clawdi 0.14.79 → 0.14.80
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -637,7 +637,7 @@ ${i.generatedContents}`))}return r}function Gee(e,t,n){return r2(e,t==="system"?
|
|
|
637
637
|
`).trim()}function Xee(e,t){let n=vd();if(n!=="root"){let r=String(Tl(n)),i=Dl(n,e.userHome,Zo(),["--user",...t],{environment:Mee(r),preserveSession:!0});return qP(i.command,i.args,i.env)}return qP(Zo(),["--user",...t])}function Qee(e,t){let n=vd(),r=Dl(n,t,"test",["-r",e],{preserveSession:!0});ete(r.command,r.args,r.env)}function ete(e,t,n){let r=qP(e,t,n);return xw(e,t,r),[r.stdout,r.stderr].filter(Boolean).join(`
|
|
638
638
|
`).trim()}function qP(e,t,n,r=A4e){if(process.platform!=="linux")throw Error("systemd runtime commands require Linux");if(!Number.isSafeInteger(r)||r<=0)throw Error("systemd command timeout must be a positive integer");let i=w4e("/usr/bin/timeout",["--signal=KILL",`${r/1000}s`,e,...t],{encoding:"utf8",...n?{env:{...process.env,...n}}:{}});if(i.error&&"code"in i.error&&i.error.code==="ENOENT")throw Error("systemd runtime commands require GNU timeout at /usr/bin/timeout; install GNU coreutils");if(i.signal==="SIGKILL"||i.status===124||i.status===137)throw new Js;return{status:i.status,stdout:i.stdout??"",stderr:i.stderr??"",...i.error?{error:i.error}:{}}}function xw(e,t,n){if(n.status===0)return;let r=[n.stdout,n.stderr].filter(Boolean).join(`
|
|
639
639
|
`).trim();throw Error(`${e} ${t.join(" ")} failed${n.status===null?"":` (${n.status})`}${n.error?`: ${n.error.message}`:""}${r?`: ${r.slice(0,1000)}`:""}`)}var k4e="clawdi-runtime-watch.service",i2="clawdi-runtime-sidecar.service",Pw,A4e=120000,Js;var KP=b(()=>{so();et();Rw();Pw=new Set([k4e]);Js=class Js extends Error{constructor(e="systemd command timed out; job outcome is unknown and requires fresh observation"){super(e)}}});import{lstatSync as tte,readFileSync as nte}from"node:fs";import{dirname as $4e,join as rte}from"node:path";function l2(e){return rte($4e(e.appliedState),"component-activations.json")}function ste(e,t,n){if(t.mode!=="hosted")return;try{let r=yn(t);if(!r?.applyReceiptId||!r.bootNonce)return;let i={schemaVersion:1,appliedStateRevision:ut(r),entries:I4e(e,t,r.activated,n)};Ot(t,l2(t),`${JSON.stringify(ote.parse(i))}
|
|
640
|
-
`,{mode:384,dirMode:493})}catch{O.warn("runtime.component_proof_unavailable",{message:"Component activation proof could not be persisted; complete-runtime admission remains required."})}}function x4e(e,t){try{let n=tte(l2(e));if(!n.isFile()||n.size>16384)return;let r=ote.parse(JSON.parse(nte(l2(e),"utf8")));if(new Set(r.entries.map((i)=>i.component)).size!==r.entries.length)return;return r.appliedStateRevision===ut(t)?r.entries:void 0}catch{return}}function ate(e){if(!e||typeof e!=="object")return!1;return Object.hasOwn(e,"$include")||Object.values(e).some(ate)}function lte(e,t,n){try{let r=GP[e],i=Gee(t,r.scope,r.unit);if(!i||i!==n)return null;let o;if(e==="files")o=[t.fileBrowserConfig];else if(e==="openclaw-ui")o=[rte(t.userHome,".openclaw","openclaw.json")];else{let a=fP("hermes","dashboard",t);if(a.status!=="ok"
|
|
640
|
+
`,{mode:384,dirMode:493})}catch{O.warn("runtime.component_proof_unavailable",{message:"Component activation proof could not be persisted; complete-runtime admission remains required."})}}function x4e(e,t){try{let n=tte(l2(e));if(!n.isFile()||n.size>16384)return;let r=ote.parse(JSON.parse(nte(l2(e),"utf8")));if(new Set(r.entries.map((i)=>i.component)).size!==r.entries.length)return;return r.appliedStateRevision===ut(t)?r.entries:void 0}catch{return}}function ate(e){if(!e||typeof e!=="object")return!1;return Object.hasOwn(e,"$include")||Object.values(e).some(ate)}function lte(e,t,n){try{let r=GP[e],i=Gee(t,r.scope,r.unit);if(!i||i!==n)return null;let o;if(e==="files")o=[t.fileBrowserConfig];else if(e==="openclaw-ui")o=[rte(t.userHome,".openclaw","openclaw.json")];else{let a=fP("hermes","dashboard",t);if(a.status!=="ok")return null;if(o=[cw("hermes",t,"dashboard")],a.config.secretFilePath)o.push(a.config.secretFilePath)}let s=o.map((a)=>{let l=tte(a);if(!l.isFile()||l.size>1048576)throw Error("Component config unavailable");return nte(a,"utf8")});if(e==="openclaw-ui"){let a=ite.default.parse(s[0]??"null");if(ate(a)||!a||typeof a!=="object"||!("gateway"in a))return null;let l=a.gateway;if(!l||typeof l!=="object"||"port"in l&&l.port!==18789)return null}return ut([i,...s])}catch{return null}}function I4e(e,t,n,r){let i=e.manifest,o=e.secretValues??{},s={};if(i.companions?.filebrowser){let u=i.companions.filebrowser.auth;s.files=ut(["files",u.accessRevision,u.secret])}let a=i.openclawGatewayAuth;if(a){let u=Ze(o,a.tokenRef);if(u)s["openclaw-ui"]=ut(["openclaw-ui",u])}let l=i.hermesDashboardAuth;if(l){let u=Ze(o,l.passwordSecretRef),d=Ze(o,l.sessionSecretRef);if(u&&d)s["hermes-ui"]=ut(["hermes-ui",l.username,u,d])}let c=[];for(let u of Object.keys(GP)){let d=GP[u],p=s[u];if(!p||!n[d.unit])continue;let m=r(d.scope,d.unit),g=lte(u,t,n[d.unit]),f=r(d.scope,d.unit);if(m&&f&&g&&m.invocationId===f.invocationId&&m.configurationRevision===f.configurationRevision)c.push({component:u,configRevision:ut([g,m.configurationRevision]),accessRevision:p,invocationId:m.invocationId})}return c}async function cte(e,t,n,r){if(!t.applyReceiptId||!t.bootNonce)return;let i=x4e(e,t);if(!i)return;let o=await Promise.all(i.map(async(a)=>{let l=a.invocationId,c="unknown";try{let u=GP[a.component],d=n(u.scope,u.unit);l=d?.invocationId??l;let p=(m)=>{let g=lte(a.component,e,t.activated[u.unit]);return g!==null&&ut([g,m.configurationRevision])===a.configRevision};if(d&&p(d)&&await r(a.component)){let m=n(u.scope,u.unit);if(m?.invocationId===d.invocationId&&p(m))c="ok"}}catch{}return{...a,invocationId:l,status:c}})),s=yn(e);if(!s||ut(s)!==ut(t))return;return{schemaVersion:1,entries:o}}var ite,ote,GP;var c2=b(()=>{Lt();gn();so();Ma();rr();Fn();KP();ite=nu(PP(),1),ote=h.object({schemaVersion:h.literal(1),appliedStateRevision:h.string().regex(/^[a-f0-9]{64}$/),entries:h.array(h.object({component:h.enum(["files","hermes-ui","openclaw-ui"]),configRevision:h.string().regex(/^[a-f0-9]{64}$/),accessRevision:h.string().regex(/^[a-f0-9]{64}$/),invocationId:h.string().regex(/^[a-f0-9]{32}$/)}).strict()).max(3)}).strict();GP={files:{scope:"system",unit:"clawdi-files.service"},"hermes-ui":{scope:"user",unit:"clawdi-hermes-dashboard.service"},"openclaw-ui":{scope:"user",unit:"openclaw-gateway.service"}}});import{createHash as O4e}from"node:crypto";import{lstatSync as bd,readdirSync as pte,readFileSync as ute,rmSync as D4e}from"node:fs";import{dirname as T4e,join as JP}from"node:path";function dte(e){return O4e("sha256").update(e).digest("hex")}function Iw(e,t,n,r,i,o){if(!mte.test(n))throw Error("archive cache key is invalid");let s=JP(t,n);if(T4e(s)!==t)throw Error("archive cache key escapes its root");let a=JP(s,r),l=JP(s,"receipt.json"),c=()=>{try{return bd(s),!0}catch(p){if(p instanceof Error&&"code"in p&&p.code==="ENOENT")return!1;throw p}},u=()=>{try{let p=bd(a),m=bd(l);if(!p.isFile()||p.isSymbolicLink()||p.size>o||(p.mode&511)!==384||!m.isFile()||m.isSymbolicLink()||m.size>j4e||(m.mode&511)!==384||typeof process.getuid==="function"&&(p.uid!==process.getuid()||m.uid!==process.getuid()))return null;let g=i.parse(JSON.parse(ute(l,"utf8"))),f=ute(a);return g.key===n&&dte(f)===g.archiveSha256?f:null}catch{return null}},d=(p={})=>{try{let m=bd(t),g=bd(s);if(!m.isDirectory()||m.isSymbolicLink()||!g.isDirectory()||g.isSymbolicLink()||p.allowIncomplete!==!0&&u()===null)return!1;for(let f of pte(s)){if(f!==r&&f!=="receipt.json")return!1;let v=bd(JP(s,f));if(!v.isFile()||v.isSymbolicLink())return!1}return D4e(s,{recursive:!0}),!0}catch(m){if(m instanceof Error&&"code"in m&&m.code==="ENOENT")return!1;throw m}};return{exists:c,read:u,write:(p,m)=>{if(p.length>o)throw Error("archive exceeds its cache limit");let g=dte(p),f=m(g),v=i.parse(f);if(v.key!==n||v.archiveSha256!==g)throw Error("archive cache receipt does not match its entry");try{Ot(e,a,p,{mode:384,dirMode:448}),Ot(e,l,`${JSON.stringify(f,null,2)}
|
|
641
641
|
`,{mode:384,dirMode:448})}catch(w){throw d({allowIncomplete:!0}),w}},remove:d}}function ZP(e,t,n,r,i,o){let s;try{let a=bd(t);if(!a.isDirectory()||a.isSymbolicLink())return;s=pte(t)}catch(a){if(a instanceof Error&&"code"in a&&a.code==="ENOENT")return;throw a}for(let a of s)if(mte.test(a)&&!n.has(a))Iw(e,t,a,r,i,o).remove()}var mte,j4e=4096;var u2=b(()=>{Fn();mte=/^[a-f0-9]{64}$/});import{createHash as N4e}from"node:crypto";import{chmodSync as M4e,existsSync as L4e,lstatSync as hte,mkdirSync as fte,mkdtempSync as yte,readFileSync as vte,rmSync as p2,writeFileSync as U4e}from"node:fs";import{validateHeaderName as F4e,validateHeaderValue as z4e}from"node:http";import{isIP as H4e}from"node:net";import{tmpdir as wte}from"node:os";import{dirname as B4e,join as Sd}from"node:path";function t6e(e){return Op(e)}function u6e(e){let[t,n=""]=e.split(":");return[Number.parseInt(t??"",16),n.split(",").map((r)=>String.fromCodePoint(Number.parseInt(r,16))).join("")]}function Cte(e){let t="";for(let n of e){let r=n.codePointAt(0);if(r===void 0)continue;let i=d6e.get(r);if(i!==void 0)t+=i;else if(r>=5024&&r<=5109||r>=5112&&r<=5117||r>=43888&&r<=43967)t+=n.toUpperCase();else t+=n.toLowerCase()}return t}function $te(e){return N4e("sha256").update(e).digest("hex")}function xte(e,t){let n=t.source.type==="github"?[t.source.type,t.source.url,t.source.path,t.source.commit]:[t.source.type,t.source.url,t.source.archiveDigest];return $te(JSON.stringify([t.installationId,e,t.version,t.agentPluginsSchema,...n,t.contentDigest]))}function p6e(e,t){return f2.parse({...t,ownershipIdentity:xte(e,t)})}function Ite(e){return Sd(e.statusRoot,"runtime-agent-plugin-receipts.json")}function kd(e){let t=Ite(e),n;try{n=hte(t)}catch(r){if(r instanceof Error&&"code"in r&&r.code==="ENOENT")return null;throw Error("Agent Plugin receipts could not be inspected")}if(!n.isFile()||n.isSymbolicLink()||n.size>Y4e)throw Error("Agent Plugin receipts are not a trusted regular file");if((n.mode&511)!==384)throw Error("Agent Plugin receipts do not have private file permissions");if(typeof process.getuid==="function"&&n.uid!==process.getuid())throw Error("Agent Plugin receipts do not have the expected file owner");try{let r=JSON.parse(vte(t,"utf8"));return Rte.parse(r)}catch{throw Error("Agent Plugin receipts do not match the expected schema")}}function Ote(e,t){let n=Ite(t);if(!e||Object.keys(e.installations).length===0){p2(n,{force:!0});return}let r=Rte.parse(e),i=kd(t),o=`${JSON.stringify(r,null,2)}
|
|
642
642
|
`;if(i&&vte(n,"utf8")===o)return;Ot(t,n,o,{mode:384,dirMode:493});let s=kd(t);if(JSON.stringify(s)!==JSON.stringify(r))throw Error("Agent Plugin receipts did not pass post-write verification")}function Dte(e){return Sd(e.cacheRoot,"agent-plugins")}function g2(e,t){return Iw(e,Dte(e),t,"source.tar.gz",Pte,m2)}function Tte(e,t){if(!e)return;for(let n of e.transientCacheOwnerships)g2(t,n).remove({allowIncomplete:!0})}function jte(e,t,n=[]){let r=new Set(Object.values(e?.installations??{}).map((i)=>i.ownershipIdentity));for(let i of n)r.add(i);ZP(t,Dte(t),r,"source.tar.gz",Pte,m2)}function Ow(e){let t=e.split("/");return e.length>0&&Buffer.byteLength(e,"utf8")<=J4e&&!cd(e)&&!e.includes("\\")&&t.every((n)=>n&&n!=="."&&n!=="..")}async function m6e(e,t,n){let r=null;if(await Oo(e,t,{resourceLabel:"Agent Plugin package",allowReservedManagementPaths:!0,limits:{entryCount:bte,fileCount:Ste,entryBytes:Ate,totalEntryBytes:kte,expandedTarBytes:G4e},filter:(o)=>{let s=o.replace(/\/$/,"").split("/");if(o.startsWith("/")||o.includes("\\")||s.some((u)=>u==="."||u===".."||cd(u)))throw Error("Agent Plugin repository archive contains an unsafe path");let a=s[0];if(!a)return!1;if(r===null)r=a;if(r!==a)throw Error("Agent Plugin repository archive has multiple roots");let l=s.slice(1).join("/");if(n!==""&&l!==n&&!l.startsWith(`${n}/`))return!1;let c=n===""?l:l.slice(n.length).replace(/^\//,"");if(c&&!Ow(c))throw Error("Agent Plugin package contains an unsafe path");return!0}}),!r)throw Error("Agent Plugin repository archive is empty");let i=Sd(e,r,...n.split("/"));if(!L4e(i)||!hte(i).isDirectory())throw Error("Agent Plugin package path does not exist in the pinned source");return i}function Nte(e,t={}){let n=$l(e,{limits:{entries:bte,files:Ste,fileBytes:Ate,totalBytes:kte},exclude:(r)=>t.ignoreTopLevelGitMetadata===!0&&r===".git",validatePath:(r)=>{if(!Ow(r))throw Error("Agent Plugin package contains an unsafe path")},collisionKey:Cte,collisionError:"Agent Plugin package contains a case-fold path collision",resourceLabel:"Agent Plugin package"});return{digest:t6e(n),tree:n}}function Mte(e,t={}){return Nte(e,t).digest}function Lte(e,t){if(!e)throw Error(`${t} must be a regular file at the package root`);if(e.bytes.length>Z4e)throw Error(`${t} is too large`);try{let n=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(e.bytes));return n6e.parse(n)}catch{throw Error(`${t} must be a valid JSON object`)}}function f6e(e,t){try{return new TextDecoder("utf-8",{fatal:!0}).decode(e.bytes)}catch{throw Error(`${t} must be valid UTF-8`)}}function g6e(e){let t=e.filter((r)=>r.path.startsWith("skills/")),n=new Set;for(let r of t){let i=r.path.split("/"),o=i[1];if(!o||!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(o)||i.length<3)throw Error("Agent Plugin contains an invalid Skill path");n.add(o)}for(let r of n){let i=e.find((c)=>c.path===`skills/${r}/SKILL.md`);if(!i)throw Error("Agent Plugin Skill is missing SKILL.md");let s=f6e(i,"Agent Plugin SKILL.md").replace(/^\uFEFF/,"").match(/^---\r?\n([\s\S]*?)\r?\n---(?:\s*\r?\n|$)/);if(!s)throw Error("Agent Plugin SKILL.md has invalid frontmatter");let a=Ly(s[1]??"",{uniqueKeys:!0});if(a.errors.length>0)throw Error("Agent Plugin SKILL.md has invalid frontmatter");let l=h.object({name:h.string().min(1).max(64),description:h.string().min(1).max(1024).refine((c)=>c.trim().length>0),license:h.string().optional(),compatibility:h.string().min(1).max(500).optional(),metadata:h.record(h.string(),h.string()).optional(),"allowed-tools":h.string().optional()}).strict().safeParse(a.toJS());if(!l.success||l.data.name!==r)throw Error("Agent Plugin SKILL.md frontmatter does not match its Skill directory")}return n.size}function h6e(e){let t;if(e.startsWith("./"))t=e.slice(2);else if(e===Tf||e===jf)return;else if(e.startsWith(`${Tf}/`))t=e.slice(Tf.length+1);else if(e.startsWith(`${jf}/`))t=e.slice(jf.length+1);else throw Error("Agent Plugin MCP path is outside the portable package boundary");if(!Ow(t))throw Error("Agent Plugin MCP path is outside the portable package boundary")}function y6e(e,t){if(e==="./"||e===Tf||e===jf)return;let n,r=!1;if(e.startsWith("./"))n=e.slice(2),r=!0;else if(e.startsWith(`${Tf}/`))n=e.slice(Tf.length+1),r=!0;else if(e.startsWith(`${jf}/`))n=e.slice(jf.length+1);else throw Error("Agent Plugin MCP cwd is outside the portable package boundary");if(!Ow(n)||uP(n))throw Error("Agent Plugin MCP cwd is outside the portable package boundary");if(r&&!t.some((i)=>i.path.startsWith(`${n}/`)))throw Error("Agent Plugin MCP cwd is not a package directory")}function Ute(e){let t=e.indexOf("://");if(t<0)return null;let n=e.slice(t+3),r=n.search(/[/?#]/);return(r<0?n:n.slice(0,r))||null}function v6e(e){let t=Ute(e);if(!t||t.includes("@"))return null;if(t.startsWith("[")){let r=t.indexOf("]");if(r<0||!/^(?::[0-9]+)?$/.test(t.slice(r+1)))return null;return t.slice(1,r)}let n=t.lastIndexOf(":");if(n<0)return t;if(t.indexOf(":")!==n||!/^[0-9]+$/.test(t.slice(n+1)))return null;return t.slice(0,n)}function w6e(e){let t=v6e(e)?.toLowerCase();if(!t)return!1;return t==="localhost"||t==="::1"||t==="0:0:0:0:0:0:0:1"||H4e(t)===4&&t.split(".")[0]==="127"}function _6e(e){if(uP(e.url))throw Error("Agent Plugin remote MCP URL cannot contain credential templates");if(e.url.includes("\\")||/[\s\u0085]/u.test(e.url)||[...e.url].some((i)=>i.charCodeAt(0)<32))throw Error("Agent Plugin remote MCP URL is invalid");let t;try{t=new URL(e.url)}catch{throw Error("Agent Plugin remote MCP URL is invalid")}let n=Ute(e.url);if(t.protocol!=="https:"&&t.protocol!=="http:"||!n||n.includes("@")||e.url.includes("#")||t.username!==""||t.password!==""||t.hash!==""||!t.hostname)throw Error("Agent Plugin remote MCP URL is invalid");if(t.protocol==="http:"){if(!w6e(e.url))throw Error("Agent Plugin remote MCP URL must use HTTPS")}let r=new Set;if(Object.keys(e.headers??{}).length>128)throw Error("Agent Plugin remote MCP headers are invalid");for(let[i,o]of Object.entries(e.headers??{})){let s=i.toLowerCase();if(cP(i)||uP(o)||o.length>0&&hz(o))throw Error("Agent Plugin remote MCP headers cannot carry credentials");if(o.length>8192)throw Error("Agent Plugin remote MCP headers are invalid");try{F4e(i),z4e(i,o)}catch{throw Error("Agent Plugin remote MCP headers are invalid")}if(r.has(s))throw Error("Agent Plugin remote MCP headers are invalid");r.add(s)}}function b6e(e,t){let n=e.find((o)=>o.path==="mcp.json");if(!n)return{serverNames:[],bareCommands:[]};let r=c6e.safeParse(Lte(n,"Agent Plugin mcp.json"));if(!r.success)throw Error("Agent Plugin mcp.json does not match the 1.0.0 schema");let i=new Set;for(let o of Object.values(r.data.mcpServers)){if(o.type!=="stdio"){if(_6e(o),o.type==="sse"&&t==="hermes")throw Error(V4e);continue}if(o.command.includes("\x00"))throw Error("Agent Plugin stdio MCP command is invalid");if(o.command.startsWith("./")){if(h6e(o.command),e.find((l)=>l.path===o.command.slice(2))?.mode!==33261)throw Error("Agent Plugin stdio MCP command is not an executable package file")}else if(!/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(o.command))throw Error("Agent Plugin stdio MCP command is invalid");else i.add(o.command);if((o.args??[]).some((a)=>a.includes("\x00")))throw Error("Agent Plugin stdio MCP args are invalid");let s=new Set;for(let[a,l]of Object.entries(o.env??{})){let c=a.toLowerCase();if(!SQ(a)||a.toUpperCase()==="PLUGIN_ROOT"||a.toUpperCase()==="PLUGIN_DATA"||s.has(c)||a.includes("\x00")||l.includes("\x00"))throw Error("Agent Plugin stdio MCP environment is invalid");if(kQ(a)||l.length>0&&hz(l))throw Error("Agent Plugin stdio MCP environment cannot carry credentials");s.add(c)}if(o.cwd!==void 0)y6e(o.cwd,e)}return{serverNames:Object.keys(r.data.mcpServers).sort(),bareCommands:[...i].sort()}}function S6e(e,t){let n=r6e.safeParse(Lte(t.find((o)=>o.path==="plugin.json"),"Agent Plugin plugin.json"));if(!n.success||n.data.$schema!==e.installation.agentPluginsSchema||n.data.name!==e.name||n.data.version!==e.installation.version)throw Error("Agent Plugin package identity does not match the desired installation");let r=n.data.extensions?.["ai.clawdi"];if(r===void 0)throw Error("Agent Plugin ai.clawdi extension does not match the Store contract");let i=s6e.safeParse(r);if(!i.success)throw Error("Agent Plugin ai.clawdi extension does not match the Store contract");if(i.data.display.icon){let o=i.data.display.icon,s=o.startsWith("./")?o.slice(2):"";if(!Ow(s)||!t.some((a)=>a.path===s))throw Error("Agent Plugin ai.clawdi display icon is not a package file")}return i.data}function k6e(e,t,n){let r=e.compatibility;if(r?.runtimes&&!r.runtimes.includes(t))throw Error(`Agent Plugin ai.clawdi compatibility excludes ${t}`);let i=new Set(r?.executables??[]);if(n.some((o)=>!i.has(o)))throw Error("Agent Plugin bare MCP commands are not declared by ai.clawdi compatibility")}function A6e(e){for(let t of e){let n=t.path.split("/").map((r)=>r.toLowerCase());if(n.includes(".git")||n.at(-1)===".gitattributes")throw Error(q4e)}}async function gte(e,t){let n=yte(Sd(wte(),"clawdi-agent-plugin-validate-"));try{if(t.installation.source.type==="github-release"&&`sha256:${$te(e)}`!==t.installation.source.archiveDigest)throw Error("Agent Plugin release archive digest does not match the desired installation");let r=t.installation.source.type==="github"?t.installation.source.path:"",i=await m6e(n,e,r),o=Nte(i);if(o.digest!==t.installation.contentDigest)throw Error("Agent Plugin package content digest does not match the desired installation");let s=S6e(t,o.tree),a=g6e(o.tree),l=b6e(o.tree,t.runtime);if(a===0&&l.serverNames.length===0)throw Error("Agent Plugin package must declare at least one Skill or MCP server");if(k6e(s,t.runtime,l.bareCommands),t.runtime==="hermes")A6e(o.tree);return{name:t.name,installation:t.installation,mcpServerNames:l.serverNames,tree:o.tree}}finally{p2(n,{recursive:!0,force:!0})}}async function E6e(e,t){let n=e.installation.source,r=n.type==="github"?(()=>{let o=aP(n.url);return gz(o.owner,o.repo,n.commit)})():new URL(n.url),i=await t(r,{headers:{Accept:n.type==="github"?"application/vnd.github+json":"application/octet-stream"},redirect:"follow"});if(!i.ok)throw Error(`Agent Plugin package download failed (${i.status})`);return Na(i,m2,{resourceLabel:"Agent Plugin source archive",limitLabel:"100 MB"})}async function R6e(e,t,n,r,i){let o=g2(t,e.installation.ownershipIdentity),s=o.read();if(s)try{return{plugin:await gte(s,e),cacheCreated:!1}}catch(c){if(r)throw Error("offline Agent Plugin cache is invalid");if(i)throw c}if(r)throw Error(o.exists()?"offline Agent Plugin cache is invalid":"offline Agent Plugin cache is missing");if(o.exists()&&!o.remove({allowIncomplete:!0}))throw Error("Agent Plugin cache ownership path is not a managed cache entry");let a=await E6e(e,n),l=await gte(a,e);return o.write(a,(c)=>({schemaVersion:_te,ownershipIdentity:e.installation.ownershipIdentity,archiveSha256:c})),{plugin:l,cacheCreated:!0}}function P6e(e){if(e.runtime==="openclaw"||e.runtime==="hermes")return e.runtime;throw Error("Agent Plugins require a selected OpenClaw or Hermes runtime")}function C6e(e){if(!e)return new Map;let t=new Map;for(let[n,r]of Object.entries(e.installations).sort(([i],[o])=>i.localeCompare(o))){let{nativeId:i,...o}=r;if(xte(n,o)!==r.ownershipIdentity)throw Error("Agent Plugin receipt ownership identity is invalid");t.set(n,{runtime:e.runtime,name:n,installation:f2.parse(o),nativeId:i})}return t}async function Fte(e,t,n={}){let r=e.projection?.agentPlugins?.installations??{},i=kd(t);if(Object.keys(r).length===0&&!i)return null;let o=C6e(i),s=Object.keys(r).length>0?P6e(e):i?.runtime;if(!s)return null;let a=n.fetcher??fetch,l=new Map,c=new Set,u=new Set(Object.values(i?.installations??{}).map((p)=>p.ownershipIdentity)),d=async(p)=>{let m=p.installation.ownershipIdentity,g=`${p.runtime}\x00${m}`,f=l.get(g);if(f)return(await f).plugin;let v=R6e(p,t,a,n.offline===!0,u.has(m));l.set(g,v);let w=await v;if(w.cacheCreated)c.add(m);return w.plugin};try{let p=new Map;for(let[m,g]of Object.entries(r).sort(([f],[v])=>f.localeCompare(v))){let f=p6e(m,g);p.set(m,await d({name:m,runtime:s,installation:f}))}return{runtime:s,desired:p,previous:o,transientCacheOwnerships:new Set([...c].filter((m)=>!u.has(m)))}}catch(p){for(let m of c)if(!u.has(m))g2(t,m).remove({allowIncomplete:!0});throw p}}function h2(e,t){let n=yte(Sd(wte(),"clawdi-agent-plugin-stage-"));try{M4e(n,448);let r=Sd(n,"package");fte(r,{recursive:!0,mode:448});for(let i of e.tree){let o=Sd(r,...i.path.split("/"));fte(B4e(o),{recursive:!0,mode:448}),U4e(o,i.bytes,{mode:i.mode&511})}return t(r)}finally{p2(n,{recursive:!0,force:!0})}}var V4e="Hermes Agent Plugins only support the portable streamable-http remote transport",q4e="Hermes Agent Plugin package cannot preserve its verified bytes through local Git transport",_te="clawdi.hostedAgentPluginArchive.v1",W4e="clawdi.hostedAgentPluginReceipts.v2",K4e="https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",m2=104857600,G4e=268435456,bte=2000,Ste=1000,kte=52428800,Ate=10485760,J4e=512,Z4e=262144,Y4e=4194304,Ete="$",Tf,jf,f2,X4e,Q4e,Rte,e6e,Pte,n6e,r6e,d2=(e,t)=>h.array(h.string().min(1).max(t)).max(e).refine((n)=>new Set(n.map(Cte)).size===n.length,"must not contain case-folded duplicates"),i6e,o6e,s6e,a6e,l6e,c6e,d6e;var Dw=b(()=>{ql();Lt();Lh();vf();Gr();u2();_f();yz();Fn();Tf=`${Ete}{PLUGIN_ROOT}`,jf=`${Ete}{PLUGIN_DATA}`,f2=lw.extend({ownershipIdentity:h.string().regex(/^[a-f0-9]{64}$/)}).strict(),X4e=h.string().min(1).max(128).regex(/^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/),Q4e=f2.extend({nativeId:X4e}).strict(),Rte=h.object({schemaVersion:h.literal(W4e),runtime:h.enum(["openclaw","hermes"]),installations:h.record(wf,Q4e)}).strict(),e6e=h.object({schemaVersion:h.literal(_te),ownershipIdentity:h.string().regex(/^[a-f0-9]{64}$/),archiveSha256:h.string().regex(/^[a-f0-9]{64}$/)}).strict(),Pte={parse(e){let t=e6e.parse(e);return{key:t.ownershipIdentity,archiveSha256:t.archiveSha256}}};n6e=h.record(h.string(),h.unknown()),r6e=h.object({$schema:h.literal(vz),name:wf,version:h.string().optional(),description:h.string().optional(),author:h.object({name:h.string().optional(),email:h.string().optional(),url:h.string().optional()}).strict().optional(),homepage:h.string().optional(),repository:h.string().optional(),license:h.string().optional(),keywords:h.array(h.string()).optional(),extensions:h.record(h.string(),h.record(h.string(),h.unknown())).optional()}).strict(),i6e=h.object({name:h.string().min(1).max(80),icon:h.string().min(1).max(512).optional(),category:h.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/),languages:d2(20,64).refine((e)=>e.every((t)=>/^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$/.test(t)),"must contain language tags")}).strict(),o6e=h.object({runtimes:d2(2,16).min(1).refine((e)=>e.every((t)=>t==="openclaw"||t==="hermes"),"contains an unsupported runtime").optional(),executables:d2(32,128).min(1).refine((e)=>e.every((t)=>/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/.test(t)),"contains an invalid executable").optional()}).strict(),s6e=h.object({schemaVersion:h.literal(1),display:i6e,compatibility:o6e.optional()}).strict(),a6e=h.object({type:h.literal("stdio"),command:h.string().min(1).max(512),args:h.array(h.string()).max(256).optional(),env:h.record(h.string(),h.string()).optional(),cwd:h.string().min(1).max(512).optional()}).strict(),l6e=h.object({type:h.enum(["streamable-http","sse"]),url:h.string().min(1).max(2048),headers:h.record(h.string(),h.string()).optional()}).strict(),c6e=h.object({$schema:h.literal(K4e),mcpServers:h.record(h.string().min(1),h.union([a6e,l6e]))}).strict();d6e=new Map("b5:3bc;df:73,73;149:2bc,6e;17f:73;1f0:6a,30c;345:3b9;390:3b9,308,301;3b0:3c5,308,301;3c2:3c3;3d0:3b2;3d1:3b8;3d5:3c6;3d6:3c0;3f0:3ba;3f1:3c1;3f5:3b5;587:565,582;1c80:432;1c81:434;1c82:43e;1c83:441;1c84:442;1c85:442;1c86:44a;1c87:463;1c88:a64b;1e96:68,331;1e97:74,308;1e98:77,30a;1e99:79,30a;1e9a:61,2be;1e9b:1e61;1e9e:73,73;1f50:3c5,313;1f52:3c5,313,300;1f54:3c5,313,301;1f56:3c5,313,342;1f80:1f00,3b9;1f81:1f01,3b9;1f82:1f02,3b9;1f83:1f03,3b9;1f84:1f04,3b9;1f85:1f05,3b9;1f86:1f06,3b9;1f87:1f07,3b9;1f88:1f00,3b9;1f89:1f01,3b9;1f8a:1f02,3b9;1f8b:1f03,3b9;1f8c:1f04,3b9;1f8d:1f05,3b9;1f8e:1f06,3b9;1f8f:1f07,3b9;1f90:1f20,3b9;1f91:1f21,3b9;1f92:1f22,3b9;1f93:1f23,3b9;1f94:1f24,3b9;1f95:1f25,3b9;1f96:1f26,3b9;1f97:1f27,3b9;1f98:1f20,3b9;1f99:1f21,3b9;1f9a:1f22,3b9;1f9b:1f23,3b9;1f9c:1f24,3b9;1f9d:1f25,3b9;1f9e:1f26,3b9;1f9f:1f27,3b9;1fa0:1f60,3b9;1fa1:1f61,3b9;1fa2:1f62,3b9;1fa3:1f63,3b9;1fa4:1f64,3b9;1fa5:1f65,3b9;1fa6:1f66,3b9;1fa7:1f67,3b9;1fa8:1f60,3b9;1fa9:1f61,3b9;1faa:1f62,3b9;1fab:1f63,3b9;1fac:1f64,3b9;1fad:1f65,3b9;1fae:1f66,3b9;1faf:1f67,3b9;1fb2:1f70,3b9;1fb3:3b1,3b9;1fb4:3ac,3b9;1fb6:3b1,342;1fb7:3b1,342,3b9;1fbc:3b1,3b9;1fbe:3b9;1fc2:1f74,3b9;1fc3:3b7,3b9;1fc4:3ae,3b9;1fc6:3b7,342;1fc7:3b7,342,3b9;1fcc:3b7,3b9;1fd2:3b9,308,300;1fd3:3b9,308,301;1fd6:3b9,342;1fd7:3b9,308,342;1fe2:3c5,308,300;1fe3:3c5,308,301;1fe4:3c1,313;1fe6:3c5,342;1fe7:3c5,308,342;1ff2:1f7c,3b9;1ff3:3c9,3b9;1ff4:3ce,3b9;1ff6:3c9,342;1ff7:3c9,342,3b9;1ffc:3c9,3b9;fb00:66,66;fb01:66,69;fb02:66,6c;fb03:66,66,69;fb04:66,66,6c;fb05:73,74;fb06:73,74;fb13:574,576;fb14:574,565;fb15:574,56b;fb16:57e,576;fb17:574,56d".split(";").map(u6e))});import{readFileSync as $6e}from"node:fs";function I6e(e){try{let t=kd(e);return t?{status:"ok",receipt:t}:{status:"missing",receipt:null}}catch{return{status:"unreadable",receipt:null}}}function O6e(e,t){try{let n=Gs.parse(JSON.parse($6e(e.manifestLastGood,"utf-8"))).manifest;return n.instanceId===t.instanceId&&un(n)===un(t)?n:null}catch{return null}}function D6e(e,t,n){return y2.parse({installationId:t.installationId,name:e,version:t.version,contentDigest:t.contentDigest,sourceRevision:n.sourceRevision,generation:un(n),status:"installed"})}function T6e(e,t,n,r){return y2.parse({installationId:t.installationId,name:e,version:t.version,contentDigest:t.contentDigest,sourceRevision:n.sourceRevision,generation:un(n),status:"unknown",errorCode:r})}function j6e(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.event;if(!t||typeof t!=="object"||Array.isArray(t))return null;let n=t;if(n.status!=="error")return null;let r=YP.safeParse(n.agentPlugins);if(!r.success||r.data.installations.some((i)=>i.status!=="failed"))return null;return r.data}function N6e(e,t,n){let r=n.status==="ok"?Object.entries(n.receipt.installations):Object.entries(O6e(e,t)?.projection?.agentPlugins?.installations??{});if(r.length===0)return null;return YP.parse({schemaVersion:1,installations:r.sort(([i],[o])=>i.localeCompare(o)).map(([i,o])=>n.status==="ok"?D6e(i,o,t):T6e(i,o,t,`receipt_${n.status}`))})}function zte(e){let t=I6e(e.paths),n=N6e(e.paths,e.applied,t),r=j6e(e.watchStatus);if(!r)return n;let i=un(e.applied),o=r.installations.filter((a)=>a.generation>=i);if(o.length===0)return n;let s=new Set(o.map((a)=>a.name));return YP.parse({schemaVersion:1,installations:[...n?.installations.filter((a)=>!s.has(a.name))??[],...o].sort((a,l)=>a.name<l.name?-1:a.name>l.name?1:0)})}function Hte(e,t,n){let r=new Set(n),i=Object.entries(e.projection?.agentPlugins?.installations??{}).filter(([s])=>r.has(s)).sort(([s],[a])=>s<a?-1:s>a?1:0).map(([s,a])=>({installationId:a.installationId,name:s,version:a.version,contentDigest:a.contentDigest,sourceRevision:t,generation:un(e),status:"failed",errorCode:"reconcile_failed"}));if(i.length===0)return null;let o=YP.safeParse({schemaVersion:1,installations:i});return o.success?o.data:null}var x6e,y2,YP;var v2=b(()=>{Lt();Ks();Dw();_f();Ua();x6e=h.enum(["reconcile_failed","receipt_missing","receipt_unreadable","receipt_mismatch"]),y2=lw.pick({version:!0,contentDigest:!0}).extend({installationId:h.uuid().max(200),name:wf,sourceRevision:h.string().regex(/^[0-9a-f]{64}$/),generation:h.number().int().positive().safe(),status:h.enum(["installed","failed","unknown"]),errorCode:x6e.nullable().optional()}).strict().superRefine((e,t)=>{if(e.status==="installed"&&e.errorCode!=null)t.addIssue({code:"custom",message:"installed observation cannot include errorCode"});if(e.status==="failed"&&e.errorCode!=="reconcile_failed")t.addIssue({code:"custom",message:"failed observation requires reconcile_failed"});if(e.status==="unknown"&&!["receipt_missing","receipt_unreadable","receipt_mismatch"].includes(e.errorCode))t.addIssue({code:"custom",message:"unknown observation requires a receipt error"})}),YP=h.object({schemaVersion:h.literal(1),installations:h.array(y2).max(128)}).strict().superRefine((e,t)=>{let n=e.installations.map((i)=>i.name),r=e.installations.map((i)=>i.installationId);if(new Set(n).size!==n.length||new Set(r).size!==r.length)t.addIssue({code:"custom",message:"observation identities must be unique"});if(!n.every((i,o)=>o===0||(n[o-1]??"")<i))t.addIssue({code:"custom",message:"observations must be sorted by name"})})});function Tw(e,t){return XP(e.projection?.providers??{},t,e).filter(([,r])=>r.configurationMode==="connection"||r.configurationMode==="custom").map(([r,i])=>{if(t!=="openclaw"&&t!=="hermes"||i.managed_by!=="user"||!i.apiKeySecretRef||i.auth||i.nativeProvider||!i.baseUrl||!i.apiMode||i.status==="error")throw Error("Invalid custom provider connection");return{id:r,initialize:i.configurationMode==="custom",baseUrl:i.baseUrl,apiMode:i.apiMode,envName:QP(r,i,t),secretRef:i.apiKeySecretRef}})}function M6e(e,t){if(t!=="openclaw"&&t!=="hermes")return[];return XP(e.projection?.providers??{},t,e).filter(([,n])=>n.configurationMode==="native").map(([n,r])=>{let i=r.auth?.type==="agent_profile",o=Wl(t,r.nativeProvider??"",r.baseUrl??"",i);if(r.status==="error"||!o||o.type!==Bte(r)||o.api_mode!==b2(r))throw Error("Invalid native provider runtime identity");if(i)return{id:n,routing:o,auth:{kind:"codex"}};if(!r.apiKeySecretRef)throw Error("Native provider credential reference is unavailable");return{id:n,routing:o,auth:{kind:"api-key",secretRef:r.apiKeySecretRef,envName:QP(n,r,t)}}})}function Nf(e,t){Va(e,t,{validateOverlap:!0});let n=M6e(e,t),r=Tw(e,t),o=[...n.map(({routing:a})=>t==="hermes"?a.hermes.provider:a.openclaw.provider),...r.map((a)=>a.id)];if(new Set(o).size!==o.length)throw Error("Native provider credential identity is selected more than once");let s=w2(_2(e,t));if(e.runtimes[t]?.providerMode==="unmanaged"&&(s||n.length>0||r.length>0))throw Error(`runtime ${t} unmanaged provider mode has a provider projection`);return{native:n,catalog:s,connections:r}}function w2(e){if(!e)return null;let t=new Map,n=e.catalog.providers.map((s)=>{if(s.managed_by!=="clawdi")return s;let a=to(s.id)?Hn:s.id===Hy||s.id.startsWith("clawdi-managed")?s.id:Hy;return t.set(s.id,a),{...s,id:a,api_mode:to(a)?zT:s.api_mode}});if(t.size===0)return e;let r=e.primaryModel?t.get(e.primaryModel.provider_id)??e.primaryModel.provider_id:void 0,i=e.catalog.defaults?.chat_provider_id,o=e.catalog.defaults?.embedding_provider_id;return{catalog:{...e.catalog,providers:n,defaults:{...e.catalog.defaults,...r?{chat_provider_id:r}:i?{chat_provider_id:t.get(i)??i}:{},...o?{embedding_provider_id:t.get(o)??o}:{}}},primaryModel:e.primaryModel&&r?{...e.primaryModel,provider_id:r}:null}}function _2(e,t){let n=e.projection?.providers;if(!n||Object.keys(n).length===0)return null;let r=XP(n,t,e).filter(([,l])=>l.configurationMode!=="native"&&l.configurationMode!=="connection"&&l.configurationMode!=="custom"),i=L6e(e,t),o=i&&r.some(([l])=>l===i.provider_id)?i:null;if(!o&&!r.every(([,l])=>l.managed_by==="clawdi"&&l.models?.length&&l.models.every((c)=>c.capabilities?.embeddings===!0)))return null;let s=r.map(([l,c])=>{let u=c.baseUrl,d=b2(c),p=c.apiKeySecretRef??void 0,m=QP(l,c,t);if(c.status==="error")return null;if(!u)return null;let g=F6e(c,Boolean(p));if(!g)return null;let f=U6e(c,l===o?.provider_id?o:null);return{id:l,type:Bte(c),base_url:u,api_mode:d,managed_by:c.managed_by,auth:g,runtime_env_name:p||g.type!=="none"?m:void 0,models:f}}).filter((l)=>l!==null);if(s.length===0)return null;let a=s.find((l)=>l.models.some((c)=>c.capabilities?.embeddings===!0));return{catalog:{schema_version:1,providers:s,defaults:{...o?{chat_provider_id:o.provider_id}:{},...a?{embedding_provider_id:a.id}:{}}},primaryModel:o}}function XP(e,t,n){if(!t)return Object.entries(e).sort(([i],[o])=>i.localeCompare(o));return(n?.runtimes?.[t]?.provider_ids??[]).filter((i)=>Object.hasOwn(e,i)).map((i)=>[i,e[i]])}function L6e(e,t){return(t?e.runtimes[t]:void 0)?.primary_model??null}function U6e(e,t){let n=b2(e),r=[...e.models??[]];if(e.model&&!r.some((i)=>i.id===e.model))r.unshift({id:e.model,api_mode:n});if(t&&!r.some((i)=>i.id===t.model))r.unshift({id:t.model,api_mode:n});return r.filter((i,o,s)=>s.findIndex((a)=>a.id===i.id)===o)}function b2(e){return e.apiMode??"openai_chat"}function Bte(e){return e.type??"custom_openai_compatible"}function F6e(e,t){let n=e.auth;if(n){if(n.type==="agent_profile"&&n.tool==="codex"&&n.profile)return{type:"agent_profile",tool:"codex",profile:n.profile};if(n.type==="api_key"||n.type==="secret_ref"){if(t)return{type:"api_key",source:"managed"};return null}if(n.type!=="none")return null}if(t)return{type:"api_key",source:"managed"};if(S2(e))return null;return{type:"none"}}function S2(e){if(e.apiKeyRequired===!0)return!0;let t=H6e(e.auth);return t?.type==="api_key"||t?.type==="secret_ref"}function QP(e,t,n){if((n==="openclaw"||n==="hermes")&&hf(t))return Or;if(t.configurationMode==="native"&&(n==="openclaw"||n==="hermes")){let i=Wl(n,t.nativeProvider??"",t.baseUrl??"",t.auth?.type==="agent_profile");if(!i)throw Error("Invalid native provider runtime identity");let o=n==="hermes"?i.hermes.env:i.runtime_env_name;if(t.runtimeEnvName&&t.runtimeEnvName!==o)throw Error("Invalid native provider credential environment");return o}let r=t.runtimeEnvName;if(r&&Vte(r))return r;return`CLAWDI_PROVIDER_${e.toUpperCase().replace(/[^A-Z0-9]/g,"_")}_API_KEY`}function Va(e,t,n={}){let r={},i={},o={},s=new Map;for(let[a,l]of XP(e.projection?.providers??{},t,e)){if(l.configurationMode==="native"&&t==="hermes"){let d=Wl(t,l.nativeProvider??"",l.baseUrl??"",l.auth?.type==="agent_profile");if(!d)throw Error("Invalid Hermes native credential routing");if(d.hermes.base_url_env)i[d.hermes.base_url_env]=d.base_url}if(!l.apiKeySecretRef)continue;let c=QP(a,l,t);if(!Vte(c))continue;let u=s.get(c);if(u&&u!==a)throw Error(`runtime ${t??"default"} credential environment ${c} has multiple providers`);if(s.set(c,a),hf(l))r[c]=Wh;else o[c]=l.apiKeySecretRef}if(n.validateOverlap)z6e(t??"default",r,o);return{placeholderEnv:r,configEnv:i,secretEnv:o}}function z6e(e,t,n){for(let r of Object.keys(t)){if(n[r]===void 0)continue;throw Error(`runtime ${e} provider env ${r} is both managed and BYOK-backed`)}}function k2(e,t,n,r){if(Object.keys(n).length===0)return t;let i=t?.env??{};for(let o of Object.keys(n))if(t?.secretEnv?.[o]!==void 0)throw Error(`runtime ${e}${r?` service ${r}`:""} provider placeholder ${o} conflicts with secretEnv`);return{...t??{},prependPath:t?.prependPath??[],env:{...i,...n}}}function H6e(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)?e:null}function Vte(e){return/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)}var bc=b(()=>{Ni();_a();yf()});import{spawnSync as Wte}from"node:child_process";import{createHash as B6e}from"node:crypto";import{chmodSync as qte,lstatSync as V6e,mkdtempSync as q6e,readFileSync as W6e,readlinkSync as K6e,rmSync as Kte,statSync as G6e}from"node:fs";import{tmpdir as J6e}from"node:os";import{isAbsolute as Z6e,join as Zs}from"node:path";import{fileURLToPath as Y6e}from"node:url";function Sc(e){return{executionUser:null,commandPath:null,appRoot:null,install:null,installerUrl:null,executedInstallerUrl:null,exitCode:null,error:null,...e}}function Ys(e,t){if(e==="openclaw")return Zs(t,".local","bin","openclaw");if(e==="hermes")return Zs(t,".local","bin","hermes");return null}function Ad(e,t){if(e==="openclaw")return Zs(t,".openclaw");if(e==="hermes")return Zs(t,".hermes","hermes-agent");return null}function eVe(){let e=process.env.CLAWDI_RUNTIME_INSTALL_TIMEOUT;if(e===void 0)return A2;let t=Number(e);if(Number.isSafeInteger(t)&&t>0&&t<=2147483647)return t;return console.warn(`CLAWDI_RUNTIME_INSTALL_TIMEOUT must be a valid positive integer; using ${A2}ms`),A2}function tVe(e,t){if(e!=="hermes"||!t.enabled||!t.install||!t.services?.dashboard)return null;let n=Zs(t.install.home,".hermes","hermes-agent","venv","bin","python");if(!an(n))return`Hermes dashboard runtime is missing its managed Python interpreter: ${n}`;let r;try{r=de(n,["-c",X6e],t.install.home,t.install.home,{timeoutMs:Q6e})}catch(i){return`Hermes dashboard runtime capability probe failed: ${i instanceof Error?i.message:String(i)}`}if(r.status===0)return null;return`Hermes dashboard runtime is incompatible: ${Mi(String(r.stderr??""))??(r.error instanceof Error?r.error.message:"uvicorn.Server.capture_signals is unavailable")}`}function nVe(e,t,n,r,i=[]){let o=process.env.CLAWDI_RUNTIME_USER?.trim(),s=rVe(e,t);if(!o||o==="root")return{command:"bash",args:[n,...t.args,...i],env:s,executionUser:null};let a=Dl(o,t.home,"bash",[n,...t.args,...i],{runtimeUid:r.uid,runtimeGid:r.gid});return{command:a.command,args:a.args,env:{...s,...a.env},executionUser:o}}function rVe(e,t){let n={...process.env,HOME:t.home,PATH:[Zs(t.home,".local","bin"),process.env.PATH].filter(Boolean).join(":")};if(VO(n),e==="openclaw")for(let r of["OPENCLAW_HOME","OPENCLAW_STATE_DIR","OPENCLAW_CONFIG_PATH","OPENCLAW_PREFIX","OPENCLAW_VERSION","OPENCLAW_INSTALL_METHOD","OPENCLAW_GIT_DIR","OPENCLAW_GIT_UPDATE"])delete n[r];return n.SSL_CERT_FILE=No,n.NODE_EXTRA_CA_CERTS=No,n.REQUESTS_CA_BUNDLE=No,n.CURL_CA_BUNDLE=No,n.GIT_SSL_CAINFO=No,n.NPM_CONFIG_CAFILE=No,n.npm_config_cafile=No,n}function Mi(e){if(!e)return null;return e.slice(-4000)}function iVe(e){if(e==="openclaw")return"CLAWDI_RUNTIME_TEST_OPENCLAW_INSTALLER";if(e==="hermes")return"CLAWDI_RUNTIME_TEST_HERMES_INSTALLER";return null}function oVe(e,t){let n=iVe(e),r=n?process.env[n]?.trim():void 0;if(r){if(process.env.CLAWDI_RUNTIME_ALLOW_TEST_INSTALLERS!=="1")throw Error(`${n} requires CLAWDI_RUNTIME_ALLOW_TEST_INSTALLERS=1`);return r}return t}function sVe(e,t,n){if(t.startsWith("file://"))return{path:Y6e(t)};if(t.startsWith("/"))return{path:t};if(!t.startsWith("https://"))throw Error(`runtime ${e} installer must use https:// or a test file URL`);let r=q6e(Zs(J6e(),`clawdi-${e}-installer-`));qte(r,493);let i=Zs(r,"install.sh"),o=Wte("curl",["-fsSL","--proto","=https","--tlsv1.2","--retry","3","-o",i,t],{encoding:"utf8"});if(o.status!==0){Kte(r,{recursive:!0,force:!0});let s=kc(n,`${e}-download`,o);throw Error(`could not download ${e} official installer; see ${s}`)}return qte(i,493),{path:i,cleanup:r}}function aVe(e,t,n,r){let i=new Date().toISOString(),o=Date.now(),s=(d)=>({...d,installStartedAt:i,installFinishedAt:new Date().toISOString(),installDurationMs:Math.max(0,Date.now()-o)}),a=Ys(e,t.home),l=Ad(e,t.home);if(!a||!l)return s(Sc({runtime:e,enabled:!0,status:"install_failed",commandPath:a,appRoot:l,install:t,installerUrl:t.url,error:`unsupported runtime ${e}`}));if(an(a))return s(Sc({runtime:e,enabled:!0,status:"present",commandPath:a,appRoot:l,install:t,installerUrl:t.url}));let c=oVe(e,t.url),u=sVe(e,c,n);try{let d=nVe(e,t,u.path,r),p=Wte(d.command,d.args,{cwd:t.home,env:d.env,encoding:"utf8",timeout:eVe()}),m=kc(n,e,p),g=p.status??1,f=g===0&&an(a);return s(Sc({runtime:e,enabled:!0,status:f?"installed":"install_failed",executionUser:d.executionUser,commandPath:a,appRoot:l,install:t,installerUrl:t.url,executedInstallerUrl:c===t.url?t.url:c,exitCode:g,error:f?null:`runtime ${e} installer failed or did not create ${a}; see ${m}`}))}catch(d){let p=kc(n,e,{error:d});return s(Sc({runtime:e,enabled:!0,status:"install_failed",commandPath:a,appRoot:l,install:t,installerUrl:t.url,executedInstallerUrl:c,error:`runtime ${e} installer failed; see ${p}`}))}finally{if(u.cleanup)Kte(u.cleanup,{recursive:!0,force:!0})}}function t0(e,t,n,r,i){if(!t.enabled)return Sc({runtime:e,enabled:!1,status:"disabled",install:t.install??null,installerUrl:t.install?.url??null});if(!t.install){if(t.run?.command?.trim()||bf(e)){let a=t.run?.command?.trim()||null,l=bf(e)&&a&&Jh(a)?a:null;return Sc({runtime:e,enabled:!0,status:"configured",commandPath:l,appRoot:l?Ad(e,n):null})}return Sc({runtime:e,enabled:!0,status:"install_failed",error:`runtime ${e} is enabled but missing install metadata`})}let o=aVe(e,t.install,r,i);if(o.error)return o;let s=tVe(e,t);return s?{...o,status:"install_failed",error:s}:o}function Gte(e,t,n,r,i){if(!t.install)return t0(e,t,n,r,i);if(!t.enabled)return t0(e,t,n,r,i);let o=Ys(e,t.install.home),s=Ad(e,t.install.home);return Sc({runtime:e,enabled:!0,status:o&&an(o)?"present":"configured",commandPath:o,appRoot:s,install:t.install,installerUrl:t.install.url,error:o&&s?null:`unsupported runtime ${e}`})}function kc(e,t,n){let r=Zs(e.statusRoot,"installer-logs",`${t}.log`),i=n.error?n.error instanceof Error?n.error.message:String(n.error):"",o=[`recordedAt=${new Date().toISOString()}`,`exitCode=${n.status??"unavailable"}`,`signal=${n.signal??"none"}`,`spawnError=${i}`,"--- stdout ---",String(n.stdout??""),"--- stderr ---",String(n.stderr??""),""].join(`
|
|
643
643
|
`),s={mode:384,dirMode:448};if(n.status!==0||n.signal||n.error)Ot(e,Zs(e.statusRoot,"installer-logs",`${t}.failed.log`),o,s);return Ot(e,r,o,s),r}function dn(e){if(!Z6e(e))return null;try{let t=V6e(e);if(!t.isFile()&&!t.isSymbolicLink())return null;let n=t.isSymbolicLink()?G6e(e):t;if(!n.isFile())return null;let r=W6e(e);return ut({path:e,contentsSha256:B6e("sha256").update(r).digest("hex"),kind:t.isSymbolicLink()?"symlink":"file",linkTarget:t.isSymbolicLink()?K6e(e):null,linkUid:t.uid,linkGid:t.gid,fileMode:n.mode&4095,fileUid:n.uid,fileGid:n.gid})}catch{return null}}function jw(e,t,n){let r=dn(e);if(!r)return null;let i=`${e}\x00${t}\x00${n}`,o=e0.get(i);if(o?.executableRevision===r)return o.commandRevision;if(!E2(e,t,n))return null;return e0.get(i)?.commandRevision??null}function E2(e,t,n){let r=dn(e);if(!r)return null;let i=`${e}\x00${t}\x00${n}`,o=e0.get(i);if(o?.executableRevision===r)return o.version;let s=e===Ys("hermes",t)?30000:1e4;try{let a=de(e,["--version"],t,n,{timeoutMs:s});if(a.error&&"code"in a.error&&a.error.code==="ETIMEDOUT")throw new Ol(`runtime --version probe for ${e}`,s);if(a.status!==0)return null;let l=Buffer.isBuffer(a.stdout)?a.stdout.toString("utf8"):a.stdout,c=Buffer.isBuffer(a.stderr)?a.stderr.toString("utf8"):a.stderr,u=[l,c].filter(Boolean).join(`
|
package/package.json
CHANGED