@1claw/cli 0.37.0 → 0.37.1

package/dist/bundled-templates/templates/coder/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw Coder Agent"
+echo "   Framework: coder"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/bundled-templates/templates/coder/requirements.txt

@@ -0,0 +1,4 @@
+openai-agents>=0.1.0
+openai>=1.50.0
+httpx>=0.27.0
+flask>=3.0.0

package/dist/bundled-templates/templates/coder/template.yaml

@@ -0,0 +1,24 @@
+name: coder
+display_name: "Coder"
+version: 1.0.0
+description: "Coder workspace automation agent"
+author: 1Claw
+language: python
+homepage: https://coder.com
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: coder
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to customize your Coder workspace automation.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/bundled-templates/templates/crewai/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=crewai
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/crewai/README.md

@@ -0,0 +1,29 @@
+# CrewAI Template
+
+A multi-agent crew using [CrewAI](https://crewai.com) with 1Claw MCP for
+secrets management and on-chain signing.
+
+## Quick start
+
+```bash
+1claw spawn crewai
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn crewai --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Starter crew with Researcher and Writer agents
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add your own agents, tools, and tasks. The crew uses
+CrewAI's `LLM` class pointed at Shroud, which handles provider routing
+transparently.

package/dist/bundled-templates/templates/crewai/agent.py

@@ -0,0 +1,109 @@
+"""
+CrewAI multi-agent crew pre-wired with 1Claw MCP for secrets and signing.
+
+LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+The container never sees raw API keys — they are injected by the host daemon.
+"""
+
+import os
+from flask import Flask, request, jsonify
+from crewai import Agent, Task, Crew, LLM
+
+app = Flask(__name__)
+
+SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
+LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
+PROVIDER = os.environ.get("ONECLAW_SHROUD_PROVIDER", "openai")
+MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+
+
+def create_crew() -> Crew | None:
+    """Build a CrewAI crew. Returns None if no LLM is configured."""
+    if not LLM_VIA_SHROUD:
+        return None
+
+    llm = LLM(
+        model=f"{PROVIDER}/{MODEL}",
+        base_url=f"{SHROUD_URL}/v1",
+        api_key="shroud-injected",
+    )
+
+    researcher = Agent(
+        role="Researcher",
+        goal="Find accurate and relevant information",
+        backstory="You are a skilled researcher who excels at finding and synthesizing information.",
+        llm=llm,
+        verbose=False,
+    )
+
+    writer = Agent(
+        role="Writer",
+        goal="Create clear, concise, and engaging content",
+        backstory="You are a talented writer who turns research into readable content.",
+        llm=llm,
+        verbose=False,
+    )
+
+    return Crew(agents=[researcher, writer], verbose=False), researcher, writer
+
+
+crew_result = create_crew()
+crew = crew_result[0] if crew_result else None
+researcher = crew_result[1] if crew_result else None
+writer = crew_result[2] if crew_result else None
+
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok", "framework": "crewai", "llm_wired": LLM_VIA_SHROUD})
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    data = request.get_json(silent=True) or {}
+    message = data.get("message", "").strip()
+    if not message:
+        return jsonify({"error": "No message provided"}), 400
+
+    if not crew:
+        return jsonify({
+            "response": "No LLM configured. Use --llm-api-key or enable Token Billing.",
+            "framework": "crewai",
+        })
+
+    try:
+        research_task = Task(
+            description=f"Research the following topic: {message}",
+            expected_output="A concise summary of key findings.",
+            agent=researcher,
+        )
+
+        write_task = Task(
+            description="Write a clear response based on the research findings.",
+            expected_output="A well-written, informative response.",
+            agent=writer,
+        )
+
+        result = crew.kickoff(tasks=[research_task, write_task])
+        return jsonify({"response": str(result), "framework": "crewai"})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/")
+def index():
+    return """<!DOCTYPE html>
+<html><head><title>1Claw CrewAI Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw CrewAI Agent</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>"""
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    print(f"CrewAI agent listening on http://0.0.0.0:{port}")
+    app.run(host="0.0.0.0", port=port)

package/dist/bundled-templates/templates/crewai/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw CrewAI Agent"
+echo "   Framework: crewai"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/bundled-templates/templates/crewai/requirements.txt

@@ -0,0 +1,3 @@
+crewai>=0.80.0
+crewai-tools>=0.14.0
+flask>=3.0.0

package/dist/bundled-templates/templates/crewai/template.yaml

@@ -0,0 +1,24 @@
+name: crewai
+display_name: "CrewAI"
+version: 1.0.0
+description: "Multi-agent crew with 1Claw-managed secrets"
+author: 1Claw
+language: python
+homepage: https://crewai.com
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: crewai
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to define your crew's agents, tasks, and workflow.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/bundled-templates/templates/elizaos/Dockerfile

@@ -0,0 +1,31 @@
+FROM node:22-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini python3 make g++ && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json tsconfig.json ./
+RUN npm install --omit=dev 2>/dev/null || npm install
+
+RUN npm install -g @1claw/mcp@latest 2>/dev/null || \
+    echo "WARN: @1claw/mcp install deferred to runtime"
+
+COPY agent.ts .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=elizaos
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/elizaos/README.md

@@ -0,0 +1,36 @@
+# 1Claw ElizaOS Agent Template
+
+[ElizaOS](https://elizaos.ai) character runtime with 1Claw vault-backed secrets and multi-chain signing via `@1claw/plugin-elizaos`.
+
+## Quick start
+
+```bash
+1claw spawn elizaos --agent-key ocv_YOUR_KEY
+```
+
+## What's included
+
+- `agent.ts` — ElizaOS agent with Shroud LLM routing and `/chat` + `/health` endpoints
+- `Dockerfile` — Node 22 slim image with `@1claw/mcp` and `@1claw/plugin-elizaos`
+- `entrypoint.sh` — Daemon socket detection, Shroud wiring, MCP server startup
+
+## Plugin actions
+
+The `@1claw/plugin-elizaos` plugin provides 8 actions:
+- `GET_SECRET` / `PUT_SECRET` / `LIST_SECRETS` / `DELETE_SECRET`
+- `SIGN_MESSAGE` / `SIGN_TYPED_DATA` / `SUBMIT_TRANSACTION`
+- `LIST_SIGNING_KEYS`
+
+## LLM authentication
+
+```bash
+# Bring your own key (stored in vault, routed through Shroud)
+1claw spawn elizaos --agent-key ocv_YOUR_KEY --llm-api-key sk-...
+
+# Use 1Claw Token Billing (no provider key needed)
+1claw spawn elizaos --agent-key ocv_YOUR_KEY
+```
+
+## Customization
+
+Edit `agent.ts` to define your character, add custom actions, or integrate with the full ElizaOS `AgentRuntime`.

package/dist/bundled-templates/templates/elizaos/agent.ts

@@ -0,0 +1,100 @@
+/**
+ * ElizaOS agent pre-wired with 1Claw plugin for vault secrets and signing.
+ *
+ * LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+ * The container never sees raw API keys — they are injected by the host daemon.
+ */
+
+import { createServer } from "node:http";
+
+const SHROUD_URL = process.env.ONECLAW_SHROUD_URL ?? "https://shroud.1claw.xyz";
+const LLM_VIA_SHROUD = process.env.ONECLAW_LLM_VIA_SHROUD === "true";
+const PROVIDER = process.env.ONECLAW_SHROUD_PROVIDER ?? "openai";
+const MODEL = process.env.ONECLAW_SHROUD_MODEL ?? "gpt-4o-mini";
+const PORT = parseInt(process.env.CHAT_UI_PORT ?? "3000", 10);
+
+const conversationHistory: { role: "user" | "assistant"; content: string }[] = [];
+
+/**
+ * Minimal chat handler using OpenAI-compatible API through Shroud.
+ * Replace with a full ElizaOS AgentRuntime for production use.
+ */
+async function handleChat(message: string): Promise<string> {
+  if (!LLM_VIA_SHROUD) {
+    return "No LLM configured. Use --llm-api-key or enable Token Billing.";
+  }
+
+  conversationHistory.push({ role: "user", content: message });
+
+  const resp = await fetch(`${SHROUD_URL}/v1/chat/completions`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: "Bearer shroud-injected" },
+    body: JSON.stringify({
+      model: MODEL,
+      messages: [
+        {
+          role: "system" as const,
+          content:
+            "You are an ElizaOS character running inside a secure 1Claw container. " +
+            "The @1claw/plugin-elizaos plugin gives you vault access and multi-chain signing. " +
+            "Be helpful and concise.",
+        },
+        ...conversationHistory,
+      ],
+    }),
+  });
+
+  if (!resp.ok) throw new Error(`LLM error: ${resp.status} ${await resp.text()}`);
+
+  const data = await resp.json() as any;
+  const text = data.choices?.[0]?.message?.content ?? "No response from LLM.";
+  conversationHistory.push({ role: "assistant", content: text });
+  return text;
+}
+
+const server = createServer(async (req, res) => {
+  if (req.url === "/health" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ status: "ok", framework: "elizaos", llm_wired: LLM_VIA_SHROUD }));
+    return;
+  }
+
+  if (req.url === "/chat" && req.method === "POST") {
+    const chunks: Buffer[] = [];
+    for await (const chunk of req) chunks.push(chunk as Buffer);
+    const body = JSON.parse(Buffer.concat(chunks).toString());
+    const message = (body.message ?? "").trim();
+
+    if (!message) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "No message provided" }));
+      return;
+    }
+
+    try {
+      const response = await handleChat(message);
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ response, framework: "elizaos" }));
+    } catch (e: any) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: e.message }));
+    }
+    return;
+  }
+
+  res.writeHead(200, { "Content-Type": "text/html" });
+  res.end(`<!DOCTYPE html>
+<html><head><title>1Claw ElizaOS Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw ElizaOS Agent</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+The @1claw/plugin-elizaos plugin provides 8 actions for vault secrets and multi-chain signing.
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>`);
+});
+
+server.listen(PORT, "0.0.0.0", () => {
+  console.log(`ElizaOS agent listening on http://0.0.0.0:${PORT}`);
+});

package/dist/bundled-templates/templates/elizaos/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw ElizaOS Agent"
+echo "   Framework: elizaos (TypeScript)"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec npx tsx agent.ts

package/dist/bundled-templates/templates/elizaos/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "1claw-elizaos-agent",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "tsx agent.ts",
+    "dev": "tsx watch agent.ts"
+  },
+  "dependencies": {
+    "@elizaos/core": "^0.2.0",
+    "@1claw/plugin-elizaos": "latest",
+    "@ai-sdk/openai": "^1.0.0",
+    "ai": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  }
+}

package/dist/bundled-templates/templates/elizaos/template.yaml

@@ -0,0 +1,25 @@
+name: elizaos
+display_name: "ElizaOS"
+version: 1.0.0
+description: "ElizaOS character runtime with 1Claw vault-backed secrets and signing"
+author: 1Claw
+language: node
+homepage: https://elizaos.ai
+
+docker:
+  base_image: node:22-slim
+  context_files:
+    - Dockerfile
+    - package.json
+    - tsconfig.json
+    - agent.ts
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: elizaos
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.ts to customize your ElizaOS character.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/bundled-templates/templates/elizaos/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "outDir": "dist"
+  },
+  "include": ["*.ts"]
+}

package/dist/bundled-templates/templates/langchain/Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=langchain
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/bundled-templates/templates/langchain/README.md

@@ -0,0 +1,37 @@
+# LangChain / LangGraph Template
+
+A Python agent using [LangChain](https://python.langchain.com) with 1Claw MCP
+for secrets management and on-chain signing.
+
+## Quick start
+
+```bash
+1claw spawn langchain
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn langchain --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Starter LangChain agent with tool calling (hello_world, list_env_vars)
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add your own tools, change the prompt, or swap the LLM
+provider. The agent uses `ChatOpenAI` pointed at Shroud, which handles
+provider routing transparently.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn langchain --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models