// Older published baselines predate this warning, but still need update coverage.

const BAD_PLUGIN_DIAGNOSTIC_MIN_VERSION = "2026.5.7";

// Restored Ubuntu snapshots may immediately run unattended-upgrades. Let that

// legitimate maintenance finish instead of racing or disabling the OS service.

const APT_LOCK_TIMEOUT_SECONDS = 900;

// Restored Ubuntu snapshots may immediately run package maintenance for hours.

// Reuse an existing downloader before touching apt, then bound the fallback.

const APT_LOCK_RETRY_SECONDS = 900;

const BOOTSTRAP_TIMEOUT_SECONDS = 1200;

function parseOpenClawPackageVersion(value: string): string | null {

this.guestExec(["hwclock", "--systohc"], { check: false });

this.guestExec(["timedatectl", "set-ntp", "true"], { check: false });

this.guestExec(["systemctl", "restart", "systemd-timesyncd"], { check: false });

this.guestExec([

"apt-get",

"-o",

"Acquire::Check-Date=false",

"-o",

`DPkg::Lock::Timeout=${APT_LOCK_TIMEOUT_SECONDS}`,

"update",

]);

this.guestExec([

"apt-get",

"-o",

`DPkg::Lock::Timeout=${APT_LOCK_TIMEOUT_SECONDS}`,

"install",

"-y",

"curl",

"ca-certificates",

]);

this.guest.bash(`

set -e

if command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1; then

exit 0

fi

deadline=$((SECONDS + ${APT_LOCK_RETRY_SECONDS}))

run_apt_with_lock_retry() {

local output status

while true; do

if output="$("$@" 2>&1)"; then

status=0

else

status=$?

fi

printf '%s\n' "$output"

if [ "$status" -eq 0 ]; then

return 0

fi

case "$output" in

*"Could not get lock"*|*"Unable to acquire the dpkg frontend lock"*|*"Unable to lock directory"*)

if [ "$SECONDS" -ge "$deadline" ]; then

printf 'Timed out waiting for Ubuntu package maintenance locks\n' >&2

return "$status"

fi

sleep 5

;;

*)

return "$status"

;;

esac

done

}

run_apt_with_lock_retry apt-get -o Acquire::Check-Date=false -o DPkg::Lock::Timeout=30 update

run_apt_with_lock_retry apt-get -o DPkg::Lock::Timeout=30 install -y curl ca-certificates`);

}

private installLatestRelease(): void {

this.guestExec(["curl", "-fsSL", this.options.installUrl, "-o", "/tmp/openclaw-install.sh"]);

this.downloadGuestFile(this.options.installUrl, "/tmp/openclaw-install.sh");

if (this.options.installVersion) {

this.guestExec([

"/usr/bin/env",

this.guestExec(["openclaw", "--version"]);

}

private downloadGuestFile(url: string, outputPath: string): void {

this.guest.bash(`

set -e

if command -v curl >/dev/null 2>&1; then

curl -fsSL ${shellQuote(url)} -o ${shellQuote(outputPath)}

else

wget -q -O ${shellQuote(outputPath)} ${shellQuote(url)}

fi`);

}

private installMainTgz(tempName: string): void {

if (!this.artifact || !this.server) {

die("package artifact/server missing");

}

const tgzUrl = this.server.urlFor(this.artifact.path);

this.guestExec(["curl", "-fsSL", tgzUrl, "-o", `/tmp/${tempName}`]);

this.downloadGuestFile(tgzUrl, `/tmp/${tempName}`);

this.guestExec(["npm", "install", "-g", `/tmp/${tempName}`, "--no-fund", "--no-audit"]);

this.guestExec(["openclaw", "--version"]);

}