clawlabor 1.11.3 → 1.14.13

package/runtime/commands/command-upgrade.js

@@ -0,0 +1,40 @@
+function installerArgsFromFlags(flags) {
+  const args = [];
+  for (const flag of flags) {
+    args.push(`--${flag}`);
+  }
+  return args;
+}
+
+async function commandUpgrade(_options, deps, flags) {
+  const spawnSync = deps.spawnSync;
+  const install = spawnSync("npm", ["install", "-g", "clawlabor@latest"], {
+    encoding: "utf8",
+    stdio: "inherit",
+  });
+  if (install.status !== 0) {
+    throw new Error("Failed to upgrade ClawLabor with `npm install -g clawlabor@latest`");
+  }
+
+  const reinstallArgs = ["install", ...installerArgsFromFlags(flags)];
+  const reinstall = spawnSync("clawlabor", reinstallArgs, {
+    encoding: "utf8",
+    stdio: "inherit",
+  });
+  if (reinstall.status !== 0) {
+    return JSON.stringify({
+      action: "upgraded",
+      package: "clawlabor@latest",
+      skill_reinstall: "failed",
+      next: `Package upgrade succeeded. Refresh skill files manually with: clawlabor ${reinstallArgs.join(" ")}`,
+    });
+  }
+
+  return JSON.stringify({
+    action: "upgraded",
+    package: "clawlabor@latest",
+    skill_reinstall: "ok",
+  });
+}
+
+module.exports = { commandUpgrade };

package/runtime/commands/core.js

@@ -10,7 +10,19 @@ const { commandComplete } = require("./command-complete");
 const { commandConfirm } = require("./command-confirm");
 const { commandCredentialsPath } = require("./command-credentials-path");
 const { commandDeleteAttachment } = require("./command-delete-attachment");
+const { commandDownloadAttachment } = require("./command-download-attachment");
 const { commandDoctor } = require("./command-doctor");
+const {
+  commandLaborAgents,
+  commandLaborList,
+  commandHire,
+  commandLaborChat,
+  commandLaborPublish,
+  commandLaborStart,
+  commandLaborUnpublish,
+  commandLaborServe,
+  commandLaborCleanup,
+} = require("./command-labor");
 const { commandInspect } = require("./command-inspect");
 const { commandInstall } = require("./command-install");
 const { commandListAttachments } = require("./command-list-attachments");
@@ -30,6 +42,7 @@ const { commandStatus } = require("./command-status");
 const { commandUploadAttachment } = require("./command-upload-attachment");
 const { commandValidate } = require("./command-validate");
 const { commandWait } = require("./command-wait");
+const { commandUpgrade } = require("./command-upgrade");
 
 module.exports = {
   ...shared,
@@ -43,7 +56,10 @@ module.exports = {
   commandConfirm,
   commandCredentialsPath,
   commandDeleteAttachment,
+  commandDownloadAttachment,
   commandDoctor,
+  commandLaborAgents,
+  commandLaborList,
   commandInspect,
   commandInstall,
   commandListAttachments,
@@ -64,6 +80,14 @@ module.exports = {
   commandSolve,
   commandStatus,
   commandUploadAttachment,
+  commandUpgrade,
   commandValidate,
   commandWait,
+  commandHire,
+  commandLaborChat,
+  commandLaborPublish,
+  commandLaborStart,
+  commandLaborUnpublish,
+  commandLaborServe,
+  commandLaborCleanup,
 };

package/runtime/commands/labor-sandbox.js

@@ -0,0 +1,314 @@
+const { spawnSync } = require("node:child_process");
+
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
+}
+
+function dockerName(value) {
+  return String(value).replace(/[^a-zA-Z0-9_.-]/g, "-");
+}
+
+function runtimeStateMounts(runtime, hireId) {
+  const source = `clawlabor-hire-${dockerName(hireId)}-state`;
+  const targets = {
+    claude: ["/home/sandbox/.claude"],
+    codex: ["/home/sandbox/.codex"],
+    opencode: ["/home/sandbox/.local/share/opencode"],
+  }[runtime] || [];
+  return targets.map((target) => ({ source, target, type: "volume" }));
+}
+
+function runtimeStateInitCommand(mounts, { excludePaths = [] } = {}) {
+  const targets = [
+    "/home/sandbox/.local",
+    "/home/sandbox/.cache",
+    "/home/sandbox/.config",
+    ...mounts.map((m) => m.target),
+  ];
+  if (targets.length === 0) return "true";
+  const quoted = targets.map(shellQuote).join(" ");
+  const excludes = excludePaths.map((p) => `! -path ${shellQuote(p)}`).join(" ");
+  const recursiveChowns = targets
+    .map((target) => `find ${shellQuote(target)} -mindepth 1 ${excludes} -exec chown sandbox:sandbox {} +`)
+    .join(" && ");
+  // Docker creates named volumes as root-owned directories. The runtime agents
+  // run as the sandbox user, so normalize ownership before agent startup. Some
+  // credentials are mounted read-only under these dirs and must be skipped.
+  return `mkdir -p ${quoted} && chown sandbox:sandbox ${quoted} && ${recursiveChowns}`;
+}
+
+function sandboxUserCommand(command) {
+  const path = [
+    "/home/sandbox/.local/share/sandbox-clawlabor/bin",
+    "/usr/local/sbin",
+    "/usr/local/bin",
+    "/usr/sbin",
+    "/usr/bin",
+    "/sbin",
+    "/bin",
+  ].join(":");
+  return `setpriv --reuid=sandbox --regid=sandbox --init-groups env HOME=/home/sandbox PATH=${shellQuote(path)} ${command}`;
+}
+
+function dockerContainerRunning(name, deps = {}) {
+  return dockerContainerState(name, deps) === "running";
+}
+
+function dockerContainerState(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run("docker", ["inspect", "-f", "{{.State.Status}}", name], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "ignore"],
+  });
+  return result.status === 0 ? String(result.stdout || "").trim() : null;
+}
+
+function hireStateVolumeName(hireId) {
+  return `clawlabor-hire-${dockerName(hireId)}-state`;
+}
+
+function dockerVolumeExists(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run("docker", ["volume", "inspect", name], {
+    stdio: ["ignore", "ignore", "ignore"],
+  });
+  return result.status === 0;
+}
+
+function dockerRemoveVolume(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run("docker", ["volume", "rm", name], {
+    stdio: ["ignore", "ignore", "ignore"],
+  });
+  return result.status === 0;
+}
+
+function stopContainerByName(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  run("docker", ["stop", name], { stdio: "ignore" });
+}
+
+function removeContainerByName(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  run("docker", ["rm", "-f", name], { stdio: "ignore" });
+}
+
+function startContainerByName(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  return run("docker", ["start", name], { stdio: "ignore" }).status === 0;
+}
+
+function restartContainerByName(name, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  return run("docker", ["restart", name], { stdio: "ignore" }).status === 0;
+}
+
+function terminateChild(child, signal = "SIGTERM") {
+  if (!child || typeof child.kill !== "function") return;
+  try {
+    child.kill(signal);
+  } catch (_err) { /* noop */ }
+}
+
+function terminateProcessGroup(child, signal = "SIGTERM", deps = {}) {
+  if (!child) return;
+  if (child.pid) {
+    try {
+      const killProcessGroup = deps.killProcessGroup || process.kill;
+      killProcessGroup(-child.pid, signal);
+      return;
+    } catch (_err) { /* fall back to child kill */ }
+  }
+  terminateChild(child, signal);
+}
+
+function forceKillProcess(child, timeoutMs = 5000, deps = {}) {
+  if (!child || child.exitCode !== null) return Promise.resolve();
+  if (typeof child.once !== "function") return Promise.resolve();
+  return new Promise((resolve) => {
+    let done = false;
+    function finish() {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      resolve();
+    }
+    const timer = setTimeout(() => {
+      terminateProcessGroup(child, "SIGKILL", deps);
+      killTimer = setTimeout(finish, Math.min(1000, timeoutMs));
+    }, timeoutMs);
+    let killTimer = null;
+    child.once("exit", finish);
+  });
+}
+
+function dockerImagePresent(image, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run("docker", ["image", "inspect", image], {
+    stdio: ["ignore", "ignore", "ignore"],
+  });
+  return result.status === 0;
+}
+
+function dockerPullImage(image, deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run("docker", ["pull", image], {
+    stdio: ["ignore", "inherit", "inherit"],
+  });
+  return result.status === 0;
+}
+
+function ensureDockerImage(image, deps = {}, stdout = () => {}, { logPrefix = "[6/7]" } = {}) {
+  if (dockerImagePresent(image, deps)) return;
+  stdout(`${logPrefix} Pulling sandbox image ${image}...`);
+  if (!dockerPullImage(image, deps)) {
+    throw new Error(`Docker image ${image} is not available locally and docker pull failed`);
+  }
+}
+
+async function removeContainerByNameAsync({ spawn, containerName, timeoutMs = 1500 }) {
+  try {
+    await new Promise((resolve) => {
+      const dockerRm = spawn("docker", ["rm", "-f", containerName], { stdio: "ignore" });
+      if (dockerRm && typeof dockerRm.once === "function") {
+        dockerRm.once("exit", () => resolve());
+        setTimeout(resolve, timeoutMs);
+      } else {
+        resolve();
+      }
+    });
+  } catch (_err) {
+    /* noop */
+  }
+}
+
+function clearPortOccupant({ port, containerName, stdout }) {
+  try {
+    const { execSync } = require("child_process");
+    const occupied = execSync(
+      `docker ps --filter "publish=${port}" --format '{{.Names}}'`,
+      { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+    ).trim();
+    if (occupied && occupied !== containerName) {
+      execSync(`docker rm -f ${occupied}`, { stdio: "ignore" });
+      stdout(`Stopped existing container ${occupied} occupying port ${port}`);
+    }
+  } catch (_err) {
+    /* best effort - if the command fails, let docker run surface the real error */
+  }
+}
+
+function startSandboxContainer({
+  spawn,
+  stdout,
+  image,
+  port,
+  runtime,
+  hireId,
+  containerName,
+  sandboxToken,
+  sandboxCreds,
+  runtimeEnv,
+  logPrefix = "[6/7]",
+}) {
+  clearPortOccupant({ port, containerName, stdout });
+  stdout(`${logPrefix} Starting sandbox container (${image})...`);
+  const credEnvFlags = Object.keys(sandboxCreds.env).flatMap((envName) => ["-e", envName]);
+  const stateMounts = runtimeStateMounts(runtime, hireId);
+  const readOnlyCredPaths = sandboxCreds.mounts.filter((m) => m.ro).map((m) => m.container);
+  const stateMountFlags = stateMounts.flatMap((m) => [
+    "--mount", `type=${m.type},source=${m.source},target=${m.target}`,
+  ]);
+  const credMountFlags = sandboxCreds.mounts.flatMap((m) => ["-v", `${m.host}:${m.container}${m.ro ? ":ro" : ""}`]);
+  return spawn(
+    "docker",
+    [
+      "run", "-d", "--name", containerName, "-p", `127.0.0.1:${port}:2468`,
+      // Start as root only long enough to repair fresh volume ownership;
+      // agent install and the long-running server run as sandbox below.
+      "-u", "root",
+      "-e", "CLAWLABOR_AGENT_RUNTIME",
+      ...credEnvFlags,
+      ...stateMountFlags,
+      ...credMountFlags,
+      "--entrypoint", "sh",
+      image,
+      "-lc",
+      [
+        runtimeStateInitCommand(stateMounts, { excludePaths: readOnlyCredPaths }),
+        sandboxUserCommand(`sandbox-clawlabor install-agent ${shellQuote(runtime)}`),
+        runtimeStateInitCommand(stateMounts, { excludePaths: readOnlyCredPaths }),
+        `exec ${sandboxUserCommand(`sandbox-clawlabor server --token=${shellQuote(sandboxToken)} --host 0.0.0.0 --port 2468`)}`,
+      ].join(" && "),
+    ],
+    { stdio: "ignore", env: runtimeEnv },
+  );
+}
+
+function dockerListHireStateVolumes(deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run(
+    "docker",
+    ["volume", "ls", "--filter", "name=clawlabor-hire-", "--format", "{{.Name}}"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+  );
+  if (result.status !== 0) return [];
+  return String(result.stdout || "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith("clawlabor-hire-") && line.endsWith("-state"));
+}
+
+function dockerListHireContainers(deps = {}) {
+  const run = deps.spawnSync || spawnSync;
+  const result = run(
+    "docker",
+    ["ps", "-a", "--filter", "name=clawlabor-hire-", "--format", "{{.Names}}"],
+    { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] },
+  );
+  if (result.status !== 0) return [];
+  return String(result.stdout || "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line.startsWith("clawlabor-hire-"));
+}
+
+function hireIdFromVolumeName(volumeName) {
+  const m = /^clawlabor-hire-(.+)-state$/.exec(volumeName);
+  return m ? m[1] : null;
+}
+
+function hireIdFromContainerName(containerName) {
+  const m = /^clawlabor-hire-(.+)$/.exec(containerName);
+  return m ? m[1] : null;
+}
+
+module.exports = {
+  dockerName,
+  shellQuote,
+  runtimeStateMounts,
+  runtimeStateInitCommand,
+  sandboxUserCommand,
+  dockerContainerRunning,
+  dockerContainerState,
+  hireStateVolumeName,
+  dockerVolumeExists,
+  dockerRemoveVolume,
+  stopContainerByName,
+  removeContainerByName,
+  startContainerByName,
+  restartContainerByName,
+  terminateChild,
+  terminateProcessGroup,
+  forceKillProcess,
+  dockerImagePresent,
+  dockerPullImage,
+  ensureDockerImage,
+  removeContainerByNameAsync,
+  startSandboxContainer,
+  dockerListHireContainers,
+  dockerListHireStateVolumes,
+  hireIdFromVolumeName,
+  hireIdFromContainerName,
+};

package/runtime/commands/labor-tunnel.js

@@ -0,0 +1,250 @@
+const dns = require("node:dns").promises;
+const https = require("node:https");
+
+const CLOUDFLARE_RESOLVERS = ["1.1.1.1", "1.0.0.1"];
+const TUNNEL_LOG_LINE_LIMIT = 12;
+const TUNNEL_AVAILABILITY_TIMEOUT_MS = 180_000;
+const DEFAULT_CLOUDFLARED_PROTOCOL = "http2";
+
+function tunnelAvailabilityTimeoutSeconds(timeoutMs = TUNNEL_AVAILABILITY_TIMEOUT_MS) {
+  return Math.ceil(timeoutMs / 1000);
+}
+
+async function resolveViaCloudflare(hostname) {
+  const previous = dns.getServers();
+  try {
+    dns.setServers(CLOUDFLARE_RESOLVERS);
+    const [v4, v6] = await Promise.allSettled([
+      dns.resolve4(hostname),
+      dns.resolve6(hostname),
+    ]);
+    return [
+      ...(v4.status === "fulfilled" ? v4.value : []),
+      ...(v6.status === "fulfilled" ? v6.value : []),
+    ];
+  } finally {
+    try { dns.setServers(previous); } catch (_err) { /* noop */ }
+  }
+}
+
+function httpsGetViaResolvedIp(url, token, ip, timeoutMs) {
+  return new Promise((resolve) => {
+    const parsed = new URL(url);
+    const family = ip.includes(":") ? 6 : 4;
+    const req = https.request(
+      {
+        protocol: parsed.protocol,
+        hostname: ip,
+        family,
+        path: `${parsed.pathname}${parsed.search}`,
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Host: parsed.hostname,
+        },
+        servername: parsed.hostname,
+        timeout: timeoutMs,
+      },
+      (resp) => {
+        resp.resume();
+        resp.once("end", () => resolve(resp.statusCode >= 200 && resp.statusCode < 300));
+      },
+    );
+    req.once("timeout", () => req.destroy(new Error("health probe timeout")));
+    req.once("error", () => resolve(false));
+    req.end();
+  });
+}
+
+async function probePublicHealthWithDnsFallback(url, token, timeoutMs) {
+  try {
+    const ips = await resolveViaCloudflare(new URL(url).hostname);
+    for (const ip of ips) {
+      if (await httpsGetViaResolvedIp(url, token, ip, timeoutMs)) return true;
+    }
+  } catch (_err) {
+    return false;
+  }
+  return false;
+}
+
+function appendLogLines(buffer, chunk, limit = TUNNEL_LOG_LINE_LIMIT) {
+  const lines = String(chunk || "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  buffer.push(...lines);
+  if (buffer.length > limit) {
+    buffer.splice(0, buffer.length - limit);
+  }
+}
+
+function cloudflaredArgs(tunnelToken, protocol = DEFAULT_CLOUDFLARED_PROTOCOL) {
+  const args = ["tunnel", "--no-autoupdate", "--grace-period=3s"];
+  if (protocol) args.push("--protocol", protocol);
+  args.push("run", "--token", tunnelToken);
+  return args;
+}
+
+function formatRecentLogs(buffer) {
+  if (!buffer.length) return "";
+  return `\nRecent cloudflared logs:\n${buffer.map((line) => `   ${line}`).join("\n")}\n`;
+}
+
+function createTunnelAvailabilityState({
+  now,
+  publicHealthUrl,
+  localHealthUrl,
+  tunnelState,
+  tunnelLogs,
+  timeoutMs = TUNNEL_AVAILABILITY_TIMEOUT_MS,
+}) {
+  let unavailableSince = null;
+  return {
+    markUnavailable() {
+      if (unavailableSince === null) unavailableSince = now();
+    },
+    reset() {
+      unavailableSince = null;
+    },
+    elapsedMs() {
+      return unavailableSince === null ? 0 : now() - unavailableSince;
+    },
+    withinGracePeriod() {
+      return unavailableSince !== null && this.elapsedMs() < timeoutMs;
+    },
+    remainingSeconds() {
+      return Math.max(0, Math.ceil((timeoutMs - this.elapsedMs()) / 1000));
+    },
+    failurePayload() {
+      return {
+        reason: "tunnel_unreachable",
+        detail: `Public tunnel health check failed for ${publicHealthUrl}`,
+        public_health_url: publicHealthUrl,
+        local_health_url: localHealthUrl,
+        tunnel_unavailable_since_ms: this.elapsedMs(),
+        tunnel_exit_summary: tunnelState.exitSummary,
+        recent_cloudflared_logs: tunnelLogs.slice(-TUNNEL_LOG_LINE_LIMIT),
+      };
+    },
+  };
+}
+
+function formatTunnelUnavailableWarning({ publicHealthUrl, laborId, tunnelState, tunnelLogs }) {
+  const tunnelStatus = tunnelState.exited && tunnelState.exitSummary
+    ? `\n   ${tunnelState.exitSummary}.`
+    : "";
+  return (
+    `\n⚠️  Sandbox is healthy locally but unreachable over the public tunnel ` +
+    `(${publicHealthUrl}). Buyers can't reach it, so the platform will mark this ` +
+    `hire sandbox OFFLINE.${tunnelStatus}\n   The Cloudflare tunnel likely dropped (free-plan tunnels often ` +
+    `exit with error 1033). To recover: stop this process (Ctrl+C) and re-run\n` +
+    `     clawlabor labor-serve --labor ${laborId}\n` +
+    formatRecentLogs(tunnelLogs)
+  );
+}
+
+function startCloudflareTunnel({
+  spawn,
+  stdout,
+  tunnelToken,
+  cleanedUpRef,
+  isStopRequested,
+  stopTunnel,
+  logPrefix = "[7/7]",
+}) {
+  stdout(`${logPrefix} Starting Cloudflare tunnel...`);
+  const logs = [];
+  const state = { exited: false, exitSummary: null, protocol: DEFAULT_CLOUDFLARED_PROTOCOL };
+  let currentTunnel = null;
+
+  function spawnTunnel(protocol = DEFAULT_CLOUDFLARED_PROTOCOL) {
+    const tunnel = spawn(
+      "cloudflared",
+      cloudflaredArgs(tunnelToken, protocol),
+      { stdio: ["ignore", "pipe", "pipe"], detached: true },
+    );
+    currentTunnel = tunnel;
+    state.exited = false;
+    state.exitSummary = null;
+    state.protocol = protocol || "auto";
+    return tunnel;
+  }
+
+  function attachHandlers(tunnel) {
+    tunnel.stdout?.on("data", (chunk) => appendLogLines(logs, chunk));
+    tunnel.stderr?.on("data", (chunk) => appendLogLines(logs, chunk));
+    if (!tunnel.stdout || !tunnel.stderr || typeof tunnel.once !== "function") return;
+    tunnel.once("error", (err) => {
+      state.exited = true;
+      state.exitSummary = `cloudflared failed to start: ${(err && err.message) || err || "unknown error"}`;
+      if (!cleanedUpRef.value && !isStopRequested()) {
+        stdout(`\n⚠️  ${state.exitSummary}${formatRecentLogs(logs)}`);
+      }
+    });
+    tunnel.once("exit", (code, signal) => {
+      const isCurrent = currentTunnel === tunnel;
+      if (!isCurrent) {
+        return;
+      }
+      state.exited = true;
+      state.exitSummary = `cloudflared exited${code === null || code === undefined ? "" : ` with code ${code}`}${signal ? ` (${signal})` : ""}`;
+      if (!cleanedUpRef.value && !isStopRequested()) {
+        stdout(`\n⚠️  ${state.exitSummary}${formatRecentLogs(logs)}`);
+      }
+    });
+  }
+
+  attachHandlers(spawnTunnel());
+
+  async function restart(reason = "public tunnel unreachable") {
+    const previousTunnel = currentTunnel;
+    if (stopTunnel) {
+      await stopTunnel(previousTunnel);
+    } else if (previousTunnel && typeof previousTunnel.kill === "function") {
+      try { previousTunnel.kill("SIGTERM"); } catch (_err) { /* noop */ }
+    }
+    if (cleanedUpRef.value || isStopRequested()) return currentTunnel;
+    stdout(`Restarting Cloudflare tunnel (${reason})...`);
+    const nextTunnel = spawnTunnel(state.protocol === "auto" ? DEFAULT_CLOUDFLARED_PROTOCOL : state.protocol);
+    attachHandlers(nextTunnel);
+    return nextTunnel;
+  }
+
+  return { tunnel: currentTunnel, currentTunnel: () => currentTunnel, logs, state, restart };
+}
+
+function createSandboxHealthProbe({ deps, sandboxToken, timeoutMs }) {
+  return async function probeHealth(url, { publicTunnel = false } = {}) {
+    try {
+      const resp = await deps.withTimeout(
+        deps.fetch(url, { headers: { Authorization: `Bearer ${sandboxToken}` } }),
+        timeoutMs,
+        "health probe",
+      );
+      return !!resp.ok;
+    } catch (_err) {
+      if (!publicTunnel) return false;
+      const fallbackProbe = deps.probePublicHealthWithDnsFallback ||
+        ((probeUrl, token) => probePublicHealthWithDnsFallback(probeUrl, token, timeoutMs));
+      try {
+        return await fallbackProbe(url, sandboxToken);
+      } catch (_fallbackErr) {
+        return false;
+      }
+    }
+  };
+}
+
+module.exports = {
+  TUNNEL_AVAILABILITY_TIMEOUT_MS,
+  TUNNEL_LOG_LINE_LIMIT,
+  tunnelAvailabilityTimeoutSeconds,
+  createTunnelAvailabilityState,
+  createSandboxHealthProbe,
+  formatRecentLogs,
+  formatTunnelUnavailableWarning,
+  cloudflaredArgs,
+  probePublicHealthWithDnsFallback,
+  startCloudflareTunnel,
+};

package/runtime/http.js

@@ -5,8 +5,9 @@ const path = require("path");
 
 const DEFAULT_API_BASE = "https://www.clawlabor.com/api";
 
-function apiBase(_env) {
-  return DEFAULT_API_BASE;
+function apiBase(env) {
+  // CLAWLABOR_API_BASE overrides for local/dev (e.g. http://localhost:8000/api).
+  return (env && env.CLAWLABOR_API_BASE) || DEFAULT_API_BASE;
 }
 
 function readCredentialsFile(env) {
@@ -40,6 +41,10 @@ function resolveApiKey(env) {
   return env.CLAWLABOR_API_KEY || readCredentialsFile(env);
 }
 
+function envWithApiKey(env, apiKey) {
+  return { ...env, CLAWLABOR_API_KEY: apiKey };
+}
+
 function credentialState(env) {
   const credentialsPath = credentialsFilePath(env);
   const fileExists = fs.existsSync(credentialsPath);
@@ -211,5 +216,6 @@ module.exports = {
   requestJsonNoAuth,
   requestMultipart,
   resolveApiKey,
+  envWithApiKey,
   writeCredentialsFile,
 };