@1claw/cli 0.36.6 → 0.37.1

package/README.md

@@ -1,4 +1,4 @@
-# @1claw/cli (v0.36.2)
+# @1claw/cli (v0.37.0)
 
 Command-line interface for [1Claw](https://1claw.xyz) — HSM-backed secret management for AI agents and humans.
 
@@ -718,6 +718,71 @@ conflicts: []                    # e.g. [other-tool] to forbid combining
 
 **Don't want to modify the CLI?** Use **`1claw eject`** to export the generated `Dockerfile`, the module asset tree, and a `docker-compose.yaml` (daemon socket pre-wired), then edit the Dockerfile freely and build/publish it yourself with `1claw publish --context ./out --tag <user>/<image>:tag`. This is the supported path for fully custom images.
 
+## Agent Templates (`spawn`)
+
+`1claw spawn` creates a framework-specific AI agent from a pre-built template. Each template ships a Dockerfile, starter code, and entrypoint pre-wired with 1Claw MCP and Shroud. The container follows the same daemon-socket security model as `init --docker` — **the container never sees raw API keys.**
+
+```bash
+1claw spawn langchain                        # LangChain agent with Shroud LLM routing
+1claw spawn crewai --llm-api-key sk-...      # CrewAI multi-agent crew with your API key
+1claw spawn openai-agents --local            # OpenAI Agents SDK, fully offline
+1claw spawn --list                           # List all available templates
+1claw spawn --refresh                        # Force-refresh templates from GitHub
+```
+
+### Available templates
+
+**Python:**
+
+| Template | Framework |
+|----------|-----------|
+| `langchain` | LangChain / LangGraph |
+| `crewai` | CrewAI |
+| `openai-agents` | OpenAI Agents SDK |
+| `agentkit` | Coinbase AgentKit |
+| `smolagents` | HuggingFace smolagents |
+| `llamaindex` | LlamaIndex |
+| `pydantic-ai` | Pydantic AI |
+| `agno` | Agno |
+| `coder` | Coder |
+
+**TypeScript:**
+
+| Template | Framework |
+|----------|-----------|
+| `typescript-sdk` | @1claw/sdk + Vercel AI SDK |
+| `mastra` | Mastra |
+| `elizaos` | ElizaOS |
+
+### LLM authentication
+
+Templates support the same three LLM authentication methods as `init --docker`:
+
+```bash
+# BYOK — provider key stored in 1Claw vault (Shroud auto-fetches):
+1claw spawn langchain --llm-api-key sk-...
+
+# BYOK — provider key stored in local vault (daemon injects):
+1claw spawn langchain --llm-api-key sk-... --llm-key-store local
+
+# Token Billing — enable in Dashboard, no provider key needed:
+1claw spawn langchain
+
+# Anthropic WIF — OIDC federation (configure in Dashboard):
+1claw spawn langchain --llm-provider anthropic
+```
+
+### Templates vs modules
+
+- **Templates** (`1claw spawn <name>`) are complete project scaffolds — they include a Dockerfile, starter code (e.g. `agent.py`), and entrypoint. Use a template to bootstrap a new framework-specific agent.
+- **Modules** (`1claw init --docker --module=<name>`) are composable Docker layers added on top of the base `1claw/agent:stable` image. Use modules to add capabilities (payments, on-chain tools) to the base agent.
+
+You can combine both: spawn a template, then add modules with `init --docker --module=...` on the resulting container.
+
+### Community templates
+
+Templates live in the [`1clawAI/agent-templates`](https://github.com/1clawAI/agent-templates) repository. To contribute a new template, see the [CONTRIBUTING.md](https://github.com/1clawAI/agent-templates/blob/main/CONTRIBUTING.md) guide.
+
 ### Container state & lifecycle
 
 Each container's state lives at `~/.config/1claw/containers/{name}.json` (mode `0600`) and is the source of truth for `info`, `start`, `restart`, `publish`, `eject`, and `deploy`. It records the agent/vault IDs, modules, port, image, and a persisted **run spec** (image, env var *names*, mounts, labels — never secret values) so `start`/`restart` can recreate a container that was removed.

package/dist/bundled-templates/registry.yaml

@@ -0,0 +1,62 @@
+version: 1
+templates:
+  - name: langchain
+    display_name: "LangChain / LangGraph"
+    version: 1.0.0
+    language: python
+    description: "Python agent using LangChain with 1Claw MCP for secrets and signing"
+  - name: crewai
+    display_name: "CrewAI"
+    version: 1.0.0
+    language: python
+    description: "Multi-agent crew with 1Claw-managed secrets"
+  - name: openai-agents
+    display_name: "OpenAI Agents SDK"
+    version: 1.0.0
+    language: python
+    description: "OpenAI Agents SDK with tool calling and 1Claw MCP integration"
+  - name: elizaos
+    display_name: "ElizaOS"
+    version: 1.0.0
+    language: node
+    description: "ElizaOS character runtime with vault-backed secrets"
+  - name: agentkit
+    display_name: "Coinbase AgentKit"
+    version: 1.0.0
+    language: python
+    description: "Coinbase AgentKit for onchain agents with 1Claw key management"
+  - name: smolagents
+    display_name: "HuggingFace smolagents"
+    version: 1.0.0
+    language: python
+    description: "HuggingFace lightweight agents with 1Claw secrets"
+  - name: llamaindex
+    display_name: "LlamaIndex"
+    version: 1.0.0
+    language: python
+    description: "LlamaIndex agent with tool integration and 1Claw MCP"
+  - name: pydantic-ai
+    display_name: "Pydantic AI"
+    version: 1.0.0
+    language: python
+    description: "Type-safe Python agent with structured output"
+  - name: agno
+    display_name: "Agno"
+    version: 1.0.0
+    language: python
+    description: "Agno multi-modal agent with 1Claw secrets"
+  - name: mastra
+    display_name: "Mastra"
+    version: 1.0.0
+    language: node
+    description: "TypeScript-first AI agent framework"
+  - name: typescript-sdk
+    display_name: "TypeScript SDK"
+    version: 1.0.0
+    language: node
+    description: "Plain TypeScript agent using @1claw/sdk with Shroud LLM routing"
+  - name: coder
+    display_name: "Coder"
+    version: 1.0.0
+    language: python
+    description: "Coder workspace automation agent"

package/dist/bundled-templates/templates/agentkit/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=agentkit
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/agentkit/README.md

@@ -0,0 +1,36 @@
+# Coinbase AgentKit Template
+
+A Python agent using [Coinbase AgentKit](https://github.com/coinbase/agentkit) for onchain operations with 1Claw key management.
+
+## Quick start
+
+```bash
+1claw spawn agentkit
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn agentkit --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — AgentKit-powered LangGraph agent with onchain tools
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to configure AgentKit actions (deploy tokens, transfer,
+check balances, etc.). Set CDP API credentials via the 1Claw vault for
+Coinbase Developer Platform integration.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn agentkit --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models

package/dist/bundled-templates/templates/agentkit/agent.py

@@ -0,0 +1,83 @@
+"""
+Coinbase AgentKit agent pre-wired with 1Claw MCP for secrets and signing.
+
+LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+The container never sees raw API keys — they are injected by the host daemon.
+"""
+
+import os
+from flask import Flask, request, jsonify
+from langchain_openai import ChatOpenAI
+from coinbase_agentkit import AgentKit, AgentKitConfig
+from coinbase_agentkit_langchain import get_langchain_tools
+from langgraph.prebuilt import create_react_agent
+
+app = Flask(__name__)
+
+SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
+LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
+MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+
+
+def create_agent():
+    """Build an AgentKit-powered LangGraph agent. Returns None if no LLM."""
+    if not LLM_VIA_SHROUD:
+        return None
+
+    llm = ChatOpenAI(
+        model=MODEL,
+        base_url=f"{SHROUD_URL}/v1",
+        api_key="shroud-injected",
+    )
+
+    agentkit = AgentKit(AgentKitConfig())
+    tools = get_langchain_tools(agentkit)
+    return create_react_agent(llm, tools=tools)
+
+
+agent_executor = create_agent()
+
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok", "framework": "agentkit", "llm_wired": LLM_VIA_SHROUD})
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    data = request.get_json(silent=True) or {}
+    message = data.get("message", "").strip()
+    if not message:
+        return jsonify({"error": "No message provided"}), 400
+
+    if not agent_executor:
+        return jsonify({
+            "response": "No LLM configured. Use --llm-api-key or enable Token Billing.",
+            "framework": "agentkit",
+        })
+
+    try:
+        result = agent_executor.invoke({"messages": [{"role": "user", "content": message}]})
+        output = result["messages"][-1].content if result.get("messages") else str(result)
+        return jsonify({"response": output, "framework": "agentkit"})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/")
+def index():
+    return """<!DOCTYPE html>
+<html><head><title>1Claw AgentKit Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw Coinbase AgentKit</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>"""
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    print(f"AgentKit agent listening on http://0.0.0.0:{port}")
+    app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/agentkit/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw AgentKit Agent"
+echo "   Framework: agentkit"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/bundled-templates/templates/agentkit/requirements.txt

@@ -0,0 +1,5 @@
+coinbase-agentkit>=0.2.0
+coinbase-agentkit-langchain>=0.2.0
+langchain-openai>=0.2.0
+langgraph>=0.2.0
+flask>=3.0.0

package/dist/bundled-templates/templates/agentkit/template.yaml

@@ -0,0 +1,24 @@
+name: agentkit
+display_name: "Coinbase AgentKit"
+version: 1.0.0
+description: "Coinbase AgentKit for onchain agents with 1Claw key management"
+author: 1Claw
+language: python
+homepage: https://github.com/coinbase/agentkit
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: agentkit
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to customize your AgentKit agent's onchain capabilities.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/bundled-templates/templates/agno/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=agno
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/agno/README.md

@@ -0,0 +1,36 @@
+# Agno Template
+
+A Python agent using [Agno](https://docs.agno.com) — a multi-modal agent framework — with 1Claw MCP for secrets management.
+
+## Quick start
+
+```bash
+1claw spawn agno
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn agno --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Agno agent with OpenAI-compatible model routing
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add tools, configure knowledge bases, or enable
+multi-modal capabilities (vision, audio). Agno supports teams of agents,
+structured output, and memory.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn agno --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models

package/dist/bundled-templates/templates/agno/agent.py

@@ -0,0 +1,86 @@
+"""
+Agno multi-modal agent pre-wired with 1Claw MCP for secrets and signing.
+
+LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+The container never sees raw API keys — they are injected by the host daemon.
+"""
+
+import os
+from flask import Flask, request, jsonify
+from agno.agent import Agent
+from agno.models.openai import OpenAILike
+
+app = Flask(__name__)
+
+SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
+LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
+MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+
+
+def create_agent() -> Agent | None:
+    """Build the Agno agent. Returns None if no LLM."""
+    if not LLM_VIA_SHROUD:
+        return None
+
+    model = OpenAILike(
+        id=MODEL,
+        api_key="shroud-injected",
+        base_url=f"{SHROUD_URL}/v1",
+    )
+
+    return Agent(
+        model=model,
+        description="A helpful AI agent running inside a secure 1Claw container.",
+        instructions=[
+            "You have access to tools for greeting and inspecting the environment.",
+        ],
+        markdown=True,
+    )
+
+
+agent = create_agent()
+
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok", "framework": "agno", "llm_wired": LLM_VIA_SHROUD})
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    data = request.get_json(silent=True) or {}
+    message = data.get("message", "").strip()
+    if not message:
+        return jsonify({"error": "No message provided"}), 400
+
+    if not agent:
+        return jsonify({
+            "response": "No LLM configured. Use --llm-api-key or enable Token Billing.",
+            "framework": "agno",
+        })
+
+    try:
+        response = agent.run(message)
+        output = response.content if hasattr(response, "content") else str(response)
+        return jsonify({"response": output, "framework": "agno"})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/")
+def index():
+    return """<!DOCTYPE html>
+<html><head><title>1Claw Agno Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw Agno Agent</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>"""
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    print(f"Agno agent listening on http://0.0.0.0:{port}")
+    app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/agno/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw Agno Agent"
+echo "   Framework: agno"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/bundled-templates/templates/agno/requirements.txt

@@ -0,0 +1,2 @@
+agno>=1.0.0
+flask>=3.0.0

package/dist/bundled-templates/templates/agno/template.yaml

@@ -0,0 +1,24 @@
+name: agno
+display_name: "Agno"
+version: 1.0.0
+description: "Agno multi-modal agent with 1Claw secrets"
+author: 1Claw
+language: python
+homepage: https://docs.agno.com
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: agno
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to add tools and configure your Agno agent.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/bundled-templates/templates/coder/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini git && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=coder
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/coder/README.md

@@ -0,0 +1,36 @@
+# Coder Template
+
+A Python agent for automating [Coder](https://coder.com) workspace management with 1Claw MCP for secrets.
+
+## Quick start
+
+```bash
+1claw spawn coder
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn coder --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Coder workspace automation agent with workspace listing
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add Coder API actions: create workspaces, start/stop
+builds, manage templates, or automate dev environments. Store
+`CODER_URL` and `CODER_SESSION_TOKEN` in your 1Claw vault.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn coder --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models