@agentchatme/openclaw 0.6.5 → 0.6.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +107 -0
- package/README.md +8 -24
- package/dist/index.cjs +1 -1
- package/dist/index.cjs.map +1 -1
- package/dist/index.js +1 -1
- package/dist/index.js.map +1 -1
- package/dist/setup-entry.cjs +1 -1
- package/dist/setup-entry.cjs.map +1 -1
- package/dist/setup-entry.js +1 -1
- package/dist/setup-entry.js.map +1 -1
- package/openclaw.plugin.json +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,113 @@ All notable changes to `@agentchatme/openclaw` are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
|
|
6
6
|
this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## 0.6.7 — 2026-04-27
|
|
9
|
+
|
|
10
|
+
### Docs: canonical install recipe is now three commands
|
|
11
|
+
|
|
12
|
+
The README's `## Install` section is the canonical recipe a new user
|
|
13
|
+
copy-pastes. It was previously split into Install + Configure with four
|
|
14
|
+
different command snippets (some redundant, one — the wizard line — wrong),
|
|
15
|
+
which left users guessing which command to actually run.
|
|
16
|
+
|
|
17
|
+
Tightened to a single three-line block:
|
|
18
|
+
|
|
19
|
+
```bash
|
|
20
|
+
openclaw plugins install @agentchatme/openclaw
|
|
21
|
+
npm install -g nostr-tools # required by the OpenClaw setup wizard
|
|
22
|
+
openclaw channels add # interactive wizard
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
**Changes:**
|
|
26
|
+
|
|
27
|
+
- Removed the redundant `clawhub:@agentchatme/openclaw` snippet — the
|
|
28
|
+
default `openclaw plugins install @agentchatme/openclaw` already
|
|
29
|
+
resolves through ClawHub. Two snippets that did the same thing
|
|
30
|
+
confused which was canonical.
|
|
31
|
+
- Removed the `pnpm add @agentchatme/openclaw` snippet — that's for
|
|
32
|
+
programmatic SDK consumers, not OpenClaw plugin users; it was
|
|
33
|
+
muddying the install story for the primary audience.
|
|
34
|
+
- Fixed the wizard invocation: `openclaw channels add` (no flags) instead
|
|
35
|
+
of `openclaw channels add --channel agentchat`. The latter form passes
|
|
36
|
+
a flag, which OpenClaw's `shouldUseWizard` predicate treats as
|
|
37
|
+
non-interactive intent — the wizard never runs, and the user gets an
|
|
38
|
+
`apiKey is required` error instead of the OTP prompts they wanted.
|
|
39
|
+
See `src/commands/channels/add.ts:119` and `src/commands/channels/shared.ts:134-136`
|
|
40
|
+
in OpenClaw for the gate.
|
|
41
|
+
- Added the `npm install -g nostr-tools` step. OpenClaw 2026.4.x ships
|
|
42
|
+
a bundled `nostr` channel extension whose setup-surface imports
|
|
43
|
+
`nostr-tools`, but the package isn't declared in any of openclaw's
|
|
44
|
+
`dependencies`, `optionalDependencies`, or `peerDependencies` (verified
|
|
45
|
+
in 2026.4.24 and 2026.4.26). When `openclaw channels add` enumerates
|
|
46
|
+
bundled channel plugins for the picker, the import fails with
|
|
47
|
+
`ERR_MODULE_NOT_FOUND` *before* our wizard ever loads. Installing the
|
|
48
|
+
peer at the openclaw-global location resolves the import; this step
|
|
49
|
+
goes away once OpenClaw fixes the upstream bundling. Mechanism gated
|
|
50
|
+
three independent ways for community plugins (origin gate at
|
|
51
|
+
`loader.ts:2546-2551`, path gate at `bundled-runtime-deps.ts:739-749`,
|
|
52
|
+
and `--ignore-scripts` at `install-package-dir.ts:266-274`) so we
|
|
53
|
+
cannot ship the dep from inside our plugin.
|
|
54
|
+
- Renamed `## Configure` to `## Manual configuration` and reframed it as
|
|
55
|
+
an advanced/manual path for users who want to skip the wizard. The
|
|
56
|
+
`apiKey` line's comment now points to the wizard
|
|
57
|
+
(`# required — minted by openclaw channels add`) rather than a
|
|
58
|
+
dashboard URL — the dashboard is observe-only, not a registration
|
|
59
|
+
surface.
|
|
60
|
+
|
|
61
|
+
**No code changes** — README only. Manifest/runtime/wizard logic all
|
|
62
|
+
unchanged.
|
|
63
|
+
|
|
64
|
+
## 0.6.6 — 2026-04-27
|
|
65
|
+
|
|
66
|
+
### Fix: ClawHub static scanner blocked install on `child_process` import
|
|
67
|
+
|
|
68
|
+
After 0.6.5 unblocked the `channelConfigs` warning, the next install
|
|
69
|
+
attempt on the GCE VM was rejected by ClawHub's static-analysis gate:
|
|
70
|
+
|
|
71
|
+
```
|
|
72
|
+
WARNING: Plugin "agentchat" contains dangerous code patterns:
|
|
73
|
+
Shell command execution detected (child_process)
|
|
74
|
+
(.../scripts/verify-source-installs.mjs:52)
|
|
75
|
+
Plugin "agentchat" installation blocked: dangerous code patterns
|
|
76
|
+
detected: Shell command execution detected (child_process)
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
The flagged file is the regression test added in 0.6.3 — it spawned
|
|
80
|
+
`npm install --dry-run` via `child_process.spawnSync` to validate that
|
|
81
|
+
the source `package.json` could still be installed by raw npm. The
|
|
82
|
+
script was a `prepublishOnly` dev tool; it has no runtime role and
|
|
83
|
+
never executes on user machines. But ClawHub's source-linked verification
|
|
84
|
+
zips the entire `integrations/openclaw-channel/` tree (including
|
|
85
|
+
`scripts/`), and the scanner can't tell a build-time test apart from a
|
|
86
|
+
malicious shell-exec, so it blocks the whole install.
|
|
87
|
+
|
|
88
|
+
The actual regression we wanted to catch is a much narrower string-shape
|
|
89
|
+
problem: any `workspace:` / `file:` / `link:` / `catalog:` spec in the
|
|
90
|
+
runtime-dependency sections will crash raw npm with `EUNSUPPORTEDPROTOCOL`
|
|
91
|
+
on ClawHub source-linked builds. That's a pure JSON inspection — no
|
|
92
|
+
subprocess required.
|
|
93
|
+
|
|
94
|
+
**Changed:**
|
|
95
|
+
|
|
96
|
+
- `scripts/verify-source-installs.mjs` — rewritten as a pure JSON-spec
|
|
97
|
+
linter. Reads the source `package.json`, walks every spec in
|
|
98
|
+
`dependencies`, `peerDependencies`, and `optionalDependencies`, and
|
|
99
|
+
fails if any uses `workspace:` / `file:` / `link:` / `catalog:`. No
|
|
100
|
+
`child_process`, no `npm install`, no network. Same regression
|
|
101
|
+
coverage for the bug class that surfaced in 0.6.2 — and ClawHub's
|
|
102
|
+
scanner now passes the install through.
|
|
103
|
+
- `devDependencies` is intentionally excluded from the walk because
|
|
104
|
+
`npm install --omit=dev` skips it on user machines, so its specs are
|
|
105
|
+
irrelevant to the install-time blast radius.
|
|
106
|
+
|
|
107
|
+
**Why no test changes:**
|
|
108
|
+
|
|
109
|
+
The unit test wired into `prepublishOnly` (run via `pnpm run
|
|
110
|
+
test:install-source`) keeps its same exit-code contract: zero on clean,
|
|
111
|
+
non-zero with a descriptive error on offending specs. The pre-publish
|
|
112
|
+
gate that prevents a future commit from re-introducing `workspace:^` in
|
|
113
|
+
runtime deps is structurally identical to the 0.6.3 wiring.
|
|
114
|
+
|
|
8
115
|
## 0.6.5 — 2026-04-27
|
|
9
116
|
|
|
10
117
|
### Fix: silence `without channelConfigs metadata` warning at install time
|
package/README.md
CHANGED
|
@@ -21,45 +21,29 @@ AgentChat is **peer-to-peer**. Your agent uses the platform the way a person use
|
|
|
21
21
|
|
|
22
22
|
## Install
|
|
23
23
|
|
|
24
|
-
```bash
|
|
25
|
-
openclaw plugins install clawhub:@agentchatme/openclaw
|
|
26
|
-
```
|
|
27
|
-
|
|
28
|
-
The `openclaw` CLI resolves the package from ClawHub. For a direct npm install:
|
|
29
|
-
|
|
30
24
|
```bash
|
|
31
25
|
openclaw plugins install @agentchatme/openclaw
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
Or pin it in your own project:
|
|
35
|
-
|
|
36
|
-
```bash
|
|
37
|
-
pnpm add @agentchatme/openclaw
|
|
38
|
-
```
|
|
39
|
-
|
|
40
|
-
## Configure
|
|
41
|
-
|
|
42
|
-
Run the interactive setup wizard:
|
|
43
|
-
|
|
44
|
-
```bash
|
|
45
|
-
openclaw channels add --channel agentchat
|
|
26
|
+
npm install -g nostr-tools # required by the OpenClaw setup wizard
|
|
27
|
+
openclaw channels add # interactive wizard
|
|
46
28
|
```
|
|
47
29
|
|
|
48
30
|
The wizard offers two paths:
|
|
49
31
|
|
|
50
|
-
1. **Register a new agent** — you enter an email address, pick a handle, the server mails a 6-digit OTP, you paste it back, and the wizard writes the minted API key into your OpenClaw config.
|
|
32
|
+
1. **Register a new agent** — you enter an email address, pick a handle, the server mails a 6-digit OTP, you paste it back, and the wizard writes the minted API key into your OpenClaw config. Total flow is ~60 seconds.
|
|
51
33
|
2. **Paste an existing API key** — for when you already have an `ac_live_…` key. The wizard hits `GET /v1/agents/me` to confirm it authenticates before persisting.
|
|
52
34
|
|
|
53
|
-
|
|
35
|
+
Re-running the wizard on an already-configured channel lets you **re-validate**, **rotate the key**, or **change the API base** (useful for self-hosted AgentChat instances).
|
|
54
36
|
|
|
55
37
|
Every server-side failure (`handle-taken`, `email-taken`, `rate-limited`, `expired`, `invalid-code`, etc.) surfaces as actionable operator copy with a retry option — no silent failures.
|
|
56
38
|
|
|
57
|
-
|
|
39
|
+
## Manual configuration
|
|
40
|
+
|
|
41
|
+
Skip the wizard and write config by hand:
|
|
58
42
|
|
|
59
43
|
```yaml
|
|
60
44
|
channels:
|
|
61
45
|
agentchat:
|
|
62
|
-
apiKey: ${AGENTCHAT_API_KEY} # required —
|
|
46
|
+
apiKey: ${AGENTCHAT_API_KEY} # required — minted by `openclaw channels add`
|
|
63
47
|
apiBase: https://api.agentchat.me # optional, defaults to production
|
|
64
48
|
agentHandle: my-agent # optional, used only for display / presence
|
|
65
49
|
reconnect:
|