@better-openclaw/core 1.0.22 → 1.0.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-openclaw/core",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "private": false,
   "description": "Core logic for better-openclaw: schemas, service registry, resolver, composer, validators and generators",
   "author": "bidew.io <bachir@bidew.io>",

package/src/__snapshots__/composer.snapshot.test.ts.snap

@@ -8,9 +8,10 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -50,11 +51,51 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
       - \${OPENCLAW_GATEWAY_BIND:-lan}
       - --port
       - "18789"
+      - --allow-unconfigured
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       minio:
         condition: service_healthy
       redis:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   minio:
     image: minio/minio:RELEASE.2025-04-22T22-12-26Z
     environment:
@@ -97,16 +138,21 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
       - openclaw-network
   openclaw-cli:
     image: \${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
+    network_mode: service:openclaw-gateway
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
     environment:
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      OPENCLAW_GATEWAY_HOST: openclaw-gateway
-      OPENCLAW_GATEWAY_PORT: "18789"
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
       BROWSER: echo
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -123,19 +169,17 @@ exports[`compose snapshot tests > creator preset (ffmpeg + remotion + minio + re
     stdin_open: true
     tty: true
     init: true
-    networks:
-      - openclaw-network
     entrypoint:
       - node
       - dist/index.js
-    restart: no
     depends_on:
-      openclaw-gateway:
-        condition: service_started
+      - openclaw-gateway
 volumes:
+  convex-data:
   ffmpeg-shared:
   minio-data:
   redis-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge
@@ -179,9 +223,10 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -220,13 +265,53 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
       - \${OPENCLAW_GATEWAY_BIND:-lan}
       - --port
       - "18789"
+      - --allow-unconfigured
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       postgresql:
         condition: service_healthy
       redis:
         condition: service_healthy
       n8n:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   postgresql:
     image: postgres:17-alpine
     environment:
@@ -341,16 +426,21 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
       - openclaw-network
   openclaw-cli:
     image: \${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
+    network_mode: service:openclaw-gateway
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
     environment:
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      OPENCLAW_GATEWAY_HOST: openclaw-gateway
-      OPENCLAW_GATEWAY_PORT: "18789"
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
       BROWSER: echo
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -367,21 +457,19 @@ exports[`compose snapshot tests > devops preset (n8n + postgresql + redis + moni
     stdin_open: true
     tty: true
     init: true
-    networks:
-      - openclaw-network
     entrypoint:
       - node
       - dist/index.js
-    restart: no
     depends_on:
-      openclaw-gateway:
-        condition: service_started
+      - openclaw-gateway
 volumes:
+  convex-data:
   grafana-data:
   n8n-data:
   postgres-data:
   prometheus-data:
   redis-data:
+  tailscale-state:
   uptime-kuma-data:
 networks:
   openclaw-network:
@@ -470,9 +558,10 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -537,11 +626,24 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
       - \${OPENCLAW_GATEWAY_BIND:-lan}
       - --port
       - "18789"
+      - --allow-unconfigured
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
     depends_on:
       browserless:
         condition: service_healthy
       caddy:
         condition: service_healthy
+      convex:
+        condition: service_healthy
       meilisearch:
         condition: service_healthy
       minio:
@@ -593,6 +695,33 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
     restart: unless-stopped
     networks:
       - openclaw-network
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   meilisearch:
     image: getmeili/meilisearch:v1.35.1
     environment:
@@ -784,16 +913,21 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
       - openclaw-network
   openclaw-cli:
     image: \${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
+    network_mode: service:openclaw-gateway
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
     environment:
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      OPENCLAW_GATEWAY_HOST: openclaw-gateway
-      OPENCLAW_GATEWAY_PORT: "18789"
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
       BROWSER: echo
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -810,18 +944,15 @@ exports[`compose snapshot tests > full preset (many services) 1`] = `
     stdin_open: true
     tty: true
     init: true
-    networks:
-      - openclaw-network
     entrypoint:
       - node
       - dist/index.js
-    restart: no
     depends_on:
-      openclaw-gateway:
-        condition: service_started
+      - openclaw-gateway
 volumes:
   caddy-config:
   caddy-data:
+  convex-data:
   ffmpeg-shared:
   gotify-data:
   grafana-data:
@@ -834,6 +965,7 @@ volumes:
   qdrant-data:
   redis-data:
   searxng-data:
+  tailscale-state:
   uptime-kuma-data:
 networks:
   openclaw-network:
@@ -849,9 +981,10 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -883,9 +1016,49 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
       - \${OPENCLAW_GATEWAY_BIND:-lan}
       - --port
       - "18789"
+      - --allow-unconfigured
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
     depends_on:
+      convex:
+        condition: service_healthy
       redis:
         condition: service_healthy
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   redis:
     image: redis:8-alpine
     environment:
@@ -906,16 +1079,21 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
       - openclaw-network
   openclaw-cli:
     image: \${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
+    network_mode: service:openclaw-gateway
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
     environment:
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      OPENCLAW_GATEWAY_HOST: openclaw-gateway
-      OPENCLAW_GATEWAY_PORT: "18789"
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
       BROWSER: echo
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -932,17 +1110,15 @@ exports[`compose snapshot tests > minimal preset (redis only) 1`] = `
     stdin_open: true
     tty: true
     init: true
-    networks:
-      - openclaw-network
     entrypoint:
       - node
       - dist/index.js
-    restart: no
     depends_on:
-      openclaw-gateway:
-        condition: service_started
+      - openclaw-gateway
 volumes:
+  convex-data:
   redis-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge
@@ -957,9 +1133,10 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -998,9 +1175,22 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
       - \${OPENCLAW_GATEWAY_BIND:-lan}
       - --port
       - "18789"
+      - --allow-unconfigured
+    healthcheck:
+      test:
+        - CMD
+        - node
+        - -e
+        - fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
     depends_on:
       browserless:
         condition: service_healthy
+      convex:
+        condition: service_healthy
       qdrant:
         condition: service_healthy
       redis:
@@ -1025,6 +1215,33 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
     restart: unless-stopped
     networks:
       - openclaw-network
+  convex:
+    image: ghcr.io/get-convex/convex-backend:latest
+    environment:
+      CONVEX_CLOUD_ORIGIN: http://127.0.0.1:3210
+      CONVEX_SITE_ORIGIN: http://127.0.0.1:3211
+      INSTANCE_NAME: openclaw-convex
+      INSTANCE_SECRET: \${INSTANCE_SECRET}
+      DATABASE_URL: \${DATABASE_URL}
+      RUST_LOG: info
+      DISABLE_BEACON: ""
+      CONVEX_SELF_HOSTED_ADMIN_KEY: \${CONVEX_SELF_HOSTED_ADMIN_KEY}
+    ports:
+      - \${CONVEX_EXTERNAL_PORT_0:-3210}:3210
+      - \${CONVEX_EXTERNAL_PORT_1:-3211}:3211
+    volumes:
+      - convex-data:/convex/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f http://localhost:3210/version
+      interval: 5s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+    restart: unless-stopped
+    networks:
+      - openclaw-network
   qdrant:
     image: qdrant/qdrant:v1.12.1
     environment:
@@ -1081,16 +1298,21 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
       - openclaw-network
   openclaw-cli:
     image: \${OPENCLAW_IMAGE:-ghcr.io/openclaw/openclaw:latest}
+    network_mode: service:openclaw-gateway
+    cap_drop:
+      - NET_RAW
+      - NET_ADMIN
+    security_opt:
+      - no-new-privileges:true
     environment:
       HOME: /home/node
       TERM: xterm-256color
       OPENCLAW_GATEWAY_TOKEN: \${OPENCLAW_GATEWAY_TOKEN}
-      OPENCLAW_GATEWAY_HOST: openclaw-gateway
-      OPENCLAW_GATEWAY_PORT: "18789"
+      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: \${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
       BROWSER: echo
-      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY}
-      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY}
-      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE}
+      CLAUDE_AI_SESSION_KEY: \${CLAUDE_AI_SESSION_KEY:-}
+      CLAUDE_WEB_SESSION_KEY: \${CLAUDE_WEB_SESSION_KEY:-}
+      CLAUDE_WEB_COOKIE: \${CLAUDE_WEB_COOKIE:-}
       OPENAI_API_KEY: \${OPENAI_API_KEY}
       ANTHROPIC_API_KEY: \${ANTHROPIC_API_KEY}
       GOOGLE_API_KEY: \${GOOGLE_API_KEY}
@@ -1107,19 +1329,17 @@ exports[`compose snapshot tests > researcher preset (qdrant + searxng + browserl
     stdin_open: true
     tty: true
     init: true
-    networks:
-      - openclaw-network
     entrypoint:
       - node
       - dist/index.js
-    restart: no
     depends_on:
-      openclaw-gateway:
-        condition: service_started
+      - openclaw-gateway
 volumes:
+  convex-data:
   qdrant-data:
   redis-data:
   searxng-data:
+  tailscale-state:
 networks:
   openclaw-network:
     driver: bridge

package/src/bare-metal-partition.test.ts

@@ -25,9 +25,10 @@ describe("bare-metal partition", () => {
 		});
 		const result = partitionBareMetal(resolved, "linux/amd64");
 		expect(result.nativeIds.has("redis")).toBe(true);
-		expect(result.nativeServices.length).toBe(1);
-		expect(result.nativeServices[0].definition.id).toBe("redis");
-		expect(result.dockerOnlyServices.length).toBe(0);
+		const redisNative = result.nativeServices.find((s) => s.definition.id === "redis");
+		expect(redisNative).toBeDefined();
+		// Mandatory services (convex, mission-control, tailscale) are Docker-only
+		expect(result.dockerOnlyServices.length).toBeGreaterThanOrEqual(0);
 	});
 
 	it("partitions n8n as Docker-only (no native recipe)", () => {

package/src/composer.test.ts

@@ -38,8 +38,10 @@ describe("compose", () => {
 		// Should have CLI companion service
 		expect(parsed.services).toHaveProperty("openclaw-cli");
 
-		// Gateway should have no depends_on (no companions)
-		expect(parsed.services["openclaw-gateway"]).not.toHaveProperty("depends_on");
+		// Gateway should have depends_on for mandatory services (convex, mission-control, tailscale)
+		// Even with no user-selected services, mandatory services are always present
+		expect(parsed.services).toHaveProperty("convex");
+		expect(parsed.services).toHaveProperty("mission-control");
 
 		// Gateway should have restart policy
 		expect(parsed.services["openclaw-gateway"].restart).toBe("unless-stopped");