clawdi 0.14.16 → 0.14.17

package/dist/index.js

@@ -1027,7 +1027,7 @@ const managedSocketMetadata = (creds) => {
 `:null,revision:WU(n)}}function ZVe(e){if(e===null)return WU({});try{let t=JSON.parse(e);if(!t||typeof t!=="object"||Array.isArray(t))return null;let n={};for(let[r,i]of Object.entries(t)){if(typeof i!=="string")return null;n[r]=i}return WU(n)}catch{return null}}function JVe(e,t){let n=vte(t);if(e.content===null)return HP(n,{force:!0}),null;Ta(t,n,e.content,{mode:384,dirMode:448}),ZU(n),Uy(t.managedSecretRoot);try{yte(n,384)}catch{}return n}function wte(e,t,n){let r=vte(n),i=BVe(r)?VVe(r,"utf-8"):null,o=KVe(e,t);return{path:JVe(o,n),changed:i!==o.content,material:o,previousRevision:ZVe(i)}}function YVe(e){return yS(e.egressProfiles)}function XVe(e){let t=new Set,n=Array.isArray(e.egressProfiles?.profiles)?e.egressProfiles.profiles:[];for(let r of n){let i=Y(r);if(i?.owner==="provider-projection")BP(r,t);if(i?.owner==="mcp-projection")BP(r,t);if(i?.owner==="clawdi-native-channels")QVe(i,t)}return[...t].sort()}function QVe(e,t){let n=Y(e.rewrite);if(!n)return;let r=Y(n.pathReplace),i=ct(r?.replacementSecretRef);if(i)t.add(i);let o=Y(n.setHeaders);if(!o)return;for(let s of Object.values(o)){let a=Y(s);if(a?.type!=="secretRef")continue;let l=ct(a.secretRef);if(l)t.add(l)}}function BP(e,t){if(!e||typeof e!=="object")return;if(Array.isArray(e)){for(let n of e)BP(n,t);return}for(let[n,r]of Object.entries(e)){if(typeof r==="string"&&(n==="secretRef"||n.endsWith("SecretRef")))t.add(r);BP(r,t)}}var om=_(()=>{Ui();qd();ii();ja();ot();Lr()});import{createHash as eqe}from"node:crypto";import{chmodSync as bte,chownSync as qP,existsSync as tqe,lstatSync as _te,mkdirSync as Ste,readFileSync as nqe,rmSync as JU}from"node:fs";import{resolve as rqe}from"node:path";function kte(e,t){Ste(e,{recursive:!0});let n=_te(e);if(!n.isDirectory()||n.isSymbolicLink())throw Error(`hosted CLAWDI_HOME must be a real directory: ${e}`);if(Xt())qP(e,t.uid,t.gid);if(bte(e,x$),n=_te(e),(n.mode&511)!==x$||n.uid!==t.uid||n.gid!==t.gid)throw Error(`hosted CLAWDI_HOME ownership or mode is invalid: ${e}`)}function Rte(e){Ste(e,{recursive:!0}),ZU(e);try{bte(e,448)}catch{}}function Pte(e){return JU(e.egressProfileBundle,{force:!0}),null}function Ete(e,t){if(e&&t?.status!=="ready")throw Error(`required egress engine is not ready: ${t?.error??"status unavailable"}`)}function Ate(e,t){if(Ta(t,t.egressProfileBundle,`${JSON.stringify(e,null,2)}
 `,{mode:416,dirMode:457}),Xt())qP(t.egressProfileBundle,0,Ll());return t.egressProfileBundle}function xte(e){let t=iqe(),n=nqe(t,"utf-8");if(Ta(e,e.egressAddon,n,{mode:416,dirMode:457}),Xt())qP(e.egressAddon,0,Ll());return{path:e.egressAddon,sha256:sqe(n)}}function $te(e){return JU(e.egressAddon,{force:!0}),null}function iqe(){let e=rqe(Tp(),"egress-addon","clawdi_egress_addon.py");if(tqe(e))return e;throw Error("packaged egress addon is missing")}function Cte(e){if(!e.program)return JU(e.paths.egressTransparentEnv,{force:!0}),null;let t={CLAWDI_RUNTIME_USER:e.runtimeUser,CLAWDI_RUNTIME_UID:String(e.runtimeUid),CLAWDI_RUNTIME_GID:String(e.runtimeGid),CLAWDI_EGRESS_UID:String(e.egressUid),CLAWDI_EGRESS_GID:String(e.egressGid),CLAWDI_EGRESS_TRANSPARENT_PORT:String(e.program.transparentPort),CLAWDI_EGRESS_NFT_TABLE:kf,CLAWDI_EGRESS_PROFILE_BUNDLE:e.program.profileBundlePath,CLAWDI_EGRESS_SECRET_FILE:e.program.secretFilePath??"",CLAWDI_EGRESS_CA_DIR:e.paths.egressCaDir,CLAWDI_EGRESS_CA_CERT:e.paths.egressCaCert,CLAWDI_EGRESS_SYSTEM_CA_BUNDLE:e.program.systemCaBundle,CLAWDI_EGRESS_TRANSPORT_VERSION:Lu,CLAWDI_EGRESS_ENGINE_TYPE:"mitmproxy",CLAWDI_EGRESS_ENGINE_VERSION:e.program.engine.version,CLAWDI_EGRESS_ENGINE_URL:e.program.engine.url,CLAWDI_EGRESS_ENGINE_SHA256:e.program.engine.sha256,CLAWDI_EGRESS_ENGINE_BINARY_PATH:e.paths.egressServiceBinary,CLAWDI_EGRESS_ADDON_PATH:e.program.addonPath,CLAWDI_EGRESS_ADDON_SHA256:e.program.addonSha256},n=Object.entries(t).sort(([r],[i])=>r.localeCompare(i)).map(([r,i])=>`${r}=${oqe(i)}`);if(Ta(e.paths,e.paths.egressTransparentEnv,`${n.join(`
 `)}
-`,{mode:416,dirMode:457}),Xt())qP(e.paths.egressTransparentEnv,0,e.egressGid);return e.paths.egressTransparentEnv}function oqe(e){if(/[\r\n]/.test(e))throw Error("runtime environment files only support single-line values");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function sqe(e){return eqe("sha256").update(e).digest("hex")}var Ite=_(()=>{Qa();om();ii();jt();ot();Uu()});import{existsSync as aqe,readFileSync as lqe,rmSync as cqe}from"node:fs";import{join as Ote}from"node:path";function YU(e){let t=e.projection?.mcp;if(t===void 0)return{servers:{}};return{servers:RS.parse(t).servers}}function Tte(e,t,n,r){let i=jte(e,t,n,r);for(let o of[...i.runtimes].sort((s,a)=>s.name===a.name?0:s.name==="hermes"?-1:1)){if(o.mutations.length===0)continue;if(o.name==="hermes"){if(!o.commandPath||!At(o.commandPath))throw Error("could not mutate managed Hermes MCP servers: runtime is unavailable");let s={...o.native.servers};for(let a of o.mutations)if(a.kind==="remove")delete s[a.serverName];else s[a.serverName]=a.server;qt({command:o.commandPath,home:i.home,cwd:r},"mcp_servers",Object.keys(s).length>0?s:void 0);continue}if(!o.commandPath||!At(o.commandPath))throw Error("could not mutate managed OpenClaw MCP servers: runtime is unavailable");for(let s of o.mutations){let a=s.kind==="remove"?["mcp","unset",s.serverName]:["mcp","set",s.serverName,JSON.stringify(s.server)];_o(o.commandPath,a,"",i.home,r)}}cqe(Ote(t.managedResourceRoot,"managed-mcp-servers.json"),{force:!0})}function jte(e,t,n,r=ws(e,t)){let i=YU(e),o=ws(e,t),s=uqe.map((a)=>{let l=e.runtimes[a]?.enabled===!0?i.servers:{},c=n.get(a),u=c?.commandPath??Za(a,o),d=Boolean(u&&At(u));if(a==="hermes"&&Object.keys(l).length>0&&!d)throw Error("could not inspect managed Hermes MCP servers: runtime is unavailable");let p=a==="openclaw"||d?pqe(a,o,u,r):{servers:{}},m=new Set(Object.entries(p.servers).flatMap(([v,w])=>dqe(v,w)?[v]:[]));for(let v of Object.keys(l).sort())if(Object.hasOwn(p.servers,v)&&!m.has(v))throw Error(`refusing to replace unmanaged ${a} MCP server ${v}`);let h=[];for(let v of[...m].sort())if(!Object.hasOwn(l,v)&&Object.hasOwn(p.servers,v))h.push({kind:"remove",serverName:v});for(let[v,w]of Object.entries(l).sort(([b],[k])=>b.localeCompare(k))){let b=mqe(v,w);if(!CS(p.servers[v],b))h.push({kind:"set",serverName:v,server:b})}if(h.some((v)=>v.kind==="set")&&(!c?.enabled||c.status==="install_failed"))throw Error(`could not apply managed ${a} MCP servers: runtime is unavailable`);return{name:a,native:p,mutations:h,commandPath:u}});return{home:o,runtimes:s}}function dqe(e,t){if(!Ke(t)||!Ke(t.headers))return!1;return Object.entries(t.headers).some(([n,r])=>typeof r==="string"&&r.endsWith(vS(e,n)))}function pqe(e,t,n,r){if(e==="hermes"){if(!n)throw Error("Hermes config command is unavailable");let c=As({command:n,home:t,cwd:r},"mcp_servers");if(!c.exists)return{servers:{}};if(!Ke(c.value))throw Error("Hermes config field mcp_servers must be an object");return{servers:c.value}}let i=Ote(t,".openclaw","openclaw.json");if(!aqe(i))return{servers:{}};let o=lqe(i,"utf-8"),s;try{s=JSON.parse(o)}catch(c){throw Error(`${e} config is invalid: ${c instanceof Error?c.message:String(c)}`)}if(!Ke(s))throw Error(`${e} config must be an object`);if(s.mcpServers!==void 0)throw Error("openclaw config uses unsupported legacy field mcpServers; canonical MCP state is mcp.servers");let a=s.mcp;if(a!==void 0&&!Ke(a))throw Error("openclaw config field mcp must be an object");let l=Ke(a)?a.servers:void 0;if(l===void 0)return{servers:{}};if(!Ke(l))throw Error("openclaw config field mcp.servers must be an object");return{servers:l}}function mqe(e,t){return{url:t.url,transport:t.transport,headers:Object.fromEntries(Object.entries(t.headers).map(([n,r])=>[n,typeof r==="string"?r:`${r.prefix}${vS(e,n)}`]))}}function Dte(e,t,n){jte(e,t,n)}var uqe;var WP=_(()=>{Ec();Gd();$c();Jd();ii();ot();uqe=["openclaw","hermes"]});import{createHash as fqe}from"node:crypto";import{chmodSync as XU,chownSync as hqe,existsSync as zy,lstatSync as Nte,mkdirSync as Mte,readdirSync as QU,readFileSync as ZP,rmdirSync as gqe,rmSync as Lte}from"node:fs";import{dirname as sm,isAbsolute as yqe,join as Vr}from"node:path";function vqe(e,t,n,r,i){if(!t)return null;if(r?.status!=="ready")return null;if(!i)return null;return{profileBundlePath:t,envFilePath:e.egressTransparentEnv,transparentPort:c4,addonPath:i.path,addonSha256:i.sha256,engine:r,systemCaBundle:e.egressSystemCaFile,secretFilePath:n}}function Ute(e){let t=vqe(e.paths,e.profileBundlePath,e.secretFilePath,e.engine,e.addon);if(!t)return{egressProgram:null,identity:null};return{egressProgram:t,identity:{runtimeUid:e.runtimeIdentity.uid,runtimeGid:e.runtimeIdentity.gid,egressUid:Zw(),egressGid:Ll()}}}function ez(e){if(!e.config.enabled)return null;let t=Zh(Fte(e.paths),sm(e.paths.cliManagedBin)),n=e.config.prependPath.join(":"),r={...e.config.env,PATH:n?[n,t].filter(Boolean).join(":"):t},i={};for(let[s,a]of Object.entries(e.config.secretEnv)){let l=xt(e.secretValues??{},a);if(!l)throw Error(`Runtime secret ${a} for ${s} is unavailable.`);r[s]=l,i[s]=l}if(e.egress)ua(r,{caFile:e.egress.systemCaBundle});let o=e.config.commandPath&&zy(e.config.commandPath)?e.config.commandPath:e.config.command;return{programKind:"runtime",runtime:e.config.runtime,service:e.config.service,command:o,args:e.config.defaultArgs,cwd:e.config.cwd??e.paths.workspaceRoot,env:r,resolvedSecretEnv:i}}function Wo(e){if(e.programKind==="file-browser")return"clawdi-files";let t=zte(e);if(t)return t;if(!e.service)return`clawdi-${GP(e.runtime)}`;return _qe(e.runtime,e.service)}function zte(e){return Fy(e)?.programName??null}function wqe(e,t,n,r={},i){if(t.programKind==="file-browser")return Yn({companion:e.companions?.filebrowser??null,providerProjectionRevision:null});if(t.service)return IJ(t);return i(e,t.runtime,n,r[t.runtime]??null)}function _qe(e,t){let n=tz.find((r)=>r.runtime===e&&r.service===t);if(n)return n.programName;if(e==="hermes"&&t==="dashboard")return"clawdi-hermes-dashboard";return`clawdi-${GP(e)}-${GP(t)}`}function GP(e){return e.replace(/[^A-Za-z0-9_-]+/g,"-")}function Fte(e){return[e.userLocalBin,Vr(e.userHome,".openclaw","bin"),process.env.PATH||"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"].join(":")}function Us(e){return`${GP(e)}.service`}function bqe(e,t){return Vr(e.systemdUserRoot,`${Us(t)}.d`,lR)}function Hte(e){if(/[\r\n]/.test(e))throw Error("systemd unit values must be single-line strings");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/%/g,"%%").replace(/\$/g,"$$")}"`}function JP(e,t){return[e,...t].map(Hte).join(" ")}function Sqe(e,t){return JP(e,["-c",t])}function kqe(e,t,n){return JP("/bin/sh",["-c",'output=$("$1" version 2>&1) || exit $?; case "$output" in *"$2"*) ;; *) exit 65 ;; esac; case "$output" in *"$3"*) ;; *) exit 65 ;; esac',"sh",e,t,n.slice(0,7)])}function Ln(e){if(!yqe(e))throw Error(`systemd unit paths must be absolute: ${e}`);if(/[\r\n]/.test(e))throw Error("systemd unit paths must be single-line strings");return e.replace(/\\/g,"\\\\").replace(/%/g,"%%").replace(/ /g,"\\x20").replace(/\t/g,"\\x09")}function Rqe(e){return Object.entries(e).map(([t,n])=>`Environment=${Hte(`${t}=${n}`)}`)}function Pqe(e,t){return Vr(e.systemdEnvRoot,`${Us(t)}.env`)}function Bte(e){if(/[\r\n]/.test(e))throw Error("systemd environment files only support single-line values");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function Fy(e){return tz.find((t)=>t.runtime===e.runtime&&t.matchesProgram(e))??null}function Eqe(e){return tz.find((t)=>Us(t.programName)===e)??null}function Vte(e,t){let n=Za(e.runtime,t.userHome);return n&&At(n)?n:e.command}function qte(e,t){let n=Fy(e);if(!n)return null;let r=Us(n.programName),i=Vr(t.systemdUserRoot,r);try{if(!Nte(i).isFile())return null;let s=ZP(i);if(aR(s.toString("utf8")))return null;let a=Gk(Vte(n,t),t.userHome,t.userHome);if(!a)return null;return fqe("sha256").update(a).update("\x00").update(s).digest("hex")}catch(o){if(o instanceof wo)throw o;return null}}function Wte(e,t,n,r){let i=[],o={};if(!n)return{pending:i,serviceRevisions:o};for(let s of Fqe(e)){let a=Us(Wo(s)),l=qte(s,t);if(l)o[a]=l;if(!l||r[a]!==l)i.push({unitName:a,program:s,serviceRevision:l})}return{pending:i,serviceRevisions:o}}function Iqe(e){Zr(e.paths.runRoot,e.paths.systemdRuntimeRoot,{mode:457}),XU(e.paths.systemdRuntimeRoot,457),Zr(e.paths.runRoot,e.paths.systemdEnvRoot,{mode:457}),XU(e.paths.systemdEnvRoot,457);let t=Pqe(e.paths,e.name),n=Object.entries(e.env).sort(([i],[o])=>i.localeCompare(o)).map(([i,o])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i))throw Error(`invalid systemd environment key: ${i}`);return`${i}=${Bte(o)}`}),r=`${sR}
+`,{mode:416,dirMode:457}),Xt())qP(e.paths.egressTransparentEnv,0,e.egressGid);return e.paths.egressTransparentEnv}function oqe(e){if(/[\r\n]/.test(e))throw Error("runtime environment files only support single-line values");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function sqe(e){return eqe("sha256").update(e).digest("hex")}var Ite=_(()=>{Qa();om();ii();jt();ot();Uu()});import{existsSync as aqe,readFileSync as lqe,rmSync as cqe}from"node:fs";import{join as Ote}from"node:path";function YU(e){let t=e.projection?.mcp;if(t===void 0)return{servers:{}};return{servers:RS.parse(t).servers}}function Tte(e,t,n,r){let i=jte(e,t,n,r);for(let o of[...i.runtimes].sort((s,a)=>s.name===a.name?0:s.name==="hermes"?-1:1)){if(o.mutations.length===0)continue;if(o.name==="hermes"){if(!o.commandPath||!At(o.commandPath))throw Error("could not mutate managed Hermes MCP servers: runtime is unavailable");let s={...o.native.servers};for(let a of o.mutations)if(a.kind==="remove")delete s[a.serverName];else s[a.serverName]=a.server;qt({command:o.commandPath,home:i.home,cwd:r},"mcp_servers",Object.keys(s).length>0?s:void 0);continue}if(!o.commandPath||!At(o.commandPath))throw Error("could not mutate managed OpenClaw MCP servers: runtime is unavailable");for(let s of o.mutations){let a=s.kind==="remove"?["mcp","unset",s.serverName]:["mcp","set",s.serverName,JSON.stringify(s.server)];_o(o.commandPath,a,"",i.home,r)}}cqe(Ote(t.managedResourceRoot,"managed-mcp-servers.json"),{force:!0})}function jte(e,t,n,r=ws(e,t)){let i=YU(e),o=ws(e,t),s=uqe.map((a)=>{let l=e.runtimes[a]?.enabled===!0?i.servers:{},c=n.get(a),u=c?.commandPath??Za(a,o),d=Boolean(u&&At(u));if(a==="hermes"&&Object.keys(l).length>0&&!d)throw Error("could not inspect managed Hermes MCP servers: runtime is unavailable");let p=a==="openclaw"||d?pqe(a,o,u,r):{servers:{}},m=new Set(Object.entries(p.servers).flatMap(([v,w])=>dqe(v,w)?[v]:[]));for(let v of Object.keys(l).sort())if(Object.hasOwn(p.servers,v)&&!m.has(v))throw Error(`refusing to replace unmanaged ${a} MCP server ${v}`);let h=[];for(let v of[...m].sort())if(!Object.hasOwn(l,v)&&Object.hasOwn(p.servers,v))h.push({kind:"remove",serverName:v});for(let[v,w]of Object.entries(l).sort(([b],[k])=>b.localeCompare(k))){let b=mqe(v,w);if(!CS(p.servers[v],b))h.push({kind:"set",serverName:v,server:b})}if(h.some((v)=>v.kind==="set")&&(!c?.enabled||c.status==="install_failed"))throw Error(`could not apply managed ${a} MCP servers: runtime is unavailable`);return{name:a,native:p,mutations:h,commandPath:u}});return{home:o,runtimes:s}}function dqe(e,t){if(!Ke(t)||!Ke(t.headers))return!1;return Object.entries(t.headers).some(([n,r])=>typeof r==="string"&&r.endsWith(vS(e,n)))}function pqe(e,t,n,r){if(e==="hermes"){if(!n)throw Error("Hermes config command is unavailable");let c=As({command:n,home:t,cwd:r},"mcp_servers");if(!c.exists)return{servers:{}};if(!Ke(c.value))throw Error("Hermes config field mcp_servers must be an object");return{servers:c.value}}let i=Ote(t,".openclaw","openclaw.json");if(!aqe(i))return{servers:{}};let o=lqe(i,"utf-8"),s;try{s=JSON.parse(o)}catch(c){throw Error(`${e} config is invalid: ${c instanceof Error?c.message:String(c)}`)}if(!Ke(s))throw Error(`${e} config must be an object`);if(s.mcpServers!==void 0)throw Error("openclaw config uses unsupported legacy field mcpServers; canonical MCP state is mcp.servers");let a=s.mcp;if(a!==void 0&&!Ke(a))throw Error("openclaw config field mcp must be an object");let l=Ke(a)?a.servers:void 0;if(l===void 0)return{servers:{}};if(!Ke(l))throw Error("openclaw config field mcp.servers must be an object");return{servers:l}}function mqe(e,t){return{url:t.url,transport:t.transport,headers:Object.fromEntries(Object.entries(t.headers).map(([n,r])=>[n,typeof r==="string"?r:`${r.prefix}${vS(e,n)}`]))}}function Dte(e,t,n){jte(e,t,n)}var uqe;var WP=_(()=>{Ec();Gd();$c();Jd();ii();ot();uqe=["openclaw","hermes"]});import{createHash as fqe}from"node:crypto";import{chmodSync as XU,chownSync as hqe,existsSync as zy,lstatSync as Nte,mkdirSync as Mte,readdirSync as QU,readFileSync as ZP,rmdirSync as gqe,rmSync as Lte}from"node:fs";import{dirname as sm,isAbsolute as yqe,join as Vr}from"node:path";function vqe(e,t,n,r,i){if(!t)return null;if(r?.status!=="ready")return null;if(!i)return null;return{profileBundlePath:t,envFilePath:e.egressTransparentEnv,transparentPort:c4,addonPath:i.path,addonSha256:i.sha256,engine:r,systemCaBundle:e.egressSystemCaFile,secretFilePath:n}}function Ute(e){let t=vqe(e.paths,e.profileBundlePath,e.secretFilePath,e.engine,e.addon);if(!t)return{egressProgram:null,identity:null};return{egressProgram:t,identity:{runtimeUid:e.runtimeIdentity.uid,runtimeGid:e.runtimeIdentity.gid,egressUid:Zw(),egressGid:Ll()}}}function ez(e){if(!e.config.enabled)return null;let t=Zh(Fte(e.paths),sm(e.paths.cliManagedBin)),n=e.config.prependPath.join(":"),r={...e.config.env,PATH:n?[n,t].filter(Boolean).join(":"):t},i={};for(let[s,a]of Object.entries(e.config.secretEnv)){let l=xt(e.secretValues??{},a);if(!l)throw Error(`Runtime secret ${a} for ${s} is unavailable.`);r[s]=l,i[s]=l}if(e.egress)ua(r,{caFile:e.egress.systemCaBundle});let o=e.config.commandPath&&zy(e.config.commandPath)?e.config.commandPath:e.config.command;return{programKind:"runtime",runtime:e.config.runtime,service:e.config.service,command:o,args:e.config.defaultArgs,cwd:e.config.cwd??e.paths.workspaceRoot,env:r,resolvedSecretEnv:i}}function Wo(e){if(e.programKind==="file-browser")return"clawdi-files";let t=zte(e);if(t)return t;if(!e.service)return`clawdi-${GP(e.runtime)}`;return _qe(e.runtime,e.service)}function zte(e){return Fy(e)?.programName??null}function wqe(e,t,n,r={},i){if(t.programKind==="file-browser")return Yn({companion:e.companions?.filebrowser??null,providerProjectionRevision:null});if(t.service)return IJ(t);return i(e,t.runtime,n,r[t.runtime]??null)}function _qe(e,t){let n=tz.find((r)=>r.runtime===e&&r.service===t);if(n)return n.programName;if(e==="hermes"&&t==="dashboard")return"clawdi-hermes-dashboard";return`clawdi-${GP(e)}-${GP(t)}`}function GP(e){return e.replace(/[^A-Za-z0-9_-]+/g,"-")}function Fte(e){return[e.userLocalBin,Vr(e.userHome,".openclaw","bin"),process.env.PATH||"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"].join(":")}function Us(e){return`${GP(e)}.service`}function bqe(e,t){return Vr(e.systemdUserRoot,`${Us(t)}.d`,lR)}function Hte(e){if(/[\r\n]/.test(e))throw Error("systemd unit values must be single-line strings");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"").replace(/%/g,"%%").replace(/\$/g,"$$")}"`}function JP(e,t){return[e,...t].map(Hte).join(" ")}function Sqe(e,t){return JP(e,["-c",t])}function kqe(e,t,n){return JP("/bin/sh",["-c",'output=$("$1" version 2>&1) || exit $?; case "$output" in *"$2"*) ;; *) exit 65 ;; esac; case "$output" in *"$3"*) ;; *) exit 65 ;; esac',"sh",e,t,n.slice(0,7)])}function Ln(e){if(!yqe(e))throw Error(`systemd unit paths must be absolute: ${e}`);if(/[\r\n]/.test(e))throw Error("systemd unit paths must be single-line strings");return e.replace(/\\/g,"\\\\").replace(/%/g,"%%").replace(/ /g,"\\x20").replace(/\t/g,"\\x09")}function Rqe(e){return Object.entries(e).map(([t,n])=>`Environment=${Hte(`${t}=${n}`)}`)}function Pqe(e,t){return Vr(e.systemdEnvRoot,`${Us(t)}.env`)}function Bte(e){if(/[\r\n]/.test(e))throw Error("systemd environment files only support single-line values");return`"${e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function Fy(e){return tz.find((t)=>t.runtime===e.runtime&&t.matchesProgram(e))??null}function Eqe(e){return tz.find((t)=>Us(t.programName)===e)??null}function Vte(e,t){let n=Za(e.runtime,t.userHome);return n&&At(n)?n:e.command}function qte(e,t){let n=Fy(e);if(!n)return null;let r=Us(n.programName),i=Vr(t.systemdUserRoot,r);try{if(!Nte(i).isFile())return null;let s=ZP(i);if(aR(s.toString("utf8")))return null;let a=Gk(Vte(n,t),t.userHome,t.userHome);if(!a)return null;return fqe("sha256").update(a).update("\x00").update(s).digest("hex")}catch(o){if(o instanceof wo)throw o;return null}}function Wte(e,t,n,r){let i=[],o={};if(!n)return{pending:i,serviceRevisions:o};for(let s of Fqe(e)){let a=Us(Wo(s)),l=qte(s,t);if(l)o[a]=l;if(!l||(r[a]??l)!==l)i.push({unitName:a,program:s,serviceRevision:l})}return{pending:i,serviceRevisions:o}}function Iqe(e){Zr(e.paths.runRoot,e.paths.systemdRuntimeRoot,{mode:457}),XU(e.paths.systemdRuntimeRoot,457),Zr(e.paths.runRoot,e.paths.systemdEnvRoot,{mode:457}),XU(e.paths.systemdEnvRoot,457);let t=Pqe(e.paths,e.name),n=Object.entries(e.env).sort(([i],[o])=>i.localeCompare(o)).map(([i,o])=>{if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(i))throw Error(`invalid systemd environment key: ${i}`);return`${i}=${Bte(o)}`}),r=`${sR}
 ${n.join(`
 `)}
 `;return nz({path:t,content:r,mode:384,dirMode:457,trustedRoot:e.paths.runRoot,owner:e.owner}),t}function nz(e){let t=!1;try{let n=Nte(e.path);t=n.isFile()&&n.nlink===1&&ZP(e.path,"utf8")===e.content}catch{}if(t)XU(e.path,e.mode);else me(e.path,e.content,{mode:e.mode,dirMode:e.dirMode,trustedRoot:e.trustedRoot});if(e.owner==="runtime-user")Af(e.path);else if(Xt())hqe(e.path,0,0)}function Gte(e){return Iqe(e)}function rz(e){return On(e)}function Kte(e){let t=Vr(e.root,Us(e.name)),n=Gte({paths:e.paths,name:e.name,owner:e.owner,env:e.env}),r=[sR,"[Unit]",`Description=${e.description}`,...e.owner==="runtime-user"?["# The environment file is regenerated by convergence each boot; this unit must not start before it exists.",`ConditionPathExists=${Ln(n)}`]:[],...e.extraUnitLines??[],"","[Service]",`Type=${e.serviceType??"simple"}`,`WorkingDirectory=${Ln(e.cwd)}`,...e.directoryKind==="platform"?[`ConfigurationDirectory=${Xw}`,"ConfigurationDirectoryMode=0700",`StateDirectory=${Xw}`,"StateDirectoryMode=0700",`CacheDirectory=${Xw}`,"CacheDirectoryMode=0700"]:e.directoryKind==="file-browser"?[`StateDirectory=${E$}`,"StateDirectoryMode=0700",`RuntimeDirectory=${E$}`,"RuntimeDirectoryMode=0700"]:[],...e.unitEnv?Rqe(e.unitEnv):[],...e.unsetEnvironment?.length?[`UnsetEnvironment=${e.unsetEnvironment.join(" ")}`]:[],...e.extraServiceLines??[],`EnvironmentFile=${Ln(n)}`,`ExecStart=${e.execStart??JP(e.command,e.args)}`,...e.restart===!1?[]:["Restart=always","RestartSec=2","KillMode=mixed","TimeoutStopSec=30"],"","[Install]",`WantedBy=${e.wantedBy}`,""],i=()=>{if(e.owner==="runtime-user")Mte(e.root,{recursive:!0});return Zr(e.root,e.root),nz({path:t,content:r.join(`

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "clawdi",
-	"version": "0.14.16",
+	"version": "0.14.17",
 	"description": "iCloud for AI Agents — cross-agent sessions, skills, memory, and vault.",
 	"license": "MIT",
 	"type": "module",