@1claw/cli 0.34.6 → 0.35.0

package/dist/src/commands/publish.js

@@ -0,0 +1,153 @@
+import { Command } from "commander";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import chalk from "chalk";
+import ora from "ora";
+import { printSuccess, printError, printWarning, printInfo, printKeyValue, } from "../output.js";
+import { dockerBuild, dockerTag, dockerPush, dockerCommit, dockerContainerStatus, } from "../lib/docker-client.js";
+import { buildModuleImage, DEFAULT_BASE_IMAGE } from "../lib/image-build.js";
+import { resolveModules } from "../modules/registry.js";
+import { loadContainerState, saveContainerState, } from "../lib/container-config.js";
+export const publishCommand = new Command("publish")
+    .description("Build and push your custom agent container to a registry")
+    .option("--name <name>", "Container name (from `1claw init` state)")
+    .option("--tag <tag>", "Image tag (default: {name}:latest)")
+    .option("--registry <url>", "Registry URL (default: docker.io)")
+    .option("--dockerfile <path>", "Custom Dockerfile (build from context)")
+    .option("--context <path>", "Build context directory (default: .)")
+    .option("--commit", "Snapshot a running container via `docker commit`")
+    .action(async (opts) => {
+    try {
+        await publishAction(opts);
+    }
+    catch (err) {
+        printError(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+});
+function resolveTag(opts, fallbackName) {
+    let tag = opts.tag ?? `${fallbackName}:latest`;
+    if (opts.registry && !tag.startsWith(opts.registry)) {
+        const host = opts.registry.replace(/^https?:\/\//, "").replace(/\/$/, "");
+        if (host && host !== "docker.io")
+            tag = `${host}/${tag}`;
+    }
+    if (!opts.tag) {
+        printWarning(`No --tag given; using "${tag}". For Docker Hub use --tag <username>/<name>:<version>.`);
+    }
+    return tag;
+}
+async function publishAction(opts) {
+    console.log();
+    // CASE B — custom Dockerfile / current directory (no --name).
+    if (!opts.name) {
+        const context = resolve(opts.context ?? ".");
+        const dockerfile = opts.dockerfile
+            ? resolve(opts.dockerfile)
+            : join(context, "Dockerfile");
+        if (!existsSync(dockerfile)) {
+            throw new Error("No --name and no Dockerfile found. Provide --name <container> or run from a directory with a Dockerfile.");
+        }
+        const tag = resolveTag(opts, "1claw-agent");
+        const buildSpinner = ora(`Building from ${dockerfile}...`).start();
+        try {
+            await dockerBuild({
+                context,
+                dockerfile,
+                tag,
+                onProgress: (l) => (buildSpinner.text = chalk.dim(l.slice(0, 70))),
+            });
+            buildSpinner.succeed(`Built ${tag}`);
+        }
+        catch (err) {
+            buildSpinner.fail("Build failed.");
+            throw err;
+        }
+        await pushTag(tag);
+        printPullHint(tag);
+        return;
+    }
+    // CASE A / C — publish a container created by `1claw init`.
+    const state = loadContainerState(opts.name);
+    if (!state) {
+        throw new Error(`No container state for "${opts.name}". Was it created with \`1claw init\`?`);
+    }
+    const tag = resolveTag(opts, state.containerName);
+    let sourceImage;
+    if (opts.commit) {
+        // CASE C — snapshot runtime state.
+        const status = await dockerContainerStatus(state.containerName);
+        if (!status.exists) {
+            throw new Error(`Container "${state.containerName}" not found to commit.`);
+        }
+        printWarning("Publishing from a container commit (not a Dockerfile). " +
+            "For reproducible builds, prefer building from a Dockerfile.");
+        const commitSpinner = ora(`Committing ${state.containerName}...`).start();
+        try {
+            sourceImage = `1claw-commit-${state.containerName}:latest`;
+            await dockerCommit(state.containerName, sourceImage);
+            commitSpinner.succeed("Container committed.");
+        }
+        catch (err) {
+            commitSpinner.fail("Commit failed.");
+            throw err;
+        }
+    }
+    else if (state.modules.length > 0) {
+        // CASE A — rebuild reproducibly from base + modules.
+        const modules = resolveModules(state.modules);
+        const baseImage = state.image || DEFAULT_BASE_IMAGE;
+        const buildSpinner = ora(`Rebuilding from base + modules (${modules.map((m) => m.name).join(", ")})...`).start();
+        try {
+            const { tag: builtTag } = await buildModuleImage(baseImage, modules, (l) => (buildSpinner.text = chalk.dim(l.slice(0, 70))));
+            sourceImage = builtTag;
+            buildSpinner.succeed("Rebuilt module image.");
+        }
+        catch (err) {
+            buildSpinner.fail("Rebuild failed.");
+            throw err;
+        }
+    }
+    else {
+        // No modules — publish the base/custom image directly.
+        sourceImage = state.customImage ?? state.image;
+    }
+    const tagSpinner = ora(`Tagging ${sourceImage} → ${tag}...`).start();
+    try {
+        await dockerTag(sourceImage, tag);
+        tagSpinner.succeed(`Tagged ${tag}`);
+    }
+    catch (err) {
+        tagSpinner.fail("Tag failed.");
+        throw err;
+    }
+    await pushTag(tag);
+    state.customImage = tag;
+    state.publishedAt = new Date().toISOString();
+    saveContainerState(state);
+    printPullHint(tag);
+}
+async function pushTag(tag) {
+    const spinner = ora(`Pushing ${tag}...`).start();
+    try {
+        await dockerPush(tag, (l) => (spinner.text = chalk.dim(l.slice(0, 70))));
+        spinner.succeed(`Pushed ${tag}`);
+    }
+    catch (err) {
+        spinner.fail("Push failed.");
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/denied|unauthorized|authentication required/i.test(msg)) {
+            printError("Registry authentication failed. Run `docker login` first, then retry.");
+        }
+        throw err;
+    }
+}
+function printPullHint(tag) {
+    console.log();
+    printSuccess("Published.");
+    printKeyValue([["Image", tag], ["Pull", `docker pull ${tag}`]]);
+    console.log();
+    printInfo("Deploy it to the cloud with `1claw deploy --google-cloud --name <name>`.");
+    console.log();
+}
+//# sourceMappingURL=publish.js.map

package/dist/src/commands/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../../src/commands/publish.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EACH,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,SAAS,EACT,aAAa,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EACH,WAAW,EACX,SAAS,EACT,UAAU,EACV,YAAY,EACZ,qBAAqB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACH,kBAAkB,EAClB,kBAAkB,GACrB,MAAM,4BAA4B,CAAC;AAWpC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC;KAC/C,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;KACnE,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;KAC3D,MAAM,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;KAC/D,MAAM,CAAC,qBAAqB,EAAE,wCAAwC,CAAC;KACvE,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,UAAU,EAAE,kDAAkD,CAAC;KACtE,MAAM,CAAC,KAAK,EAAE,IAAoB,EAAE,EAAE;IACnC,IAAI,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,UAAU,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP,SAAS,UAAU,CAAC,IAAoB,EAAE,YAAoB;IAC1D,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,SAAS,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,IAAI,IAAI,KAAK,WAAW;YAAE,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACZ,YAAY,CACR,0BAA0B,GAAG,0DAA0D,CAC1F,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAoB;IAC7C,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU;YAC9B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1B,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACX,0GAA0G,CAC7G,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC5C,MAAM,YAAY,GAAG,GAAG,CAAC,iBAAiB,UAAU,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC;YACD,MAAM,WAAW,CAAC;gBACd,OAAO;gBACP,UAAU;gBACV,GAAG;gBACH,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACrE,CAAC,CAAC;YACH,YAAY,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,YAAY,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACnC,MAAM,GAAG,CAAC;QACd,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QACnB,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO;IACX,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACX,2BAA2B,IAAI,CAAC,IAAI,wCAAwC,CAC/E,CAAC;IACN,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAElD,IAAI,WAAmB,CAAC;IAExB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,aAAa,wBAAwB,CAAC,CAAC;QAC/E,CAAC;QACD,YAAY,CACR,yDAAyD;YACrD,6DAA6D,CACpE,CAAC;QACF,MAAM,aAAa,GAAG,GAAG,CAAC,cAAc,KAAK,CAAC,aAAa,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;QAC1E,IAAI,CAAC;YACD,WAAW,GAAG,gBAAgB,KAAK,CAAC,aAAa,SAAS,CAAC;YAC3D,MAAM,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;YACrD,aAAa,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,qDAAqD;QACrD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,kBAAkB,CAAC;QACpD,MAAM,YAAY,GAAG,GAAG,CACpB,mCAAmC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CACjF,CAAC,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,MAAM,gBAAgB,CAC5C,SAAS,EACT,OAAO,EACP,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CACzD,CAAC;YACF,WAAW,GAAG,QAAQ,CAAC;YACvB,YAAY,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC;QACd,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,uDAAuD;QACvD,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,WAAW,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,IAAI,CAAC;QACD,MAAM,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClC,UAAU,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC/B,MAAM,GAAG,CAAC;IACd,CAAC;IAED,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnB,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC;IACxB,KAAK,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE1B,aAAa,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACD,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,OAAO,CAAC,OAAO,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,8CAA8C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,UAAU,CACN,uEAAuE,CAC1E,CAAC;QACN,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAC9B,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,YAAY,CAAC,YAAY,CAAC,CAAC;IAC3B,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,SAAS,CAAC,0EAA0E,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC"}

package/dist/src/deploy/google-cloud/main.tf

@@ -0,0 +1,74 @@
+# Generated by `1claw deploy --google-cloud`.
+# Deploys a 1Claw agent container to Cloud Run with the agent API key stored in
+# Secret Manager and injected as an environment variable at runtime.
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = ">= 5.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+
+resource "google_secret_manager_secret" "agent_key" {
+  secret_id = "${var.service_name}-agent-key"
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "agent_key" {
+  secret      = google_secret_manager_secret.agent_key.id
+  secret_data = var.agent_api_key
+}
+
+resource "google_cloud_run_v2_service" "agent" {
+  name     = var.service_name
+  location = var.region
+
+  template {
+    containers {
+      image = var.image_tag
+
+      ports {
+        container_port = 3000
+      }
+
+      # Cloud mode: the container talks to the 1Claw API directly using the
+      # agent key injected from Secret Manager (no host daemon in the cloud).
+      env {
+        name  = "ONECLAW_LOCAL_VAULT"
+        value = "false"
+      }
+      env {
+        name  = "ONECLAW_AGENT_ID"
+        value = var.agent_id
+      }
+      env {
+        name  = "ONECLAW_CONTAINER_MODULES"
+        value = var.modules
+      }
+      env {
+        name = "ONECLAW_AGENT_API_KEY"
+        value_source {
+          secret_key_ref {
+            secret  = google_secret_manager_secret.agent_key.secret_id
+            version = "latest"
+          }
+        }
+      }
+    }
+  }
+}
+
+resource "google_cloud_run_v2_service_iam_member" "invoker" {
+  name     = google_cloud_run_v2_service.agent.name
+  location = google_cloud_run_v2_service.agent.location
+  role     = "roles/run.invoker"
+  member   = var.invoker_member
+}

package/dist/src/deploy/google-cloud/outputs.tf

@@ -0,0 +1,9 @@
+output "service_url" {
+  description = "Public URL of the deployed Cloud Run service"
+  value       = google_cloud_run_v2_service.agent.uri
+}
+
+output "service_name" {
+  description = "Cloud Run service name"
+  value       = google_cloud_run_v2_service.agent.name
+}

package/dist/src/deploy/google-cloud/variables.tf

@@ -0,0 +1,44 @@
+variable "project_id" {
+  type        = string
+  description = "Google Cloud project ID"
+}
+
+variable "region" {
+  type        = string
+  description = "Cloud Run region"
+  default     = "us-central1"
+}
+
+variable "service_name" {
+  type        = string
+  description = "Cloud Run service name"
+}
+
+variable "image_tag" {
+  type        = string
+  description = "Container image (must be in a registry, e.g. docker.io/<user>/<name>:<tag>)"
+}
+
+variable "agent_id" {
+  type        = string
+  description = "1Claw agent ID (metadata only)"
+  default     = ""
+}
+
+variable "modules" {
+  type        = string
+  description = "Comma-separated module names baked into the image"
+  default     = ""
+}
+
+variable "agent_api_key" {
+  type        = string
+  description = "1Claw agent API key (ocv_...) stored in Secret Manager"
+  sensitive   = true
+}
+
+variable "invoker_member" {
+  type        = string
+  description = "IAM member allowed to invoke the service"
+  default     = "allUsers"
+}

package/dist/src/docker/base/Dockerfile

@@ -0,0 +1,34 @@
+FROM node:20-alpine AS base
+
+RUN apk add --no-cache curl tini
+
+WORKDIR /app
+
+# Install the 1Claw MCP server (local daemon mode). Best-effort: the chat UI
+# talks to the daemon over the mounted socket directly, so the container is
+# still healthy if the registry is unreachable at build time.
+RUN npm install -g @1claw/mcp@latest || echo "WARN: @1claw/mcp install deferred to runtime"
+
+# Baked-in chat UI (single Node http server + static HTML, zero deps).
+COPY chat-ui /app/chat-ui
+
+# Startup + health scripts
+COPY entrypoint.sh /app/entrypoint.sh
+COPY healthcheck.sh /app/healthcheck.sh
+RUN chmod +x /app/entrypoint.sh /app/healthcheck.sh
+
+# Module extension point: modules drop assets under /app/modules
+RUN mkdir -p /app/modules /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_LOCAL_VAULT=true
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV CHAT_UI_PORT=3000
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=5s --retries=5 \
+    CMD /app/healthcheck.sh
+
+ENTRYPOINT ["tini", "--"]
+CMD ["/app/entrypoint.sh"]

package/dist/src/docker/base/chat-ui/index.html

@@ -0,0 +1,110 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>1Claw Agent</title>
+<style>
+    :root { color-scheme: dark; }
+    * { box-sizing: border-box; }
+    body {
+        margin: 0; font-family: ui-sans-serif, system-ui, -apple-system, sans-serif;
+        background: #0b0d12; color: #e6e9ef; height: 100vh; display: flex; flex-direction: column;
+    }
+    header {
+        padding: 12px 18px; border-bottom: 1px solid #1c2230;
+        display: flex; align-items: center; gap: 12px; background: #0e1219;
+    }
+    header .dot { width: 9px; height: 9px; border-radius: 50%; background: #38d39f; box-shadow: 0 0 8px #38d39f; }
+    header h1 { font-size: 15px; margin: 0; font-weight: 600; }
+    header .meta { margin-left: auto; font-size: 12px; color: #7c869b; }
+    header .badge { background: #1c2230; padding: 2px 8px; border-radius: 999px; margin-left: 6px; }
+    #log { flex: 1; overflow-y: auto; padding: 18px; display: flex; flex-direction: column; gap: 12px; }
+    .msg { max-width: 80%; padding: 10px 14px; border-radius: 12px; white-space: pre-wrap; line-height: 1.45; font-size: 14px; }
+    .user { align-self: flex-end; background: #2563eb; color: #fff; border-bottom-right-radius: 3px; }
+    .bot { align-self: flex-start; background: #161b25; border: 1px solid #1c2230; border-bottom-left-radius: 3px; }
+    .tool { align-self: flex-start; font-size: 11px; color: #8aa0c2; margin-top: -6px; }
+    form { display: flex; gap: 8px; padding: 14px 18px; border-top: 1px solid #1c2230; background: #0e1219; }
+    input { flex: 1; background: #0b0d12; border: 1px solid #28303f; color: #e6e9ef; padding: 11px 14px; border-radius: 10px; font-size: 14px; outline: none; }
+    input:focus { border-color: #2563eb; }
+    button { background: #2563eb; color: #fff; border: none; padding: 0 18px; border-radius: 10px; font-size: 14px; cursor: pointer; font-weight: 600; }
+    button:disabled { opacity: .5; cursor: default; }
+    a { color: #6ea8fe; }
+</style>
+</head>
+<body>
+<header>
+    <span class="dot"></span>
+    <h1>1Claw Agent</h1>
+    <span class="meta" id="meta">connecting…</span>
+</header>
+<div id="log"></div>
+<form id="form">
+    <input id="input" placeholder="Type a message or /help" autocomplete="off" autofocus />
+    <button id="send" type="submit">Send</button>
+</form>
+<script>
+    const log = document.getElementById("log");
+    const form = document.getElementById("form");
+    const input = document.getElementById("input");
+    const send = document.getElementById("send");
+    const meta = document.getElementById("meta");
+
+    function add(role, text, tool) {
+        if (tool) {
+            const t = document.createElement("div");
+            t.className = "tool";
+            t.textContent = "⚙ tool: " + tool;
+            log.appendChild(t);
+        }
+        const el = document.createElement("div");
+        el.className = "msg " + (role === "user" ? "user" : "bot");
+        el.textContent = text;
+        log.appendChild(el);
+        log.scrollTop = log.scrollHeight;
+    }
+
+    async function loadInfo() {
+        try {
+            const r = await fetch("/api/info");
+            const info = await r.json();
+            const parts = [];
+            parts.push("mode=" + info.mode);
+            if (info.agentId) parts.push("agent=" + info.agentId.slice(0, 8) + "…");
+            if (info.modules && info.modules.length) parts.push("modules=" + info.modules.join(","));
+            parts.push(info.daemonReachable ? "daemon ✓" : "daemon —");
+            meta.innerHTML = parts.map((p) => '<span class="badge">' + p + "</span>").join("");
+        } catch {
+            meta.textContent = "offline";
+        }
+    }
+
+    form.addEventListener("submit", async (e) => {
+        e.preventDefault();
+        const message = input.value.trim();
+        if (!message) return;
+        add("user", message);
+        input.value = "";
+        send.disabled = true;
+        try {
+            const r = await fetch("/api/chat", {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ message }),
+            });
+            const data = await r.json();
+            add("bot", data.reply || "(no reply)", data.tool);
+        } catch (err) {
+            add("bot", "Error: " + err.message);
+        } finally {
+            send.disabled = false;
+            input.focus();
+        }
+    });
+
+    add("bot", "1Claw agent ready. Your credentials stay in the host daemon — this container never sees secret values. Type /help to begin.");
+    loadInfo();
+    setInterval(loadInfo, 15000);
+</script>
+</body>
+</html>

package/dist/src/docker/base/chat-ui/server.js

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+// 1Claw agent chat UI — a tiny, zero-dependency HTTP server.
+//
+// It serves a single-page chat interface and bridges browser requests to the
+// host daemon over the mounted Unix socket. Secret VALUES never transit this
+// process: the daemon injects them into outbound requests and returns only the
+// upstream response. This server only ever sees secret NAMES and metadata.
+"use strict";
+
+const http = require("node:http");
+const { readFileSync } = require("node:fs");
+const { join } = require("node:path");
+
+const PORT = parseInt(process.env.CHAT_UI_PORT || "3000", 10);
+const SOCKET = process.env.ONECLAW_DAEMON_SOCKET || "/run/1claw/daemon.sock";
+const AGENT_ID = process.env.ONECLAW_AGENT_ID || "";
+const MODULES = (process.env.ONECLAW_CONTAINER_MODULES || "")
+    .split(",")
+    .map((m) => m.trim())
+    .filter(Boolean);
+const MODE = process.env.ONECLAW_LOCAL_VAULT === "true" ? "local" : "cloud";
+
+let INDEX_HTML = "<h1>1Claw Agent Running</h1>";
+try {
+    INDEX_HTML = readFileSync(join(__dirname, "index.html"), "utf-8");
+} catch {
+    /* fall back to placeholder */
+}
+
+/** Call the host daemon over the Unix socket. */
+function daemonRequest(method, path, body) {
+    return new Promise((resolve, reject) => {
+        const payload = body ? JSON.stringify(body) : undefined;
+        const req = http.request(
+            {
+                socketPath: SOCKET,
+                path,
+                method,
+                headers: {
+                    "Content-Type": "application/json",
+                    ...(payload
+                        ? { "Content-Length": Buffer.byteLength(payload) }
+                        : {}),
+                },
+                timeout: 10000,
+            },
+            (res) => {
+                const chunks = [];
+                res.on("data", (c) => chunks.push(c));
+                res.on("end", () => {
+                    const text = Buffer.concat(chunks).toString("utf-8");
+                    let parsed = null;
+                    try {
+                        parsed = text ? JSON.parse(text) : null;
+                    } catch {
+                        parsed = { raw: text };
+                    }
+                    resolve({ status: res.statusCode || 0, body: parsed });
+                });
+            },
+        );
+        req.on("error", reject);
+        req.on("timeout", () => req.destroy(new Error("daemon timeout")));
+        if (payload) req.write(payload);
+        req.end();
+    });
+}
+
+function json(res, status, obj) {
+    const body = JSON.stringify(obj);
+    res.writeHead(status, {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body),
+    });
+    res.end(body);
+}
+
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on("data", (c) => {
+            size += c.length;
+            if (size > 1024 * 1024) {
+                reject(new Error("body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+        req.on("error", reject);
+    });
+}
+
+async function daemonReachable() {
+    if (MODE !== "local") return false;
+    try {
+        const r = await daemonRequest("GET", "/health");
+        return r.status === 200;
+    } catch {
+        return false;
+    }
+}
+
+// A minimal, LLM-optional assistant. Demonstrates the daemon trust boundary
+// with slash commands; if an LLM provider is wired in later it replaces this.
+async function handleChat(message) {
+    const text = (message || "").trim();
+
+    if (text === "/help" || text === "") {
+        return {
+            reply:
+                "1Claw agent ready. Commands:\n" +
+                "  /secrets        — list secret names available via the daemon\n" +
+                "  /info           — show this agent's runtime info\n" +
+                "  /proxy <name> <url> — make a request with the secret injected by the daemon\n" +
+                "Secret values never enter this container.",
+            tool: null,
+        };
+    }
+
+    if (text === "/info") {
+        return {
+            reply: `Agent ${AGENT_ID || "(local)"} · mode=${MODE} · modules=${MODULES.join(", ") || "none"}`,
+            tool: "info",
+        };
+    }
+
+    if (text === "/secrets") {
+        try {
+            const r = await daemonRequest("GET", "/secrets");
+            if (r.status !== 200) {
+                return { reply: `Daemon returned ${r.status}`, tool: "list_secrets" };
+            }
+            const names = (r.body.secrets || []).map((s) => s.name);
+            return {
+                reply: names.length
+                    ? "Available secrets:\n" + names.map((n) => "  • " + n).join("\n")
+                    : "No secrets available to this agent.",
+                tool: "list_secrets",
+            };
+        } catch (err) {
+            return { reply: `Could not reach daemon: ${err.message}`, tool: "list_secrets" };
+        }
+    }
+
+    if (text.startsWith("/proxy ")) {
+        const parts = text.split(/\s+/);
+        const secretName = parts[1];
+        const url = parts[2];
+        if (!secretName || !url) {
+            return { reply: "Usage: /proxy <secret-name> <url>", tool: null };
+        }
+        try {
+            const r = await daemonRequest("POST", "/proxy", {
+                secretName,
+                url,
+                method: "GET",
+            });
+            return {
+                reply:
+                    r.status === 200
+                        ? `Proxied request (secret injected by daemon). Upstream status: ${r.body.status}`
+                        : `Daemon denied request (${r.status}): ${r.body && r.body.error}`,
+                tool: "proxy_request",
+            };
+        } catch (err) {
+            return { reply: `Proxy error: ${err.message}`, tool: "proxy_request" };
+        }
+    }
+
+    return {
+        reply:
+            "No LLM provider is configured in this container yet. " +
+            "Try /help, /secrets, /info, or /proxy. " +
+            "Wire a model via a module to enable conversational replies.",
+        tool: null,
+    };
+}
+
+const server = http.createServer(async (req, res) => {
+    const url = req.url || "/";
+    const method = req.method || "GET";
+
+    if (url === "/health") {
+        return json(res, 200, { status: "ok", agent: AGENT_ID || null, mode: MODE });
+    }
+
+    if (url === "/api/info" && method === "GET") {
+        return json(res, 200, {
+            agentId: AGENT_ID || null,
+            modules: MODULES,
+            mode: MODE,
+            daemonReachable: await daemonReachable(),
+        });
+    }
+
+    if (url === "/api/secrets" && method === "GET") {
+        try {
+            const r = await daemonRequest("GET", "/secrets");
+            return json(res, r.status, r.body || { secrets: [] });
+        } catch (err) {
+            return json(res, 502, { error: `daemon unreachable: ${err.message}` });
+        }
+    }
+
+    if (url === "/api/chat" && method === "POST") {
+        let body;
+        try {
+            body = JSON.parse((await readBody(req)) || "{}");
+        } catch {
+            return json(res, 400, { error: "invalid JSON" });
+        }
+        const result = await handleChat(body.message);
+        return json(res, 200, result);
+    }
+
+    if (url === "/" || url === "/index.html") {
+        res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+        return res.end(INDEX_HTML);
+    }
+
+    json(res, 404, { error: "not found" });
+});
+
+server.listen(PORT, "0.0.0.0", () => {
+    console.log(`[chat-ui] listening on :${PORT} (mode=${MODE})`);
+});
+
+for (const sig of ["SIGINT", "SIGTERM"]) {
+    process.on(sig, () => server.close(() => process.exit(0)));
+}