Error("mitmproxy archive did not contain mitmdump");return sp(X,{recursive:!0,mode:493}),Xr(U,G),Wr(G,493),Jz(J.maintainedRoot),Jz(J.egressEngineMaintainedRoot),Jz(ZX(J.egressEngineMaintainedRoot,$.version)),Jz(X),Jz(G),ep($,X,G)}finally{KE$(Y,{recursive:!0,force:!0})}}catch(X){return $r($,X instanceof Error?X.message:String(X))}}function ME$($,J){if($.type!=="mitmproxy")throw Error("egress engine must use mitmproxy");if(!/^[A-Za-z0-9._-]+$/.test($.version))throw Error("mitmproxy version contains unsafe characters");if(!/^[a-fA-F0-9]{64}$/.test($.sha256))throw Error("mitmproxy sha256 must be 64 hex characters");let W=new URL($.url);if(W.protocol==="file:"&&J.allowFileUrls)return;if(W.protocol!=="https:")throw Error("mitmproxy URL must use https");if(W.hostname!=="downloads.mitmproxy.org")throw Error("mitmproxy URL must use official mitmproxy downloads");let Q=`/${$.version}/mitmproxy-${$.version}-linux-x86_64.tar.gz`;if(W.pathname!==Q)throw Error("mitmproxy URL must use the pinned linux x86_64 release archive")}function AE$($,J,W){let Q=new URL($);if(Q.protocol==="file:"){Xr(Q,J);return}let X=W.downloadCommand??"curl",G=Jr(X,["-fL","--proto","=https","-o",J,$],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});if(G.status!==0){let Y=[G.stdout,G.stderr].filter(Boolean).join(`

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "clawdi",
-	"version": "0.12.10-beta.48",
+	"version": "0.12.10-beta.49",
 	"description": "iCloud for AI Agents — cross-agent sessions, skills, memory, and vault.",
 	"license": "MIT",
 	"type": "module",
@@ -20,7 +20,7 @@
 	},
 	"publishConfig": {
 		"access": "public",
-		"tag": "agent-v2"
+		"tag": "agent-v2-candidate"
 	},
 	"scripts": {
 		"dev": "bun run src/index.ts",