@1claw/cli 0.37.0 → 0.37.2

package/dist/src/templates/llamaindex/template.yaml

@@ -0,0 +1,24 @@
+name: llamaindex
+display_name: "LlamaIndex"
+version: 1.0.0
+description: "LlamaIndex agent with tool integration and 1Claw MCP"
+author: 1Claw
+language: python
+homepage: https://docs.llamaindex.ai
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: llamaindex
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to customize your LlamaIndex agent's tools and data sources.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/src/templates/mastra/Dockerfile

@@ -0,0 +1,31 @@
+FROM node:22-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package.json tsconfig.json ./
+RUN npm install --omit=dev 2>/dev/null || npm install
+
+RUN npm install -g @1claw/mcp@latest 2>/dev/null || \
+    echo "WARN: @1claw/mcp install deferred to runtime"
+
+COPY agent.ts .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=mastra
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/mastra/README.md

@@ -0,0 +1,31 @@
+# 1Claw Mastra Agent Template
+
+TypeScript-first AI agent using [Mastra](https://mastra.ai) + Vercel AI SDK with 1Claw secrets and signing.
+
+## Quick start
+
+```bash
+1claw spawn mastra --agent-key ocv_YOUR_KEY
+```
+
+## What's included
+
+- `agent.ts` — Mastra agent with AI SDK tool calling, Shroud LLM routing, and `/chat` + `/health` endpoints
+- `Dockerfile` — Node 22 slim image with `@1claw/mcp` for vault access
+- `entrypoint.sh` — Daemon socket detection, Shroud wiring, MCP server startup
+
+## LLM authentication
+
+The container never sees your LLM API key. Credentials are injected by the host daemon and routed through Shroud.
+
+```bash
+# Bring your own key (stored in vault, routed through Shroud)
+1claw spawn mastra --agent-key ocv_YOUR_KEY --llm-api-key sk-...
+
+# Use 1Claw Token Billing (no provider key needed)
+1claw spawn mastra --agent-key ocv_YOUR_KEY
+```
+
+## Customization
+
+Edit `agent.ts` to add tools, change the system prompt, or integrate with Mastra workflows.

package/dist/src/templates/mastra/agent.ts

@@ -0,0 +1,112 @@
+/**
+ * Mastra agent pre-wired with 1Claw MCP for secrets and signing.
+ *
+ * LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+ * The container never sees raw API keys — they are injected by the host daemon.
+ */
+
+import { createServer } from "node:http";
+import { Mastra } from "@mastra/core";
+import { createOpenAI } from "@ai-sdk/openai";
+import { generateText, tool } from "ai";
+import { z } from "zod";
+
+const SHROUD_URL = process.env.ONECLAW_SHROUD_URL ?? "https://shroud.1claw.xyz";
+const LLM_VIA_SHROUD = process.env.ONECLAW_LLM_VIA_SHROUD === "true";
+const PROVIDER = process.env.ONECLAW_SHROUD_PROVIDER ?? "openai";
+const MODEL = process.env.ONECLAW_SHROUD_MODEL ?? "gpt-4o-mini";
+
+const conversationHistory: { role: "user" | "assistant"; content: string }[] = [];
+
+const openai = LLM_VIA_SHROUD
+  ? createOpenAI({ baseURL: `${SHROUD_URL}/v1`, apiKey: "shroud-injected" })
+  : null;
+
+const mastra = new Mastra({});
+
+const helloTool = tool({
+  description: "Say hello to someone",
+  parameters: z.object({ name: z.string().describe("Name to greet") }),
+  execute: async ({ name }) =>
+    `Hello, ${name}! I'm a Mastra agent running inside 1Claw.`,
+});
+
+const envTool = tool({
+  description: "List 1Claw-related environment variables (values redacted)",
+  parameters: z.object({}),
+  execute: async () => {
+    const vars = Object.keys(process.env)
+      .filter((k) => k.startsWith("ONECLAW_"))
+      .sort()
+      .map((k) => `  ${k}=***`);
+    return vars.length ? vars.join("\n") : "No ONECLAW_* vars set.";
+  },
+});
+
+async function handleChat(message: string): Promise<string> {
+  if (!openai) {
+    return "No LLM configured. Use --llm-api-key or enable Token Billing.";
+  }
+
+  conversationHistory.push({ role: "user", content: message });
+
+  const { text } = await generateText({
+    model: openai(MODEL),
+    system:
+      "You are a helpful AI agent running inside a secure 1Claw container. " +
+      "You have access to tools for greeting and inspecting the environment.",
+    messages: conversationHistory,
+    tools: { hello: helloTool, env: envTool },
+  });
+
+  conversationHistory.push({ role: "assistant", content: text });
+  return text;
+}
+
+const PORT = parseInt(process.env.CHAT_UI_PORT ?? "3000", 10);
+
+const server = createServer(async (req, res) => {
+  if (req.url === "/health" && req.method === "GET") {
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ status: "ok", framework: "mastra", llm_wired: LLM_VIA_SHROUD }));
+    return;
+  }
+
+  if (req.url === "/chat" && req.method === "POST") {
+    const chunks: Buffer[] = [];
+    for await (const chunk of req) chunks.push(chunk as Buffer);
+    const body = JSON.parse(Buffer.concat(chunks).toString());
+    const message = (body.message ?? "").trim();
+
+    if (!message) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "No message provided" }));
+      return;
+    }
+
+    try {
+      const response = await handleChat(message);
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ response, framework: "mastra" }));
+    } catch (e: any) {
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: e.message }));
+    }
+    return;
+  }
+
+  res.writeHead(200, { "Content-Type": "text/html" });
+  res.end(`<!DOCTYPE html>
+<html><head><title>1Claw Mastra Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw Mastra Agent</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>`);
+});
+
+server.listen(PORT, "0.0.0.0", () => {
+  console.log(`Mastra agent listening on http://0.0.0.0:${PORT}`);
+});

package/dist/src/templates/mastra/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw Mastra Agent"
+echo "   Framework: mastra (TypeScript)"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec npx tsx agent.ts

package/dist/src/templates/mastra/package.json

@@ -0,0 +1,17 @@
+{
+  "name": "1claw-mastra-agent",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "tsx agent.ts",
+    "dev": "tsx watch agent.ts"
+  },
+  "dependencies": {
+    "@mastra/core": "^0.10.0",
+    "@ai-sdk/openai": "^1.0.0",
+    "ai": "^4.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  }
+}

package/dist/src/templates/mastra/template.yaml

@@ -0,0 +1,25 @@
+name: mastra
+display_name: "Mastra"
+version: 1.0.0
+description: "TypeScript-first AI agent framework with 1Claw MCP for secrets and signing"
+author: 1Claw
+language: node
+homepage: https://mastra.ai
+
+docker:
+  base_image: node:22-slim
+  context_files:
+    - Dockerfile
+    - package.json
+    - tsconfig.json
+    - agent.ts
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: mastra
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.ts to customize your Mastra agent.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/src/templates/mastra/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "esModuleInterop": true,
+    "strict": true,
+    "skipLibCheck": true,
+    "outDir": "dist"
+  },
+  "include": ["*.ts"]
+}

package/dist/src/templates/openai-agents/Dockerfile

@@ -0,0 +1,34 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+RUN pip install --no-cache-dir 1claw-mcp 2>/dev/null || \
+    (apt-get update && apt-get install -y --no-install-recommends nodejs npm && \
+     npm install -g @1claw/mcp@latest && \
+     rm -rf /var/lib/apt/lists/*) || \
+    echo "WARN: 1claw-mcp install deferred to runtime"
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=openai-agents
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/openai-agents/README.md

@@ -0,0 +1,29 @@
+# OpenAI Agents SDK Template
+
+A Python agent using the [OpenAI Agents SDK](https://openai.github.io/openai-agents-python/)
+with 1Claw MCP for secrets management and on-chain signing.
+
+## Quick start
+
+```bash
+1claw spawn openai-agents
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn openai-agents --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Starter agent with function tools (hello_world, list_env_vars)
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to add your own `@function_tool` tools, change the agent
+instructions, or add handoffs between agents. The agent uses the OpenAI
+Agents SDK with the base URL pointed at Shroud.

package/dist/src/templates/openai-agents/agent.py

@@ -0,0 +1,98 @@
+"""
+OpenAI Agents SDK agent pre-wired with 1Claw MCP for secrets and signing.
+
+LLM calls are routed through Shroud when ONECLAW_LLM_VIA_SHROUD is set.
+The container never sees raw API keys — they are injected by the host daemon.
+"""
+
+import os
+import asyncio
+from flask import Flask, request, jsonify
+from agents import Agent, Runner, function_tool, ModelSettings
+
+app = Flask(__name__)
+
+SHROUD_URL = os.environ.get("ONECLAW_SHROUD_URL", "https://shroud.1claw.xyz")
+LLM_VIA_SHROUD = os.environ.get("ONECLAW_LLM_VIA_SHROUD", "").lower() == "true"
+MODEL = os.environ.get("ONECLAW_SHROUD_MODEL", "gpt-4o-mini")
+
+
+@function_tool
+def hello_world(name: str) -> str:
+    """Say hello to someone."""
+    return f"Hello, {name}! I'm an OpenAI Agents SDK agent running inside 1Claw."
+
+
+@function_tool
+def list_env_vars() -> str:
+    """List 1Claw-related environment variables (values redacted)."""
+    prefix = "ONECLAW_"
+    vars_list = [k for k in sorted(os.environ) if k.startswith(prefix)]
+    return "\n".join(f"  {k}=***" for k in vars_list) if vars_list else "No ONECLAW_* vars set."
+
+
+def create_agent() -> Agent | None:
+    """Build the OpenAI agent. Returns None if no LLM is configured."""
+    if not LLM_VIA_SHROUD:
+        return None
+
+    os.environ["OPENAI_BASE_URL"] = f"{SHROUD_URL}/v1"
+    os.environ["OPENAI_API_KEY"] = "shroud-injected"
+
+    return Agent(
+        name="1Claw Agent",
+        instructions=(
+            "You are a helpful AI agent running inside a secure 1Claw container. "
+            "You have access to tools for greeting and inspecting the environment."
+        ),
+        tools=[hello_world, list_env_vars],
+        model=MODEL,
+    )
+
+
+agent = create_agent()
+
+
+@app.route("/health")
+def health():
+    return jsonify({"status": "ok", "framework": "openai-agents", "llm_wired": LLM_VIA_SHROUD})
+
+
+@app.route("/chat", methods=["POST"])
+def chat():
+    data = request.get_json(silent=True) or {}
+    message = data.get("message", "").strip()
+    if not message:
+        return jsonify({"error": "No message provided"}), 400
+
+    if not agent:
+        return jsonify({
+            "response": "No LLM configured. Use --llm-api-key or enable Token Billing.",
+            "framework": "openai-agents",
+        })
+
+    try:
+        result = asyncio.run(Runner.run(agent, message))
+        output = result.final_output
+        return jsonify({"response": output, "framework": "openai-agents"})
+    except Exception as e:
+        return jsonify({"error": str(e)}), 500
+
+
+@app.route("/")
+def index():
+    return """<!DOCTYPE html>
+<html><head><title>1Claw OpenAI Agent</title></head>
+<body style="font-family:system-ui;max-width:600px;margin:40px auto;padding:0 20px">
+<h1>1Claw OpenAI Agents SDK</h1>
+<p>Send messages via <code>POST /chat</code> with <code>{"message": "..."}</code></p>
+<p>Health: <a href="/health">/health</a></p>
+<p style="color:#666;font-size:0.9em">
+Credentials stay in the host daemon — this container never sees secret values.
+</p></body></html>"""
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("CHAT_UI_PORT", "3000"))
+    print(f"OpenAI Agents SDK agent listening on http://0.0.0.0:{port}")
+    app.run(host="0.0.0.0", port=port)

package/dist/src/templates/openai-agents/entrypoint.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -e
+
+DAEMON_SOCKET="${ONECLAW_DAEMON_SOCKET:-/run/1claw/daemon.sock}"
+CHAT_UI_PORT="${CHAT_UI_PORT:-3000}"
+
+echo "─────────────────────────────────────────────"
+echo " 1Claw OpenAI Agents SDK"
+echo "   Framework: openai-agents"
+echo "   Agent ID:  ${ONECLAW_AGENT_ID:-not set}"
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    echo "   Mode:      ${ONECLAW_MODE:-cloud} (daemon socket)"
+    echo "   Socket:    $DAEMON_SOCKET"
+else
+    echo "   Mode:      standalone (no daemon socket)"
+fi
+echo "─────────────────────────────────────────────"
+
+if [ "$ONECLAW_LLM_VIA_SHROUD" = "true" ]; then
+    export OPENAI_BASE_URL="${ONECLAW_SHROUD_URL}/v1"
+    echo "LLM routed through Shroud: ${ONECLAW_SHROUD_PROVIDER}/${ONECLAW_SHROUD_MODEL}"
+fi
+
+if [ -S "$DAEMON_SOCKET" ]; then
+    if command -v 1claw-mcp >/dev/null 2>&1; then
+        ONECLAW_LOCAL_VAULT=true ONECLAW_DAEMON_SOCKET="$DAEMON_SOCKET" \
+            1claw-mcp --local 2>/tmp/mcp.log &
+        echo "MCP server started in background."
+    fi
+fi
+
+echo "Ready: http://0.0.0.0:${CHAT_UI_PORT}"
+exec python agent.py

package/dist/src/templates/openai-agents/requirements.txt

@@ -0,0 +1,3 @@
+openai-agents>=0.1.0
+openai>=1.50.0
+flask>=3.0.0

package/dist/src/templates/openai-agents/template.yaml

@@ -0,0 +1,24 @@
+name: openai-agents
+display_name: "OpenAI Agents SDK"
+version: 1.0.0
+description: "OpenAI Agents SDK with tool calling and 1Claw MCP integration"
+author: 1Claw
+language: python
+homepage: https://openai.github.io/openai-agents-python/
+
+docker:
+  base_image: python:3.12-slim
+  context_files:
+    - Dockerfile
+    - requirements.txt
+    - agent.py
+    - entrypoint.sh
+  env:
+    ONECLAW_FRAMEWORK: openai-agents
+  health_endpoint: /health
+  health_port: 3000
+
+post_spawn_message: |
+  Edit agent.py to customize your OpenAI agent's tools and instructions.
+  Your 1Claw MCP server is available at the daemon socket.
+  LLM calls are routed through Shroud for inspection and redaction.

package/dist/src/templates/pydantic-ai/Dockerfile

@@ -0,0 +1,34 @@
+FROM python:3.12-slim
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl tini && \
+    rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+RUN pip install --no-cache-dir 1claw-mcp 2>/dev/null || \
+    (apt-get update && apt-get install -y --no-install-recommends nodejs npm && \
+     npm install -g @1claw/mcp@latest && \
+     rm -rf /var/lib/apt/lists/*) || \
+    echo "WARN: 1claw-mcp install deferred to runtime"
+
+COPY agent.py .
+COPY entrypoint.sh .
+RUN chmod +x entrypoint.sh
+
+RUN mkdir -p /run/1claw
+
+ENV NODE_ENV=production
+ENV ONECLAW_DAEMON_SOCKET=/run/1claw/daemon.sock
+ENV ONECLAW_FRAMEWORK=pydantic-ai
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=5 \
+    CMD curl -sf http://localhost:3000/health || exit 1
+
+ENTRYPOINT ["tini", "--"]
+CMD ["./entrypoint.sh"]

package/dist/src/templates/pydantic-ai/README.md

@@ -0,0 +1,36 @@
+# Pydantic AI Template
+
+A Python agent using [Pydantic AI](https://ai.pydantic.dev) for type-safe, structured agent interactions with 1Claw MCP.
+
+## Quick start
+
+```bash
+1claw spawn pydantic-ai
+```
+
+Or with your own API key:
+
+```bash
+1claw spawn pydantic-ai --llm-api-key sk-...
+```
+
+## What's included
+
+- **agent.py** — Pydantic AI agent with typed tools and dependency injection
+- **Flask server** on port 3000 with `/chat` and `/health` endpoints
+- **Shroud integration** — LLM calls are routed through Shroud for inspection
+- **MCP server** — started automatically for tool access to 1Claw vault
+
+## Customizing
+
+Edit `agent.py` to define typed result models, add tools with
+`RunContext` dependency injection, or use structured output validation.
+Pydantic AI enforces type safety on tool inputs/outputs and agent results.
+
+## LLM authentication
+
+The template supports three methods (configured at spawn time):
+
+1. **BYOK** — `1claw spawn pydantic-ai --llm-api-key sk-...`
+2. **Token Billing** — enable in Dashboard, no key needed
+3. **Anthropic WIF** — OIDC federation for Anthropic models