@1claw/cli 0.36.6 → 0.37.1

package/dist/src/templates/crewai/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw CrewAI Agent"
+echo "   Framework: crewai"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/src/templates/crewai/requirements.txt

@@ -0,0 +1,3 @@
+crewai>=0.80.0
+crewai-tools>=0.14.0
+flask>=3.0.0

package/dist/src/templates/crewai/template.yaml

@@ -0,0 +1,24 @@
+name: crewai
+display_name: "CrewAI"
+version: 1.0.0
+description: "Multi-agent crew with 1Claw-managed secrets"
+author: 1Claw
+language: python
+homepage: https://crewai.com
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: crewai
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to define your crew's agents, tasks, and workflow.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/src/templates/elizaos/Dockerfile

@@ -0,0 +1,31 @@
+FROM node:22-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini python3 make g++ && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json tsconfig.json ./
+RUN npm install --omit=dev 2>/dev/null || npm install
+
+RUN npm install -g @1claw/mcp@latest 2>/dev/null || \
+    echo "WARN: @1claw/mcp install deferred to runtime"
+
+COPY agent.ts .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=elizaos
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/elizaos/README.md

@@ -0,0 +1,36 @@
+# 1Claw ElizaOS Agent Template
+
+[ElizaOS](https://elizaos.ai) character runtime with 1Claw vault-backed secrets and multi-chain signing via `@1claw/plugin-elizaos`.
+
+## Quick start
+
+```bash
+1claw spawn elizaos --agent-key ocv_YOUR_KEY
+```
+
+## What's included
+
+- `agent.ts` — ElizaOS agent with Shroud LLM routing and `/chat` + `/health` endpoints
+- `Dockerfile` — Node 22 slim image with `@1claw/mcp` and `@1claw/plugin-elizaos`
+- `entrypoint.sh` — Daemon socket detection, Shroud wiring, MCP server startup
+
+## Plugin actions
+
+The `@1claw/plugin-elizaos` plugin provides 8 actions:
+- `GET_SECRET` / `PUT_SECRET` / `LIST_SECRETS` / `DELETE_SECRET`
+- `SIGN_MESSAGE` / `SIGN_TYPED_DATA` / `SUBMIT_TRANSACTION`
+- `LIST_SIGNING_KEYS`
+
+## LLM authentication
+
+```bash
+# Bring your own key (stored in vault, routed through Shroud)
+1claw spawn elizaos --agent-key ocv_YOUR_KEY --llm-api-key sk-...
+
+# Use 1Claw Token Billing (no provider key needed)
+1claw spawn elizaos --agent-key ocv_YOUR_KEY
+```
+
+## Customization
+
+Edit `agent.ts` to define your character, add custom actions, or integrate with the full ElizaOS `AgentRuntime`.

package/dist/src/templates/elizaos/agent.ts

@@ -0,0 +1,100 @@
+/**
+ * ElizaOS agent pre-wired with 1Claw plugin for vault secrets and signing.
+ *
+ * LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+ * The container never sees raw API keys — they are injected by the host daemon.
+ */
+
+import { createServer } from "node:http";
+
+const SHROUD_URL = process.env.ONECLAW_SHROUD_URL ?? "https://shroud.1claw.xyz";
+const LLM_VIA_SHROUD = process.env.ONECLAW_LLM_VIA_SHROUD === "true";
+const PROVIDER = process.env.ONECLAW_SHROUD_PROVIDER ?? "openai";
+const MODEL = process.env.ONECLAW_SHROUD_MODEL ?? "gpt-4o-mini";
+const PORT = parseInt(process.env.CHAT_UI_PORT ?? "3000", 10);
+
+const conversationHistory: { role: "user" | "assistant"; content: string }[] = [];
+
+/**
+ * Minimal chat handler using OpenAI-compatible API through Shroud.
+ * Replace with a full ElizaOS AgentRuntime for production use.
+ */
+async function handleChat(message: string): Promise<string> {
+  if (!LLM_VIA_SHROUD) {
+    return "No LLM configured. Use --llm-api-key or enable Token Billing.";
+  }
+
+  conversationHistory.push({ role: "user", content: message });
+
+  const resp = await fetch(`${SHROUD_URL}/v1/chat/completions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: "Bearer shroud-injected" },
+    body: JSON.stringify({
+      model: MODEL,
+      messages: [
+        {
+          role: "system" as const,
+          content:
+            "You are an ElizaOS character running inside a secure 1Claw container. " +
+            "The @1claw/plugin-elizaos plugin gives you vault access and multi-chain signing. " +
+            "Be helpful and concise.",
+        },
+        ...conversationHistory,
+      ],
+    }),
+  });
+
+  if (!resp.ok) throw new Error(`LLM error: ${resp.status} ${await resp.text()}`);
+
+  const data = await resp.json() as any;
+  const text = data.choices?.[0]?.message?.content ?? "No response from LLM.";
+  conversationHistory.push({ role: "assistant", content: text });
+  return text;
+}
+
+const server = createServer(async (req, res) => {
+  if (req.url === "/health" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ status: "ok", framework: "elizaos", llm_wired: LLM_VIA_SHROUD }));
+    return;
+  }
+
+  if (req.url === "/chat" && req.method === "POST") {
+    const chunks: Buffer[] = [];
+    for await (const chunk of req) chunks.push(chunk as Buffer);
+    const body = JSON.parse(Buffer.concat(chunks).toString());
+    const message = (body.message ?? "").trim();
+
+    if (!message) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "No message provided" }));
+      return;
+    }
+
+    try {
+      const response = await handleChat(message);
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ response, framework: "elizaos" }));
+    } catch (e: any) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: e.message }));
+    }
+    return;
+  }
+
+  res.writeHead(200, { "Content-Type": "text/html" });
+  res.end(`<!DOCTYPE html>
+<html><head><title>1Claw ElizaOS Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw ElizaOS Agent</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+The @1claw/plugin-elizaos plugin provides 8 actions for vault secrets and multi-chain signing.
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>`);
+});
+
+server.listen(PORT, "0.0.0.0", () => {
+  console.log(`ElizaOS agent listening on http://0.0.0.0:${PORT}`);
+});

package/dist/src/templates/elizaos/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw ElizaOS Agent"
+echo "   Framework: elizaos (TypeScript)"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec npx tsx agent.ts

package/dist/src/templates/elizaos/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "1claw-elizaos-agent",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "tsx agent.ts",
+    "dev": "tsx watch agent.ts"
+  },
+  "dependencies": {
+    "@elizaos/core": "^0.2.0",
+    "@1claw/plugin-elizaos": "latest",
+    "@ai-sdk/openai": "^1.0.0",
+    "ai": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  }
+}

package/dist/src/templates/elizaos/template.yaml

@@ -0,0 +1,25 @@
+name: elizaos
+display_name: "ElizaOS"
+version: 1.0.0
+description: "ElizaOS character runtime with 1Claw vault-backed secrets and signing"
+author: 1Claw
+language: node
+homepage: https://elizaos.ai
+
+docker:
+  base_image: node:22-slim
+  context_files:
+    - Dockerfile
+    - package.json
+    - tsconfig.json
+    - agent.ts
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: elizaos
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.ts to customize your ElizaOS character.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/src/templates/elizaos/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "outDir": "dist"
+  },
+  "include": ["*.ts"]
+}

package/dist/src/templates/fetcher.d.ts

@@ -0,0 +1,20 @@
+/** Check if the local cache is fresh enough to skip a fetch. */
+export declare function isCacheFresh(): boolean;
+/**
+ * Ensure templates are available locally. Tries (in order):
+ *   1. Bundled templates (from the agent-templates submodule)
+ *   2. Local cache (~/.config/1claw/templates/)
+ *   3. GitHub fetch (if online and cache is stale)
+ *
+ * Returns the directory containing the templates.
+ */
+export declare function ensureTemplates(opts?: {
+    force?: boolean;
+    onProgress?: (msg: string) => void;
+}): Promise<string>;
+/**
+ * Fetch a single template on demand (for `1claw spawn <name>` when the
+ * template isn't cached or bundled).
+ */
+export declare function fetchSingleTemplate(name: string, onProgress?: (msg: string) => void): Promise<string>;
+//# sourceMappingURL=fetcher.d.ts.map

package/dist/src/templates/fetcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher.d.ts","sourceRoot":"","sources":["../../../src/templates/fetcher.ts"],"names":[],"mappings":"AAuDA,gEAAgE;AAChE,wBAAgB,YAAY,IAAI,OAAO,CAKtC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACtC,GAAG,OAAO,CAAC,MAAM,CAAC,CAuClB;AAyHD;;;GAGG;AACH,wBAAsB,mBAAmB,CACrC,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACnC,OAAO,CAAC,MAAM,CAAC,CAejB"}

package/dist/src/templates/fetcher.js

@@ -0,0 +1,189 @@
+import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, statSync, cpSync, } from "node:fs";
+import { join } from "node:path";
+import { templatesCacheDir, bundledTemplatesDir } from "../lib/paths.js";
+function dirHasTemplateManifests(root) {
+    if (!existsSync(root))
+        return false;
+    try {
+        return readdirSync(root).some((d) => statSync(join(root, d)).isDirectory() &&
+            existsSync(join(root, d, "template.yaml")));
+    }
+    catch {
+        return false;
+    }
+}
+const REPO_OWNER = "1clawAI";
+const REPO_NAME = "agent-templates";
+const BRANCH = "main";
+const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
+function cacheMetaPath() {
+    return join(templatesCacheDir(), ".cache-meta.json");
+}
+function readCacheMeta() {
+    const p = cacheMetaPath();
+    if (!existsSync(p))
+        return null;
+    try {
+        return JSON.parse(readFileSync(p, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeCacheMeta(meta) {
+    const dir = templatesCacheDir();
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    writeFileSync(cacheMetaPath(), JSON.stringify(meta, null, 2));
+}
+/** Check if the local cache is fresh enough to skip a fetch. */
+export function isCacheFresh() {
+    const meta = readCacheMeta();
+    if (!meta)
+        return false;
+    const age = Date.now() - new Date(meta.fetchedAt).getTime();
+    return age < CACHE_MAX_AGE_MS;
+}
+/**
+ * Ensure templates are available locally. Tries (in order):
+ *   1. Bundled templates (from the agent-templates submodule)
+ *   2. Local cache (~/.config/1claw/templates/)
+ *   3. GitHub fetch (if online and cache is stale)
+ *
+ * Returns the directory containing the templates.
+ */
+export async function ensureTemplates(opts) {
+    const force = opts?.force ?? false;
+    const onProgress = opts?.onProgress;
+    // Bundled templates always take priority (submodule is the source of truth)
+    const bundled = bundledTemplatesDir();
+    if (bundled && existsSync(bundled)) {
+        if (dirHasTemplateManifests(bundled)) {
+            syncBundledToCache(bundled);
+            return bundled;
+        }
+    }
+    const cacheDir = templatesCacheDir();
+    if (!force && isCacheFresh() && dirHasTemplateManifests(cacheDir)) {
+        return cacheDir;
+    }
+    // Try fetching from GitHub
+    try {
+        onProgress?.("Fetching templates from GitHub...");
+        await fetchFromGitHub(cacheDir, onProgress);
+        return cacheDir;
+    }
+    catch (err) {
+        // Offline or rate-limited — fall back to cache if anything is there
+        if (existsSync(cacheDir) && readdirSync(cacheDir).length > 0) {
+            onProgress?.("GitHub unreachable — using cached templates.");
+            return cacheDir;
+        }
+        throw new Error(`Cannot fetch templates and no local cache exists.\n` +
+            `  Error: ${err instanceof Error ? err.message : String(err)}\n` +
+            `  • Check your internet connection\n` +
+            `  • Or initialize the agent-templates submodule: git submodule update --init packages/agent-templates`);
+    }
+}
+/** Fetch registry.yaml and individual templates from GitHub. */
+async function fetchFromGitHub(cacheDir, onProgress) {
+    if (!existsSync(cacheDir))
+        mkdirSync(cacheDir, { recursive: true });
+    // Fetch registry.yaml
+    const registryUrl = `https://raw.githubusercontent.com/${REPO_OWNER}/${REPO_NAME}/${BRANCH}/registry.yaml`;
+    const registryRes = await fetch(registryUrl);
+    if (!registryRes.ok) {
+        throw new Error(`Failed to fetch registry.yaml: ${registryRes.status} ${registryRes.statusText}`);
+    }
+    const registryContent = await registryRes.text();
+    writeFileSync(join(cacheDir, "..", "registry.yaml"), registryContent);
+    // Parse to get template list
+    const { parse } = await import("yaml");
+    const registry = parse(registryContent);
+    const templateNames = registry.templates?.map((t) => t.name) ?? [];
+    // Fetch each template's files via the GitHub Contents API
+    for (const name of templateNames) {
+        onProgress?.(`Fetching template: ${name}`);
+        await fetchTemplate(cacheDir, name);
+    }
+    writeCacheMeta({
+        fetchedAt: new Date().toISOString(),
+        etag: registryRes.headers.get("etag") ?? undefined,
+    });
+}
+/** Required files for every spawn template (build will fail without these). */
+const REQUIRED_TEMPLATE_FILES = [
+    "template.yaml",
+    "Dockerfile",
+    "entrypoint.sh",
+];
+function assertTemplateComplete(templateDir, name) {
+    const missing = REQUIRED_TEMPLATE_FILES.filter((f) => !existsSync(join(templateDir, f)));
+    if (missing.length > 0) {
+        throw new Error(`Template "${name}" is incomplete (missing: ${missing.join(", ")}).\n` +
+            `  Run \`1claw spawn --refresh\` or initialize packages/agent-templates.`);
+    }
+}
+/** Fetch a single template's files from GitHub into the cache. */
+async function fetchTemplate(cacheDir, name) {
+    const templateDir = join(cacheDir, name);
+    if (!existsSync(templateDir))
+        mkdirSync(templateDir, { recursive: true });
+    const contentsUrl = `https://api.github.com/repos/${REPO_OWNER}/${REPO_NAME}/contents/templates/${name}?ref=${BRANCH}`;
+    const res = await fetch(contentsUrl, {
+        headers: { Accept: "application/vnd.github.v3+json" },
+    });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch template "${name}" from GitHub: ${res.status} ${res.statusText}`);
+    }
+    const files = (await res.json());
+    for (const file of files) {
+        if (file.type !== "file" || !file.download_url)
+            continue;
+        const fileRes = await fetch(file.download_url);
+        if (!fileRes.ok) {
+            throw new Error(`Failed to download ${name}/${file.name}: ${fileRes.status}`);
+        }
+        writeFileSync(join(templateDir, file.name), await fileRes.text());
+    }
+    assertTemplateComplete(templateDir, name);
+}
+/** Copy bundled templates (from submodule) into the cache directory. */
+function syncBundledToCache(bundledDir) {
+    const cacheDir = templatesCacheDir();
+    if (!existsSync(cacheDir))
+        mkdirSync(cacheDir, { recursive: true });
+    for (const name of readdirSync(bundledDir)) {
+        const src = join(bundledDir, name);
+        if (!statSync(src).isDirectory())
+            continue;
+        if (!existsSync(join(src, "template.yaml")))
+            continue;
+        const dest = join(cacheDir, name);
+        try {
+            cpSync(src, dest, { recursive: true, force: true });
+        }
+        catch {
+            // best-effort
+        }
+    }
+    writeCacheMeta({ fetchedAt: new Date().toISOString() });
+}
+/**
+ * Fetch a single template on demand (for `1claw spawn <name>` when the
+ * template isn't cached or bundled).
+ */
+export async function fetchSingleTemplate(name, onProgress) {
+    const cacheDir = templatesCacheDir();
+    if (!existsSync(cacheDir))
+        mkdirSync(cacheDir, { recursive: true });
+    onProgress?.(`Fetching template: ${name}`);
+    await fetchTemplate(cacheDir, name);
+    const dir = join(cacheDir, name);
+    if (!existsSync(join(dir, "template.yaml"))) {
+        throw new Error(`Template "${name}" not found in the template registry.\n` +
+            `  Run \`1claw spawn --list\` to see available templates.`);
+    }
+    return dir;
+}
+//# sourceMappingURL=fetcher.js.map

package/dist/src/templates/fetcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher.js","sourceRoot":"","sources":["../../../src/templates/fetcher.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,UAAU,EACV,SAAS,EACT,aAAa,EACb,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,MAAM,GACT,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEzE,SAAS,uBAAuB,CAAC,IAAY;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC;QACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CACF,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;YACrC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC,CACjD,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,SAAS,CAAC;AAC7B,MAAM,SAAS,GAAG,iBAAiB,CAAC;AACpC,MAAM,MAAM,GAAG,MAAM,CAAC;AACtB,MAAM,gBAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AAOzD,SAAS,aAAa;IAClB,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa;IAClB,MAAM,CAAC,GAAG,aAAa,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAc,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAe;IACnC,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY;IACxB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5D,OAAO,GAAG,GAAG,gBAAgB,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAGrC;IACG,MAAM,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,KAAK,CAAC;IACnC,MAAM,UAAU,GAAG,IAAI,EAAE,UAAU,CAAC;IAEpC,4EAA4E;IAC5E,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,OAAO,CAAC;QACnB,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,IAAI,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChE,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,2BAA2B;IAC3B,IAAI,CAAC;QACD,UAAU,EAAE,CAAC,mCAAmC,CAAC,CAAC;QAClD,MAAM,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,oEAAoE;QACpE,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3D,UAAU,EAAE,CACR,8CAA8C,CACjD,CAAC;YACF,OAAO,QAAQ,CAAC;QACpB,CAAC;QACD,MAAM,IAAI,KAAK,CACX,qDAAqD;YACjD,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;YAChE,sCAAsC;YACtC,uGAAuG,CAC9G,CAAC;IACN,CAAC;AACL,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,eAAe,CAC1B,QAAgB,EAChB,UAAkC;IAElC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,sBAAsB;IACtB,MAAM,WAAW,GAAG,qCAAqC,UAAU,IAAI,SAAS,IAAI,MAAM,gBAAgB,CAAC;IAC3G,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACX,kCAAkC,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,EAAE,CACnF,CAAC;IACN,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;IACjD,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,EAAE,eAAe,CAAC,CAAC;IAEtE,6BAA6B;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAErC,CAAC;IACF,MAAM,aAAa,GACf,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEjD,0DAA0D;IAC1D,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QAC/B,UAAU,EAAE,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,cAAc,CAAC;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS;KACrD,CAAC,CAAC;AACP,CAAC;AAED,+EAA+E;AAC/E,MAAM,uBAAuB,GAAG;IAC5B,eAAe;IACf,YAAY;IACZ,eAAe;CACT,CAAC;AAEX,SAAS,sBAAsB,CAAC,WAAmB,EAAE,IAAY;IAC7D,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAC3C,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,aAAa,IAAI,6BAA6B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;YAClE,yEAAyE,CAChF,CAAC;IACN,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,aAAa,CACxB,QAAgB,EAChB,IAAY;IAEZ,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,MAAM,WAAW,GAAG,gCAAgC,UAAU,IAAI,SAAS,uBAAuB,IAAI,QAAQ,MAAM,EAAE,CAAC;IACvH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;QACjC,OAAO,EAAE,EAAE,MAAM,EAAE,gCAAgC,EAAE;KACxD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACX,6BAA6B,IAAI,kBAAkB,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACpF,CAAC;IACN,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI5B,CAAC;IAEJ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,SAAS;QACzD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACX,sBAAsB,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAC/D,CAAC;QACN,CAAC;QACD,aAAa,CACT,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,EAC5B,MAAM,OAAO,CAAC,IAAI,EAAE,CACvB,CAAC;IACN,CAAC;IAED,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,wEAAwE;AACxE,SAAS,kBAAkB,CAAC,UAAkB;IAC1C,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YAAE,SAAS;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACL,cAAc;QAClB,CAAC;IACL,CAAC;IAED,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,IAAY,EACZ,UAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,UAAU,EAAE,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACX,aAAa,IAAI,yCAAyC;YACtD,0DAA0D,CACjE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/src/templates/langchain/Dockerfile

@@ -0,0 +1,34 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+RUN pip install --no-cache-dir 1claw-mcp 2>/dev/null || \
+    (apt-get update && apt-get install -y --no-install-recommends nodejs npm && \
+     npm install -g @1claw/mcp@latest && \
+     rm -rf /var/lib/apt/lists/*) || \
+    echo "WARN: 1claw-mcp install deferred to runtime"
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=langchain
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/langchain/README.md

@@ -0,0 +1,37 @@
+# LangChain / LangGraph Template
+
+A Python agent using [LangChain](https://python.langchain.com) with 1Claw MCP
+for secrets management and on-chain signing.
+
+## Quick start
+
+```bash
+1claw spawn langchain
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn langchain --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Starter LangChain agent with tool calling (hello_world, list_env_vars)
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add your own tools, change the prompt, or swap the LLM
+provider. The agent uses `ChatOpenAI` pointed at Shroud, which handles
+provider routing transparently.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn langchain --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models