controlclaw 0.0.0-stage → 0.9.4

package/dist/index.js

@@ -0,0 +1,2501 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createInterface } from "readline";
+import { parseArgs } from "util";
+
+// src/commands.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { hostname } from "os";
+import { join as join8 } from "path";
+
+// src/agent.ts
+import { join } from "path";
+var UNIT = "controlclaw-agent.service";
+var AGENT_PORT = 3100;
+function agentPaths(sys, user) {
+  const system = sys.euid === 0;
+  const home = sys.env.HOME ?? user.home;
+  return {
+    bin: system ? "/usr/local/bin/controlclaw-vm-agent" : join(home, ".local/bin/controlclaw-vm-agent"),
+    config: system ? "/etc/controlclaw/agent.json" : join(home, ".config/controlclaw/agent.json"),
+    unit: system ? join("/etc/systemd/system", UNIT) : join(home, ".config/systemd/user", UNIT),
+    state: join(user.home, ".local/state/controlclaw"),
+    system
+  };
+}
+function agentConfig(o, state) {
+  const file = {
+    mode: "unmanaged",
+    listen: o.listen ?? `127.0.0.1:${AGENT_PORT}`,
+    state_dir: state,
+    ...o.agentId ? { agent_id: o.agentId } : {},
+    firewall: {
+      url: o.firewallUrl,
+      public_key: o.firewallKey,
+      // The firewall signs its tokens for the address it dials (`h`): checked once there is one.
+      ...o.listen && o.agentId ? { hostnames: [hostOf(o.listen)] } : {},
+      ...o.allowFrom?.length ? { allow_from: o.allowFrom } : {},
+      ...o.gate ? { gate: o.gate } : {}
+    },
+    openclaw: o.container ? { runs: "docker", container: o.container } : {}
+  };
+  return `${JSON.stringify(file, null, 2)}
+`;
+}
+function hostOf(listen) {
+  return listen.slice(0, listen.lastIndexOf(":"));
+}
+function agentUnit(o, p) {
+  const lines = [
+    "# Written by controlclaw connect; removed by controlclaw disconnect.",
+    "[Unit]",
+    "Description=ControlClaw agent (unmanaged)",
+    `After=network-online.target${o.after ? ` ${o.after}` : ""}`,
+    "",
+    "[Service]"
+  ];
+  if (p.system) {
+    lines.push(`User=${o.user.name}`, `Environment=HOME=${o.user.home}`, `Environment=XDG_RUNTIME_DIR=/run/user/${o.user.uid}`);
+  }
+  lines.push(
+    `Environment=CC_AGENT_CONFIG=${p.config}`,
+    `ExecStart=${p.bin}`,
+    "Restart=always",
+    "RestartSec=5",
+    "",
+    "[Install]",
+    `WantedBy=${p.system ? "multi-user.target" : "default.target"}`,
+    ""
+  );
+  return lines.join("\n");
+}
+async function installAgent(sys, rec, o) {
+  const p = agentPaths(sys, o.user);
+  const ctl = p.system ? ["systemctl"] : ["systemctl", "--user"];
+  if (sys.realpath(o.binary) === sys.realpath(p.bin)) {
+  } else {
+    if (sys.exists(p.bin)) {
+      const aside = `${p.bin}.before-controlclaw`;
+      if (sys.exists(aside)) throw new Error(`${aside} exists already: put it back or remove it, then connect again`);
+      const mv = await sys.run(["mv", "-f", p.bin, aside]);
+      if (mv.code !== 0) throw new Error(`could not set ${p.bin} aside: ${mv.stderr.trim()}`);
+      rec.onUndo("put back the vm-agent binary that was there", [["mv", "-f", aside, p.bin]]);
+    }
+    rec.onUndo("remove the vm-agent", [["rm", "-f", p.bin]]);
+    const cp = await sys.run(["install", "-D", "-m", "0755", o.binary, p.bin]);
+    if (cp.code !== 0) throw new Error(`could not install the vm-agent: ${cp.stderr.trim()}`);
+  }
+  rec.onUndo("remove the agent's state", [["rm", "-rf", "--", p.state]], sys.euid === 0 && o.user.uid !== 0 ? { user: o.user } : {});
+  if (o.keypair) {
+    await rec.file(join(p.state, "vm_private_key.pem"), o.keypair.privatePem, { mode: 384, owner: o.user });
+    await rec.file(join(p.state, "vm_public_key.pem"), o.keypair.publicPem, { mode: 420, owner: o.user });
+  }
+  await rec.file(p.config, agentConfig(o, p.state));
+  rec.onUndo("reload systemd", [[...ctl, "daemon-reload"]]);
+  await rec.file(p.unit, agentUnit(o, p));
+  rec.onUndo("stop the vm-agent", [[...ctl, "disable", "--now", UNIT]]);
+  await sys.run([...ctl, "daemon-reload"]);
+  const up2 = await sys.run([...ctl, "enable", "--now", UNIT]);
+  if (up2.code !== 0) throw new Error(`could not start the vm-agent: ${up2.stderr.trim()}`);
+  return p;
+}
+
+// src/ca.ts
+import { join as join2 } from "path";
+
+// src/sys.ts
+import { spawn } from "child_process";
+import { chmodSync, chownSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { dirname } from "path";
+var DEFAULT_TIMEOUT = 12e4;
+function asUser(sys, user, argv, env = {}) {
+  const vars = { ...env };
+  if (user) {
+    vars.HOME = user.home;
+    vars.XDG_RUNTIME_DIR = `/run/user/${user.uid}`;
+  }
+  const pairs = Object.entries(vars).map(([k, v]) => `${k}=${v}`);
+  const withEnv = pairs.length ? ["env", ...pairs, ...argv] : argv;
+  if (user && sys.euid === 0 && user.uid !== 0) return ["runuser", "-u", user.name, "--", ...withEnv];
+  return withEnv;
+}
+function realSys() {
+  const euid = process.geteuid?.() ?? -1;
+  const sys = {
+    euid,
+    env: process.env,
+    run(argv, opts = {}) {
+      const full = asUser(sys, opts.user, argv, opts.env);
+      return new Promise((resolve) => {
+        const [cmd, ...args] = full;
+        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        const timer = setTimeout(() => child.kill("SIGKILL"), opts.timeoutMs ?? DEFAULT_TIMEOUT);
+        child.stdout.on("data", (d) => stdout += d.toString());
+        child.stderr.on("data", (d) => stderr += d.toString());
+        child.on("error", (e) => {
+          clearTimeout(timer);
+          resolve({ code: 127, stdout, stderr: stderr + e.message });
+        });
+        child.on("close", (code) => {
+          clearTimeout(timer);
+          resolve({ code: code ?? 1, stdout, stderr });
+        });
+        child.stdin.on("error", () => {
+        });
+        child.stdin.end(opts.input ?? "");
+      });
+    },
+    read(path) {
+      try {
+        return readFileSync(path, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    write(path, data, opts = {}) {
+      const made = [];
+      for (let d = dirname(path); d !== "/" && !existsSync(d); d = dirname(d)) made.push(d);
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, data, { mode: opts.mode ?? 420 });
+      chmodSync(path, opts.mode ?? 420);
+      if (opts.owner && euid === 0) {
+        for (const d of made) chownSync(d, opts.owner.uid, opts.owner.gid);
+        chownSync(path, opts.owner.uid, opts.owner.gid);
+      }
+    },
+    remove(path) {
+      rmSync(path, { force: true, recursive: true });
+    },
+    stat(path) {
+      try {
+        const s = statSync(path);
+        return { mode: s.mode & 4095, uid: s.uid, gid: s.gid };
+      } catch {
+        return null;
+      }
+    },
+    lstat(path) {
+      try {
+        const s = lstatSync(path);
+        return { uid: s.uid, mode: s.mode & 4095, link: s.isSymbolicLink() };
+      } catch {
+        return null;
+      }
+    },
+    async readAs(user, path) {
+      const r = await sys.run(["sh", "-c", 'if [ -e "$1" ] || [ -L "$1" ]; then cat -- "$1"; else exit 4; fi', "sh", path], { user });
+      if (r.code === 4) return null;
+      if (r.code !== 0) {
+        throw new Error(`cannot read ${path} as ${user.name}, who owns its folder (${r.stderr.trim()}): give it to ${user.name} or remove it, then connect again`);
+      }
+      return r.stdout;
+    },
+    async writeAs(user, path, data, mode) {
+      const script = 'umask "$3"; mkdir -p -- "$(dirname -- "$1")" && cat > "$1" && if [ -n "$2" ]; then chmod "$2" -- "$1"; fi';
+      const argv = ["sh", "-c", script, "sh", path, mode === void 0 ? "" : mode.toString(8), mode === void 0 ? "022" : "077"];
+      const r = await sys.run(argv, { user, input: data });
+      if (r.code !== 0) {
+        throw new Error(`cannot write ${path} as ${user.name}, who owns its folder (${r.stderr.trim()}): give it to ${user.name} or remove it, then connect again`);
+      }
+    },
+    async removeAs(user, path, dirs) {
+      await sys.run(["sh", "-c", 'rm -f -- "$1"; shift; for d; do rmdir -- "$d" 2>/dev/null; done; true', "sh", path, ...dirs], { user });
+    },
+    realpath(path) {
+      try {
+        return realpathSync(path);
+      } catch {
+        return path;
+      }
+    },
+    removeEmptyDir(path) {
+      try {
+        rmdirSync(path);
+      } catch {
+      }
+    },
+    exists(path) {
+      return existsSync(path);
+    }
+  };
+  return sys;
+}
+function userByName(sys, name) {
+  return parsePasswd(sys.read("/etc/passwd") ?? "").find((u) => u.name === name) ?? null;
+}
+function userByUid(sys, uid) {
+  return parsePasswd(sys.read("/etc/passwd") ?? "").find((u) => u.uid === uid) ?? null;
+}
+function parsePasswd(raw) {
+  return raw.split("\n").map((l) => l.split(":")).filter((p) => p.length >= 6).map(([name, , uid, gid, , home]) => ({ name, uid: Number(uid), gid: Number(gid), home }));
+}
+async function which(sys, ...names) {
+  for (const n of names) {
+    const r = await sys.run(["sh", "-c", 'command -v "$1"', "sh", n]);
+    if (r.code === 0 && r.stdout.trim()) return r.stdout.trim();
+  }
+  return null;
+}
+
+// src/ca.ts
+var SYSTEM_CA = "/usr/local/share/ca-certificates/controlclaw.crt";
+var NSS_NAME = "ControlClaw firewall";
+function checkPem(pem) {
+  const t = pem.trim();
+  if (!t.startsWith("-----BEGIN CERTIFICATE-----") || !t.endsWith("-----END CERTIFICATE-----")) {
+    return "the CA file is not a PEM certificate";
+  }
+  return null;
+}
+async function installSystemStore(sys, rec, pem) {
+  rec.onUndo("refresh the system CA store", [["update-ca-certificates"]]);
+  await rec.file(SYSTEM_CA, pem);
+  const r = await sys.run(["update-ca-certificates"]);
+  if (r.code !== 0) throw new Error(`update-ca-certificates failed: ${r.stderr.trim()}`);
+}
+async function installNodeEnv(sys, rec, install, user, caPath) {
+  const body = `# Written by controlclaw connect; removed by controlclaw disconnect.
+[Service]
+Environment=NODE_EXTRA_CA_CERTS=${caPath}
+`;
+  const runs = install.runs;
+  if (runs.kind === "systemd-user" && user) {
+    const reload = ["systemctl", "--user", "daemon-reload"];
+    rec.onUndo("reload the user's systemd", [reload], { user });
+    await rec.file(join2(user.home, ".config/systemd/user", `${runs.unit}.d`, "controlclaw.conf"), body, { owner: user });
+    await sys.run(reload, { user });
+    return null;
+  }
+  if (runs.kind === "systemd-system") {
+    rec.onUndo("reload systemd", [["systemctl", "daemon-reload"]]);
+    await rec.file(join2("/etc/systemd/system", `${runs.unit}.d`, "controlclaw.conf"), body);
+    await sys.run(["systemctl", "daemon-reload"]);
+    return null;
+  }
+  return `OpenClaw does not run as a systemd unit: add NODE_EXTRA_CA_CERTS=${caPath} to how you start it, then restart it.`;
+}
+async function installNss(sys, rec, user, caPath) {
+  const certutil = await which(sys, "certutil");
+  if (!certutil) return 0;
+  let n = 0;
+  for (const db of [join2(user.home, ".pki/nssdb"), join2(user.home, ".local/share/pki/nssdb")]) {
+    if (!sys.exists(db)) continue;
+    rec.onUndo("remove the CA from Chrome", [[certutil, "-d", `sql:${db}`, "-D", "-n", NSS_NAME]], { user });
+    const r = await sys.run([certutil, "-d", `sql:${db}`, "-A", "-t", "C,,", "-n", NSS_NAME, "-i", caPath], { user });
+    if (r.code === 0) n++;
+  }
+  return n;
+}
+
+// src/capture/docker.ts
+import { isIPv4 as isIPv42 } from "net";
+import { join as join4 } from "path";
+
+// src/probe.ts
+import { Resolver } from "dns/promises";
+import { lookup } from "dns/promises";
+import { isIPv4 } from "net";
+import { connect } from "net";
+function splitHostPort(raw, port) {
+  const m = /^([A-Za-z0-9](?:[A-Za-z0-9.-]{0,251}[A-Za-z0-9])?)(?::(\d{1,5}))?$/.exec(raw.trim());
+  const p = m?.[2] ? Number(m[2]) : port;
+  if (!m || p < 1 || p > 65535) throw new Error(`not a host:port (an IPv4 address or a hostname): ${raw}`);
+  return { host: m[1], port: p };
+}
+async function ipv4Of(host2) {
+  if (isIPv4(host2)) return host2;
+  const { address } = await lookup(host2, { family: 4 });
+  return address;
+}
+async function dnsAnswers(server, name = "example.com") {
+  const r = new Resolver({ timeout: 3e3, tries: 1 });
+  r.setServers([server]);
+  try {
+    const a = await r.resolve4(name);
+    return { name: "firewall DNS", ok: true, detail: `${server} answers (${name} \u2192 ${a[0]})` };
+  } catch (e) {
+    const code = e.code ?? String(e);
+    return { name: "firewall DNS", ok: false, detail: `${server} does not answer (${code})` };
+  }
+}
+function proxyAnswers(proxy2, target = "example.com:443") {
+  const { host: host2, port } = splitHostPort(proxy2, 8080);
+  return new Promise((resolve) => {
+    const done = (ok, detail) => {
+      sock.destroy();
+      resolve({ name: "firewall proxy", ok, detail });
+    };
+    const sock = connect({ host: host2, port, timeout: 5e3 });
+    sock.on("connect", () => sock.write(`CONNECT ${target} HTTP/1.1\r
+Host: ${target}\r
+\r
+`));
+    sock.once("data", (d) => {
+      const line = d.toString().split("\r\n")[0] ?? "";
+      done(/^HTTP\/1\.[01] 200/.test(line), `${host2}:${port} answered "${line}"`);
+    });
+    sock.on("timeout", () => done(false, `${host2}:${port} did not answer`));
+    sock.on("error", (e) => done(false, `${host2}:${port}: ${e.message}`));
+  });
+}
+
+// src/groups.ts
+var ESCAPE_GROUPS = ["docker", "lxd", "incus", "incus-admin", "libvirt", "podman"];
+function escapeGroupMessage(user, groups) {
+  const removes = groups.map((g) => `gpasswd -d ${user.name} ${g}`).join("; ");
+  return `${user.name} is in the ${groups.join(", ")} group: it can start a container or VM that the daemon sends out, past host mode's rules. Remove it (${removes}), or use docker mode`;
+}
+
+// src/openclaw.ts
+import { join as join3 } from "path";
+var NOT_FOUND = {
+  cli: null,
+  version: null,
+  config_file: null,
+  state_dir: null,
+  runs: { kind: "not-found" },
+  gateway_port: 18789
+};
+async function findVmAgent(sys, given) {
+  for (const p of [given, sys.env.CC_VM_AGENT, "/usr/local/bin/controlclaw-vm-agent"]) {
+    if (p && sys.exists(p)) return p;
+  }
+  return which(sys, "controlclaw-vm-agent", "vm-agent");
+}
+async function findUser(sys, given) {
+  if (given) return userByName(sys, given);
+  const ps = await sys.run(["ps", "-eo", "uid=,pid=,args="]);
+  for (const line of ps.stdout.split("\n")) {
+    const m = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    if (!m || !isGatewayProcess(m[3])) continue;
+    const cgroup = sys.read(`/proc/${m[2]}/cgroup`) ?? "";
+    if (/docker|containerd|libpod/.test(cgroup)) continue;
+    const u = userByUid(sys, Number(m[1]));
+    if (u) return u;
+  }
+  const owners = parsePasswd(sys.read("/etc/passwd") ?? "").filter((u) => (u.uid === 0 || u.uid >= 1e3) && sys.exists(join3(u.home, ".openclaw/openclaw.json")));
+  if (owners.length === 1) return owners[0];
+  if (sys.env.SUDO_USER) return userByName(sys, sys.env.SUDO_USER);
+  return userByUid(sys, sys.euid);
+}
+function isGatewayProcess(args) {
+  const [exe = "", ...rest] = args.trim().split(/\s+/);
+  const prog = exe.split("/").pop();
+  if (prog === "openclaw-gateway") return true;
+  if (prog === "openclaw") return rest.includes("gateway");
+  if (prog === "bun" || /^node(js)?\d*$/.test(prog)) {
+    return rest.some((a) => /openclaw/.test(a)) && rest.includes("gateway");
+  }
+  return false;
+}
+function parseDiscover(raw) {
+  try {
+    const v = jsonFrom(raw);
+    return v && typeof v === "object" && v.runs ? v : null;
+  } catch {
+    return null;
+  }
+}
+async function findOpenClaw(sys, user, vmAgent) {
+  let discoverError;
+  if (vmAgent) {
+    const r = await discover(sys, vmAgent, user);
+    const install = r.code === 0 ? parseDiscover(r.stdout) : null;
+    if (install) return { install, user: install.runs.kind === "docker" ? null : user, via: "vm-agent" };
+    discoverError = (r.stderr || r.stdout).trim().split("\n").pop() || `exit ${r.code}`;
+  }
+  return { install: await lightLook(sys, user), user, via: "light", ...discoverError ? { discoverError } : {} };
+}
+async function discover(sys, vmAgent, user) {
+  const r = await sys.run([vmAgent, "discover"], { user: user ?? void 0, timeoutMs: 6e4 });
+  if (!(r.code === 126 || /permission denied/i.test(r.stderr)) || !user || sys.euid !== 0) return r;
+  const dir = (await sys.run(["mktemp", "-d", "/tmp/controlclaw-discover.XXXXXX"])).stdout.trim();
+  if (!dir) return r;
+  try {
+    await sys.run(["chmod", "0755", dir]);
+    const copy = join3(dir, "vm-agent");
+    if ((await sys.run(["install", "-m", "0755", vmAgent, copy])).code !== 0) return r;
+    return await sys.run([copy, "discover"], { user, timeoutMs: 6e4 });
+  } finally {
+    await sys.run(["rm", "-rf", dir]);
+  }
+}
+async function lightLook(sys, user) {
+  const home = user?.home ?? sys.env.HOME ?? "/root";
+  const places = [join3(home, ".openclaw/bin/openclaw"), join3(home, ".npm-global/bin/openclaw"), join3(home, ".local/bin/openclaw"), "/usr/local/bin/openclaw", "/usr/bin/openclaw"];
+  const cli = places.find((p) => sys.exists(p)) ?? null;
+  if (!cli) return NOT_FOUND;
+  const v = await sys.run([cli, "--version"], { user: user ?? void 0, timeoutMs: 3e4 });
+  const version = /(\d{4}\.\d+\.\d+)/.exec(v.stdout)?.[1] ?? null;
+  return { ...NOT_FOUND, cli, version, runs: { kind: "not-running" } };
+}
+function cliArgv(install, args) {
+  if (install.runs.kind === "docker") return ["docker", "exec", "-i", install.runs.container, "node", "dist/index.js", ...args];
+  return [install.cli ?? "openclaw", ...args];
+}
+function restartArgv(install) {
+  switch (install.runs.kind) {
+    case "systemd-system":
+      return ["systemctl", "restart", "--", install.runs.unit];
+    case "docker":
+      return ["docker", "restart", "--", install.runs.container];
+    case "pm2":
+      return ["pm2", "restart", install.runs.name];
+    // Not `openclaw gateway restart`: it refuses while the gateway restarts itself after a config
+    // change (found on 2026.10.9), and a unit restart is what re-reads the drop-in's environment.
+    case "systemd-user":
+      return ["systemctl", "--user", "restart", "--", install.runs.unit];
+    case "process":
+      return cliArgv(install, ["gateway", "restart"]);
+    default:
+      return null;
+  }
+}
+function restartUser(install, user) {
+  return ["systemd-user", "process", "pm2"].includes(install.runs.kind) ? user ?? void 0 : void 0;
+}
+function jsonFrom(out) {
+  return JSON.parse(out.slice(out.indexOf("{")));
+}
+async function restartOpenClaw(sys, install, user) {
+  const argv = restartArgv(install);
+  if (!argv) return null;
+  const r = await sys.run(argv, { user: restartUser(install, user), timeoutMs: 18e4 });
+  if (r.code === 0) return null;
+  return `OpenClaw did not restart (${(r.stderr || r.stdout).trim().split("\n").pop()}): restart it yourself so it reads the new settings.`;
+}
+
+// src/capture/apt.ts
+async function aptInstall(sys, rec, pkg) {
+  rec.onUndo(`remove ${pkg}`, [["apt-get", "purge", "-y", "-q", pkg]]);
+  const env = { DEBIAN_FRONTEND: "noninteractive" };
+  await sys.run(["apt-get", "update", "-q"], { env, timeoutMs: 3e5 });
+  const r = await sys.run(["apt-get", "install", "-y", "-q", pkg], { env, timeoutMs: 3e5 });
+  if (r.code !== 0) throw new Error(`apt-get install ${pkg} failed: ${r.stderr.trim()}`);
+}
+
+// src/capture/host.ts
+var DIR = "/etc/controlclaw/capture";
+var TABLE = "controlclaw_capture";
+var REDSOCKS_PORT = 12346;
+var CAPTURE_UNIT = "controlclaw-capture.service";
+var REDSOCKS_UNIT = "controlclaw-redsocks.service";
+var RESOLVED_DROPIN = "/etc/systemd/resolved.conf.d/controlclaw.conf";
+var NFTABLES_DROPIN = "/etc/systemd/system/nftables.service.d/controlclaw.conf";
+var HEADER = "# Written by controlclaw connect; removed by controlclaw disconnect.";
+var WG_IFACE = "cc-wg0";
+var REMOVE_NFT = `table inet ${TABLE}
+delete table inet ${TABLE}
+`;
+var CONNECTOR_RELAY_PORT = 3111;
+var GATE_PORTS = [3900, 3940];
+function captureNft(o) {
+  const { uid, dns } = o;
+  const ports = o.loopbackPorts.join(", ");
+  const resolve = o.resolveUid === null ? "" : `    # systemd-resolved asks only the firewall (not a DHCP server of some link, not DNS over TLS,
+    # not the link by LLMNR or mDNS).
+    meta skuid ${o.resolveUid} meta l4proto { tcp, udp } th dport { 53, 853 } ip daddr != ${dns} reject
+    meta skuid ${o.resolveUid} meta nfproto ipv6 meta l4proto { tcp, udp } th dport { 53, 853 } reject
+    meta skuid ${o.resolveUid} meta l4proto { tcp, udp } th dport { 5353, 5355 } reject
+`;
+  const stub = o.resolveUid === null ? "" : "    ip daddr { 127.0.0.53, 127.0.0.54 } meta l4proto { tcp, udp } th dport 53 accept\n";
+  const gatePorts = GATE_PORTS.join(", ");
+  const gateNat = o.gate ? `    meta skuid ${uid} ip daddr ${o.gate} tcp dport { ${gatePorts} } return
+` : "";
+  const gateOut = o.gate ? `    ip daddr ${o.gate} tcp dport { ${gatePorts} } accept
+` : "";
+  return `#!/usr/sbin/nft -f
+${HEADER}
+# Traffic from uid ${uid} (OpenClaw): TCP to redsocks, DNS to the firewall (or resolved's stub, which
+# asks only the firewall), the rest refused.
+table inet ${TABLE}
+delete table inet ${TABLE}
+table inet ${TABLE} {
+  chain nat_out {
+    type nat hook output priority -100; policy accept;
+    meta skuid ${uid} meta nfproto ipv4 ip daddr != 127.0.0.0/8 meta l4proto { tcp, udp } th dport 53 dnat ip to ${dns}:53
+    meta skuid ${uid} ip daddr 127.0.0.0/8 return
+${gateNat}    meta skuid ${uid} meta nfproto ipv4 meta l4proto tcp redirect to :${REDSOCKS_PORT}
+  }
+  chain out {
+    type filter hook output priority 0; policy accept;
+${resolve}    # Only the uid's packets are judged; others, and the kernel's own (WireGuard's UDP, which has
+    # no socket owner and would match neither skuid test), go on.
+    meta skuid ${uid} jump uid_out
+  }
+  chain uid_out {
+    ct state established,related accept
+    # By address, not oif: a redirected packet still shows the outside interface here.
+    ip daddr 127.0.0.0/8 tcp dport { ${ports} } accept
+    ip6 daddr ::1 tcp dport { ${ports} } accept
+    meta nfproto ipv4 ip daddr ${dns} meta l4proto { tcp, udp } th dport 53 accept
+${gateOut}${stub}    meta l4proto tcp reject with tcp reset
+    reject
+  }
+${tunnelChains(o)}}
+`;
+}
+function tunnelChains(o) {
+  if (!o.tunnel) return "";
+  const { iface, address, firewall } = o.tunnel;
+  return `  chain tunnel_post {
+    type filter hook postrouting priority 0; policy accept;
+    ip daddr ${firewall} oifname != "${iface}" drop
+  }
+  chain tunnel_fwd {
+    type filter hook forward priority 0; policy accept;
+    # A container's traffic (Docker masquerades it on the way out) would reach the firewall as this
+    # agent's: nothing forwarded goes into the tunnel.
+    oifname "${iface}" drop
+  }
+  chain tunnel_snat {
+    type nat hook postrouting priority 100; policy accept;
+    # DNS DNATed into the tunnel keeps the source of the route it first took; the firewall takes
+    # only this machine's tunnel address from it.
+    oifname "${iface}" ip saddr != ${address} snat ip to ${address}
+  }
+  chain tunnel_in {
+    type filter hook input priority 0; policy accept;
+    ip daddr ${address} iifname != { "${iface}", "lo" } drop
+  }
+`;
+}
+function loopbackPorts(gatewayPort, profilePorts2 = []) {
+  const top = Math.min(gatewayPort + (profilePorts2 === null ? 110 : 11), 65535);
+  const own = top > gatewayPort ? `${gatewayPort}-${top}` : String(gatewayPort);
+  const extra = [...new Set(profilePorts2 ?? [])].filter((p) => Number.isInteger(p) && p > 0 && p <= 65535 && (p < gatewayPort || p > top)).sort((a, b) => a - b);
+  return [String(REDSOCKS_PORT), "3100", String(CONNECTOR_RELAY_PORT), own, ...extra.map(String)];
+}
+function profilePorts(configText) {
+  if (configText === null) return [];
+  let cfg;
+  try {
+    cfg = JSON.parse(configText);
+  } catch {
+    return null;
+  }
+  const profiles = cfg?.browser?.profiles ?? {};
+  return Object.values(profiles).flatMap((p) => {
+    if (typeof p?.cdpPort === "number") return [p.cdpPort];
+    let u = null;
+    try {
+      u = typeof p?.cdpUrl === "string" ? new URL(p.cdpUrl) : null;
+    } catch {
+      u = null;
+    }
+    return u && ["127.0.0.1", "localhost", "[::1]"].includes(u.hostname) && u.port ? [Number(u.port)] : [];
+  });
+}
+function redsocksConf(proxyIp, proxyPort) {
+  return `// ${HEADER.slice(2)}
+base {
+  log_debug = off;
+  log_info = on;
+  log = stderr;
+  daemon = off;
+  redirector = iptables;
+  redsocks_conn_max = 2000;
+}
+
+redsocks {
+  local_ip = 127.0.0.1;
+  local_port = ${REDSOCKS_PORT};
+  ip = ${proxyIp};
+  port = ${proxyPort};
+  type = http-connect;
+}
+`;
+}
+function redsocksUnit() {
+  return `${HEADER}
+[Unit]
+Description=ControlClaw: OpenClaw's TCP to the firewall's proxy
+After=network.target
+
+[Service]
+# Its own uid, never OpenClaw's: its connections to the proxy are not caught again.
+DynamicUser=yes
+ExecStart=/usr/sbin/redsocks -c ${DIR}/redsocks.conf
+Restart=always
+RestartSec=2
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function captureUnit(nft) {
+  return `${HEADER}
+[Unit]
+Description=ControlClaw: capture rules for OpenClaw's user
+DefaultDependencies=no
+Before=network-pre.target shutdown.target
+Wants=network-pre.target
+# nftables.service flushes the whole ruleset: load after it at boot. Its drop-in
+# (${NFTABLES_DROPIN}) loads ours again after each later start, restart or reload.
+After=local-fs.target nftables.service
+Conflicts=shutdown.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${nft} -f ${DIR}/capture.nft
+ExecStop=${nft} -f ${DIR}/remove.nft
+
+[Install]
+WantedBy=multi-user.target
+`;
+}
+function nftablesDropin(nft) {
+  return `${HEADER}
+[Service]
+ExecStartPost=-${nft} -f ${DIR}/capture.nft
+ExecReload=-${nft} -f ${DIR}/capture.nft
+ExecStopPost=-${nft} -f ${DIR}/capture.nft
+`;
+}
+function resolvedDropin(dns) {
+  return `${HEADER}
+[Resolve]
+DNS=${dns}
+Domains=~.
+LLMNR=no
+MulticastDNS=no
+`;
+}
+async function requestAs(sys, user) {
+  const r = await sys.run(["curl", "-sS", "-o", "/dev/null", "-w", "%{http_code}", "--max-time", "15", "https://example.com/"], { user });
+  if (r.code === 127) return { name: `request as ${user.name}`, ok: true, detail: "skipped (no curl)" };
+  const code = r.stdout.trim();
+  const ok = r.code === 0 && code !== "000";
+  return { name: `request as ${user.name}`, ok, detail: ok ? `https://example.com answered ${code} through the firewall` : r.stderr.trim() || `curl exit ${r.code}` };
+}
+var host = {
+  name: "host",
+  protects: "limited: OpenClaw's user cannot reach the network except through the firewall, but anyone with root or sudo on this machine can remove the rules",
+  blockers(f) {
+    const out = [];
+    if (!f.linux) out.push("needs Linux");
+    if (!f.systemd) out.push("needs systemd");
+    if (!f.root) out.push("needs root (run it with sudo)");
+    if (!f.nft) out.push("needs nftables (apt-get install nftables)");
+    if (!f.redsocks && !f.apt) out.push("needs redsocks, and apt-get is not here to install it");
+    const runs = f.openclaw.install.runs.kind;
+    if (runs === "not-found") out.push("no OpenClaw found on this machine");
+    if (runs === "docker") out.push("OpenClaw runs in Docker: use --mode docker");
+    const u = f.openclaw.user;
+    if (u && u.uid !== 0 && f.escapeGroups.length) out.push(escapeGroupMessage(u, f.escapeGroups));
+    if (u && u.uid !== 0 && f.groupsUnknown) out.push(`cannot read the groups of ${u.name} (id -nG failed), so cannot tell whether it can start containers that go around the rules`);
+    if (f.resolved && f.resolveUid === null) {
+      out.push("systemd-resolved runs, but there is no systemd-resolve user to limit to the firewall's DNS: resolved could still ask any DNS server");
+    }
+    if (runs !== "not-found" && f.openclaw.user?.uid === 0) out.push("OpenClaw runs as root: the rules would catch every root process. Run OpenClaw as its own user");
+    return out;
+  },
+  async install(ctx) {
+    const { sys, rec, facts, user } = ctx;
+    if (!user) throw new Error("no OpenClaw user");
+    if (!ctx.firewall.dns) throw new Error("host mode needs the firewall's DNS address (--dns)");
+    const notes = [];
+    const proxy2 = splitHostPort(ctx.firewall.proxy, 8080);
+    const proxyIp = await ipv4Of(proxy2.host);
+    const dns = await ipv4Of(ctx.firewall.dns);
+    const nft = facts.nft ?? "/usr/sbin/nft";
+    if (!facts.redsocks) {
+      ctx.log("Installing redsocks");
+      await aptInstall(sys, rec, "redsocks");
+      await sys.run(["systemctl", "disable", "--now", "redsocks.service"]);
+    }
+    rec.onUndo("reload systemd", [["systemctl", "daemon-reload"]]);
+    await rec.file(`${DIR}/redsocks.conf`, redsocksConf(proxyIp, proxy2.port));
+    await rec.file(`/etc/systemd/system/${REDSOCKS_UNIT}`, redsocksUnit());
+    const nftText = captureNft({
+      uid: user.uid,
+      dns,
+      loopbackPorts: loopbackPorts(ctx.install.gateway_port, profilePorts(ctx.install.config_file ? sys.read(ctx.install.config_file) : null)),
+      resolveUid: facts.resolved ? facts.resolveUid : null,
+      ...ctx.tunnel ? { tunnel: { iface: WG_IFACE, address: ctx.tunnel.address, firewall: ctx.tunnel.firewall } } : {},
+      gate: proxyIp
+    });
+    await rec.file(`${DIR}/capture.nft`, nftText);
+    await rec.file(`${DIR}/remove.nft`, REMOVE_NFT);
+    await rec.file(`/etc/systemd/system/${CAPTURE_UNIT}`, captureUnit(nft));
+    await rec.file(NFTABLES_DROPIN, nftablesDropin(nft));
+    rec.onUndo("remove the capture rules", [["systemctl", "disable", "--now", CAPTURE_UNIT]]);
+    rec.onUndo("remove the capture rules", [[nft, "-f", `${DIR}/remove.nft`]]);
+    rec.onUndo("stop redsocks", [["systemctl", "disable", "--now", REDSOCKS_UNIT]]);
+    await sys.run(["systemctl", "daemon-reload"]);
+    for (const unit of [REDSOCKS_UNIT, CAPTURE_UNIT]) {
+      const r = await sys.run(["systemctl", "enable", "--now", unit]);
+      if (r.code !== 0) throw new Error(`could not start ${unit}: ${r.stderr.trim()}`);
+    }
+    await sys.run(["sleep", "2"]);
+    const rs = await sys.run(["systemctl", "show", "-p", "ActiveState,NRestarts", REDSOCKS_UNIT]);
+    const prop = Object.fromEntries(rs.stdout.split("\n").map((l) => l.trim().split("=", 2)));
+    if (prop.ActiveState !== "active" || prop.NRestarts !== "0") {
+      throw new Error(`${REDSOCKS_UNIT} does not stay up (journalctl -u ${REDSOCKS_UNIT})`);
+    }
+    ctx.log(`Capture rules loaded for ${user.name} (uid ${user.uid})`);
+    if (facts.resolved) {
+      rec.onUndo("restart systemd-resolved", [["systemctl", "restart", "systemd-resolved"]]);
+      await rec.file(RESOLVED_DROPIN, resolvedDropin(dns));
+      await sys.run(["systemctl", "restart", "systemd-resolved"]);
+      notes.push(`This machine's DNS now goes to the firewall (${dns}). If the firewall stops, DNS stops for every program here, not only OpenClaw.`);
+    }
+    await installSystemStore(sys, rec, ctx.caPem);
+    const envNote = await installNodeEnv(sys, rec, ctx.install, user, ctx.caPath);
+    if (envNote) notes.push(envNote);
+    const nss = await installNss(sys, rec, user, ctx.caPath);
+    if (nss) ctx.log(`CA added to ${nss} Chrome certificate store(s)`);
+    ctx.log("Restarting OpenClaw");
+    const restarted = await restartOpenClaw(sys, ctx.install, user);
+    if (restarted) notes.push(restarted);
+    return notes;
+  },
+  async status(sys, record) {
+    const checks = [];
+    const table = await sys.run(["nft", "list", "table", "inet", TABLE]);
+    checks.push({
+      name: "capture rules",
+      ok: table.code === 0,
+      detail: table.code === 0 ? `loaded for uid ${record.user?.uid}` : `not loaded: OpenClaw's traffic is not captured (sudo systemctl restart ${CAPTURE_UNIT})`
+    });
+    for (const unit of [REDSOCKS_UNIT, CAPTURE_UNIT]) {
+      const r = await sys.run(["systemctl", "is-active", unit]);
+      checks.push({ name: unit, ok: r.stdout.trim() === "active", detail: r.stdout.trim() || "unknown" });
+    }
+    if (record.firewall.dns) {
+      const d = await dnsAnswers(record.firewall.dns);
+      if (!d.ok) d.detail += ": DNS on this whole machine depends on it";
+      checks.push(d);
+    }
+    if (record.user) checks.push(await requestAs(sys, record.user));
+    return checks;
+  }
+};
+
+// src/capture/docker.ts
+var DIR2 = "/etc/controlclaw/docker";
+var OVERRIDE = `${DIR2}/compose.controlclaw.yml`;
+var BUNDLE = `${DIR2}/ca-bundle.crt`;
+var SUBNET = "172.31.250.0/24";
+var GATE_IP = "172.31.250.2";
+var GATEWAY_IP = "172.31.250.10";
+var GATE_SERVICE = "controlclaw-gate";
+var GATE_IMAGE = "alpine/socat:1.8.0.3";
+var CONTAINER_CA = "/etc/controlclaw/ca.crt";
+var PROBE = `fetch("https://example.com/").then(r => console.log("HTTP " + r.status), e => console.log("failed: " + (e.cause?.code ?? e.message)))`;
+var SOCKET = /(docker|containerd|podman|crio|cri-dockerd)\.sock$|^\/run\/(docker|containerd|podman)\b|^\/var\/run\/(docker|containerd|podman)\b/;
+var SOCKET_DIRS = ["/", "/run", "/var/run", "/var", "/run/user", "/var/run/user"];
+var USER_RUNTIME = /^\/(var\/)?run\/user\/\d+(\/|$)/;
+var NET_CAPS = ["ALL", "NET_ADMIN", "NET_RAW", "SYS_ADMIN"];
+function escapesOf(c) {
+  const out = [];
+  for (const m of c.Mounts ?? []) {
+    const src = (m.Source ?? "").replace(/\/+$/, "") || "/";
+    if (SOCKET.test(src) || SOCKET.test(m.Destination ?? "") || SOCKET_DIRS.includes(src) || USER_RUNTIME.test(src)) {
+      out.push(`it mounts ${m.Source} (a container runtime can start containers that are not on the internal network)`);
+    }
+  }
+  if (c.HostConfig?.Privileged) out.push("it is privileged");
+  const caps = (c.HostConfig?.CapAdd ?? []).map((x) => x.toUpperCase().replace(/^CAP_/, "")).filter((x) => NET_CAPS.includes(x));
+  if (caps.length) out.push(`it has ${caps.join(", ")}`);
+  const net = c.HostConfig?.NetworkMode ?? "";
+  if (net === "host" || net.startsWith("container:")) out.push(`its network mode is ${net}`);
+  return out;
+}
+function parseInspect(raw) {
+  let c;
+  try {
+    c = JSON.parse(raw)[0];
+  } catch {
+    return null;
+  }
+  const l = c?.Config?.Labels ?? {};
+  const project = l["com.docker.compose.project"];
+  const workingDir = l["com.docker.compose.project.working_dir"];
+  const files = l["com.docker.compose.project.config_files"];
+  const service = l["com.docker.compose.service"];
+  if (!project || !workingDir || !files || !service) return null;
+  const ports = [];
+  for (const [key, binds] of Object.entries(c.HostConfig?.PortBindings ?? {})) {
+    const [port, proto] = key.split("/");
+    if (proto !== "tcp") continue;
+    for (const b of binds ?? []) {
+      if (!b.HostPort) continue;
+      ports.push({ host: b.HostIp ? `${b.HostIp}:${b.HostPort}` : b.HostPort, container: Number(port) });
+    }
+  }
+  return { project, workingDir, files: files.split(","), service, ports, escapes: escapesOf(c) };
+}
+function isLoopback(host2) {
+  return host2 === "localhost" || /^127\./.test(host2) || host2 === "::1";
+}
+function q(s) {
+  return JSON.stringify(s);
+}
+function gateScript(proxy2, dns, info) {
+  const relays = [`socat TCP-LISTEN:8080,fork,reuseaddr TCP:${proxy2.host}:${proxy2.port}`];
+  if (dns) {
+    relays.push(`socat UDP-LISTEN:53,fork,reuseaddr UDP:${dns}:53`, `socat TCP-LISTEN:53,fork,reuseaddr TCP:${dns}:53`);
+  }
+  for (const port of GATE_PORTS) relays.push(`socat TCP-LISTEN:${port},fork,reuseaddr TCP:${proxy2.host}:${port}`);
+  for (const p of info.ports) relays.push(`socat TCP-LISTEN:${p.container},fork,reuseaddr TCP:${GATEWAY_IP}:${p.container}`);
+  return `${relays.map((r) => `${r} &`).join(" ")} wait`;
+}
+function proxyEnv(proxyUrl, gate) {
+  const direct = ["localhost", "127.0.0.1", "::1", ...gate ? [gate] : []].join(",");
+  return [
+    ["OPENCLAW_PROXY_URL", proxyUrl],
+    ["HTTP_PROXY", proxyUrl],
+    ["HTTPS_PROXY", proxyUrl],
+    ["http_proxy", proxyUrl],
+    ["https_proxy", proxyUrl],
+    ["NO_PROXY", direct],
+    ["no_proxy", direct],
+    ["NODE_USE_ENV_PROXY", "1"],
+    ["NODE_EXTRA_CA_CERTS", CONTAINER_CA],
+    ["SSL_CERT_FILE", "/etc/ssl/certs/ca-certificates.crt"]
+  ];
+}
+function overrideYaml(info, proxy2, dns) {
+  const env = proxyEnv(`http://${GATE_IP}:8080`, GATE_IP);
+  const clash = info.ports.find((p) => p.container === 8080 || p.container === 53 || GATE_PORTS.includes(p.container));
+  if (clash) throw new Error(`the gateway publishes port ${clash.container}, which the gate uses for the firewall`);
+  const loop = [proxy2.host, dns ?? ""].find(isLoopback);
+  if (loop) {
+    throw new Error(`${loop} is the gate itself, not this machine: a firewall here must listen on the docker0 address (172.17.0.1), and --proxy and --dns name it`);
+  }
+  return [
+    "# Written by controlclaw connect; removed by controlclaw disconnect.",
+    "# OpenClaw's gateway on an internal network; the gate is its only way out.",
+    "services:",
+    `  ${info.service}:`,
+    "    ports: !reset []",
+    "    networks: !override",
+    "      controlclaw:",
+    `        ipv4_address: ${GATEWAY_IP}`,
+    `    dns: [${q(GATE_IP)}]`,
+    "    environment:",
+    ...env.map(([k, v]) => `      ${k}: ${q(v)}`),
+    "    volumes:",
+    `      - ${q(`${CONTAINER_CA}:${CONTAINER_CA}:ro`)}`,
+    `      - ${q(`${BUNDLE}:/etc/ssl/certs/ca-certificates.crt:ro`)}`,
+    `  ${GATE_SERVICE}:`,
+    `    image: ${GATE_IMAGE}`,
+    "    restart: unless-stopped",
+    `    entrypoint: ["/bin/sh", "-c"]`,
+    `    command: [${q(gateScript(proxy2, dns, info))}]`,
+    ...info.ports.length ? ["    ports:", ...info.ports.map((p) => `      - ${q(`${p.host}:${p.container}`)}`)] : [],
+    "    networks:",
+    "      default: {}",
+    "      controlclaw:",
+    `        ipv4_address: ${GATE_IP}`,
+    "networks:",
+    "  controlclaw:",
+    "    internal: true",
+    ...ISOLATED_GATEWAY,
+    "    ipam:",
+    "      config:",
+    `        - subnet: ${SUBNET}`,
+    ""
+  ].join("\n");
+}
+function composeFileValue(info) {
+  const rel = (f) => f.startsWith(`${info.workingDir}/`) ? f.slice(info.workingDir.length + 1) : f;
+  return [...info.files.map(rel), OVERRIDE].join(":");
+}
+function composeArgv(info, withOverride) {
+  const files = withOverride ? [...info.files, OVERRIDE] : info.files;
+  return ["docker", "compose", "-p", info.project, "--project-directory", info.workingDir, ...files.flatMap((f) => ["-f", f])];
+}
+async function subnetTaken(sys, ours, subnet = SUBNET) {
+  const ids = (await sys.run(["docker", "network", "ls", "-q"])).stdout.split("\n").filter(Boolean);
+  if (!ids.length) return null;
+  const r = await sys.run(["docker", "network", "inspect", ...ids]);
+  try {
+    const nets = JSON.parse(r.stdout);
+    return nets.find((n) => n.Name !== ours && (n.IPAM?.Config ?? []).some((c) => c.Subnet === subnet))?.Name ?? null;
+  } catch {
+    return null;
+  }
+}
+var ISOLATED_GATEWAY = [
+  // No IPv6 either: a daemon that turns it on for new networks would give the host an IPv6 address there.
+  "    enable_ipv6: false",
+  "    driver_opts:",
+  "      com.docker.network.bridge.gateway_mode_ipv4: isolated"
+];
+var DOCKER_MIN_MAJOR = 28;
+function dockerMajor(version) {
+  return Number(/^(\d+)\./.exec(version ?? "")?.[1] ?? 0);
+}
+function dockerTooOld(version) {
+  if (dockerMajor(version) >= DOCKER_MIN_MAJOR) return null;
+  return `needs Docker ${DOCKER_MIN_MAJOR} or newer (found ${version || "none"}): an older one gives the host an address on the internal network, where its services would be a way out`;
+}
+async function gatewayIsolated(sys, network) {
+  const r = await sys.run(["docker", "network", "inspect", "-f", '{{index .Options "com.docker.network.bridge.gateway_mode_ipv4"}}', network]);
+  if (r.code !== 0) return { name: "host unreachable from it", ok: false, detail: `no network ${network} (not running?)` };
+  const mode = r.stdout.trim();
+  return {
+    name: "host unreachable from it",
+    ok: mode === "isolated",
+    detail: mode === "isolated" ? `${network} gives the host no address` : `${network} gives the host an address: its services on 0.0.0.0 are reachable (disconnect, then connect again)`
+  };
+}
+var docker = {
+  name: "docker",
+  protects: "strong: the gateway container has no route out; its only way to the internet is the firewall",
+  blockers(f) {
+    const out = [];
+    if (!f.root) out.push("needs root (run it with sudo)");
+    if (!f.docker?.ok) out.push("needs Docker");
+    else if (!f.docker.compose || !composeAtLeast(f.docker.compose, 2, 24, 4)) out.push("needs Docker Compose 2.24.4 or newer");
+    const old = f.docker?.ok ? dockerTooOld(f.docker.version) : null;
+    if (old) out.push(old);
+    if (f.openclaw.install.runs.kind !== "docker") out.push("OpenClaw does not run in a Docker container here");
+    return out;
+  },
+  async install(ctx) {
+    const { sys, rec } = ctx;
+    if (ctx.install.runs.kind !== "docker") throw new Error("OpenClaw does not run in Docker");
+    const container = ctx.install.runs.container;
+    const info = parseInspect((await sys.run(["docker", "inspect", "--", container])).stdout);
+    if (!info) throw new Error(`${container} was not started with Docker Compose: docker mode needs its compose file`);
+    if (info.escapes.length) {
+      throw new Error(`${container} could leave the internal network: ${info.escapes.join("; ")}. Remove that from its compose file first`);
+    }
+    const others = (await sys.run(["docker", "ps", "--filter", `label=com.docker.compose.project=${info.project}`, "--format", "{{.Names}}"])).stdout.split("\n").filter((n) => n && n !== container);
+    if (others.length) {
+      throw new Error(`docker mode takes the gateway off its network, and these services of ${info.project} run with it: ${others.join(", ")}`);
+    }
+    const taken = await subnetTaken(sys, `${info.project}_controlclaw`);
+    if (taken) throw new Error(`the Docker network ${taken} already uses ${SUBNET}`);
+    const proxy2 = splitHostPort(ctx.firewall.proxy, 8080);
+    const bundle = await sys.run(["docker", "exec", container, "cat", "/etc/ssl/certs/ca-certificates.crt"]);
+    if (bundle.code !== 0 || !bundle.stdout.includes("BEGIN CERTIFICATE")) {
+      throw new Error(`could not read the CA bundle in ${container}: is it running?`);
+    }
+    await rec.file(BUNDLE, `${bundle.stdout.trimEnd()}
+${ctx.caPem.trim()}
+`);
+    await rec.file(OVERRIDE, overrideYaml(info, proxy2, ctx.firewall.dns));
+    rec.onUndo("put the gateway back on its own network", [
+      [...composeArgv(info, true), "rm", "-s", "-f", GATE_SERVICE],
+      [...composeArgv(info, false), "up", "-d", info.service],
+      ["docker", "network", "rm", `${info.project}_controlclaw`]
+    ]);
+    ctx.log(`Moving ${container} onto the internal network`);
+    const up2 = await sys.run([...composeArgv(info, true), "up", "-d", info.service, GATE_SERVICE], { timeoutMs: 6e5 });
+    if (up2.code !== 0) throw new Error(`docker compose up failed: ${up2.stderr.trim().split("\n").slice(-3).join(" ")}`);
+    const notes = [`OpenClaw's container now reaches the internet only through the firewall. Its ports are published by ${GATE_SERVICE}.`];
+    const env = join4(info.workingDir, ".env");
+    const before = sys.read(env);
+    if (before !== null && /^\s*(export\s+)?COMPOSE_(FILE|PATH_SEPARATOR)\s*=/m.test(before)) {
+      notes.push(`Your ${env} sets COMPOSE_FILE or COMPOSE_PATH_SEPARATOR, so it is left as it is: add ${OVERRIDE} to COMPOSE_FILE. Otherwise the next "docker compose up" there puts the gateway back on its open network (controlclaw status shows it).`);
+    } else {
+      const line = `COMPOSE_FILE=${composeFileValue(info)}`;
+      await rec.file(env, `${before === null ? "" : `${before.trimEnd()}
+`}# Added by controlclaw connect; removed by controlclaw disconnect.
+${line}
+`);
+      notes.push(`"docker compose up" in ${info.workingDir} keeps the capture: ${env} now names the override in COMPOSE_FILE. With -f, add -f ${OVERRIDE}; without it the gateway goes back on its open network (controlclaw status shows it).`);
+    }
+    return notes;
+  },
+  async status(sys, record) {
+    const checks = [];
+    const c = record.container ?? "";
+    const nets = await sys.run(["docker", "inspect", "-f", "{{json .NetworkSettings.Networks}}", "--", c]);
+    let names = [];
+    try {
+      names = Object.keys(JSON.parse(nets.stdout));
+    } catch {
+    }
+    const only = names.length === 1 && names[0].endsWith("_controlclaw");
+    checks.push({ name: "gateway network", ok: only, detail: names.length ? `${c} is on ${names.join(", ")}` : `${c} is not running` });
+    if (only) checks.push(await gatewayIsolated(sys, names[0]));
+    const gate = await sys.run(["docker", "ps", "-q", "--filter", `label=com.docker.compose.service=${GATE_SERVICE}`]);
+    checks.push({ name: GATE_SERVICE, ok: gate.stdout.trim() !== "", detail: gate.stdout.trim() ? "running" : "not running" });
+    const probe = await sys.run(["docker", "exec", c, "node", "-e", PROBE], { timeoutMs: 3e4 });
+    const answer = probe.stdout.trim();
+    checks.push({ name: "request from the gateway", ok: /^HTTP \d+/.test(answer), detail: answer || "no answer" });
+    if (record.firewall.dns && isIPv42(record.firewall.dns)) checks.push(await dnsAnswers(record.firewall.dns));
+    return checks;
+  }
+};
+function composeAtLeast(version, major, minor, patch) {
+  const m = /(\d+)\.(\d+)(?:\.(\d+))?/.exec(version);
+  if (!m) return false;
+  const have = [Number(m[1]), Number(m[2]), Number(m[3] ?? 0)];
+  const want = [major, minor, patch];
+  for (let i = 0; i < 3; i++) if (have[i] !== want[i]) return have[i] > want[i];
+  return true;
+}
+
+// src/capture/proxy.ts
+function proxyPatch(proxy2) {
+  return { proxy: { enabled: true, proxyUrl: `http://${proxy2}`, loopbackMode: "gateway-only" } };
+}
+function currentProxy(path, raw) {
+  if (!path || raw === null) throw new Error(`cannot read OpenClaw's config file${path ? ` (${path})` : ""}`);
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    throw new Error(`${path} is not plain JSON, so its proxy setting cannot be saved: set proxy.proxyUrl by hand`);
+  }
+  return cfg.proxy;
+}
+var proxy = {
+  name: "proxy",
+  protects: "observability, plus enforcement for OpenClaw's own requests; shell commands and other programs go around it",
+  blockers(f) {
+    const runs = f.openclaw.install.runs.kind;
+    if (runs === "not-found") return ["no OpenClaw found on this machine"];
+    if (runs === "docker") return ["OpenClaw runs in Docker: use --mode docker"];
+    return [];
+  },
+  async install(ctx) {
+    const { sys, rec, user, install } = ctx;
+    const notes = [];
+    const run2 = (args, input) => sys.run(cliArgv(install, args), { user: user ?? void 0, input, timeoutMs: 12e4 });
+    const existing = currentProxy(install.config_file, install.config_file ? sys.read(install.config_file) : null);
+    if (existing && typeof existing === "object" && Object.keys(existing).length) {
+      throw new Error("OpenClaw already has a proxy setting. Proxy mode would replace it: remove it first, or use host mode");
+    }
+    const ours = proxyPatch(ctx.firewall.proxy);
+    rec.onUndo("remove OpenClaw's proxy setting", [cliArgv(install, ["config", "patch", "--stdin"])], {
+      user: user ?? void 0,
+      input: JSON.stringify({ proxy: null })
+    });
+    const patched = await run2(["config", "patch", "--stdin"], JSON.stringify(ours));
+    if (patched.code !== 0) throw new Error(`openclaw config patch failed: ${(patched.stderr || patched.stdout).trim()}`);
+    ctx.log(`OpenClaw's proxy set to http://${ctx.firewall.proxy}`);
+    if (sys.euid === 0) await installSystemStore(sys, rec, ctx.caPem);
+    if (install.runs.kind === "systemd-system" && sys.euid !== 0) {
+      notes.push(`OpenClaw runs as a system unit: run connect with sudo, or add NODE_EXTRA_CA_CERTS=${ctx.caPath} to its unit yourself.`);
+    } else {
+      const envNote = await installNodeEnv(sys, rec, install, user, ctx.caPath);
+      if (envNote) notes.push(envNote);
+    }
+    ctx.log("Restarting OpenClaw");
+    const restarted = await restartOpenClaw(sys, install, user);
+    if (restarted) notes.push(restarted);
+    notes.push("Only OpenClaw's own requests go through the firewall. Shell commands and other programs on this machine do not.");
+    return notes;
+  },
+  async status(sys, record) {
+    const r = await sys.run([...record.cli, "proxy", "validate", "--json"], {
+      user: record.user ?? void 0,
+      env: { NODE_EXTRA_CA_CERTS: record.ca },
+      timeoutMs: 9e4
+    });
+    return validateChecks(r.stdout, `http://${record.firewall.proxy}`);
+  }
+};
+function validateChecks(stdout, want) {
+  let v = {};
+  try {
+    v = jsonFrom(stdout);
+  } catch {
+    return [{ name: "OpenClaw proxy setting", ok: false, detail: "openclaw proxy validate gave no answer" }];
+  }
+  const url = v.config?.proxyUrl?.replace(/\/$/, "");
+  const setting = {
+    name: "OpenClaw proxy setting",
+    ok: v.config?.enabled === true && url === want,
+    detail: url ? `${v.config?.enabled ? "on" : "off"}, ${url}` : "not set"
+  };
+  const allowed = v.checks?.find((c) => c.kind === "allowed");
+  const request = {
+    name: "request through OpenClaw's proxy",
+    ok: typeof allowed?.status === "number",
+    detail: allowed ? `${allowed.url} ${allowed.status ?? allowed.error ?? "failed"}` : "not checked"
+  };
+  return [setting, request];
+}
+
+// src/capture/remote.ts
+var WG_DIR = "/etc/wireguard";
+var WG_UNIT = `wg-quick@${WG_IFACE}.service`;
+var HANDSHAKE_TRIES = 15;
+function wgConf(t) {
+  return `# Written by controlclaw connect; removed by controlclaw disconnect.
+[Interface]
+Address = ${t.address}/32
+PostUp = wg set %i private-key ${WG_DIR}/${WG_IFACE}.key
+
+[Peer]
+PublicKey = ${t.firewallPublicKey}
+Endpoint = ${t.endpoint}
+# Only the firewall's tunnel address: the machine's other traffic keeps its own routes.
+AllowedIPs = ${t.firewall}/32
+PersistentKeepalive = 25
+`;
+}
+var remote = {
+  name: "remote",
+  protects: "like host mode on this machine (anyone with root or sudo can remove the rules); its traffic reaches the firewall over WireGuard from any network, and its tunnel address is its identity",
+  blockers(f) {
+    const out = host.blockers(f).map((b) => b.replace("use --mode docker", "use --mode docker with a firewall it can reach"));
+    if (!f.wireguard && !f.apt) out.push("needs WireGuard (wireguard-tools), and apt-get is not here to install it");
+    return out;
+  },
+  // The tunnel first: the vm-agent listens on its address, and the checks after install go through it.
+  async prepare(ctx) {
+    const { sys, rec, facts } = ctx;
+    const t = ctx.tunnel;
+    if (!t) throw new Error("remote mode needs a tunnel: pair with a code (not --ca)");
+    if (!facts.wireguard) {
+      ctx.log("Installing WireGuard");
+      await aptInstall(sys, rec, "wireguard-tools");
+    }
+    await rec.file(`${WG_DIR}/${WG_IFACE}.key`, `${t.privateKey}
+`, { mode: 384 });
+    await rec.file(`${WG_DIR}/${WG_IFACE}.conf`, wgConf(t), { mode: 384 });
+    rec.onUndo("take down the tunnel", [["systemctl", "disable", "--now", WG_UNIT]]);
+    const up2 = await sys.run(["systemctl", "enable", "--now", WG_UNIT]);
+    if (up2.code !== 0) throw new Error(`could not bring up ${WG_IFACE}: ${up2.stderr.trim()} (journalctl -u ${WG_UNIT})`);
+    for (let i = 0; i < HANDSHAKE_TRIES; i++) {
+      await sys.run(["ping", "-c", "1", "-W", "1", t.firewall]);
+      const h = await sys.run(["wg", "show", WG_IFACE, "latest-handshakes"]);
+      if (Number(h.stdout.trim().split(/\s+/)[1] ?? 0) > 0) {
+        ctx.log(`Tunnel ${WG_IFACE} up: ${t.address} to the firewall at ${t.firewall} (${t.endpoint})`);
+        return;
+      }
+      await sys.run(["sleep", "2"]);
+    }
+    throw new Error(`the firewall does not answer on WireGuard at ${t.endpoint} (is UDP ${t.endpoint.split(":").pop()} open to this machine?)`);
+  },
+  install(ctx) {
+    return host.install(ctx);
+  },
+  async status(sys, record) {
+    const checks = [await tunnelCheck(sys)];
+    return [...checks, ...await host.status(sys, record)];
+  }
+};
+async function tunnelCheck(sys) {
+  const r = await sys.run(["wg", "show", WG_IFACE, "latest-handshakes"]);
+  if (r.code !== 0) return { name: "tunnel", ok: false, detail: `${WG_IFACE} is down: OpenClaw reaches nothing (sudo systemctl restart ${WG_UNIT})` };
+  const at = Number(r.stdout.trim().split(/\s+/)[1] ?? 0);
+  const ago = Math.round(Date.now() / 1e3 - at);
+  if (!at) return { name: "tunnel", ok: false, detail: `${WG_IFACE} is up, but the firewall never answered (UDP to its endpoint blocked?)` };
+  return { name: "tunnel", ok: ago < 180, detail: `${WG_IFACE} up, last handshake ${ago}s ago` };
+}
+
+// src/local.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { join as join7 } from "path";
+
+// src/release.ts
+import { createHash, createPublicKey, verify } from "crypto";
+import { chmodSync as chmodSync2, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir } from "os";
+import { dirname as dirname2, join as join5 } from "path";
+var RELEASE_URL = "https://github.com/madarco/controlclaw-oss/releases/download/v{version}";
+var RELEASE_PUBKEY = "RWQM3PqrimL9ko1EkO9cSOv1QVcfUCHBSrscQ29a8+Tflcrksl2f5d5h";
+var ED25519_SPKI = Buffer.from("302a300506032b6570032100", "hex");
+function verifyMinisign(pubkey, data, minisig) {
+  const pk = Buffer.from(pubkey.trim(), "base64");
+  if (pk.length !== 42 || pk.subarray(0, 2).toString() !== "Ed") throw new Error("not a minisign public key");
+  const lines = minisig.split("\n");
+  const sig = Buffer.from(lines[1] ?? "", "base64");
+  if (sig.length !== 74 || sig.subarray(0, 2).toString() !== "ED") throw new Error("not a prehashed minisign signature");
+  if (!sig.subarray(2, 10).equals(pk.subarray(2, 10))) throw new Error("signed with another key");
+  const key = createPublicKey({ key: Buffer.concat([ED25519_SPKI, pk.subarray(10)]), format: "der", type: "spki" });
+  const s = sig.subarray(10);
+  if (!verify(null, createHash("blake2b512").update(data).digest(), key, s)) throw new Error("the file does not match its signature");
+  const tc = lines[2] ?? "";
+  if (!tc.startsWith("trusted comment: ")) throw new Error("no trusted comment");
+  const global = Buffer.from(lines[3] ?? "", "base64");
+  if (!verify(null, Buffer.concat([s, Buffer.from(tc.slice("trusted comment: ".length))]), key, global)) {
+    throw new Error("the trusted comment does not match its signature");
+  }
+  return tc.slice("trusted comment: ".length);
+}
+async function releaseVmAgent(o = {}) {
+  const version = o.version ?? (true ? "0.9.4" : "0.0.0-dev");
+  const pubkey = o.pubkey ?? RELEASE_PUBKEY;
+  const pattern = o.url ?? process.env.CONTROLCLAW_RELEASE_URL ?? RELEASE_URL;
+  if (!pubkey || !pattern) return null;
+  const arch = { x64: "x86_64", arm64: "aarch64" }[o.arch ?? process.arch];
+  if (!arch) throw new Error(`The release has no vm-agent for ${o.arch ?? process.arch}.`);
+  const base = pattern.replaceAll("{version}", version).replace(/\/$/, "");
+  const get = async (name) => {
+    const url = `${base}/${name}`;
+    try {
+      const res = await (o.fetch ?? fetch)(url, { signal: AbortSignal.timeout(12e4) });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      return Buffer.from(await res.arrayBuffer());
+    } catch (e) {
+      throw new Error(`Could not download ${url} (${e.message}).`, { cause: e });
+    }
+  };
+  const sums = await get("SHA256SUMS");
+  let comment;
+  try {
+    comment = verifyMinisign(pubkey, sums, (await get("SHA256SUMS.minisig")).toString());
+  } catch (e) {
+    throw new Error(`The release's SHA256SUMS is not signed by the release key: ${e.message.replace(/\.$/, "")}.`, { cause: e });
+  }
+  if (comment !== `controlclaw ${version}`) throw new Error(`The release's signature is for another version (${comment}).`);
+  const asset = `vm-agent-${arch}-linux-musl`;
+  const want = sums.toString().split("\n").find((l) => l.endsWith(`  ${asset}`))?.slice(0, 64);
+  if (!want) throw new Error(`The release's SHA256SUMS has no ${asset}.`);
+  const bin = await get(asset);
+  if (createHash("sha256").update(bin).digest("hex") !== want) throw new Error(`${asset} does not match the release's SHA256SUMS.`);
+  const path = join5(mkdtempSync(join5(tmpdir(), "controlclaw-vm-agent-")), "vm-agent");
+  writeFileSync2(path, bin);
+  chmodSync2(path, 493);
+  return path;
+}
+async function vmAgentOrRelease(found, say) {
+  if (found) return { path: found, downloaded: null };
+  let path;
+  try {
+    path = await releaseVmAgent();
+  } catch (e) {
+    say.err(`${e.message} Pass --vm-agent <path>.`);
+    return null;
+  }
+  if (!path) {
+    say.err("No vm-agent binary found. Pass --vm-agent <path> (this build has no release to download it from).");
+    return null;
+  }
+  say.out(`  Downloaded and checked the vm-agent of this release: ${path}`);
+  return { path, downloaded: dirname2(path) };
+}
+
+// src/pair.ts
+import { createHash as createHash2, createHmac, generateKeyPairSync, randomBytes, timingSafeEqual, X509Certificate } from "crypto";
+import { createSocket } from "dgram";
+import { networkInterfaces } from "os";
+import { isIPv4 as isIPv43 } from "net";
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+var REQUEST_TAG = "cc-pair-v1 request\n";
+var RESPONSE_TAG = "cc-pair-v1 response\n";
+function normalizeCode(code) {
+  const s = code.replace(/[-\s]/g, "").toUpperCase().replace(/O/g, "0").replace(/[IL]/g, "1");
+  return s.length === 12 && [...s].every((c) => ALPHABET.includes(c)) ? s : null;
+}
+function hmacHex(code, tag, text) {
+  return createHmac("sha256", code).update(tag).update(text).digest("hex");
+}
+function wgKeypair() {
+  const { privateKey, publicKey } = generateKeyPairSync("x25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "der" },
+    publicKeyEncoding: { type: "spki", format: "der" }
+  });
+  return { privateKey: privateKey.subarray(-32).toString("base64"), publicKey: publicKey.subarray(-32).toString("base64") };
+}
+function agentKeypair() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519", {
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" }
+  });
+  return { privatePem: privateKey, publicPem: publicKey };
+}
+var httpPost = async (url, body) => {
+  const r = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+    signal: AbortSignal.timeout(15e3)
+  });
+  return { status: r.status, json: await r.json().catch(() => null) };
+};
+function pairUrl(firewall) {
+  const base = new URL(firewall);
+  if (!base.pathname.endsWith("/")) base.pathname += "/";
+  return new URL("pair", base).toString();
+}
+async function pair(firewall, code, req, post = httpPost) {
+  const key = normalizeCode(code);
+  if (!key) throw new Error("the code is 12 letters and digits, like 4F7K-92QD-XM3P");
+  const nonce = randomBytes(32).toString("hex");
+  if (!req.source) throw new Error("this machine's own address toward the firewall is not known");
+  const unpairSha = req.unpairSecret ? createHash2("sha256").update(req.unpairSecret).digest("hex") : null;
+  const text = JSON.stringify({ v: 1, nonce, agent_public_key: req.publicKey, name: req.name ?? null, source: req.source, unpair_sha256: unpairSha, wg_public_key: req.wgPublicKey ?? null, agent_listen: req.agentListen ?? null });
+  const url = pairUrl(firewall);
+  let r;
+  try {
+    r = await post(url, { request: text, proof: hmacHex(key, REQUEST_TAG, text) });
+  } catch (e) {
+    throw new Error(`could not reach ${url}: ${e.message}`, { cause: e });
+  }
+  const body = r.json ?? {};
+  if (r.status !== 200) throw new Error(`the firewall refused: ${typeof body.error === "string" ? body.error : `HTTP ${r.status}`}`);
+  if (typeof body.pairing !== "string" || typeof body.mac !== "string") throw new Error("the firewall's answer is not a pairing");
+  const want = Buffer.from(hmacHex(key, RESPONSE_TAG, body.pairing), "hex");
+  const got = Buffer.from(body.mac, "hex");
+  if (got.length !== want.length || !timingSafeEqual(got, want)) {
+    throw new Error("the answer was not made with this code: it did not come from your firewall. Nothing was installed.");
+  }
+  const p = JSON.parse(body.pairing);
+  if (p.nonce !== nonce) throw new Error("the answer is not for this request (another nonce). Nothing was installed.");
+  const str = (k) => typeof p[k] === "string" ? p[k] : null;
+  const agentId = str("agent_id");
+  const fwKey = str("firewall_public_key");
+  const caPem = str("ca_pem");
+  if (!agentId || !fwKey?.includes("BEGIN PUBLIC KEY") || !caPem) throw new Error("the firewall's answer misses its key, its CA or the agent id");
+  return {
+    agentId,
+    name: str("name") ?? agentId,
+    address: str("address") ?? "",
+    firewallPublicKey: fwKey.trim(),
+    caPem,
+    proxy: str("proxy"),
+    dns: str("dns"),
+    replaced: Array.isArray(p.replaced) ? p.replaced.filter((x) => typeof x === "string") : [],
+    wg: tunnelOf(p.wg),
+    // Only an IPv4 address goes into the vm-agent's config; anything else is dropped (then the
+    // address connect dialled is used).
+    callsFrom: isIPv43(str("calls_from") ?? "") ? str("calls_from") : null
+  };
+}
+var WG_KEY = /^[A-Za-z0-9+/]{43}=$/;
+var IPV4 = /^(\d{1,3}\.){3}\d{1,3}$/;
+function tunnelOf(v) {
+  if (!v || typeof v !== "object") return null;
+  const w = v;
+  const ok = typeof w.firewall_public_key === "string" && WG_KEY.test(w.firewall_public_key) && typeof w.endpoint === "string" && /^[A-Za-z0-9.-]+:\d{1,5}$/.test(w.endpoint) && typeof w.address === "string" && IPV4.test(w.address) && typeof w.firewall_address === "string" && IPV4.test(w.firewall_address);
+  if (!ok) throw new Error("the firewall's WireGuard settings are not valid");
+  return { firewallPublicKey: w.firewall_public_key, endpoint: w.endpoint, address: w.address, firewallAddress: w.firewall_address };
+}
+async function unpair(firewall, agentId, secret, post = httpPost) {
+  const url = new URL("unpair", pairUrl(firewall)).toString();
+  try {
+    const r = await post(url, { agent_id: agentId, secret });
+    if (r.status === 200) return null;
+    const e = r.json?.error;
+    return typeof e === "string" ? e : `HTTP ${r.status}`;
+  } catch (e) {
+    return `could not reach ${url}: ${e.message}`;
+  }
+}
+function sourceToward(ip) {
+  return new Promise((resolve, reject) => {
+    const s = createSocket("udp4");
+    s.on("error", (e) => {
+      s.close();
+      reject(e);
+    });
+    s.connect(9, ip, () => {
+      const { address } = s.address();
+      s.close();
+      resolve(address);
+    });
+  });
+}
+function onThisMachine(ip, source, ifaces = networkInterfaces()) {
+  const all = Object.entries(ifaces).flatMap(([name, list]) => (list ?? []).filter((a) => a.family === "IPv4").map((a) => ({ name, address: a.address })));
+  if (all.some((a) => a.address === ip)) return true;
+  const via = all.find((a) => a.address === source);
+  return !!via && /^(docker\d*|br-[0-9a-f]+)$/.test(via.name);
+}
+function caFingerprint(pem) {
+  try {
+    return new X509Certificate(pem).fingerprint256;
+  } catch {
+    return "(not a certificate)";
+  }
+}
+
+// src/state.ts
+import { dirname as dirname3, join as join6 } from "path";
+function stateDir(sys) {
+  if (sys.euid === 0) return "/etc/controlclaw";
+  const base = sys.env.XDG_CONFIG_HOME || join6(sys.env.HOME ?? "/tmp", ".config");
+  return join6(base, "controlclaw");
+}
+function recordPath(sys) {
+  return join6(stateDir(sys), "connect.json");
+}
+var ROOT_RECORD = "/etc/controlclaw/connect.json";
+function loadRecord(sys) {
+  const raw = sys.read(recordPath(sys));
+  if (!raw) return null;
+  try {
+    const r = JSON.parse(raw);
+    return r.version === 1 ? r : null;
+  } catch {
+    return null;
+  }
+}
+function pathOwner(sys, path) {
+  const parts = path.split("/").filter(Boolean);
+  for (let i = 1; i <= parts.length; i++) {
+    const p = `/${parts.slice(0, i).join("/")}`;
+    const l = sys.lstat(p);
+    if (!l) return 0;
+    const last = i === parts.length;
+    if (l.uid !== 0 && (!last || l.link)) return l.uid;
+    if (!last && !l.link && l.mode & 18) throw new SharedFolder(p, l.mode);
+  }
+  return 0;
+}
+var SharedFolder = class extends Error {
+  constructor(dir, mode) {
+    super(`${dir} can be written by other users (mode ${mode.toString(8)}): connect does not write through it. Remove their write access (chmod go-w ${dir}), then connect again`);
+    this.dir = dir;
+  }
+};
+var Recorder = class {
+  constructor(sys, record) {
+    this.sys = sys;
+    this.record = record;
+  }
+  save() {
+    this.sys.write(recordPath(this.sys), `${JSON.stringify(this.record, null, 2)}
+`, { mode: 384 });
+  }
+  /**
+   * Writes `path`, remembering what was there (content, mode, owner). A second write to the same
+   * path keeps the first. A file that was there keeps its mode and owner unless `opts` says else.
+   *
+   * As root, a path that a user owns a part of (its home, a project folder) is written as that
+   * user: root following a link the user planted there would write wherever it points.
+   */
+  async file(path, data, opts = {}) {
+    const uid = this.sys.euid === 0 ? pathOwner(this.sys, path) : 0;
+    if (uid !== 0) {
+      const user = userByUid(this.sys, uid);
+      if (!user) throw new Error(`${path} is owned by uid ${uid}, which has no user here: not written`);
+      if (!this.record.steps.some((s) => s.kind === "file" && s.path === path)) {
+        const dirs = [];
+        for (let d = dirname3(path); d !== "/" && !this.sys.exists(d); d = dirname3(d)) dirs.push(d);
+        const previous = await this.sys.readAs(user, path);
+        this.record.steps.push({ kind: "file", path, previous, user, ...dirs.length ? { dirs } : {} });
+        this.save();
+      }
+      await this.sys.writeAs(user, path, data, opts.mode);
+      return;
+    }
+    const was = this.sys.stat(path) ?? void 0;
+    if (!this.record.steps.some((s) => s.kind === "file" && s.path === path)) {
+      const dirs = [];
+      for (let d = dirname3(path); d !== "/" && !this.sys.exists(d); d = dirname3(d)) dirs.push(d);
+      const previous = this.sys.read(path);
+      this.record.steps.push({ kind: "file", path, previous, ...previous !== null && was ? { was } : {}, ...dirs.length ? { dirs } : {} });
+      this.save();
+    }
+    this.sys.write(path, data, { mode: opts.mode ?? was?.mode, owner: opts.owner ?? was });
+  }
+  /** Records how to undo what is about to be done. */
+  onUndo(what, argv, opts = {}) {
+    this.record.steps.push({ kind: "run", what, argv, ...opts });
+    this.save();
+  }
+  start() {
+    this.save();
+  }
+};
+async function undoAll(sys, record, log) {
+  const left = [];
+  for (const step of [...record.steps].reverse()) {
+    if (step.kind === "file") {
+      try {
+        if (step.user) {
+          if (step.previous === null) await sys.removeAs(step.user, step.path, step.dirs ?? []);
+          else await sys.writeAs(step.user, step.path, step.previous);
+          continue;
+        }
+        if (step.previous === null) sys.remove(step.path);
+        else sys.write(step.path, step.previous, { mode: step.was?.mode, owner: step.was });
+        for (const d of step.dirs ?? []) sys.removeEmptyDir(d);
+      } catch (e) {
+        left.unshift(step);
+        log(`  could not put back ${step.path}: ${e.message}`);
+      }
+      continue;
+    }
+    const failedArgv = [];
+    for (const argv of step.argv) {
+      const r = await sys.run(argv, { user: step.user, input: step.input });
+      if (r.code !== 0) {
+        failedArgv.push(argv);
+        log(`  could not ${step.what}: ${(r.stderr || r.stdout).trim().split("\n").pop() ?? ""}`);
+      }
+    }
+    if (failedArgv.length) left.unshift({ ...step, argv: failedArgv });
+  }
+  if (left.length) {
+    sys.write(recordPath(sys), `${JSON.stringify({ ...record, steps: left }, null, 2)}
+`, { mode: 384 });
+  } else {
+    sys.remove(recordPath(sys));
+    sys.removeEmptyDir(stateDir(sys));
+  }
+  return left.length;
+}
+
+// src/local.ts
+var PROJECT = "controlclaw-local";
+var DEFAULT_DIR = "/opt/controlclaw-local";
+var DEFAULT_OPENCLAW_IMAGE = "ghcr.io/openclaw/openclaw:2026.10.9";
+var AGENTS_SUBNET = "172.31.251.0/24";
+var OUTSIDE_SUBNET = "172.31.252.0/24";
+var FW_AGENTS_IP = "172.31.251.2";
+var OPENCLAW_IP = "172.31.251.10";
+var FW_OUTSIDE_IP = "172.31.252.2";
+var HOST_OUTSIDE_IP = "172.31.252.1";
+var GATEWAY_PORT = 18789;
+var AGENT_LISTEN = `${HOST_OUTSIDE_IP}:${AGENT_PORT}`;
+var OPENCLAW_CONTAINER = `${PROJECT}-openclaw-1`;
+var NODE_UID = 1e3;
+var GATE_ADDR = "127.0.0.1";
+var GATE_RELAY = "/etc/controlclaw/gate-relay.mjs";
+function gateRelayScript() {
+  return [
+    "// Written by controlclaw up --local: the firewall's gates on OpenClaw's loopback.",
+    'import net from "node:net";',
+    "const say = (m) => process.stderr.write(`[controlclaw gate-relay] ${m}\\n`);",
+    'process.on("uncaughtException", (e) => say(`error: ${e?.message ?? e}`));',
+    `for (const port of ${JSON.stringify(GATE_PORTS)}) {`,
+    "  const server = net.createServer((c) => {",
+    `    const u = net.connect(port, ${q(FW_AGENTS_IP)});`,
+    "    const end = () => { c.destroy(); u.destroy(); };",
+    '    u.on("error", (e) => { say(`${port}: the firewall: ${e.code ?? e.message}`); end(); });',
+    '    c.on("error", end); c.on("close", end); u.on("close", end);',
+    "    c.pipe(u).pipe(c);",
+    "  });",
+    `  const listen = () => server.listen(port, ${q(GATE_ADDR)});`,
+    '  server.on("error", (e) => { say(`${port}: cannot listen (${e.code ?? e.message}); trying again in 5 s`); setTimeout(listen, 5000); });',
+    '  server.on("listening", () => say(`${port}: listening`));',
+    "  listen();",
+    "}",
+    ""
+  ].join("\n");
+}
+function localCompose(o) {
+  const proxy2 = `http://${FW_AGENTS_IP}:8080`;
+  const oc = (k, v) => `      ${k}: ${q(v)}`;
+  return [
+    "# Written by controlclaw up --local; removed by controlclaw disconnect (the data stays).",
+    `name: ${PROJECT}`,
+    "services:",
+    "  firewall:",
+    `    image: ${q(o.firewallImage)}`,
+    "    restart: unless-stopped",
+    "    environment:",
+    // A private address: the firewall starts its DNS for the agents.
+    oc("CC_LISTEN", FW_AGENTS_IP),
+    // The panel and pairing on the outside network only: OpenClaw, on the agents network, cannot
+    // reach them. Published on this machine's loopback (below).
+    oc("LOCAL_PANEL_BIND", `${FW_OUTSIDE_IP}:8800`),
+    oc("LOCAL_PANEL_INSECURE", "1"),
+    oc("PAIR_BIND", `${FW_OUTSIDE_IP}:8801`),
+    oc("PAIR_PROXY_ADDR", `${FW_AGENTS_IP}:8080`),
+    oc("PAIR_DNS_ADDR", FW_AGENTS_IP),
+    oc("CC_FORWARD", `${GATEWAY_PORT}=${OPENCLAW_IP}:${GATEWAY_PORT}`),
+    // The relay, the pages and webhooks on the outside network too; the connector gates on the
+    // agents network, where OpenClaw dials them.
+    oc("CC_FORWARD_BIND", FW_OUTSIDE_IP),
+    oc("INGRESS_BIND", FW_OUTSIDE_IP),
+    oc("CONNECTOR_GATE_BIND", FW_AGENTS_IP),
+    "    volumes:",
+    "      - firewall:/opt/controlclaw",
+    "    tmpfs:",
+    "      - /run/mitm/config:uid=10001,gid=10001,mode=0700,size=16m",
+    "    networks:",
+    "      agents:",
+    `        ipv4_address: ${FW_AGENTS_IP}`,
+    "      outside:",
+    `        ipv4_address: ${FW_OUTSIDE_IP}`,
+    "    ports:",
+    `      - ${q(`127.0.0.1:${GATEWAY_PORT}:${GATEWAY_PORT}`)} # OpenClaw's gateway and Control UI`,
+    `      - ${q("127.0.0.1:8800:8800")} # the firewall's panel`,
+    `      - ${q("127.0.0.1:8801:8801")} # pairing`,
+    `      - ${q("127.0.0.1:8790:8790")} # the firewall's pages and webhooks`,
+    "  openclaw:",
+    `    image: ${q(o.openclawImage)}`,
+    "    restart: unless-stopped",
+    "    init: true",
+    "    depends_on: [firewall]",
+    // The gates' relay, then the gateway: both in this container, so a restart restarts both.
+    `    command: ["sh", "-c", ${q(`node ${GATE_RELAY} & exec node dist/index.js gateway --bind lan --port ${GATEWAY_PORT}`)}]`,
+    "    env_file: [.env]",
+    "    environment:",
+    oc("HOME", "/home/node"),
+    oc("OPENCLAW_HOME", "/home/node"),
+    oc("OPENCLAW_STATE_DIR", "/home/node/.openclaw"),
+    oc("OPENCLAW_CONFIG_PATH", "/home/node/.openclaw/openclaw.json"),
+    oc("OPENCLAW_CONFIG_DIR", "/home/node/.openclaw"),
+    oc("OPENCLAW_WORKSPACE_DIR", "/home/node/.openclaw/workspace"),
+    oc("OPENCLAW_GATEWAY_PORT", String(GATEWAY_PORT)),
+    ...proxyEnv(proxy2, FW_AGENTS_IP).map(([k, v]) => oc(k, v)),
+    "    volumes:",
+    `      - ${q(`${join7(o.dir, "openclaw")}:/home/node/.openclaw`)}`,
+    `      - ${q(`${join7(o.dir, "openclaw-secrets")}:/home/node/.config/openclaw`)}`,
+    `      - ${q(`${join7(o.dir, "ca.crt")}:/etc/controlclaw/ca.crt:ro`)}`,
+    `      - ${q(`${join7(o.dir, "gate-relay.mjs")}:${GATE_RELAY}:ro`)}`,
+    `      - ${q(`${join7(o.dir, "ca-bundle.crt")}:/etc/ssl/certs/ca-certificates.crt:ro`)}`,
+    `    dns: [${q(FW_AGENTS_IP)}]`,
+    "    cap_drop: [NET_RAW, NET_ADMIN]",
+    '    security_opt: ["no-new-privileges:true"]',
+    "    networks:",
+    "      agents:",
+    `        ipv4_address: ${OPENCLAW_IP}`,
+    "    healthcheck:",
+    '      test: ["CMD", "node", "dist/docker-healthcheck.js"]',
+    "      interval: 15s",
+    "      start_period: 60s",
+    "networks:",
+    "  agents:",
+    "    internal: true",
+    ...ISOLATED_GATEWAY,
+    "    ipam:",
+    `      config: [{ subnet: ${q(AGENTS_SUBNET)} }]`,
+    "  outside:",
+    "    ipam:",
+    `      config: [{ subnet: ${q(OUTSIDE_SUBNET)} }]`,
+    "volumes:",
+    "  firewall:",
+    ""
+  ].join("\n");
+}
+var compose = (dir, ...args) => ["docker", "compose", "-p", PROJECT, "--project-directory", dir, "-f", join7(dir, "compose.yaml"), ...args];
+async function hasImage(sys, image) {
+  return (await sys.run(["docker", "image", "inspect", "--format", "{{.Id}}", image])).code === 0;
+}
+async function waitFor(sys, what, tries, test) {
+  for (let i = 0; i < tries; i++) {
+    if (await test()) return;
+    await sys.run(["sleep", "2"]);
+  }
+  throw new Error(`${what} did not come up`);
+}
+async function up(sys, io, o, net = realNet) {
+  const tmp = { dir: null };
+  try {
+    return await upWith(sys, io, o, net, tmp);
+  } finally {
+    if (tmp.dir) sys.remove(tmp.dir);
+  }
+}
+async function upWith(sys, io, o, net, tmp) {
+  if (sys.euid !== 0) {
+    io.err("up --local needs root (sudo): it runs Docker and installs the vm-agent for the container.");
+    return 1;
+  }
+  if (!o.firewallImage) {
+    io.err("up --local needs --firewall-image <image>: there is no published image yet. Build one with standalone/docker/build.sh (controlclaw-firewall:dev-amd64), or docker load its tar.");
+    return 2;
+  }
+  const existing = loadRecord(sys);
+  if (existing) {
+    io.err(`Already connected (${existing.mode}). Run controlclaw disconnect first.`);
+    return 1;
+  }
+  const dir = o.dir ?? DEFAULT_DIR;
+  const ocImage = o.openclawImage ?? DEFAULT_OPENCLAW_IMAGE;
+  const v = await sys.run(["docker", "compose", "version", "--short"]);
+  if (v.code !== 0 || !composeAtLeast(v.stdout.trim(), 2, 24, 4)) {
+    io.err(`up --local needs Docker with Compose 2.24.4 or newer (found: ${v.stdout.trim() || "none"}).`);
+    return 1;
+  }
+  const server = await sys.run(["docker", "version", "--format", "{{.Server.Version}}"]);
+  if (server.code !== 0) {
+    io.err(`Docker does not answer: ${server.stderr.trim()}`);
+    return 1;
+  }
+  const old = dockerTooOld(server.stdout.trim());
+  if (old) {
+    io.err(`up --local ${old}.`);
+    return 1;
+  }
+  if (!await hasImage(sys, o.firewallImage)) {
+    io.err(`No image ${o.firewallImage} here: build it (standalone/docker/build.sh) or docker load it first.`);
+    return 1;
+  }
+  for (const [net_, subnet] of [[`${PROJECT}_agents`, AGENTS_SUBNET], [`${PROJECT}_outside`, OUTSIDE_SUBNET]]) {
+    const taken = await subnetTaken(sys, net_, subnet);
+    if (taken) {
+      io.err(`Docker network ${taken} already uses ${subnet}, which up --local needs.`);
+      return 1;
+    }
+  }
+  const agent = await vmAgentOrRelease(await findVmAgent(sys, o.vmAgent), io);
+  if (!agent) return 1;
+  tmp.dir = agent.downloaded;
+  const vmAgent = agent.path;
+  const root = userByUid(sys, 0) ?? { name: "root", uid: 0, gid: 0, home: "/root" };
+  const record = {
+    version: 1,
+    mode: "local",
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    user: null,
+    firewall: { url: "http://127.0.0.1:8801/", proxy: `${FW_AGENTS_IP}:8080`, dns: FW_AGENTS_IP },
+    container: OPENCLAW_CONTAINER,
+    cli: ["docker", "exec", "-i", OPENCLAW_CONTAINER, "node", "dist/index.js"],
+    ca: join7(dir, "ca.crt"),
+    steps: []
+  };
+  const rec = new Recorder(sys, record);
+  rec.start();
+  const log = (l) => io.out(`  ${l}`);
+  let paired = false;
+  try {
+    if (!await hasImage(sys, ocImage)) {
+      io.out(`Pulling ${ocImage}`);
+      const p2 = await sys.run(["docker", "pull", "-q", ocImage], { timeoutMs: 9e5 });
+      if (p2.code !== 0) throw new Error(`docker pull ${ocImage}: ${p2.stderr.trim()}`);
+    }
+    io.out(`Writing ${dir}`);
+    const token = randomBytes2(24).toString("hex");
+    await rec.file(join7(dir, "compose.yaml"), localCompose({ firewallImage: o.firewallImage, openclawImage: ocImage, dir }));
+    await rec.file(join7(dir, ".env"), `# Written by controlclaw up --local.
+OPENCLAW_GATEWAY_TOKEN=${token}
+`, { mode: 384 });
+    for (const d of ["openclaw", "openclaw/workspace", "openclaw-secrets"]) {
+      const made2 = await sys.run(["install", "-d", "-m", "0700", "-o", String(NODE_UID), "-g", String(NODE_UID), join7(dir, d)]);
+      if (made2.code !== 0) throw new Error(`could not make ${join7(dir, d)}: ${made2.stderr.trim()}`);
+    }
+    io.out("Starting the firewall");
+    rec.onUndo("stop the containers (their data stays)", [compose(dir, "down")]);
+    const fw = await sys.run(compose(dir, "up", "-d", "firewall"), { timeoutMs: 3e5 });
+    if (fw.code !== 0) throw new Error(`docker compose up firewall: ${fw.stderr.trim()}`);
+    await waitFor(sys, "the firewall", 45, async () => {
+      const r = await sys.run(compose(dir, "exec", "-T", "-u", "controlclaw", "firewall", "sh", "-c", "test -s /opt/controlclaw/state/local.db && test -s /opt/controlclaw/keys/vm_public_key.pem"));
+      return r.code === 0;
+    });
+    io.out("Pairing OpenClaw with it");
+    const name = o.name ?? "openclaw";
+    const made = await sys.run(compose(dir, "exec", "-T", "-u", "controlclaw", "firewall", "mitm-agent", "pair-code", "--name", name, "--address", OPENCLAW_IP, "--replace"));
+    const code = made.stdout.trim().split("\n")[0] ?? "";
+    if (made.code !== 0 || !code) throw new Error(`mitm-agent pair-code: ${made.stderr.trim() || "no code"}`);
+    const keypair = agentKeypair();
+    const unpairSecret = randomBytes2(32).toString("hex");
+    let p = null;
+    for (let i = 0; !p; i++) {
+      try {
+        p = await pair(record.firewall.url, code, { publicKey: keypair.publicPem, name, source: "127.0.0.1", unpairSecret, agentListen: AGENT_LISTEN }, net.post);
+      } catch (e) {
+        if (i >= 15 || !e.message.startsWith("could not reach")) throw e;
+        await sys.run(["sleep", "2"]);
+      }
+    }
+    paired = true;
+    record.firewall.agentId = p.agentId;
+    record.firewall.unpair = unpairSecret;
+    log(`agent ${p.agentId} (${p.name}), known to the firewall by ${p.address}`);
+    log(`the firewall's CA: SHA-256 ${caFingerprint(p.caPem)}`);
+    const bundle = await sys.run(["docker", "run", "--rm", "--network", "none", "--entrypoint", "cat", ocImage, "/etc/ssl/certs/ca-certificates.crt"]);
+    if (bundle.code !== 0) throw new Error(`could not read ${ocImage}'s CA bundle: ${bundle.stderr.trim()}`);
+    await rec.file(join7(dir, "ca.crt"), `${p.caPem.trim()}
+`);
+    await rec.file(join7(dir, "gate-relay.mjs"), gateRelayScript());
+    await rec.file(join7(dir, "ca-bundle.crt"), `${bundle.stdout.trimEnd()}
+${p.caPem.trim()}
+`);
+    if (!sys.exists(join7(dir, "openclaw/openclaw.json"))) {
+      io.out("Setting up OpenClaw");
+      const onboard = await sys.run(
+        compose(
+          dir,
+          "run",
+          "--rm",
+          "--no-deps",
+          "-T",
+          "--entrypoint",
+          "node",
+          "openclaw",
+          "dist/index.js",
+          "onboard",
+          "--non-interactive",
+          "--accept-risk",
+          "--skip-health",
+          "--mode",
+          "local",
+          "--auth-choice",
+          "skip",
+          "--gateway-auth",
+          "token",
+          "--gateway-token-ref-env",
+          "OPENCLAW_GATEWAY_TOKEN",
+          "--skip-channels",
+          "--no-install-daemon"
+        ),
+        { timeoutMs: 3e5 }
+      );
+      if (onboard.code !== 0) throw new Error(`openclaw onboard: ${(onboard.stderr || onboard.stdout).trim().split("\n").pop()}`);
+    }
+    const origins = { gateway: { controlUi: { allowedOrigins: [`http://127.0.0.1:${GATEWAY_PORT}`, `http://localhost:${GATEWAY_PORT}`] } } };
+    const patched = await sys.run(compose(dir, "run", "--rm", "--no-deps", "-T", "--entrypoint", "node", "openclaw", "dist/index.js", "config", "patch", "--stdin"), {
+      input: JSON.stringify(origins),
+      timeoutMs: 3e5
+    });
+    if (patched.code !== 0) throw new Error(`openclaw config patch: ${(patched.stderr || patched.stdout).trim().split("\n").pop()}`);
+    io.out("Starting OpenClaw");
+    const oc = await sys.run(compose(dir, "up", "-d", "openclaw"), { timeoutMs: 3e5 });
+    if (oc.code !== 0) throw new Error(`docker compose up openclaw: ${oc.stderr.trim()}`);
+    await waitFor(sys, "OpenClaw's gateway", 120, async () => {
+      const r = await sys.run(["docker", "inspect", "-f", "{{.State.Health.Status}}", OPENCLAW_CONTAINER]);
+      return r.stdout.trim() === "healthy";
+    });
+    io.out("Installing the vm-agent");
+    const paths = await installAgent(sys, rec, {
+      binary: vmAgent,
+      user: root,
+      firewallUrl: record.firewall.url,
+      firewallKey: p.firewallPublicKey,
+      container: OPENCLAW_CONTAINER,
+      agentId: p.agentId,
+      keypair,
+      // On the host's side of the `outside` network, where the firewall's container reaches it;
+      // OpenClaw, on the internal network only, cannot.
+      listen: AGENT_LISTEN,
+      allowFrom: [FW_OUTSIDE_IP],
+      gate: GATE_ADDR,
+      after: "docker.service"
+    });
+    log(`${paths.bin}, config ${paths.config}`);
+    io.out("");
+    for (const c of await local.status(sys, record)) io.out(`${c.ok ? "\u2713" : "\u2717"} ${c.name}: ${c.detail}`);
+    const logs = await sys.run(compose(dir, "logs", "--no-color", "firewall"));
+    const setup = /setup token \(POST \/api\/setup\): ([0-9a-f]+)/.exec(logs.stdout)?.[1];
+    io.out("");
+    io.out(`OpenClaw:  http://127.0.0.1:${GATEWAY_PORT}/#token=${token}`);
+    io.out(`Firewall:  http://127.0.0.1:8800${setup ? `  (first sign-in: the setup token ${setup})` : ""}`);
+    io.out("           From another machine: ssh -L 8800:127.0.0.1:8800 -L 18789:127.0.0.1:18789 <this machine>");
+    if (setup) io.out("! The firewall blocks everything until you add rules in its panel (Internet access): allow your model provider first.");
+    io.out(`Undo it with: controlclaw disconnect (the data in ${dir} and the firewall's volume stay)`);
+    return 0;
+  } catch (e) {
+    io.err(`up --local failed: ${e.message}`);
+    io.err("Undoing what was done");
+    if (paired) await unpair(record.firewall.url, record.firewall.agentId ?? "", record.firewall.unpair ?? "", net.post);
+    await undoAll(sys, record, io.err);
+    return 1;
+  }
+}
+var local = {
+  name: "local",
+  protects: "strong: OpenClaw runs in a container whose only way out is the firewall container (controlclaw up --local)",
+  blockers(f) {
+    const out = [];
+    if (!f.root) out.push("needs root (run it with sudo)");
+    if (!f.docker?.ok) out.push("needs Docker");
+    else if (!f.docker.compose || !composeAtLeast(f.docker.compose, 2, 24, 4)) out.push("needs Compose 2.24.4 or newer");
+    out.push("made by controlclaw up --local, not connect");
+    return out;
+  },
+  async install() {
+    throw new Error("use controlclaw up --local");
+  },
+  async status(sys) {
+    const checks = [];
+    for (const svc of ["firewall", "openclaw"]) {
+      const r = await sys.run(["docker", "inspect", "-f", "{{.State.Status}} {{if .State.Health}}{{.State.Health.Status}}{{end}}", `${PROJECT}-${svc}-1`]);
+      const s = r.stdout.trim();
+      checks.push({ name: svc, ok: r.code === 0 && s.startsWith("running"), detail: s || "not running" });
+    }
+    const nets = await sys.run(["docker", "inspect", "-f", "{{json .NetworkSettings.Networks}}", OPENCLAW_CONTAINER]);
+    let names = [];
+    try {
+      names = Object.keys(JSON.parse(nets.stdout));
+    } catch {
+    }
+    checks.push({ name: "OpenClaw's network", ok: names.length === 1 && names[0] === `${PROJECT}_agents`, detail: names.join(", ") || "none" });
+    checks.push(await gatewayIsolated(sys, `${PROJECT}_agents`));
+    const probe = await sys.run(["docker", "exec", OPENCLAW_CONTAINER, "node", "-e", PROBE], { timeoutMs: 3e4 });
+    const answer = probe.stdout.trim();
+    checks.push({ name: "request from OpenClaw", ok: /^HTTP \d+/.test(answer), detail: answer || "no answer" });
+    return checks;
+  }
+};
+
+// src/doctor.ts
+var MODES = [docker, host, proxy, remote, local];
+async function gatherFacts(sys, opts = {}) {
+  const osRelease = sys.read("/etc/os-release") ?? "";
+  const os = /^PRETTY_NAME="?([^"\n]*)"?/m.exec(osRelease)?.[1] ?? null;
+  const [nft, apt, chrome, certutil, wireguard, vmAgent, user] = await Promise.all([
+    which(sys, "nft").then((p) => p ?? (sys.exists("/usr/sbin/nft") ? "/usr/sbin/nft" : null)),
+    which(sys, "apt-get"),
+    which(sys, "google-chrome", "google-chrome-stable", "chromium", "chromium-browser"),
+    which(sys, "certutil"),
+    which(sys, "wg"),
+    findVmAgent(sys, opts.vmAgent),
+    findUser(sys, opts.user)
+  ]);
+  const [dockerV, composeV, resolved, openclaw] = await Promise.all([
+    sys.run(["docker", "version", "--format", "{{.Server.Version}}"], { timeoutMs: 15e3 }),
+    sys.run(["docker", "compose", "version", "--short"], { timeoutMs: 15e3 }),
+    sys.run(["systemctl", "is-active", "systemd-resolved"], { timeoutMs: 15e3 }),
+    findOpenClaw(sys, user, vmAgent)
+  ]);
+  const hasDocker = dockerV.code !== 127;
+  const id = openclaw.user ? await sys.run(["id", "-nG", openclaw.user.name]) : null;
+  const groups = id?.code === 0 ? id.stdout.split(/\s+/) : [];
+  return {
+    os,
+    linux: process.platform === "linux",
+    systemd: sys.exists("/run/systemd/system"),
+    root: sys.euid === 0,
+    nft,
+    docker: hasDocker ? { ok: dockerV.code === 0, version: dockerV.stdout.trim() || null, compose: composeV.code === 0 ? composeV.stdout.trim() : null } : null,
+    redsocks: sys.exists("/usr/sbin/redsocks"),
+    apt: apt !== null,
+    resolved: resolved.stdout.trim() === "active",
+    nameservers: (sys.read("/etc/resolv.conf") ?? "").split("\n").flatMap((l) => /^nameserver\s+(\S+)/.exec(l)?.[1] ?? []),
+    chrome,
+    certutil,
+    wireguard,
+    vmAgent,
+    openclaw,
+    userSudo: groups.some((g) => ["sudo", "admin", "wheel"].includes(g)),
+    escapeGroups: groups.filter((g) => ESCAPE_GROUPS.includes(g)),
+    groupsUnknown: id !== null && id.code !== 0,
+    resolveUid: userByName(sys, "systemd-resolve")?.uid ?? null
+  };
+}
+function verdicts(f) {
+  return MODES.map((m) => {
+    const blockers = m.blockers(f);
+    return { name: m.name, ok: blockers.length === 0, protects: m.protects, blockers };
+  });
+}
+function warnings(f) {
+  const out = [];
+  const u = f.openclaw.user;
+  if (u?.uid === 0 && f.openclaw.install.runs.kind !== "docker") {
+    out.push("OpenClaw runs as root. Host mode needs it under its own user; proxy mode works but cannot stop shell commands.");
+  }
+  if (u && u.uid !== 0 && f.userSudo) out.push(`${u.name} can use sudo, so in host mode OpenClaw (or its agent) can remove the rules.`);
+  if (u && u.uid !== 0 && f.escapeGroups.length) out.push(escapeGroupMessage(u, f.escapeGroups));
+  if (f.resolved) {
+    out.push("Host mode points this machine's DNS at the firewall. If the firewall stops, DNS stops for every program here, not only OpenClaw.");
+  }
+  if (!f.vmAgent) out.push("No vm-agent binary found: connect needs one (--vm-agent <path>).");
+  return out;
+}
+function runsText(r, user) {
+  const who = user ? `, user ${user}` : "";
+  switch (r.kind) {
+    case "systemd-user":
+      return `systemd user unit ${r.unit}${who}`;
+    case "systemd-system":
+      return `systemd unit ${r.unit}${who}`;
+    case "docker":
+      return `Docker container ${r.container}`;
+    case "pm2":
+      return `pm2 process ${r.name}${who}`;
+    case "process":
+      return `a plain process${r.pid ? ` (pid ${r.pid})` : ""}${who}`;
+    case "not-running":
+      return `installed, not running${who}`;
+    case "not-found":
+      return "not found";
+  }
+}
+function renderDoctor(f) {
+  const row = (k, v) => `  ${k.padEnd(11)} ${v}`;
+  const i = f.openclaw.install;
+  const lines = [
+    "This machine",
+    row("OS", `${f.os ?? "unknown"}${f.systemd ? " (systemd)" : ""}`),
+    row("Root", f.root ? "yes" : "no"),
+    row("nftables", f.nft ?? "not found"),
+    row("Docker", f.docker ? f.docker.ok ? `${f.docker.version}, Compose ${f.docker.compose ?? "missing"}` : "installed, but this user cannot use it" : "not found"),
+    row("redsocks", f.redsocks ? "installed" : f.apt ? "not installed (apt-get can install it)" : "not installed"),
+    row("DNS", `${f.resolved ? "systemd-resolved" : "resolv.conf"} (${f.nameservers.join(", ") || "no nameserver"})`),
+    row("Chrome", f.chrome ? `${f.chrome}${f.certutil ? "" : " (no certutil: the CA cannot be added to it)"}` : "not found"),
+    row("WireGuard", f.wireguard ?? "not found"),
+    row("vm-agent", f.vmAgent ?? "not found"),
+    "",
+    "OpenClaw"
+  ];
+  if (i.runs.kind === "not-found") {
+    lines.push(row("Found", "no"));
+  } else {
+    lines.push(
+      row("CLI", `${i.runs.kind === "docker" ? cliArgv(i, []).join(" ") : i.cli ?? "?"}${i.version ? ` (${i.version})` : ""}`),
+      row("Config", i.config_file ?? "unknown"),
+      row("Runs as", runsText(i.runs, f.openclaw.user?.name ?? null)),
+      row("Gateway", `port ${i.gateway_port}`)
+    );
+    if (f.openclaw.via === "light") lines.push(row("", "(a quick look: install the vm-agent for the full one)"));
+  }
+  lines.push("", "Modes");
+  for (const v of verdicts(f)) {
+    lines.push(`  ${v.ok ? "\u2713" : "\u2717"} ${v.name.padEnd(7)} ${v.ok ? v.protects : v.blockers.join("; ")}`);
+  }
+  const w = warnings(f);
+  if (w.length) lines.push("", "Warnings", ...w.map((x) => `  ! ${x}`));
+  return lines.join("\n");
+}
+function doctorJson(f) {
+  return { facts: f, modes: verdicts(f), warnings: warnings(f) };
+}
+
+// src/commands.ts
+async function doctor(sys, io, opts) {
+  const f = await gatherFacts(sys, opts);
+  io.out(opts.json ? JSON.stringify(doctorJson(f), null, 2) : renderDoctor(f));
+  return 0;
+}
+async function readCode(sys, io, o) {
+  if (o.codeFile) {
+    const text = sys.read(o.codeFile);
+    if (text === null) {
+      io.err(`--code-file: cannot read ${o.codeFile}`);
+      return null;
+    }
+    if ((sys.stat(o.codeFile)?.mode ?? 0) & 63) io.out(`! ${o.codeFile} can be read by other users: keep it 0600, and delete it after.`);
+    return text.trim();
+  }
+  if (o.code && o.code !== "-") {
+    io.err("Not on the command line: every user of this machine can read it while connect runs. Leave out --code and type the code when asked, or use --code - (stdin) or --code-file <file>.");
+    return null;
+  }
+  const typed = io.ask ? await io.ask(o.code === "-" ? "" : "Pairing code from the firewall (mitm-agent pair-code): ") : null;
+  if (!typed?.trim()) {
+    io.err("No pairing code: type it when asked, or pass --code - (stdin) or --code-file <file>.");
+    return null;
+  }
+  return typed.trim();
+}
+function readKey(sys, v) {
+  if (v.trim().startsWith("-----BEGIN")) return v.trim();
+  const pem = sys.read(v);
+  if (!pem || !pem.includes("-----BEGIN PUBLIC KEY-----")) throw new Error(`--firewall-key: ${v} is not a PEM public key`);
+  return pem.trim();
+}
+var realNet = { post: httpPost, source: sourceToward, ipv4: ipv4Of, sameMachine: onThisMachine };
+async function connect2(sys, io, o, net = realNet) {
+  const tmp = { dir: null };
+  try {
+    return await connectWith(sys, io, o, net, tmp);
+  } finally {
+    if (tmp.dir) sys.remove(tmp.dir);
+  }
+}
+async function connectWith(sys, io, o, net, tmp) {
+  const mode = MODES.find((m) => m.name === o.mode);
+  if (!mode) {
+    io.err("--mode must be docker, host, proxy or remote.");
+    return 2;
+  }
+  if (!o.firewall) {
+    io.err("connect needs --firewall <url>: the firewall's pairing address (or, by hand, its URL with --ca and --firewall-key).");
+    return 2;
+  }
+  const pairing = !o.ca;
+  if (mode.name === "remote" && !pairing) {
+    io.err("Remote mode pairs with a code (the firewall gives this machine its tunnel): leave out --ca and --firewall-key.");
+    return 2;
+  }
+  if (mode.name === "remote" && (o.proxy || o.dns)) {
+    io.err("Remote mode uses the firewall's proxy and DNS inside the tunnel: leave out --proxy and --dns.");
+    return 2;
+  }
+  if (pairing && o.firewallKey) {
+    io.err("--firewall-key goes with --ca. Without them, connect pairs with a code, which brings both.");
+    return 2;
+  }
+  if (!pairing && (o.code || o.codeFile)) {
+    io.err("A pairing code brings the firewall's CA and key: leave out --ca and --firewall-key.");
+    return 2;
+  }
+  const existing = loadRecord(sys);
+  if (existing) {
+    io.err(`Already connected (${existing.mode} mode). Run controlclaw disconnect first (--force gives up steps that keep failing).`);
+    return 1;
+  }
+  let url;
+  try {
+    url = new URL(o.firewall);
+  } catch {
+    io.err(`--firewall: not a URL: ${o.firewall}`);
+    return 2;
+  }
+  let caPem = null;
+  let key = null;
+  let code = null;
+  if (pairing) {
+    code = await readCode(sys, io, o);
+    if (code === null) return 2;
+    if (!normalizeCode(code)) {
+      io.err("The pairing code is 12 letters and digits, like 4F7K-92QD-XM3P.");
+      return 2;
+    }
+  } else {
+    caPem = sys.read(o.ca ?? "");
+    const bad = caPem === null ? `cannot read ${o.ca}` : checkPem(caPem);
+    if (bad || !caPem) {
+      io.err(`--ca: ${bad}`);
+      return 2;
+    }
+    try {
+      if (o.firewallKey) key = readKey(sys, o.firewallKey);
+    } catch (e) {
+      io.err(e.message);
+      return 2;
+    }
+  }
+  io.out("Checking this machine");
+  let facts = await gatherFacts(sys, { user: o.user, vmAgent: o.vmAgent });
+  const agent = await vmAgentOrRelease(facts.vmAgent, io);
+  if (!agent) return 1;
+  const binary = agent.path;
+  if (agent.downloaded) {
+    tmp.dir = agent.downloaded;
+    facts = await gatherFacts(sys, { user: o.user, vmAgent: binary });
+  }
+  if (facts.openclaw.discoverError) {
+    io.err(`The vm-agent could not look at this OpenClaw (vm-agent discover: ${facts.openclaw.discoverError}).`);
+    return 1;
+  }
+  const blockers = mode.blockers(facts);
+  if (blockers.length) {
+    io.err(`This machine cannot do ${mode.name} mode:`);
+    for (const b of blockers) io.err(`  - ${b}`);
+    return 1;
+  }
+  const install = facts.openclaw.install;
+  const user = facts.openclaw.user;
+  const container = install.runs.kind === "docker" ? install.runs.container : void 0;
+  const agentUser = user ?? userByUid(sys, sys.euid);
+  if (!agentUser) {
+    io.err("Cannot tell which user to run the vm-agent as. Pass --user.");
+    return 1;
+  }
+  let paired = null;
+  let keypair;
+  let wgKeys;
+  const unpairSecret = randomBytes3(32).toString("hex");
+  let reach;
+  let sameHost = true;
+  if (code !== null) {
+    keypair = agentKeypair();
+    wgKeys = mode.name === "remote" ? wgKeypair() : void 0;
+    try {
+      const ip = await net.ipv4(url.hostname);
+      const source = await net.source(ip);
+      const base = new URL(url.toString());
+      if (base.protocol === "http:") base.hostname = ip;
+      io.out(`Pairing with ${pairUrl(base.toString())}, from ${source}`);
+      sameHost = (net.sameMachine ?? onThisMachine)(ip, source);
+      const agentListen = !wgKeys && sameHost ? `${source}:${AGENT_PORT}` : void 0;
+      paired = await pair(base.toString(), code, { publicKey: keypair.publicPem, name: o.name ?? hostname(), source, unpairSecret, wgPublicKey: wgKeys?.publicKey, agentListen }, net.post);
+      reach = paired.wg ? { listen: `${paired.wg.address}:${AGENT_PORT}`, allowFrom: [paired.wg.firewallAddress] } : agentListen ? { listen: agentListen, allowFrom: [paired.callsFrom ?? ip] } : void 0;
+    } catch (e) {
+      io.err(`Pairing failed: ${e.message}`);
+      return 1;
+    }
+    if (wgKeys && !paired.wg) {
+      io.err("Pairing failed: the firewall gave no tunnel (does it run WireGuard? install.sh --wireguard)");
+      return 1;
+    }
+    caPem = paired.caPem;
+    key = paired.firewallPublicKey;
+    io.out(`  agent ${paired.agentId} (${paired.name}), known to the firewall by ${paired.address}`);
+    io.out(`  the firewall's CA: SHA-256 ${caFingerprint(caPem)}`);
+    if (paired.replaced.length) {
+      io.out(`  ! the firewall had ${paired.replaced.join(", ")} at ${paired.address}: this machine replaces it (the proxy tells agents apart by address only)`);
+    }
+  }
+  const badCa = caPem === null ? "missing" : checkPem(caPem);
+  if (badCa || caPem === null) {
+    io.err(`The firewall's CA: ${badCa}`);
+    return 1;
+  }
+  let proxyAddr;
+  let dns = null;
+  try {
+    const p = splitHostPort(o.proxy ?? paired?.proxy ?? url.hostname, 8080);
+    proxyAddr = `${p.host}:${p.port}`;
+    if (mode.name !== "proxy") dns = await ipv4Of(o.dns ?? paired?.dns ?? url.hostname);
+  } catch (e) {
+    io.err(e.message);
+    return 2;
+  }
+  const record = {
+    version: 1,
+    mode: mode.name,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    user,
+    firewall: { url: url.toString(), proxy: proxyAddr, dns, ...paired ? { agentId: paired.agentId, unpair: unpairSecret } : {} },
+    container,
+    cli: cliArgv(install, []),
+    ca: mode.name === "docker" ? CONTAINER_CA : join8(stateDir(sys), "ca.crt"),
+    steps: []
+  };
+  const rec = new Recorder(sys, record);
+  rec.start();
+  const log = (l) => io.out(`  ${l}`);
+  try {
+    const restart = restartArgv(install);
+    if (restart && mode.name !== "docker") {
+      rec.onUndo("restart OpenClaw", [restart], { user: restartUser(install, user) });
+    }
+    const caPath = record.ca;
+    await rec.file(caPath, `${caPem.trim()}
+`);
+    const tunnel = paired?.wg && wgKeys ? { address: paired.wg.address, firewall: paired.wg.firewallAddress, firewallPublicKey: paired.wg.firewallPublicKey, endpoint: paired.wg.endpoint, privateKey: wgKeys.privateKey } : void 0;
+    const ctx = { sys, rec, facts, install, user, firewall: record.firewall, caPem, caPath, log, ...tunnel ? { tunnel } : {} };
+    if (mode.prepare) {
+      io.out(`Preparing ${mode.name} mode`);
+      await mode.prepare(ctx);
+    }
+    io.out("Installing the vm-agent");
+    const paths = await installAgent(sys, rec, {
+      binary,
+      user: agentUser,
+      firewallUrl: url.toString(),
+      firewallKey: key,
+      container,
+      agentId: paired?.agentId,
+      keypair,
+      ...reach ?? {},
+      // Where OpenClaw reaches the firewall's gates: the gate container in docker mode, else the
+      // proxy's address (the tunnel's in remote mode). Not in proxy mode: everything OpenClaw sends
+      // goes through the proxy there, which never connects to the firewall itself.
+      ...mode.name === "proxy" ? {} : { gate: mode.name === "docker" ? GATE_IP : await ipv4Of(splitHostPort(proxyAddr, 8080).host) },
+      // Remote: once the tunnel is up.
+      ...paired?.wg ? { after: WG_UNIT } : {}
+    });
+    log(`${paths.bin}, config ${paths.config}`);
+    if (!key) log("No --firewall-key: the agent answers nothing until it has the firewall's key (pair with --code).");
+    io.out(`Setting up ${mode.name} mode`);
+    const notes = await mode.install(ctx);
+    io.out("");
+    for (const c of [...await mode.status(sys, record), await proxyAnswers(proxyAddr)]) io.out(`${c.ok ? "\u2713" : "\u2717"} ${c.name}: ${c.detail}`);
+    for (const n of notes) io.out(`! ${n}`);
+    if (paired && !paired.wg && !sameHost) {
+      io.out("! The firewall is on another machine: it does not call this agent's vm-agent (that would be plain HTTP across the network), so it cannot set bots, models or MCP servers here or stop OpenClaw. Use --mode remote for those.");
+    }
+    io.out("");
+    io.out(`Connected in ${mode.name} mode. Protection: ${mode.protects}.`);
+    io.out("Undo it all with: controlclaw disconnect");
+    return 0;
+  } catch (e) {
+    io.err(`Connect failed: ${e.message}`);
+    io.err("Undoing what was done");
+    await undoAll(sys, record, io.err);
+    if (paired) {
+      await unpairFrom(record.firewall, io, net.post);
+      io.err("The code is spent: make a new one.");
+    }
+    return 1;
+  }
+}
+function needsSudo(sys, io, what) {
+  if (sys.euid === 0 || !sys.exists(ROOT_RECORD)) return false;
+  io.err(`This machine was connected with sudo. Run: sudo controlclaw ${what}`);
+  return true;
+}
+async function unpairFrom(fw, io, post) {
+  if (!fw.agentId) return;
+  const r = fw.unpair ? await unpair(fw.url, fw.agentId, fw.unpair, post) : "no secret was kept";
+  if (r === null) io.out(`  The firewall forgot this machine (${fw.agentId}).`);
+  else io.out(`  ! The firewall still lists this machine as ${fw.agentId} (${r}); remove it there if it is not coming back.`);
+}
+async function disconnect(sys, io, opts = {}, post = httpPost) {
+  const record = loadRecord(sys);
+  if (!record && needsSudo(sys, io, "disconnect")) return 1;
+  if (!record) {
+    io.out("Not connected.");
+    return 0;
+  }
+  io.out(`Removing ${record.mode} mode, the CA and the vm-agent`);
+  await unpairFrom(record.firewall, io, post);
+  const failed = await undoAll(sys, record, io.err);
+  if (!failed) {
+    io.out("Done. This machine is as it was before connect.");
+    return 0;
+  }
+  if (opts.force) {
+    sys.remove(recordPath(sys));
+    sys.removeEmptyDir(stateDir(sys));
+    io.out(`Done. ${failed} step(s) failed (above) and were given up; check them by hand.`);
+    return 1;
+  }
+  io.out(`Done, with ${failed} step(s) that failed (above). They are kept: run disconnect again once fixed, or disconnect --force to give them up.`);
+  return 1;
+}
+async function status(sys, io, opts) {
+  const record = loadRecord(sys);
+  if (!record && needsSudo(sys, io, "status")) return 1;
+  if (!record) {
+    io.out(opts.json ? JSON.stringify({ connected: false }) : "Not connected.");
+    return 0;
+  }
+  const mode = MODES.find((m) => m.name === record.mode);
+  const checks = await mode.status(sys, record);
+  const agentUser = record.user ?? userByUid(sys, sys.euid);
+  if (agentUser) {
+    const p = agentPaths(sys, agentUser);
+    const r = await sys.run([...p.system ? ["systemctl"] : ["systemctl", "--user"], "is-active", UNIT]);
+    checks.push({ name: "vm-agent", ok: r.stdout.trim() === "active", detail: r.stdout.trim() || "unknown" });
+  }
+  if (record.mode !== "local") {
+    checks.push(await proxyAnswers(record.firewall.proxy));
+    if (record.firewall.dns && !checks.some((c) => c.name === "firewall DNS")) checks.push(await dnsAnswers(record.firewall.dns));
+  }
+  const ok = checks.every((c) => c.ok);
+  if (opts.json) {
+    io.out(JSON.stringify({ connected: true, mode: record.mode, since: record.at, firewall: record.firewall, ok, checks }, null, 2));
+  } else {
+    io.out(`Connected in ${record.mode} mode since ${record.at}, firewall ${record.firewall.url}${record.firewall.agentId ? `, as ${record.firewall.agentId}` : ""}`);
+    for (const c of checks) io.out(`  ${c.ok ? "\u2713" : "\u2717"} ${c.name}: ${c.detail}`);
+  }
+  return ok ? 0 : 1;
+}
+
+// src/cli.ts
+var VERSION = true ? "0.9.4" : "0.0.0-dev";
+var USAGE = `controlclaw ${VERSION}
+
+  Connect a machine that runs OpenClaw to a ControlClaw firewall.
+
+  controlclaw doctor [--json]
+      What this machine has, which modes it can do, and how much each protects.
+
+  controlclaw connect --mode docker|host|proxy|remote --firewall <url> [--code - | --code-file <file>]
+                      [--name <agent name>] [--proxy <host:port>] [--dns <ip>]
+                      [--user <name>] [--vm-agent <path>]
+      Pair with the firewall using a one-time code from it (mitm-agent pair-code), then install
+      the vm-agent, the firewall's CA and the capture for the mode. --firewall is the firewall's
+      pairing address, such as http://fw.example.com:8801. connect asks for the code; --code -
+      reads it from stdin, --code-file from a file. --code <code> is refused: other users can read it.
+
+  controlclaw connect --mode ... --firewall <url> --ca <file> [--firewall-key <pem>] ...
+      The same without pairing: the firewall's CA and key by hand.
+      --proxy defaults to what pairing says, else the firewall's host, port 8080; --dns likewise.
+
+  controlclaw up --local --firewall-image <image> [--openclaw-image <image>] [--dir <folder>]
+                 [--name <agent name>] [--vm-agent <path>]
+      The firewall and OpenClaw as two containers on this machine, OpenClaw's only way out through
+      the firewall, paired; prints the addresses of OpenClaw and of the firewall's panel.
+
+  controlclaw disconnect [--force]
+      Remove everything connect installed and put back what it changed. Steps that fail are kept
+      for another try; --force gives them up.
+
+  controlclaw status [--json]
+      Whether the capture, the vm-agent and the firewall are up.
+
+  Docker and host mode need root (sudo). Proxy mode works without it.
+`;
+async function run(argv, io, sys = realSys()) {
+  const [command, ...rest] = argv;
+  let values;
+  try {
+    ({ values } = parseArgs({
+      args: rest,
+      strict: true,
+      options: {
+        json: { type: "boolean" },
+        force: { type: "boolean" },
+        mode: { type: "string" },
+        firewall: { type: "string" },
+        ca: { type: "string" },
+        "firewall-key": { type: "string" },
+        proxy: { type: "string" },
+        dns: { type: "string" },
+        user: { type: "string" },
+        "vm-agent": { type: "string" },
+        code: { type: "string" },
+        "code-file": { type: "string" },
+        name: { type: "string" },
+        local: { type: "boolean" },
+        "firewall-image": { type: "string" },
+        "openclaw-image": { type: "string" },
+        dir: { type: "string" }
+      }
+    }));
+  } catch (e) {
+    io.err(e.message);
+    return 2;
+  }
+  const s = (k) => typeof values[k] === "string" ? values[k] : void 0;
+  switch (command) {
+    case "doctor":
+      return doctor(sys, io, { json: values.json === true, user: s("user"), vmAgent: s("vm-agent") });
+    case "connect":
+      return connect2(sys, io, {
+        mode: s("mode"),
+        firewall: s("firewall"),
+        ca: s("ca"),
+        firewallKey: s("firewall-key"),
+        proxy: s("proxy"),
+        dns: s("dns"),
+        user: s("user"),
+        vmAgent: s("vm-agent"),
+        code: s("code"),
+        codeFile: s("code-file"),
+        name: s("name")
+      });
+    case "up":
+      if (values.local !== true) {
+        io.err("up --local is the only shape for now.");
+        return 2;
+      }
+      return up(sys, io, {
+        firewallImage: s("firewall-image"),
+        openclawImage: s("openclaw-image"),
+        dir: s("dir"),
+        name: s("name"),
+        vmAgent: s("vm-agent")
+      });
+    case "disconnect":
+      return disconnect(sys, io, { force: values.force === true });
+    case "status":
+      return status(sys, io, { json: values.json === true });
+    case "--version":
+    case "version":
+      io.out(VERSION);
+      return 0;
+    case void 0:
+    case "help":
+    case "--help":
+    case "-h":
+      io.out(USAGE);
+      return command === void 0 ? 2 : 0;
+    default:
+      io.err(`Unknown command: ${command}
+`);
+      io.err(USAGE);
+      return 2;
+  }
+}
+function terminalIo() {
+  return { out: (l) => console.log(l), err: (l) => console.error(l), ask };
+}
+function ask(prompt) {
+  return new Promise((resolve) => {
+    const tty = process.stdin.isTTY === true;
+    const rl = createInterface({ input: process.stdin, output: tty ? process.stderr : void 0, terminal: tty });
+    if (tty) {
+      process.stderr.write(prompt);
+      rl._writeToOutput = () => {
+      };
+    }
+    let done = false;
+    rl.once("line", (line) => {
+      done = true;
+      if (tty) process.stderr.write("\n");
+      rl.close();
+      resolve(line);
+    });
+    rl.once("close", () => {
+      if (!done) resolve(null);
+    });
+    rl.once("SIGINT", () => {
+      if (tty) process.stderr.write("\n");
+      rl.close();
+      process.exit(130);
+    });
+  });
+}
+
+// src/index.ts
+process.exitCode = await run(process.argv.slice(2), terminalIo());