clawdi 0.16.22 → 0.16.23

package/dist/index.js

@@ -1731,7 +1731,7 @@ ${I}`,p++;break;case"id":if(!I.includes("\x00"))u=I;break;case"retry":if(/^\d+$/
 `,{mode:384}),_Ce(o,r),_Ce(s,i)}var xvt;var ICe=v(()=>{Ae();Bn();Ee();Ne();Me();Sr();Mu();er();An();pn();Mn();mo();sy();xvt=["skills","sessions"]});import{existsSync as $vt,readFileSync as Nvt,writeFileSync as Mvt}from"node:fs";import{join as OCe}from"node:path";function MT(){let e=OCe(he(),Gq);if(!$vt(e))return{};try{return JSON.parse(Nvt(e,"utf-8"))}catch{return console.log(y.yellow(`⚠ ~/.clawdi/${Gq} is corrupted; resetting.`)),{}}}function DCe(e){let t=OCe(he(),Gq);Mvt(t,`${JSON.stringify(e,null,2)}
 `,{mode:384})}var Gq="state.json";var Kq=v(()=>{Ae();Me()});function $Ce(e){return e.sessions.length>0||e.skills.length>0}function NCe(e,t){if(t==="sessions")return e.sessions!==void 0;if(t==="skills")return e.skills!==void 0;return!1}async function UCe(e){if(!e.dryRun)Q();if(ee.intro(y.bold("clawdi push"),{output:process.stderr}),e.project&&e.excludeProject&&e.excludeProject.length>0){ee.log.error("--project and --exclude-project cannot be combined (--project is positive selection, --exclude-project is subtractive).",{output:process.stderr}),ee.outro(y.red("Aborted."),{output:process.stderr}),process.exitCode=1;return}if(e.all&&!e.agent&&!e.allAgents)e.allAgents=!0;let t=await Ah(e.agent,!!e.allAgents);if(t.length===0){ee.outro(y.red("Aborted."),{output:process.stderr}),process.exitCode=1;return}let n=UE(e.modules,Lvt);if(!n){process.exitCode=1;return}let r=e.modules!==void 0,i=r&&t.length===1,o=MT(),s=e.project??(e.all?void 0:process.cwd());if(n.includes("sessions")){let S=s?`project ${s}`:"all projects";ee.log.info(y.gray(`Scanning ${S}`),{output:process.stderr})}let a=ee.spinner();a.start(`Scanning ${t.length} agent${t.length===1?"":"s"}...`);let l=[],c=[],u=null;try{for(let S of t){let C=ui(S);if(!C)continue;let k=n.filter((R)=>NCe(C,R)),A=n.filter((R)=>!NCe(C,R));if(i&&A.length>0){u=`${we[S].displayName} does not support ${A.join(", ")}.`;break}if(r&&A.length>0)c.push({agentType:S,modules:A});if(k.length===0)continue;let P=await jvt(C,k,e,s);if("error"in P){u=P.error;break}l.push(P)}}catch(S){throw a.stop("Scan failed."),S}if(a.stop(u?"Scan failed.":"Scan complete."),u){ee.log.error(u,{output:process.stderr}),ee.outro(y.red("Aborted."),{output:process.stderr}),process.exitCode=1;return}for(let S of c)ee.log.warn(`${we[S.agentType].displayName} skipped unsupported ${S.modules.join(", ")}.`,{output:process.stderr});for(let S of l){let C=we[S.agentType].displayName,k=[];if(S.modules.includes("sessions")){let A=S.sessionsCacheSkipped>0?` (${S.sessionsCacheSkipped} in sync)`:"";if(k.push(`${S.sessions.length} session${S.sessions.length===1?"":"s"}${A}`),S.sessionsBlocked>0)k.push(`${S.sessionsBlocked} session${S.sessionsBlocked===1?"":"s"} blocked`)}if(S.modules.includes("skills")){let A=S.skillsCacheSkipped>0?` (${S.skillsCacheSkipped} in sync)`:"";k.push(`${S.skills.length} skill${S.skills.length===1?"":"s"}${A}`)}ee.log.message(`${y.bold(C)} — ${k.join(", ")} to upload`);for(let A of S.notes)ee.log.message(y.gray(`  ${A}`))}let d=l.filter($Ce);if(e.dryRun){if(e.json){LCe(l.map((S)=>({scan:S,result:MCe(S)})),!0,[]);return}ee.outro(y.gray(d.length>0?"Dry run complete.":"Dry run — nothing to push, everything already in sync."));return}let p={cacheSkipped:0,created:0,updated:0,unchanged:0,suppressed:0,content:0,skillsCacheSkipped:0,skills:0},m=l.map((S)=>({scan:S,result:{...MCe(),sessionsFailed:S.sessionErrors.length}})),g=l.flatMap((S)=>S.sessionErrors),f=null,h=0,w=!1;try{for(let{scan:S,result:C}of m){if(p.cacheSkipped+=S.sessionsCacheSkipped,p.skillsCacheSkipped+=S.skillsCacheSkipped,!$Ce(S))continue;if(f=S.agentType,h=g.length,d.length>1)ee.log.step(y.bold(`▶ ${we[S.agentType].displayName}`));if(await Uvt(S,o,C,g)==="aborted"){w=!0;break}p.created+=C.sessionsCreated,p.updated+=C.sessionsUpdated,p.unchanged+=C.sessionsUnchanged,p.suppressed+=C.sessionsSuppressed,p.content+=C.contentUploaded,p.skills+=C.skillsPushed}f=null,h=g.length,DCe(o)}catch(S){if(process.exitCode=1,!e.json)throw S;if(g.length===h)g.push({agent:f,module:null,key:null,message:Ve(S)});ee.log.error(Ve(S));return}finally{if(e.json)LCe(m,!1,g)}if(g.length>0)process.exitCode=1;if(w){ee.outro(y.red("Aborted."),{output:process.stderr}),process.exitCode=1;return}let _=[];if(n.includes("sessions")){let S=p.cacheSkipped+p.unchanged;if(_.push(`${p.created} new, ${p.updated} updated, ${S} unchanged`),p.suppressed>0)_.push(`${p.suppressed} cloud session${p.suppressed===1?"":"s"} kept deleted`);_.push(`${p.content} content upload${p.content===1?"":"s"}`)}if(n.includes("skills")){let S=p.skillsCacheSkipped>0?`${p.skills} skill${p.skills===1?"":"s"} uploaded, ${p.skillsCacheSkipped} already in sync`:`${p.skills} skill${p.skills===1?"":"s"}`;_.push(S)}if(_.push(`across ${t.length} agent${t.length===1?"":"s"}`),!e.json)ee.outro(g.length>0?y.red(`Push completed with errors — ${_.join(", ")}`):y.green(`✓ Push complete — ${_.join(", ")}`))}function MCe(e){return{sessionsCreated:e?.sessionsNew??0,sessionsUpdated:e?.sessionsUpdated??0,sessionsUnchanged:0,sessionsSuppressed:0,contentUploaded:0,skillsPushed:e?.skills.length??0,sessionsFailed:0,skillsFailed:0}}function LCe(e,t,n){let r={sessions:$T(),skills:{uploaded:0,unchanged:0,failed:0}},i=e.map(({scan:o,result:s})=>{let a={new:s.sessionsCreated,updated:s.sessionsUpdated,unchanged:o.sessionsCacheSkipped+s.sessionsUnchanged,failed:s.sessionsFailed},l={uploaded:s.skillsPushed,unchanged:o.skillsCacheSkipped,failed:s.skillsFailed};for(let c of["new","updated","unchanged","failed"])r.sessions[c]+=a[c];for(let c of["uploaded","unchanged","failed"])r.skills[c]+=l[c];return{agent:o.agentType,...o.modules.includes("sessions")?{sessions:a}:{},...o.modules.includes("skills")?{skills:l}:{}}});F({schemaVersion:"clawdi.push.v1",dryRun:t,agents:i,totals:r,errors:n})}async function jvt(e,t,n,r){let i=e.agentType,o=Ar(i),s=!n.all&&!n.project;if(!n.dryRun&&!o)return{error:`No environment registered for ${we[i].displayName}. Run \`clawdi setup\` first.`};if(!n.dryRun&&o){let P=new L;try{let R=await P.GET("/v1/agents/{agent_id}",{params:{path:{agent_id:o}}});if(R.error||!R.data){if((R.response?.status??0)===404)return{error:LT}}}catch(R){if(R instanceof te&&R.status===404)return{error:LT}}}let a=[],l=new Map,c=null,u=new L({requireAuth:!n.dryRun}),d=new Set([...ve().excludeProjects??[],...n.excludeProject??[]].map(Vd));if(i==="hermes"&&t.includes("sessions")&&r!==void 0)a.push(s?"Hermes ignores project filters — pushing all sessions. Use --all to suppress.":"Hermes ignores project filters — pushing all sessions.");let p=[],m=[],g=0,f=U0(e,u,o,{readOnly:n.dryRun}),h=t.includes("sessions")?f.sessions:void 0;if(await f.refresh(),h){c=n.dryRun?await h.contentProtocol():await z0(u,h);let P=await lf(h,{kind:"complete",projectFilter:r});for await(let R of P.batches)p.push(...R.sessions)}if(t.includes("skills")&&e.skills){let P=0,R=0,x=new Map;if(!n.dryRun&&o){let O=await G_(new L,o);x=oy(i,o,O).claims}for(let O of await e.skills.collect()){if(!Yt(O.skillKey)){P++;continue}if(is({agentType:i,localSkillKey:O.skillKey})){R++;continue}if(O.contentHash=await Nm(O.directoryPath,void 0,O.skillKey),x.get(O.skillKey)===O.contentHash)g++;else m.push(O)}if(P>0)a.push(`Skipped ${P} skill ${P===1?"directory":"directories"} with invalid names. Use only letters, numbers, dots, underscores, and hyphens, with at most 4 slash-separated parts.`);if(R>0)a.push(`Skipped ${R} project-owned skill ${R===1?"reference":"references"}; update them from their source project.`)}if(d.size>0&&p.length>0){let P=p.length,R=new Set;p=p.filter((O)=>{if(!O.projectPath)return!0;let E=Vd(O.projectPath);if(d.has(E))return R.add(E),!1;return!0});let x=P-p.length;if(x>0)a.push(`Excluded ${x} session${x===1?"":"s"} from ${R.size} project${R.size===1?"":"s"}.`);for(let O of d)if(!R.has(O))a.push(`--exclude-project ${O} matched no local sessions; ignored.`)}let w=0,_=0,S=0,C=0,k=[],A=t.includes("sessions")?yo():null;if(h&&c&&A){let P=p.length,R=[];for(let O of p){let E=await Tm(O,c);if(l.set(Jn(O.profileKey,O.localSessionId),E),!o){S++,R.push(O);continue}let I=ry(u,{environmentId:o,adapter:i,sourceSessionKey:Jn(O.profileKey,O.localSessionId),profileKey:O.profileKey}),z=qb(I,E,A);if(z){_+=1,a.push(z),k.push({agent:i,module:"sessions",key:Jn(O.profileKey,O.localSessionId),message:z});continue}let W=td(A,I);if(!(W?.protocol===E.protocol&&W.local_hash===E.localHash&&W.pending===void 0&&W.blocked===void 0))if(R.push(O),W)C++;else S++}p=R,w=P-p.length-_;let x=new Set(p.map((O)=>Jn(O.profileKey,O.localSessionId)));for(let O of[...l.keys()])if(!x.has(O))l.delete(O)}if(A&&p.length===0&&w===0){let P=!Object.keys(A.sessions).some((R)=>R.startsWith(`${i}:`));if(d.size>0)a.push("Nothing left to push after exclusions.");else if(s&&P)a.push(`No sessions in ${process.cwd()} — looks like a first run. Use --all to scan every project.`);else if(r)a.push(n.all?"No sessions matched that project — check the --project path.":"No sessions matched. Use --all to scan every project, or --project <abs-path>.")}return{agentType:i,modules:t,envId:o,sessions:p,sessionPlans:l,sessionsModule:h,sessionProtocol:c,skills:m,sessionsCacheSkipped:w,sessionsBlocked:_,sessionsNew:S,sessionsUpdated:C,skillsCacheSkipped:g,sessionErrors:k,notes:a}}function jCe(e,t){let n=e.get(t);if(!n)throw Error(`internal error: missing upload plan for ${t}`);return n}async function Uvt(e,t,n,r){let{agentType:i,envId:o,sessions:s,sessionPlans:a,skills:l}=e,c=e.sessionsModule;if(!o)return r.push({agent:i,module:null,key:null,message:"Environment id missing — rerun `clawdi setup`."}),ee.log.error("Environment id missing — rerun `clawdi setup`."),"aborted";let u=new L,d=new Set;function p(m,g,f){if(r.push({agent:i,module:m,key:g,message:f}),m==="skills")n.skillsFailed++;else if(!d.has(g))d.add(g),n.sessionsFailed++}if(s.length>0){let m=ee.spinner();m.start(`Uploading metadata for ${s.length} session${s.length===1?"":"s"}...`);let g=new Set,f=new Set,h=new Set,w=500,_=[];try{let S=new Map;for(let A of s){let P=S.get(A.profileKey)??[];P.push(A),S.set(A.profileKey,P)}let C=[];for(let A of S.values())for(let P=0;P<A.length;P+=w)C.push(A.slice(P,P+w));for(let A of C){_=A;let P=A[0]?.profileKey,R=N(await u.POST("/v1/sessions/batch",{body:{...P!==void 0?{profile_key:P}:{},sessions:A.map((x)=>{let O=jCe(a,Jn(x.profileKey,x.localSessionId));return{environment_id:o,local_session_id:x.localSessionId,project_path:x.projectPath,started_at:x.startedAt.toISOString(),ended_at:x.endedAt?.toISOString()??null,last_activity_at:gx(x),duration_seconds:x.durationSeconds,message_count:x.messageCount,input_tokens:x.inputTokens,output_tokens:x.outputTokens,cache_read_tokens:x.cacheReadTokens,model:x.model,models_used:x.modelsUsed,summary:x.summary,status:"completed",content_protocol:O.protocol,content_hash:O.protocol==="snapshot-v1"?O.localHash:null}})}}));for(let x of R.needs_content)g.add(Jn(P,x));for(let x of R.suppressed??[])h.add(Jn(P,x));n.sessionsCreated+=R.created,n.sessionsUpdated+=R.updated,n.sessionsUnchanged+=R.unchanged,n.sessionsSuppressed+=R.suppressed?.length??0;for(let x of R.rejected??[]){let O=Jn(P,x);f.add(O),p("sessions",O,"Session rejected by server (cross-env race); retry on next push.")}}for(let A of h)g.delete(A);if(f.size>0)ee.log.warn(`${f.size} session${f.size===1?"":"s"} rejected by server (cross-env race) — will retry on next push`,{output:process.stderr});let k=n.sessionsSuppressed>0?`, ${n.sessionsSuppressed} kept deleted`:"";m.stop(`Metadata: ${n.sessionsCreated} new, ${n.sessionsUpdated} updated, ${n.sessionsUnchanged} unchanged${k}`)}catch(S){if(m.stop("Session metadata upload failed."),S instanceof te&&S.status===400&&S.body.includes("unknown_environment")){for(let C of _)p("sessions",Jn(C.profileKey,C.localSessionId),LT);return ee.log.error(LT,{output:process.stderr}),"aborted"}for(let C of _)p("sessions",Jn(C.profileKey,C.localSessionId),Ve(S));throw S}if(s.some((S)=>!f.has(Jn(S.profileKey,S.localSessionId)))){let S=ee.spinner();S.start(`Syncing content for ${s.length} session${s.length===1?"":"s"}...`);for(let C of s){let k=Jn(C.profileKey,C.localSessionId);if(f.has(k))continue;try{let A=jCe(a,k),P=ry(u,{environmentId:o,adapter:i,sourceSessionKey:k,profileKey:C.profileKey});if(h.has(k)){q0(P,C,A);continue}let R=await W0({api:u,fence:P,session:C,plan:A,needsSnapshotContent:g.has(k),confirmPlanCurrent:async()=>{let x=await c?.resolve(k);return!!x&&(await Tm(x,A.protocol)).localHash===A.localHash}});if(R.status==="blocked")p("sessions",k,R.message),ee.log.warn(R.message,{output:process.stderr});else if(R.uploaded)n.contentUploaded+=1,S.message(`Synced content for ${n.contentUploaded} session${n.contentUploaded===1?"":"s"}...`)}catch(A){p("sessions",k,Ve(A)),ee.log.warn(`Content sync failed for ${C.localSessionId}: ${Ve(A)}`,{output:process.stderr})}}S.stop(`Synced ${n.contentUploaded} changed content session${n.contentUploaded===1?"":"s"}`)}t[`sessions:${i}`]={lastActivityAt:new Date().toISOString()}}if(l.length>0){if(!o)throw Error(`internal error: skill push without envId for ${i}; the early-return guard above should have caught this`);let m=await G_(u,o),g=ee.spinner();g.start(`Uploading ${l.length} skill${l.length===1?"":"s"}...`);let f=0,h=[],w=null;try{for(let S of l){w=S.skillKey;let C=await Lr(S.directoryPath,void 0,S.skillKey);try{await u.uploadAgentSkill(o,m,S.skillKey,C.archive,`${S.skillKey}.tar.gz`,C.hash),f++,n.skillsPushed=f,Lm({agentType:i,agentId:o,projectId:m,skillKey:S.skillKey,hash:C.hash})}catch(k){if(!(k instanceof te&&(k.status===413||typeof k.body==="string"&&/(?:^|[^0-9])413(?:[^0-9]|$)|payload too large/i.test(k.body))))throw k;let P=(C.archive.length/1024/1024).toFixed(1);p("skills",S.skillKey,`${P} MB exceeds upload limit`),h.push({key:S.skillKey,reason:`${P} MB exceeds upload limit`})}g.message(`Uploading skills (${f+h.length}/${l.length})...`)}let _=[`Pushed ${f} skill${f===1?"":"s"}`];if(h.length>0)_.push(`skipped ${h.length} (too large)`);g.stop(_.join(", "));for(let S of h)ee.log.warn(`Skipped ${S.key} — ${S.reason}`,{output:process.stderr});n.skillsPushed=f}catch(_){if(w)p("skills",w,Ve(_));throw g.stop(`Failed after ${f} skill${f===1?"":"s"}.`),_}t.skills={lastActivityAt:new Date().toISOString()}}return"complete"}var LT="This machine's environment is no longer registered. Run `clawdi setup` again.",Lvt;var FCe=v(()=>{Ae();Wg();Bn();Ee();Ne();Me();Sr();NB();Mu();pC();An();pn();mo();yx();zB();Vb();Ss();sy();Kq();xo();Lvt=["sessions","skills"]});async function zCe(e,t={}){try{if(t.dryRun){let r=await Hle(e,py(t));if(t.json){F({schemaVersion:"clawdi.read.v1",...r});return}if(console.log(y.green(`✓ Reference resolves from ${r.source_alias} (redacted)`)),t.debug)BCe(r);return}let n=await wP(e,py(t));if(t.json){F({schemaVersion:"clawdi.read.v1",...n});return}if(console.log(n.value),t.debug)BCe(n)}catch(n){if(zr(n))throw n;console.error(y.red(n instanceof Error?n.message:String(n))),process.exitCode=1}}function BCe(e){if(console.error(y.gray(`from ${e.source_alias}`)),!Array.isArray(e.precedence))return;console.error(y.gray("searched:"));for(let t of e.precedence){if(typeof t!=="object"||t===null)continue;let n=t;console.error(y.gray(`  ${n.alias} ${n.reason}`))}}var VCe=v(()=>{Ae();Ne();Sr();qz();Dh()});function GCe(e){return Zq(e).entries}function Zq(e){let t=[],n=[];for(let r of e.split(/\r?\n/)){let i=r.trim();if(!i||i.startsWith("#"))continue;let o=/^(?:export\s+)?([^=\s]+)\s*=\s*(.*)$/.exec(i);if(!o)continue;if(!Fvt.test(o[1])){n.push(o[1]);continue}t.push([o[1],Hvt(o[2].trim())])}return{entries:t,skippedInvalidIdentifiers:n}}function Hvt(e){if(e.startsWith('"')){let n=WCe(e,'"');if(n!==-1)return e.slice(1,n).replace(/\\n/g,`
 `).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}if(e.startsWith("'")){let n=WCe(e,"'");if(n!==-1)return e.slice(1,n)}let t=e.indexOf(" #");return t===-1?e:e.slice(0,t).trimEnd()}function WCe(e,t){for(let n=1;n<e.length;n+=1){if(e[n]!==t)continue;if(t==='"'&&Bvt(e,n))continue;return n}return-1}function Bvt(e,t){let n=0;for(let r=t-1;r>=0&&e[r]==="\\";r-=1)n+=1;return n%2===1}var Fvt;var Jq=v(()=>{Fvt=/^[A-Za-z_][A-Za-z0-9_]*$/});import{spawn as zvt}from"node:child_process";import{existsSync as Vvt,readFileSync as qvt}from"node:fs";import{dirname as Wvt}from"node:path";async function JCe(e,t={},n=zvt){if(e.length===0&&!t.runtimeService)console.error(y.red("No command specified. Usage: clawdi run -- <command>")),process.exit(1);let r={...process.env},i=Zvt(t.runtimeService);if(i.status==="ok"&&!US(t)){let A=pe({mode:"hosted"});await FS(ox(i,[i.runtime],r,A),n);return}if(i.status!=="not-runtime"&&i.status!=="ok"&&!US(t))console.error(y.red(jT(i))),process.exit(1);let o=Kvt(e[0]),s=KCe(e,r);if(o.status==="ok"&&!US(t)){let A=pe({mode:"hosted"});await FS(ox(o,e,r,A),n);return}if(o.status!=="not-runtime"&&o.status!=="ok"&&!US(t))console.error(y.red(jT(o))),process.exit(1);if(s&&!US(t)){await FS(s,n);return}if(!_i()&&o.status!=="not-runtime"&&o.status!=="ok")console.error(y.red(jT(o))),process.exit(1);Q();let a=new L,l=await nwt(a,t),c={};if(t.dryRun){let A=t.inheritEnv===!1?{}:{...process.env},P=ZCe(t.envFile??[]),R={...A,...P};await ewt(e,R,l,t);return}let u=t.inheritEnv===!1?{}:{...process.env},d=ZCe(t.envFile??[]),p={...u,...d},m={};try{m=await iwt(p,{project:t.project,projectId:t.project||t.agent?void 0:l?.projectId,agent:t.agent,allowConflicts:t.allowConflicts})}catch(A){console.error(y.red(`Could not resolve clawdi references: ${Ve(A)}`)),process.exit(1)}let g={...p,...c,...m};if(o.status!=="not-runtime"&&o.status!=="ok")console.error(y.red(jT(o))),process.exit(1);let f=dt()==="hosted"?{}:await Gvt(g),h={...g,...f};if(o.status==="ok"){let A=pe({mode:"hosted"});await FS(ox(o,e,h,A),n);return}let w=KCe(e,h);if(w){await FS(w,n);return}let[_,...S]=e,C=n(_,S,{env:h,stdio:"inherit"}),k=await YCe(C,"command");process.exitCode=k}async function Gvt(e){let t;try{t=Ui({allowNoAuthPublic:!0})}catch(o){return console.error(y.yellow(`⚠ Could not read AI provider catalog: ${Ve(o)}`)),{}}let n={},r={...e};for(let o of t.providers){if(o.auth.type!=="api_key"||o.auth.source!=="managed")continue;let s=o.runtime_env_name;if(!s||r[s])continue;let a=await CP(o);if(a.status!=="available"||!a.value){console.error(y.yellow(`⚠ Could not resolve AI provider key for ${o.id}: ${a.detail??a.status}`));continue}n[s]=a.value,r[s]=a.value}let i=Object.keys(n).length;if(i>0)console.log(y.green(`✓ Resolved ${i} AI provider key${i===1?"":"s"}`));return n}function US(e){return Boolean(e.project||e.agent||e.dryRun||e.envFile&&e.envFile.length>0)}function Kvt(e){if(dt()!=="hosted")return{status:"not-runtime",runtime:null};if(!e)return{status:"not-runtime",runtime:null};return DY(e,pe({mode:"hosted"}))}function Zvt(e){if(dt()!=="hosted")return{status:"not-runtime",runtime:null};if(!e)return{status:"not-runtime",runtime:null};let[t,n,...r]=e.split("+");if(!t||!n||r.length>0)return{status:"not-runtime",runtime:null};return ix(t,n,pe({mode:"hosted"}))}function KCe(e,t){if(dt()!=="hosted")return null;let[n,...r]=e;if(!n)return null;let i=pe({mode:"hosted"}),o=Vvt(i.egressProfileBundle)?i.egressProfileBundle:null,s={...t,PATH:bw(t.PATH??"",Wvt(i.cliManagedBin))};if(o)_a(s);return{runtime:"generic",service:null,command:n,args:r,cwd:process.cwd(),env:s}}function jT(e){if(e.status==="missing")return`No hosted run config for ${e.runtime}. Run \`clawdi runtime init --non-interactive\` first.`;if(e.status==="disabled")return`Runtime ${e.runtime} is disabled by the current hosted runtime manifest.`;return`Invalid hosted run config for ${e.runtime} at ${e.path}: ${e.error}`}async function FS(e,t){jf(e.env);let n;try{n=Jvt(e)}catch(o){let s=o instanceof Error?o.message:String(o);console.error(y.red(`Failed to prepare ${e.runtime}: ${s}`)),process.exit(1)}let r=t(n.command,n.args,{cwd:n.cwd,env:n.env,stdio:"inherit"}),i=await YCe(r,e.runtime);process.exitCode=i}function Jvt(e,t={}){let n=e.env.CLAWDI_RUNTIME_USER?.trim(),r=Yvt(e.env,n);if(!n||n==="root")return{command:e.command,args:e.args,env:r,cwd:e.cwd};let i=Uc(n,r.HOME??`/home/${n}`,e.command,e.args,t);return{command:i.command,args:i.args,env:{...r,...i.env},cwd:e.cwd}}function Yvt(e,t){let n={...e};if(jf(n),t&&t!=="root")n.HOME||=`/home/${t}`;return n}function Xvt(e){if(!e)return 1;return Qvt[e]??1}function YCe(e,t){return new Promise((n)=>{let r=!1,i=(o)=>{if(r)return;r=!0,n(o)};e.once("error",(o)=>{console.error(y.red(`Failed to start ${t}: ${o.message}`)),i(1)}),e.once("exit",(o,s)=>{i(o??Xvt(s))})})}async function ewt(e,t,n,r){let i=QCe(t),o=await bP(i.map((s)=>s.ref),{project:r.project,projectId:r.project||r.agent?void 0:n?.projectId,agent:r.agent,allowConflicts:r.allowConflicts});if(console.log(y.green("Dry run: command will not be launched.")),console.log(y.gray(`  Command: ${e.join(" ")}`)),r.agent)console.log(y.gray(`  Agent context: ${r.agent}`));else if(n)console.log(y.gray(`  Project context: ${n.label}`));else console.log(y.gray("  Project context: default write project"));if(o.size===0){console.log(y.gray("  No clawdi references found in env input."));return}console.log(y.green(`  Would resolve ${o.size} clawdi reference${o.size===1?"":"s"}:`));for(let s of o.values()){let a=i.filter((l)=>l.ref.raw===s.reference).map((l)=>l.envKey).join(", ");console.log(y.gray(`    ${a}: ${twt(s)}`))}}function twt(e){let t=[e.vault_slug,e.section,e.item_name].filter(Boolean).join("/"),n=t?` ${t}`:"";return`${e.reference} -> ${e.source_alias}${n} (redacted)`}async function nwt(e,t){if(t.agent)return null;if(t.project){let r=await je(e.baseUrl,await e.getAccessToken(),t.project);return{projectId:r,label:await rwt(e,r).catch(()=>null)??t.project}}if(t.projectFolder===!1)return null;let n=Bm(process.cwd());if(!n)return null;return{projectId:n.link.project_id,label:n.link.project_label}}async function rwt(e,t){let r=(await Xn(e.baseUrl,await e.getAccessToken())).find((i)=>i.id===t);if(!r)return null;if(r.is_owner===!1&&r.owner_handle)return`@${r.owner_handle}/${r.slug}`;return r.slug}function ZCe(e){let t={};for(let n of e){let r=qvt(n,"utf8");for(let[i,o]of GCe(r))t[i]=o}return t}async function iwt(e,t){let n=QCe(e);if(n.length===0)return{};let r=await _P(n.map((s)=>s.ref),t),i=new Set(n.map((s)=>s.envKey)),o={};for(let[s,a]of Object.entries(e)){if(typeof a!=="string"||!i.has(s))continue;o[s]=SP(a,r)}return console.log(y.green(`✓ Resolved ${r.size} clawdi reference${r.size===1?"":"s"}`)),o}function QCe(e){let t=[];for(let[n,r]of Object.entries(e)){if(typeof r!=="string")continue;for(let i of Ule(r))t.push({envKey:n,ref:i})}return t}var Qvt;var XCe=v(()=>{Ae();u2();y2();Ee();Me();Jq();Sr();bI();er();pn();Dh();xs();Ut();_$();Ia();xe();Qvt={SIGHUP:129,SIGINT:130,SIGQUIT:131,SIGILL:132,SIGTRAP:133,SIGABRT:134,SIGBUS:135,SIGFPE:136,SIGKILL:137,SIGUSR1:138,SIGSEGV:139,SIGUSR2:140,SIGPIPE:141,SIGALRM:142,SIGTERM:143}});import{lstatSync as owt}from"node:fs";function tAe(e,t){if(t!==e.userHome||/\s/.test(t))throw Error("Files source root must be the canonical tenant home path");let n=process.env.CLAWDI_RUNTIME_USER?.trim()||"clawdi";if(n==="root"||n==="0")throw Error("Files requires a non-root tenant runtime user");let r={uid:Po(n),gid:wl(n)},i=owt(t);if(!i.isDirectory()||i.isSymbolicLink()||i.uid!==r.uid)throw Error("Files source root must be owned by the tenant runtime user");return r}var nAe=v(()=>{xe()});import{spawnSync as iAe}from"node:child_process";import{createHash as swt}from"node:crypto";import{chmodSync as Yq,chownSync as Qq,existsSync as oAe,lstatSync as vd,mkdirSync as awt,mkdtempSync as lwt,readdirSync as sAe,readFileSync as aAe,renameSync as cwt,rmSync as UT}from"node:fs";import{basename as uwt,join as yc}from"node:path";function HT(e){return e.companions?.filebrowser??null}function hc(e){return yc(e.fileBrowserInstallRoot,dwt)}function BT(e,t){return yc(hc(e),t.toLowerCase())}function FT(e,t){return yc(BT(e,t),lAe)}function Xq(e,t){if(t==="x64")return e.assets.amd64;if(t==="arm64")return e.assets.arm64;throw Error(`Files companion does not support runtime architecture ${t}`)}function dAe(e){try{let t=vd(e);if(!t.isFile()||t.isSymbolicLink())return null;return swt("sha256").update(aAe(e)).digest("hex")}catch{return null}}function zT(e,t){try{let n=vd(BT(e,t));if(!n.isDirectory()||n.isSymbolicLink())return!1;let r=oa();if(n.uid!==r.uid||n.gid!==r.gid||(n.mode&511)!==493)return!1}catch{return!1}try{let n=vd(FT(e,t)),r=oa();return n.isFile()&&!n.isSymbolicLink()&&n.uid===r.uid&&n.gid===r.gid&&(n.mode&511)===493&&dAe(FT(e,t))===t.toLowerCase()}catch{return!1}}function pwt(e,t){return A_({server:{listen:e.listen,port:e.port,baseURL:e.baseURL,database:yc(t.fileBrowserStateRoot,"filebrowser.db"),cacheDir:yc(t.fileBrowserStateRoot,"cache"),disableUpdateCheck:!0,disableWebDAV:!0,disablePreviews:!0,sources:[{path:e.sourceRoot,name:"Files",config:{defaultEnabled:!0,private:!0,rules:[{folderPath:"/",ignoreSymlinks:!0,viewable:!0}]}}]},frontend:{name:"Files",disableDefaultLinks:!0,disableUsedPercentage:!1},http:{trustedHeaders:[]},auth:{methods:{password:{enabled:!1,signup:!1},passkey:{enabled:!1},jwt:{enabled:!0,secret:e.auth.secret,algorithm:e.auth.algorithm,header:e.auth.header,userIdentifier:e.auth.userIdentifier,groupsClaim:e.auth.groupsClaim,userGroups:[e.auth.requiredGroup]}}},userDefaults:{sidebar:{sticky:!1},listing:{showHidden:!0},account:{lockPassword:!0,disableSettings:!1,disableUpdateNotifications:!0,loginMethod:"jwt",permissions:{admin:!1,api:!1,modify:!0,share:!1,realtime:!1,delete:!0,create:!0,download:!0}}}})}function oa(){if(bn())return{uid:0,gid:0};return{uid:typeof process.geteuid==="function"?process.geteuid():0,gid:typeof process.getegid==="function"?process.getegid():0}}function HS(e,t,n){if(!oAe(e))awt(e,{recursive:!0,mode:n});let r=vd(e);if(!r.isDirectory()||r.isSymbolicLink())throw Error(`Files companion managed path is not a trusted directory: ${e}`);Qq(e,t.uid,t.gid),Yq(e,n)}function mwt(e,t,n){let r=iAe("curl",["-fsSL","--proto","=https","--tlsv1.2","--retry","3","-o",t,e],{cwd:n.fileBrowserInstallRoot,encoding:"utf8",maxBuffer:65536,timeout:300000});if(r.status!==0){let i=[r.stderr,r.stdout].filter((o)=>typeof o==="string"&&o.trim().length>0).join(`
-`).trim().slice(-2000);throw Error(`Files companion download failed${i?`: ${i}`:""}`)}}function pAe(e,t,n,r){let i=BT(t,n.sha256);if(zT(t,n.sha256))return;UT(i,{recursive:!0,force:!0});let o=lwt(yc(hc(t),".staging-"));try{let s=yc(o,lAe);if(r.download)r.download(n.url,s);else mwt(n.url,s,t);let a=dAe(s);if(a!==n.sha256.toLowerCase())throw Error(`Files companion SHA256 mismatch: expected ${n.sha256.toLowerCase()}, got ${a??"unreadable"}`);if(Yq(s,493),Qq(s,oa().uid,oa().gid),Yq(o,493),e&&r.versionProbe){let l=r.versionProbe(s);if(!l.includes(e.version)||!l.includes(e.commit.slice(0,7)))throw Error("Files companion version probe did not match the pinned release")}cwt(o,i)}finally{UT(o,{recursive:!0,force:!0})}}function fwt(e){let t=[];for(let n of sAe(hc(e)).sort()){if(!n.startsWith(".staging-"))continue;let r=yc(hc(e),n),i=vd(r);if(!i.isDirectory()||i.isSymbolicLink())throw Error(`Files companion staging entry is not a trusted directory: ${n}`);UT(r,{recursive:!0}),t.push(r)}return t}function mAe(e,t){return Ue({version:e.version,commit:e.commit,assets:e.assets,config:t})}function rAe(e,t,n,r,i){if(!zT(t,n))return null;try{let o=oa(),s=vd(t.fileBrowserConfigRoot);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==o.uid||s.gid!==o.gid||(s.mode&511)!==cAe)return null;let a=vd(t.fileBrowserConfig);if(!a.isFile()||a.isSymbolicLink()||a.uid!==o.uid||a.gid!==i.gid||(a.mode&511)!==uAe)return null;if(aAe(t.fileBrowserConfig,"utf8")!==r)return null}catch{return null}return mAe(e,r)}function fAe(e,t,n={}){let r=HT(e);if(!r)return null;let i=Xq(r,n.arch??process.arch),o=pwt(r,t),s=mAe(r,o),a=(n.serviceIsolation??tAe)(t,r.sourceRoot),l=rAe(r,t,i.sha256,o,a),c=zT(t,i.sha256);if(HS(t.fileBrowserInstallRoot,oa(),493),HS(hc(t),oa(),493),HS(t.fileBrowserConfigRoot,oa(),cAe),fwt(t),l===null)pAe(r,t,i,n),ie(t.fileBrowserConfig,o,{mode:uAe,trustedRoot:t.runRoot}),Qq(t.fileBrowserConfig,oa().uid,a.gid);if((()=>rAe(r,t,i.sha256,o,a))()!==s)throw Error("Files companion candidate did not pass activation verification");return{activeBinary:FT(t,i.sha256),installed:!c}}function gAe(e,t){if(HS(e.fileBrowserInstallRoot,oa(),493),HS(hc(e),oa(),493),pAe(null,e,t,{}),!zT(e,t.sha256))throw Error("Files companion candidate did not pass verification")}function hAe(e,t){let n=HT(e);if(!n)return null;let r=Xq(n,process.arch);return{programKind:"file-browser",runtime:"files",service:null,command:FT(t,r.sha256),args:["-c",t.fileBrowserConfig],cwd:n.sourceRoot,env:{},resolvedSecretEnv:{}}}function yAe(e,t={}){let n=HT(e);if(!n)return;let r=`http://127.0.0.1:${n.port}${n.healthPath}`;if(!(t.probe?t.probe(r):iAe("curl",["-fsS","--retry","5","--retry-connrefused","--retry-delay","1","--max-time","2",r],{encoding:"utf8",timeout:12000}).status===0))throw Error(`Files companion readiness failed at ${r}`)}function vAe(e,t,n=process.arch){let r=HT(e);if(!r||!oAe(hc(t)))return[];let i=BT(t,Xq(r,n).sha256),o=[];for(let s of sAe(hc(t)).sort()){let a=yc(hc(t),s);if(a===i)continue;let l=vd(a);if(!l.isDirectory()||l.isSymbolicLink())throw Error(`Files companion candidate is not a trusted directory: ${uwt(a)}`);UT(a,{recursive:!0}),o.push(a)}return o}var lAe="filebrowser",dwt="candidates",cAe=448,uAe=288;var VT=v(()=>{Fa();ut();Pi();nAe();xe()});import{spawnSync as SAe}from"node:child_process";import{createHash as gwt}from"node:crypto";import{chmodSync as hwt,copyFileSync as kAe,mkdirSync as wAe,mkdtempSync as ywt,readdirSync as vwt,readFileSync as wwt,rmSync as _wt,statSync as CAe}from"node:fs";import{tmpdir as bwt}from"node:os";import{basename as AAe,join as Ty}from"node:path";function Jm(e,t,n={}){if(!e)return bAe(null,"mitmproxy artifact pin is missing");let r=e.sha256.toLowerCase();try{Cwt(e,n);let i=Ty(t.egressEngineMaintainedRoot,e.version,r),o=Ty(i,"mitmdump");if(Pwt(o))return _Ae(e,i,o);let s=ywt(Ty(bwt(),"clawdi-egress-engine-"));try{let a=Ty(s,AAe(new URL(e.url).pathname)||"mitmproxy.tar.gz");Awt(e.url,a,n);let l=Ewt(a);if(l!==r)throw Error(`mitmproxy checksum mismatch: expected ${r}, got ${l}`);let c=Ty(s,"extract");wAe(c,{recursive:!0,mode:493}),xwt(a,c);let u=Rwt(c);if(!u)throw Error("mitmproxy archive did not contain mitmdump");return wAe(i,{recursive:!0,mode:493}),kAe(u,o),hwt(o,493),_Ae(e,i,o)}finally{_wt(s,{recursive:!0,force:!0})}}catch(i){return bAe(e,kwt(i))}}function kwt(e){let t=e instanceof Error?e.message:String(e);if(Swt.has(t))return t;if(/^failed to download mitmproxy \(exit (?:[0-9]+|unknown)\)$/.test(t))return t;if(/^tar failed to extract mitmproxy \(exit (?:[0-9]+|unknown)\)$/.test(t))return t;if(/^mitmproxy checksum mismatch: expected [a-f0-9]{64}, got [a-f0-9]{64}$/.test(t))return t;return"mitmproxy preparation failed"}function Cwt(e,t){if(e.type!=="mitmproxy")throw Error("egress engine must use mitmproxy");if(!/^[A-Za-z0-9._-]+$/.test(e.version))throw Error("mitmproxy version contains unsafe characters");if(!/^[a-fA-F0-9]{64}$/.test(e.sha256))throw Error("mitmproxy sha256 must be 64 hex characters");let n=new URL(e.url);if(n.protocol==="file:"&&t.allowFileUrls)return;if(n.protocol!=="https:")throw Error("mitmproxy URL must use https");if(n.hostname!=="downloads.mitmproxy.org")throw Error("mitmproxy URL must use official mitmproxy downloads");let r=`/${e.version}/mitmproxy-${e.version}-linux-x86_64.tar.gz`;if(n.pathname!==r)throw Error("mitmproxy URL must use the pinned linux x86_64 release archive")}function Awt(e,t,n){let r=new URL(e);if(r.protocol==="file:"){kAe(r,t);return}let i=n.downloadCommand??"curl",o=SAe(i,["-fL","--proto","=https","-o",t,e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});if(o.status!==0)throw Error(`failed to download mitmproxy (exit ${o.status??"unknown"})`)}function xwt(e,t){let n=SAe("tar",["-xzf",e,"-C",t],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});if(n.status!==0)throw Error(`tar failed to extract mitmproxy (exit ${n.status??"unknown"})`)}function Rwt(e){for(let t of xAe(e)){if(AAe(t)!=="mitmdump")continue;if(CAe(t).isFile())return t}return null}function*xAe(e){for(let t of vwt(e,{withFileTypes:!0})){let n=Ty(e,t.name);if(t.isDirectory())yield*xAe(n);else yield n}}function Ewt(e){return gwt("sha256").update(wwt(e)).digest("hex")}function Pwt(e){try{let t=CAe(e);return t.isFile()&&(t.mode&73)!==0}catch{return!1}}function _Ae(e,t,n){return{status:"ready",version:e.version,url:e.url,sha256:e.sha256.toLowerCase(),cacheDir:t,binaryPath:n}}function bAe(e,t){return{status:"degraded",version:e?.version??null,url:e?.url??null,sha256:e?.sha256?.toLowerCase()??null,error:t}}var Swt;var qT=v(()=>{Swt=new Set(["egress engine must use mitmproxy","mitmproxy version contains unsafe characters","mitmproxy sha256 must be 64 hex characters","mitmproxy URL must use https","mitmproxy URL must use official mitmproxy downloads","mitmproxy URL must use the pinned linux x86_64 release archive","mitmproxy archive did not contain mitmdump"])});import{spawnSync as Iwt}from"node:child_process";import{randomBytes as Twt}from"node:crypto";import{join as Owt}from"node:path";function eW(e){return{gateway:{mode:"local",port:18789,bind:"lan",auth:{mode:"token",token:e},controlUi:{basePath:"/",dangerouslyAllowHostHeaderOriginFallback:!1}},channels:{},plugins:{entries:{}}}}function Dwt(e){let t=Wh("clawdi",1),n=Fs(e.userHome),r=Owt(n,"skills",t.id);Zf({targetDir:r,id:t.id,version:1,digest:t.identity.digest,manager:"hosted-manifest"},()=>Fv(t,(i)=>bt(()=>vx({home:e.userHome,workspaceRoot:n,sourceDir:i,targetDir:r}))),{verify:()=>OC(t,r,{exclude:Ew}),discard:()=>{throw Error("anonymous bundled Skill installation could not be verified")}})}function RAe(e,t){let n=br("openclaw",e.userHome),r=n&&Da(e.userHome,[n],ao.configMutation);if(!r)throw Error("OpenClaw config-mutation SDK export is unavailable");let i=Iwt("systemctl",["start",`user@${t.uid}.service`],{stdio:"ignore",timeout:60000});if(i.error||i.status!==0)throw Error("anonymous runtime user manager did not start");bb(r,JSON.stringify(eW(Twt(32).toString("base64url"))),e.userHome,e.userHome);let o=Zx(e,t,Yx(e));Si("systemctl",["--user","disable","--now",o],"",e.userHome,e.userHome,{runtimeUid:t.uid,runtimeGid:t.gid,timeoutMs:120000}),Dwt(e)}function WT(e,t){let r=ML(e.userHome,!0);r.refreshSdkExports({commandPath:t}),l0(r,"anonymous-preinstallation"),tB({context:r,revision:"anonymous-preinstallation",oauth:!1,cleanupManagedProvider:!0}),r.agentDirs.managed=p0(r,"anonymous-preinstallation"),d0(r,e.userHome,"anonymous-preinstallation")}var tW=v(()=>{iu();Fl();wx();Gh();Fc();ka();jn();m0();Qa();Ls();cu();xe()});import{spawnSync as $wt}from"node:child_process";import{createHash as EAe}from"node:crypto";import{lstatSync as nW,mkdirSync as Nwt,readdirSync as IAe,readFileSync as Mwt,readlinkSync as Lwt,renameSync as jwt,rmSync as Uwt,writeFileSync as Fwt}from"node:fs";import{isAbsolute as Hwt,join as BS}from"node:path";function zwt(e){return{HOME:e,USER:"clawdi",LOGNAME:"clawdi",PATH:`${e}/.local/bin:${Bwt}`,CI:"1",TERM:"dumb",LANG:"C.UTF-8",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",NPM_CONFIG_USERCONFIG:"/dev/null",NPM_CONFIG_GLOBALCONFIG:`${e}/.cache/anonymous-npm-globalrc`,NPM_CONFIG_REGISTRY:"https://registry.npmjs.org",NPM_CONFIG_CACHE:`${e}/.cache/npm`,UV_NO_CONFIG:"1",UV_CACHE_DIR:`${e}/.cache/uv`,XDG_CONFIG_HOME:`${e}/.config`,XDG_CACHE_HOME:`${e}/.cache`,PIP_CONFIG_FILE:"/dev/null",PYTHONNOUSERSITE:"1"}}function Vwt(e){let t=EAe("sha256");function n(r){let i=BS(e,r),o=nW(i),s=o.isSymbolicLink()?"link":o.isDirectory()?"directory":o.isFile()?"file":null;if(!s)throw Error("preinstallation contains a special file");if(t.update(JSON.stringify([r,s,o.mode&4095,o.uid,o.gid])),s==="link")t.update(JSON.stringify(Lwt(i)));if(s==="file")t.update(EAe("sha256").update(Mwt(i)).digest("hex"));if(s==="directory")for(let a of IAe(i).sort())n(BS(r,a))}return n(""),t.digest("hex")}function qwt(e,t){Fg(e),Fs(e.userHome);let n=Da(e.userHome,[t],ao.configMutation);if(n)Spe(t,e.userHome,n);WT(e,t),Hg(e)}function TAe(e,t={}){let n=GT.parse(e);if(process.platform!=="linux"||process.arch!==n.architecture)throw Error("preinstallation architecture mismatch");let r=t.home??"/home/clawdi",i=t.state??"/var/lib/clawdi";for(let _ of[r,i])if(nW(_).isSymbolicLink()||!nW(_).isDirectory()||IAe(_).length)throw Error("preinstallation requires empty anonymous home and state directories");let o=t.hosted?.paths;if(!o)throw Error("hosted runtime paths are required for anonymous preparation");let s={uid:t.uid??10001,gid:t.gid??10001},a={authority:"official",method:"official-installer",url:dM[n.runtime],home:r,args:pM(n.runtime,r)},l=bg(n.runtime,{enabled:!0,install:a,services:{}},r,o,s);if(l.status==="install_failed"||!l.commandPath||l.error)throw Error(l.error??`anonymous ${n.runtime} installation failed`);let c=l.commandPath,u=(_,S)=>{let C=Hf(s.uid,s.gid,c,_),k=$wt(C.command,C.args,{cwd:r,env:zwt(r),encoding:"utf8",timeout:S,maxBuffer:1048576});if(k.error||k.status!==0)throw Error(`anonymous runtime health check failed (exit ${k.status??"timeout"})`);return k.stdout.trim()},d=u(["--version"],30000);if(!d)throw Error("anonymous runtime health check returned no version");let p=kt(c);if(!p)throw Error("installed runtime executable identity is unavailable");let m=_M(n.runtime,r);if(!m)throw Error("installed runtime source identity is unavailable");let g={runtime:n.runtime,command:c,home:r,executableRevision:p,sourceIdentity:m,version:d,...n.runtime==="hermes"?{configPath:u(["config","path"],30000)}:{}};if(g.configPath!==void 0&&!Hwt(g.configPath))throw Error("installed Hermes config path is not absolute");if(n.fileBrowserAsset)gAe(o,n.fileBrowserAsset);if(n.egressEngine){let _=Jm(n.egressEngine,o);if(_.status!=="ready")throw Error(`egress engine preparation failed: ${_.error}`)}if(!kb(o))throw Error("Codex preparation is disabled");if(n.runtime==="openclaw")RAe(o,s),qwt(o,c);let f=ab({clawdiCli:{packageSpec:n.cliPackageSpec,registry:"https://registry.npmjs.org"}},o);if(f.status==="error"||f.status==="deferred"||f.status==="not_requested")throw Error(f.error??`anonymous CLI installation failed (${f.status})`);for(let _ of[".cache/npm",".cache/uv",".npm"])Uwt(BS(r,_),{recursive:!0,force:!0});let h={...n,preparedAt:new Date().toISOString(),health:d,probes:g,homeTreeSha256:Vwt(r)};Nwt(BS(i,"preinstallation"),{mode:448});let w=BS(i,"preinstallation/receipt.json");return Fwt(`${w}.tmp`,`${JSON.stringify(h)}
+`).trim().slice(-2000);throw Error(`Files companion download failed${i?`: ${i}`:""}`)}}function pAe(e,t,n,r){let i=BT(t,n.sha256);if(zT(t,n.sha256))return;UT(i,{recursive:!0,force:!0});let o=lwt(yc(hc(t),".staging-"));try{let s=yc(o,lAe);if(r.download)r.download(n.url,s);else mwt(n.url,s,t);let a=dAe(s);if(a!==n.sha256.toLowerCase())throw Error(`Files companion SHA256 mismatch: expected ${n.sha256.toLowerCase()}, got ${a??"unreadable"}`);if(Yq(s,493),Qq(s,oa().uid,oa().gid),Yq(o,493),e&&r.versionProbe){let l=r.versionProbe(s);if(!l.includes(e.version)||!l.includes(e.commit.slice(0,7)))throw Error("Files companion version probe did not match the pinned release")}cwt(o,i)}finally{UT(o,{recursive:!0,force:!0})}}function fwt(e){let t=[];for(let n of sAe(hc(e)).sort()){if(!n.startsWith(".staging-"))continue;let r=yc(hc(e),n),i=vd(r);if(!i.isDirectory()||i.isSymbolicLink())throw Error(`Files companion staging entry is not a trusted directory: ${n}`);UT(r,{recursive:!0}),t.push(r)}return t}function mAe(e,t){return Ue({version:e.version,commit:e.commit,assets:e.assets,config:t})}function rAe(e,t,n,r,i){if(!zT(t,n))return null;try{let o=oa(),s=vd(t.fileBrowserConfigRoot);if(!s.isDirectory()||s.isSymbolicLink()||s.uid!==o.uid||s.gid!==o.gid||(s.mode&511)!==cAe)return null;let a=vd(t.fileBrowserConfig);if(!a.isFile()||a.isSymbolicLink()||a.uid!==o.uid||a.gid!==i.gid||(a.mode&511)!==uAe)return null;if(aAe(t.fileBrowserConfig,"utf8")!==r)return null}catch{return null}return mAe(e,r)}function fAe(e,t,n={}){let r=HT(e);if(!r)return null;let i=Xq(r,n.arch??process.arch),o=pwt(r,t),s=mAe(r,o),a=(n.serviceIsolation??tAe)(t,r.sourceRoot),l=rAe(r,t,i.sha256,o,a),c=zT(t,i.sha256);if(HS(t.fileBrowserInstallRoot,oa(),493),HS(hc(t),oa(),493),HS(t.fileBrowserConfigRoot,oa(),cAe),fwt(t),l===null)pAe(r,t,i,n),ie(t.fileBrowserConfig,o,{mode:uAe,trustedRoot:t.runRoot}),Qq(t.fileBrowserConfig,oa().uid,a.gid);if((()=>rAe(r,t,i.sha256,o,a))()!==s)throw Error("Files companion candidate did not pass activation verification");return{activeBinary:FT(t,i.sha256),installed:!c}}function gAe(e,t){if(HS(e.fileBrowserInstallRoot,oa(),493),HS(hc(e),oa(),493),pAe(null,e,t,{}),!zT(e,t.sha256))throw Error("Files companion candidate did not pass verification")}function hAe(e,t){let n=HT(e);if(!n)return null;let r=Xq(n,process.arch);return{programKind:"file-browser",runtime:"files",service:null,command:FT(t,r.sha256),args:["-c",t.fileBrowserConfig],cwd:n.sourceRoot,env:{},resolvedSecretEnv:{}}}function yAe(e,t={}){let n=HT(e);if(!n)return;let r=`http://127.0.0.1:${n.port}${n.healthPath}`;if(!(t.probe?t.probe(r):iAe("curl",["-fsS","--retry","60","--retry-connrefused","--retry-delay","1","--retry-max-time","60","--max-time","2",r],{encoding:"utf8",timeout:70000}).status===0))throw Error(`Files companion readiness failed at ${r}`)}function vAe(e,t,n=process.arch){let r=HT(e);if(!r||!oAe(hc(t)))return[];let i=BT(t,Xq(r,n).sha256),o=[];for(let s of sAe(hc(t)).sort()){let a=yc(hc(t),s);if(a===i)continue;let l=vd(a);if(!l.isDirectory()||l.isSymbolicLink())throw Error(`Files companion candidate is not a trusted directory: ${uwt(a)}`);UT(a,{recursive:!0}),o.push(a)}return o}var lAe="filebrowser",dwt="candidates",cAe=448,uAe=288;var VT=v(()=>{Fa();ut();Pi();nAe();xe()});import{spawnSync as SAe}from"node:child_process";import{createHash as gwt}from"node:crypto";import{chmodSync as hwt,copyFileSync as kAe,mkdirSync as wAe,mkdtempSync as ywt,readdirSync as vwt,readFileSync as wwt,rmSync as _wt,statSync as CAe}from"node:fs";import{tmpdir as bwt}from"node:os";import{basename as AAe,join as Ty}from"node:path";function Jm(e,t,n={}){if(!e)return bAe(null,"mitmproxy artifact pin is missing");let r=e.sha256.toLowerCase();try{Cwt(e,n);let i=Ty(t.egressEngineMaintainedRoot,e.version,r),o=Ty(i,"mitmdump");if(Pwt(o))return _Ae(e,i,o);let s=ywt(Ty(bwt(),"clawdi-egress-engine-"));try{let a=Ty(s,AAe(new URL(e.url).pathname)||"mitmproxy.tar.gz");Awt(e.url,a,n);let l=Ewt(a);if(l!==r)throw Error(`mitmproxy checksum mismatch: expected ${r}, got ${l}`);let c=Ty(s,"extract");wAe(c,{recursive:!0,mode:493}),xwt(a,c);let u=Rwt(c);if(!u)throw Error("mitmproxy archive did not contain mitmdump");return wAe(i,{recursive:!0,mode:493}),kAe(u,o),hwt(o,493),_Ae(e,i,o)}finally{_wt(s,{recursive:!0,force:!0})}}catch(i){return bAe(e,kwt(i))}}function kwt(e){let t=e instanceof Error?e.message:String(e);if(Swt.has(t))return t;if(/^failed to download mitmproxy \(exit (?:[0-9]+|unknown)\)$/.test(t))return t;if(/^tar failed to extract mitmproxy \(exit (?:[0-9]+|unknown)\)$/.test(t))return t;if(/^mitmproxy checksum mismatch: expected [a-f0-9]{64}, got [a-f0-9]{64}$/.test(t))return t;return"mitmproxy preparation failed"}function Cwt(e,t){if(e.type!=="mitmproxy")throw Error("egress engine must use mitmproxy");if(!/^[A-Za-z0-9._-]+$/.test(e.version))throw Error("mitmproxy version contains unsafe characters");if(!/^[a-fA-F0-9]{64}$/.test(e.sha256))throw Error("mitmproxy sha256 must be 64 hex characters");let n=new URL(e.url);if(n.protocol==="file:"&&t.allowFileUrls)return;if(n.protocol!=="https:")throw Error("mitmproxy URL must use https");if(n.hostname!=="downloads.mitmproxy.org")throw Error("mitmproxy URL must use official mitmproxy downloads");let r=`/${e.version}/mitmproxy-${e.version}-linux-x86_64.tar.gz`;if(n.pathname!==r)throw Error("mitmproxy URL must use the pinned linux x86_64 release archive")}function Awt(e,t,n){let r=new URL(e);if(r.protocol==="file:"){kAe(r,t);return}let i=n.downloadCommand??"curl",o=SAe(i,["-fL","--proto","=https","-o",t,e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});if(o.status!==0)throw Error(`failed to download mitmproxy (exit ${o.status??"unknown"})`)}function xwt(e,t){let n=SAe("tar",["-xzf",e,"-C",t],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});if(n.status!==0)throw Error(`tar failed to extract mitmproxy (exit ${n.status??"unknown"})`)}function Rwt(e){for(let t of xAe(e)){if(AAe(t)!=="mitmdump")continue;if(CAe(t).isFile())return t}return null}function*xAe(e){for(let t of vwt(e,{withFileTypes:!0})){let n=Ty(e,t.name);if(t.isDirectory())yield*xAe(n);else yield n}}function Ewt(e){return gwt("sha256").update(wwt(e)).digest("hex")}function Pwt(e){try{let t=CAe(e);return t.isFile()&&(t.mode&73)!==0}catch{return!1}}function _Ae(e,t,n){return{status:"ready",version:e.version,url:e.url,sha256:e.sha256.toLowerCase(),cacheDir:t,binaryPath:n}}function bAe(e,t){return{status:"degraded",version:e?.version??null,url:e?.url??null,sha256:e?.sha256?.toLowerCase()??null,error:t}}var Swt;var qT=v(()=>{Swt=new Set(["egress engine must use mitmproxy","mitmproxy version contains unsafe characters","mitmproxy sha256 must be 64 hex characters","mitmproxy URL must use https","mitmproxy URL must use official mitmproxy downloads","mitmproxy URL must use the pinned linux x86_64 release archive","mitmproxy archive did not contain mitmdump"])});import{spawnSync as Iwt}from"node:child_process";import{randomBytes as Twt}from"node:crypto";import{join as Owt}from"node:path";function eW(e){return{gateway:{mode:"local",port:18789,bind:"lan",auth:{mode:"token",token:e},controlUi:{basePath:"/",dangerouslyAllowHostHeaderOriginFallback:!1}},channels:{},plugins:{entries:{}}}}function Dwt(e){let t=Wh("clawdi",1),n=Fs(e.userHome),r=Owt(n,"skills",t.id);Zf({targetDir:r,id:t.id,version:1,digest:t.identity.digest,manager:"hosted-manifest"},()=>Fv(t,(i)=>bt(()=>vx({home:e.userHome,workspaceRoot:n,sourceDir:i,targetDir:r}))),{verify:()=>OC(t,r,{exclude:Ew}),discard:()=>{throw Error("anonymous bundled Skill installation could not be verified")}})}function RAe(e,t){let n=br("openclaw",e.userHome),r=n&&Da(e.userHome,[n],ao.configMutation);if(!r)throw Error("OpenClaw config-mutation SDK export is unavailable");let i=Iwt("systemctl",["start",`user@${t.uid}.service`],{stdio:"ignore",timeout:60000});if(i.error||i.status!==0)throw Error("anonymous runtime user manager did not start");bb(r,JSON.stringify(eW(Twt(32).toString("base64url"))),e.userHome,e.userHome);let o=Zx(e,t,Yx(e));Si("systemctl",["--user","disable","--now",o],"",e.userHome,e.userHome,{runtimeUid:t.uid,runtimeGid:t.gid,timeoutMs:120000}),Dwt(e)}function WT(e,t){let r=ML(e.userHome,!0);r.refreshSdkExports({commandPath:t}),l0(r,"anonymous-preinstallation"),tB({context:r,revision:"anonymous-preinstallation",oauth:!1,cleanupManagedProvider:!0}),r.agentDirs.managed=p0(r,"anonymous-preinstallation"),d0(r,e.userHome,"anonymous-preinstallation")}var tW=v(()=>{iu();Fl();wx();Gh();Fc();ka();jn();m0();Qa();Ls();cu();xe()});import{spawnSync as $wt}from"node:child_process";import{createHash as EAe}from"node:crypto";import{lstatSync as nW,mkdirSync as Nwt,readdirSync as IAe,readFileSync as Mwt,readlinkSync as Lwt,renameSync as jwt,rmSync as Uwt,writeFileSync as Fwt}from"node:fs";import{isAbsolute as Hwt,join as BS}from"node:path";function zwt(e){return{HOME:e,USER:"clawdi",LOGNAME:"clawdi",PATH:`${e}/.local/bin:${Bwt}`,CI:"1",TERM:"dumb",LANG:"C.UTF-8",GIT_CONFIG_NOSYSTEM:"1",GIT_CONFIG_GLOBAL:"/dev/null",GIT_TERMINAL_PROMPT:"0",NPM_CONFIG_USERCONFIG:"/dev/null",NPM_CONFIG_GLOBALCONFIG:`${e}/.cache/anonymous-npm-globalrc`,NPM_CONFIG_REGISTRY:"https://registry.npmjs.org",NPM_CONFIG_CACHE:`${e}/.cache/npm`,UV_NO_CONFIG:"1",UV_CACHE_DIR:`${e}/.cache/uv`,XDG_CONFIG_HOME:`${e}/.config`,XDG_CACHE_HOME:`${e}/.cache`,PIP_CONFIG_FILE:"/dev/null",PYTHONNOUSERSITE:"1"}}function Vwt(e){let t=EAe("sha256");function n(r){let i=BS(e,r),o=nW(i),s=o.isSymbolicLink()?"link":o.isDirectory()?"directory":o.isFile()?"file":null;if(!s)throw Error("preinstallation contains a special file");if(t.update(JSON.stringify([r,s,o.mode&4095,o.uid,o.gid])),s==="link")t.update(JSON.stringify(Lwt(i)));if(s==="file")t.update(EAe("sha256").update(Mwt(i)).digest("hex"));if(s==="directory")for(let a of IAe(i).sort())n(BS(r,a))}return n(""),t.digest("hex")}function qwt(e,t){Fg(e),Fs(e.userHome);let n=Da(e.userHome,[t],ao.configMutation);if(n)Spe(t,e.userHome,n);WT(e,t),Hg(e)}function TAe(e,t={}){let n=GT.parse(e);if(process.platform!=="linux"||process.arch!==n.architecture)throw Error("preinstallation architecture mismatch");let r=t.home??"/home/clawdi",i=t.state??"/var/lib/clawdi";for(let _ of[r,i])if(nW(_).isSymbolicLink()||!nW(_).isDirectory()||IAe(_).length)throw Error("preinstallation requires empty anonymous home and state directories");let o=t.hosted?.paths;if(!o)throw Error("hosted runtime paths are required for anonymous preparation");let s={uid:t.uid??10001,gid:t.gid??10001},a={authority:"official",method:"official-installer",url:dM[n.runtime],home:r,args:pM(n.runtime,r)},l=bg(n.runtime,{enabled:!0,install:a,services:{}},r,o,s);if(l.status==="install_failed"||!l.commandPath||l.error)throw Error(l.error??`anonymous ${n.runtime} installation failed`);let c=l.commandPath,u=(_,S)=>{let C=Hf(s.uid,s.gid,c,_),k=$wt(C.command,C.args,{cwd:r,env:zwt(r),encoding:"utf8",timeout:S,maxBuffer:1048576});if(k.error||k.status!==0)throw Error(`anonymous runtime health check failed (exit ${k.status??"timeout"})`);return k.stdout.trim()},d=u(["--version"],30000);if(!d)throw Error("anonymous runtime health check returned no version");let p=kt(c);if(!p)throw Error("installed runtime executable identity is unavailable");let m=_M(n.runtime,r);if(!m)throw Error("installed runtime source identity is unavailable");let g={runtime:n.runtime,command:c,home:r,executableRevision:p,sourceIdentity:m,version:d,...n.runtime==="hermes"?{configPath:u(["config","path"],30000)}:{}};if(g.configPath!==void 0&&!Hwt(g.configPath))throw Error("installed Hermes config path is not absolute");if(n.fileBrowserAsset)gAe(o,n.fileBrowserAsset);if(n.egressEngine){let _=Jm(n.egressEngine,o);if(_.status!=="ready")throw Error(`egress engine preparation failed: ${_.error}`)}if(!kb(o))throw Error("Codex preparation is disabled");if(n.runtime==="openclaw")RAe(o,s),qwt(o,c);let f=ab({clawdiCli:{packageSpec:n.cliPackageSpec,registry:"https://registry.npmjs.org"}},o);if(f.status==="error"||f.status==="deferred"||f.status==="not_requested")throw Error(f.error??`anonymous CLI installation failed (${f.status})`);for(let _ of[".cache/npm",".cache/uv",".npm"])Uwt(BS(r,_),{recursive:!0,force:!0});let h={...n,preparedAt:new Date().toISOString(),health:d,probes:g,homeTreeSha256:Vwt(r)};Nwt(BS(i,"preinstallation"),{mode:448});let w=BS(i,"preinstallation/receipt.json");return Fwt(`${w}.tmp`,`${JSON.stringify(h)}
 `,{mode:256,flag:"wx"}),jwt(`${w}.tmp`,w),h}var PAe,GT,Bwt="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";var rW=v(()=>{Qe();iu();gm();WA();VT();Fl();oB();dp();jn();qT();tW();Qa();Rp();dx();xe();PAe=b().regex(/^[a-f0-9]{64}$/),GT=T({schemaVersion:M("clawdi.runtime-preinstallation.v1"),imageFingerprint:PAe,architecture:ce(["x64","arm64"]),cliPackageSpec:b().regex(/^clawdi@\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/),egressEngine:sp.strict().optional(),fileBrowserAsset:T({url:b().regex(/^https:\/\/github\.com\/gtsteffaniak\/filebrowser\/releases\/download\/[A-Za-z0-9._-]+\/linux-(?:amd64|arm64)-filebrowser$/),sha256:PAe}).strict().optional(),runtime:ce(["openclaw","hermes"])}).strict()});import{spawn as DAe,spawnSync as Wwt}from"node:child_process";import{chmodSync as Gwt,chownSync as Kwt,existsSync as iW,readFileSync as oW}from"node:fs";async function NAe(){if(dt()!=="hosted")throw Error("runtime sidecar is only available in hosted runtime mode");let e=Boolean(process.env.CLAWDI_EGRESS_ENV_FILE?.trim());if(!e)throw Error("runtime sidecar requires egress configuration.");let t=null;try{if(e)t=await Ywt(),console.error(`runtime sidecar egress module listening on 127.0.0.1:${t.port}`);l_t("runtime sidecar ready")}catch(i){throw t?.close(),i}let n=a_t().then(()=>({kind:"shutdown"})),r=t?.wait().then(()=>({kind:"egress-exit"}));try{await(r?Promise.race([n,r]):n)}finally{t?.close(),await r?.catch(()=>{return})}}async function Ywt(){let e=xC(process.env),t=Qwt(e),n=r_t(t),r=!1,i=!1,o=()=>{if(!r)return;try{a3(process.env)}catch(a){console.error(`transparent egress nft cleanup failed: ${Z(a)}`)}r=!1},s=()=>{if(i=!0,o(),!t.killed)t.kill("SIGTERM")};try{return await i_t("127.0.0.1",e.transparentPort,Zwt,()=>OAe(t)),await s_t(e.caCertPath,Jwt,()=>OAe(t)),sW(e),s3(process.env),r=!0,{port:e.transparentPort,close:s,wait:async()=>{let a=await n;if(o(),!i){let l=a.signal===null?`status ${a.code}`:`signal ${a.signal}`;throw Error(`egress engine exited unexpectedly with ${l}`)}}}}catch(a){throw s(),a}}function Qwt(e){if(!iW(e.engineBinaryPath))throw Error(`egress engine binary is missing: ${e.engineBinaryPath}`);if(!iW(e.addonPath))throw Error(`egress addon is missing: ${e.addonPath}`);let t=CC(process.env,{envFile:e.envFile,home:e.caDir}),n=e.engineBinaryPath,r=Xwt(e),i=bn()?n_t(e.egressUid,e.egressGid,n,r,t):t_t(e.egressUid,e.egressGid,n,r,t);return i.stdout?.pipe(process.stdout),i.stderr?.pipe(process.stderr),i}function Xwt(e){return["--mode","transparent","--listen-host","127.0.0.1","--listen-port",String(e.transparentPort),"--set",`confdir=${e.caDir}`,"--set","stream_large_bodies=1","--set","flow_detail=0","--set","termlog_verbosity=warn","-s",e.addonPath]}function e_t(e,t,n,r){if(e===void 0||t===void 0)throw Error("cannot verify non-root egress engine UID/GID on this platform");if(e===0||t===0)throw Error("egress engine identity must be non-root");if(e!==n||t!==r)throw Error(`current egress engine identity ${e}:${t} does not match configured ${n}:${r}`)}function t_t(e,t,n,r,i){return e_t(process.getuid?.(),process.getgid?.(),e,t),DAe(n,r,{env:i,stdio:["ignore","pipe","pipe"]})}function n_t(e,t,n,r,i){let o=Hf(e,t,n,r);return DAe(o.command,o.args,{env:i,stdio:["ignore","pipe","pipe"]})}function r_t(e){return new Promise((t)=>{e.once("exit",(n,r)=>t({code:n,signal:r}))})}function OAe(e){return e.exitCode!==null||e.signalCode!==null}function i_t(e,t,n,r){let i=Date.now();return new Promise((o,s)=>{let a=()=>{if(r()){s(Error(`egress engine exited before listening on ${e}:${t}`));return}if(o_t(e,t)){o();return}if(Date.now()-i>=n){s(Error(`timed out waiting for egress engine on ${e}:${t}`));return}setTimeout(a,$Ae)};a()})}function o_t(e,t){let n=t.toString(16).toUpperCase().padStart(4,"0"),r=e==="127.0.0.1"?new Set(["0100007F"]):new Set(["00000000","0100007F"]);try{for(let i of oW("/proc/net/tcp","utf-8").split(/\r?\n/).slice(1)){let o=i.trim().split(/\s+/),s=o[1]??"",a=o[3]??"",[l,c]=s.split(":");if(a==="0A"&&c===n&&l&&r.has(l))return!0}}catch{return!1}return!1}function s_t(e,t,n){let r=Date.now();return new Promise((i,o)=>{let s=()=>{if(n()){o(Error(`egress engine exited before writing ${e}`));return}if(iW(e)){i();return}if(Date.now()-r>=t){o(Error(`timed out waiting for ${e}`));return}setTimeout(s,$Ae)};s()})}function sW(e){if(e.systemCaBundle===As)throw Error("CLAWDI_EGRESS_SYSTEM_CA_BUNDLE must be a runtime-managed CA projection path");let t=oW(As,"utf-8"),n=oW(e.caCertPath,"utf-8");if(ie(e.systemCaBundle,`${t.trimEnd()}
 ${n.trimEnd()}
 `,{mode:416,dirMode:457}),bn())Kwt(e.systemCaBundle,0,e.runtimeGid);Gwt(e.systemCaBundle,416)}function a_t(){let e=process;return new Promise((t)=>{let n=()=>{e.removeListener("SIGTERM",n),e.removeListener("SIGINT",n),t()};e.once("SIGTERM",n),e.once("SIGINT",n)})}function l_t(e){if(!process.env.NOTIFY_SOCKET)return;Wwt("systemd-notify",["--ready",`--status=${e}`],{stdio:"ignore",env:process.env})}var Zwt=15000,Jwt=1e4,$Ae=100;var aW=v(()=>{ut();ht();xs();Ut();xe();Wd()});import{spawn as c_t,spawnSync as u_t}from"node:child_process";import{chmodSync as MAe,existsSync as LAe,readFileSync as lW}from"node:fs";import{basename as d_t,dirname as jAe,join as UAe}from"node:path";import{setTimeout as p_t}from"node:timers/promises";async function KT(e,t){let n=GT.passthrough().parse(JSON.parse(lW(UAe(e.serviceStateRoot,"preinstallation","receipt.json"),"utf8"))),r=sp.safeParse(n.egressEngine);if(!r.success)return;let i=Jm(r.data,e);if(i.status!=="ready")throw Error("prepared egress engine is unavailable");if(Hc(e,e.egressRoot,{mode:457}),MAe(e.egressRoot,457),Nh(e.egressCaDir),Hc(e,jAe(e.egressSystemCaFile),{mode:457}),MAe(jAe(e.egressSystemCaFile),457),!LAe(e.egressCaCert)){Oe(e,e.egressServiceBinary,lW(i.binaryPath),{mode:493});let o=Hf(_l(),Io(),e.egressServiceBinary,["--set",`confdir=${e.egressCaDir}`,"--set","server=false"]),s=c_t(o.command,o.args,{env:CC(process.env,{envFile:"",home:e.egressCaDir}),stdio:["ignore","ignore","pipe"]}),a="",l=!1;s.stderr?.on("data",(u)=>{a=(a+u.toString("utf8")).slice(-4096)}),s.once("error",()=>{l=!0});let c=new Promise((u)=>s.once("close",()=>u()));try{let u=Date.now()+m_t;while(!LAe(e.egressCaCert)){if(l||s.exitCode!==null||Date.now()>u)throw Error(`anonymous egress CA creation failed (${s.exitCode??"timeout"}): ${a.trim()}`);await p_t(1000)}}finally{if(s.exitCode===null)s.kill("SIGTERM");let u=setTimeout(()=>s.kill("SIGKILL"),2000);try{await c}finally{clearTimeout(u)}}}sW({systemCaBundle:e.egressSystemCaFile,caCertPath:e.egressCaCert,runtimeGid:t})}function ZT(e,t){ty(e);let n=GT.passthrough().parse(JSON.parse(lW(UAe(e.serviceStateRoot,"preinstallation","receipt.json"),"utf8"))),r=sp.safeParse(n.egressEngine);if(!r.success)return;let i=Jm(r.data,e);if(i.status!=="ready")throw Error("prepared egress engine is unavailable");let o=IP({schemaVersion:"clawdi.egressProfiles.v1",profiles:[]},e);Hc(e,e.managedSecretRoot,{mode:457}),bp(e.managedSecretRoot);let s=Ng(e);Oe(e,s,`{}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "clawdi",
-	"version": "0.16.22",
+	"version": "0.16.23",
 	"description": "The best home for all your AI agents. Run them in the cloud or connect your own—with their context and tools in one place.",
 	"license": "MIT",
 	"type": "module",