@better-openclaw/core 1.0.22 → 1.0.24

package/src/composer.ts

@@ -50,6 +50,7 @@ const CATEGORY_PROFILE_MAP: Partial<Record<ServiceCategory, { file: string; prof
 	"social-media": { file: "docker-compose.social.yml", profile: "social" },
 	knowledge: { file: "docker-compose.knowledge.yml", profile: "knowledge" },
 	communication: { file: "docker-compose.communication.yml", profile: "communication" },
+	"saas-boilerplate": { file: "docker-compose.saas.yml", profile: "saas" },
 };
 
 const YAML_OPTIONS = { lineWidth: 120, nullStr: "" };
@@ -83,10 +84,11 @@ function buildGatewayServices(
 		HOME: "/home/node",
 		TERM: "xterm-256color",
 		OPENCLAW_GATEWAY_TOKEN: "${OPENCLAW_GATEWAY_TOKEN}",
+		OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: "${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}",
 		// Claude web-provider session vars (optional, user fills in .env)
-		CLAUDE_AI_SESSION_KEY: "${CLAUDE_AI_SESSION_KEY}",
-		CLAUDE_WEB_SESSION_KEY: "${CLAUDE_WEB_SESSION_KEY}",
-		CLAUDE_WEB_COOKIE: "${CLAUDE_WEB_COOKIE}",
+		CLAUDE_AI_SESSION_KEY: "${CLAUDE_AI_SESSION_KEY:-}",
+		CLAUDE_WEB_SESSION_KEY: "${CLAUDE_WEB_SESSION_KEY:-}",
+		CLAUDE_WEB_COOKIE: "${CLAUDE_WEB_COOKIE:-}",
 	};
 
 	// Add AI provider API keys to gateway environment
@@ -150,7 +152,20 @@ function buildGatewayServices(
 			"${OPENCLAW_GATEWAY_BIND:-lan}",
 			"--port",
 			"18789",
+			"--allow-unconfigured",
 		],
+		healthcheck: {
+			test: [
+				"CMD",
+				"node",
+				"-e",
+				"fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
+			],
+			interval: "30s",
+			timeout: "5s",
+			retries: 5,
+			start_period: "20s",
+		},
 	};
 
 	// Traefik labels for the gateway
@@ -173,13 +188,11 @@ function buildGatewayServices(
 		HOME: "/home/node",
 		TERM: "xterm-256color",
 		OPENCLAW_GATEWAY_TOKEN: "${OPENCLAW_GATEWAY_TOKEN}",
-		// Gateway connection: use Docker service name so CLI can reach the gateway over the bridge network
-		OPENCLAW_GATEWAY_HOST: "openclaw-gateway",
-		OPENCLAW_GATEWAY_PORT: "18789",
+		OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: "${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}",
 		BROWSER: "echo",
-		CLAUDE_AI_SESSION_KEY: "${CLAUDE_AI_SESSION_KEY}",
-		CLAUDE_WEB_SESSION_KEY: "${CLAUDE_WEB_SESSION_KEY}",
-		CLAUDE_WEB_COOKIE: "${CLAUDE_WEB_COOKIE}",
+		CLAUDE_AI_SESSION_KEY: "${CLAUDE_AI_SESSION_KEY:-}",
+		CLAUDE_WEB_SESSION_KEY: "${CLAUDE_WEB_SESSION_KEY:-}",
+		CLAUDE_WEB_COOKIE: "${CLAUDE_WEB_COOKIE:-}",
 	};
 
 	// Add same AI provider API keys to CLI for direct AI interactions
@@ -189,6 +202,9 @@ function buildGatewayServices(
 
 	const cliService: Record<string, unknown> = {
 		image: `\${OPENCLAW_IMAGE:-${defaultImage}}`,
+		network_mode: "service:openclaw-gateway",
+		cap_drop: ["NET_RAW", "NET_ADMIN"],
+		security_opt: ["no-new-privileges:true"],
 		environment: cliEnv,
 		volumes: [
 			"${OPENCLAW_CONFIG_DIR:-./openclaw/config}:/home/node/.openclaw",
@@ -197,13 +213,8 @@ function buildGatewayServices(
 		stdin_open: true,
 		tty: true,
 		init: true,
-		networks: ["openclaw-network"],
 		entrypoint: ["node", "dist/index.js"],
-		// CLI is interactive — don't auto-restart, but wait for gateway to be ready
-		restart: "no",
-		depends_on: {
-			"openclaw-gateway": { condition: "service_started" },
-		},
+		depends_on: ["openclaw-gateway"],
 	};
 
 	return { gatewayService: gateway, cliService: cliService, allVolumes };
@@ -220,7 +231,25 @@ function buildCompanionService(
 	const svc: Record<string, unknown> = {};
 	const volumeNames: string[] = [];
 
-	svc.image = `${def.image}:${def.imageTag}`;
+	// Git-based services use build: context; image-based services use image:
+	if (def.gitSource && def.buildContext) {
+		const subdir = def.gitSource.subdirectory || ".";
+		const ctxPath = def.buildContext.context || ".";
+		const contextFull = subdir === "." ? `./repos/${def.id}/${ctxPath}` : `./repos/${def.id}/${subdir}/${ctxPath}`;
+		const buildBlock: Record<string, unknown> = { context: contextFull };
+		if (def.buildContext.dockerfile) {
+			buildBlock.dockerfile = def.buildContext.dockerfile;
+		}
+		if (def.buildContext.args && Object.keys(def.buildContext.args).length > 0) {
+			buildBlock.args = def.buildContext.args;
+		}
+		if (def.buildContext.target) {
+			buildBlock.target = def.buildContext.target;
+		}
+		svc.build = buildBlock;
+	} else {
+		svc.image = `${def.image}:${def.imageTag}`;
+	}
 
 	if (def.environment.length > 0) {
 		const env: Record<string, string> = {};

package/src/generate.test.ts

@@ -187,7 +187,8 @@ describe("generate (end-to-end)", () => {
 		for (const id of lasuiteMeetServices) {
 			expect(allServiceIds.has(id), `missing service ${id}`).toBe(true);
 		}
-		expect(result.metadata.serviceCount).toBe(lasuiteMeetServices.length);
+		// Service count includes user services + mandatory platform services (convex, mission-control, tailscale)
+		expect(result.metadata.serviceCount).toBeGreaterThanOrEqual(lasuiteMeetServices.length);
 	});
 
 	it("generates bare-metal installer for Windows (install.ps1)", () => {

package/src/generate.ts

@@ -7,6 +7,7 @@ import { composeMultiFile } from "./composer.js";
 import { StackConfigError, ValidationError } from "./errors.js";
 import { generateBareMetalInstall } from "./generators/bare-metal-install.js";
 import { generateCaddyfile } from "./generators/caddy.js";
+import { generateCloneScripts } from "./generators/clone-repos.js";
 import { generateCloudInit } from "./generators/cloud-init.js";
 import { generateEnvFiles } from "./generators/env.js";
 import { generateGsdScripts } from "./generators/get-shit-done.js";
@@ -149,6 +150,7 @@ export function generate(rawInput: GenerationInput): GenerationResult {
 		".env.*.local",
 		"*.log",
 		"docker-compose.override.yml",
+		"repos/",
 	].join("\n");
 
 	// Stack manifest (consumed by Mission Control)
@@ -181,11 +183,18 @@ export function generate(rawInput: GenerationInput): GenerationResult {
 	});
 
 	// Scripts
-	const scripts = generateScripts();
+	const hasGitServices = resolvedForCompose.services.some((s) => s.definition.gitSource);
+	const scripts = generateScripts({ hasGitServices });
 	for (const [path, content] of Object.entries(scripts)) {
 		files[path] = content;
 	}
 
+	// Clone scripts for git-based services (SaaS boilerplates)
+	const cloneScripts = generateCloneScripts(resolvedForCompose);
+	for (const [path, content] of Object.entries(cloneScripts)) {
+		files[path] = content;
+	}
+
 	// Health check scripts (dynamic, stack-specific)
 	const healthCheckFiles = generateHealthCheck(resolved, {
 		projectName: input.projectName,
@@ -307,6 +316,7 @@ export function generate(rawInput: GenerationInput): GenerationResult {
 			serviceCount: resolved.services.length,
 			skillCount,
 			estimatedMemoryMB: resolved.estimatedMemoryMB,
+			resolvedServices: resolved.services.map((s) => s.definition.id),
 			generatedAt: new Date().toISOString(),
 		},
 	};

package/src/generators/clone-repos.test.ts

@@ -0,0 +1,154 @@
+import { describe, expect, it } from "vitest";
+import { generateCloneScripts } from "./clone-repos.js";
+import type { ResolverOutput } from "../types.js";
+
+/** Minimal resolved output with no services */
+function emptyResolved(): ResolverOutput {
+	return {
+		services: [],
+		addedDependencies: [],
+		removedConflicts: [],
+		warnings: [],
+		errors: [],
+		isValid: true,
+		estimatedMemoryMB: 0,
+		aiProviders: [],
+		gsdRuntimes: [],
+	};
+}
+
+/** Create a resolved output with image-based services only */
+function imageOnlyResolved(): ResolverOutput {
+	return {
+		...emptyResolved(),
+		services: [
+			{
+				definition: {
+					id: "redis",
+					name: "Redis",
+					description: "In-memory cache",
+					category: "database",
+					icon: "🔴",
+					image: "redis",
+					imageTag: "7-alpine",
+					ports: [],
+					volumes: [],
+					environment: [],
+					dependsOn: [],
+					restartPolicy: "unless-stopped",
+					networks: ["openclaw-network"],
+					skills: [],
+					openclawEnvVars: [],
+					docsUrl: "https://redis.io",
+					tags: [],
+					maturity: "stable",
+					requires: [],
+					recommends: [],
+					conflictsWith: [],
+					gpuRequired: false,
+				},
+				addedBy: "user",
+			},
+		],
+	};
+}
+
+/** Create a resolved output with a git-based service */
+function gitServiceResolved(): ResolverOutput {
+	return {
+		...emptyResolved(),
+		services: [
+			{
+				definition: {
+					id: "open-saas",
+					name: "Open SaaS",
+					description: "SaaS boilerplate",
+					category: "saas-boilerplate",
+					icon: "🚀",
+					gitSource: {
+						repoUrl: "https://github.com/wasp-lang/open-saas.git",
+						branch: "main",
+						subdirectory: "template",
+						postCloneCommands: ["cp .env.example .env"],
+					},
+					buildContext: {
+						dockerfile: "Dockerfile",
+						context: ".",
+					},
+					ports: [{ host: 3100, container: 3000, description: "Web app", exposed: true }],
+					volumes: [],
+					environment: [],
+					dependsOn: [],
+					restartPolicy: "unless-stopped",
+					networks: ["openclaw-network"],
+					skills: [],
+					openclawEnvVars: [],
+					docsUrl: "https://opensaas.sh/docs",
+					tags: [],
+					maturity: "beta",
+					requires: [],
+					recommends: [],
+					conflictsWith: [],
+					gpuRequired: false,
+				},
+				addedBy: "user",
+			},
+		],
+	};
+}
+
+describe("generateCloneScripts", () => {
+	it("returns empty object when no git-based services exist", () => {
+		const result = generateCloneScripts(emptyResolved());
+		expect(result).toEqual({});
+	});
+
+	it("returns empty object when only image-based services exist", () => {
+		const result = generateCloneScripts(imageOnlyResolved());
+		expect(result).toEqual({});
+	});
+
+	it("generates bash and PowerShell scripts for git-based services", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		expect(Object.keys(result)).toHaveLength(2);
+		expect(result).toHaveProperty("scripts/clone-repos.sh");
+		expect(result).toHaveProperty("scripts/clone-repos.ps1");
+	});
+
+	it("bash script contains clone command with repo URL", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("https://github.com/wasp-lang/open-saas.git");
+		expect(bash).toContain('"open-saas"');
+		expect(bash).toContain('"main"');
+	});
+
+	it("bash script includes postCloneCommands", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("cp .env.example .env");
+	});
+
+	it("bash script includes git check and idempotency logic", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toContain("command -v git");
+		expect(bash).toContain("clone_or_update");
+		expect(bash).toContain("pull --ff-only");
+		expect(bash).toContain("git clone --depth 1");
+	});
+
+	it("PowerShell script contains clone command with repo URL", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const ps = result["scripts/clone-repos.ps1"];
+		expect(ps).toContain("https://github.com/wasp-lang/open-saas.git");
+		expect(ps).toContain('"open-saas"');
+		expect(ps).toContain("Clone-OrUpdate");
+	});
+
+	it("bash script is executable (starts with shebang)", () => {
+		const result = generateCloneScripts(gitServiceResolved());
+		const bash = result["scripts/clone-repos.sh"];
+		expect(bash).toMatch(/^#!/);
+	});
+});

package/src/generators/clone-repos.ts

@@ -0,0 +1,159 @@
+import type { ResolverOutput } from "../types.js";
+
+/**
+ * Generates clone scripts for git-based services (SaaS boilerplates).
+ * Returns empty object if no git-based services exist in the resolved stack.
+ */
+export function generateCloneScripts(resolved: ResolverOutput): Record<string, string> {
+	const gitServices = resolved.services.filter(
+		(s) => s.definition.gitSource && s.definition.buildContext,
+	);
+
+	if (gitServices.length === 0) return {};
+
+	const files: Record<string, string> = {};
+
+	// ── scripts/clone-repos.sh ─────────────────────────────────────────────
+
+	const bashEntries = gitServices
+		.map((s) => {
+			const gs = s.definition.gitSource!;
+			const branchArg = gs.branch ? `"${gs.branch}"` : '""';
+			let block = `clone_or_update "${s.definition.id}" "${gs.repoUrl}" ${branchArg}`;
+			if (gs.postCloneCommands && gs.postCloneCommands.length > 0) {
+				const cmds = gs.postCloneCommands
+					.map((cmd) => `  (cd "$REPOS_DIR/${s.definition.id}${gs.subdirectory ? `/${gs.subdirectory}` : ""}" && ${cmd})`)
+					.join("\n");
+				block += `\n${cmds}`;
+			}
+			return block;
+		})
+		.join("\n\n");
+
+	files["scripts/clone-repos.sh"] = `#!/usr/bin/env bash
+set -euo pipefail
+
+# ─── Clone/Update Git-Based Service Repositories ────────────────────────────
+# Idempotent: clones if missing, pulls if already present.
+
+SCRIPT_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+REPOS_DIR="$PROJECT_DIR/repos"
+
+# ── Colour helpers ──────────────────────────────────────────────────────────
+if [ -t 1 ]; then
+  GREEN='\\033[0;32m'; YELLOW='\\033[1;33m'; CYAN='\\033[0;36m'; RED='\\033[0;31m'; NC='\\033[0m'
+else
+  GREEN=''; YELLOW=''; CYAN=''; RED=''; NC=''
+fi
+info()  { echo -e "\${CYAN}i  $*\${NC}"; }
+ok()    { echo -e "\${GREEN}✓  $*\${NC}"; }
+warn()  { echo -e "\${YELLOW}⚠  $*\${NC}"; }
+err()   { echo -e "\${RED}✗  $*\${NC}" >&2; }
+
+# ── Check git ───────────────────────────────────────────────────────────────
+if ! command -v git &> /dev/null; then
+  err "git is not installed. Please install git first."
+  exit 1
+fi
+
+mkdir -p "$REPOS_DIR"
+
+clone_or_update() {
+  local name="$1" url="$2" branch="\${3:-}"
+  local dir="$REPOS_DIR/$name"
+
+  if [ -d "$dir/.git" ]; then
+    info "Updating $name..."
+    git -C "$dir" pull --ff-only 2>/dev/null || warn "Could not fast-forward $name (you may have local changes)"
+  else
+    info "Cloning $name..."
+    if [ -n "$branch" ]; then
+      git clone --depth 1 --branch "$branch" "$url" "$dir"
+    else
+      git clone --depth 1 "$url" "$dir"
+    fi
+  fi
+}
+
+echo ""
+info "Cloning/updating SaaS boilerplate repositories..."
+echo ""
+
+${bashEntries}
+
+echo ""
+ok "All repositories ready."
+`;
+
+	// ── scripts/clone-repos.ps1 ────────────────────────────────────────────
+
+	const psEntries = gitServices
+		.map((s) => {
+			const gs = s.definition.gitSource!;
+			const branchArg = gs.branch ? ` -Branch "${gs.branch}"` : "";
+			let block = `Clone-OrUpdate -Name "${s.definition.id}" -Url "${gs.repoUrl}"${branchArg}`;
+			if (gs.postCloneCommands && gs.postCloneCommands.length > 0) {
+				const subdir = gs.subdirectory ? `/${gs.subdirectory}` : "";
+				const cmds = gs.postCloneCommands
+					.map((cmd) => `Push-Location "$ReposDir/${s.definition.id}${subdir}"; ${cmd}; Pop-Location`)
+					.join("\n");
+				block += `\n${cmds}`;
+			}
+			return block;
+		})
+		.join("\n\n");
+
+	files["scripts/clone-repos.ps1"] = `#Requires -Version 5.1
+<#
+.SYNOPSIS
+  Clone/update git-based service repositories.
+  Idempotent: clones if missing, pulls if already present.
+#>
+$ErrorActionPreference = "Stop"
+
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$ProjectDir = Split-Path -Parent $ScriptDir
+$ReposDir = Join-Path $ProjectDir "repos"
+
+if (-not (Get-Command git -ErrorAction SilentlyContinue)) {
+    Write-Error "git is not installed. Please install git first."
+    exit 1
+}
+
+if (-not (Test-Path $ReposDir)) { New-Item -ItemType Directory -Path $ReposDir -Force | Out-Null }
+
+function Clone-OrUpdate {
+    param(
+        [string]$Name,
+        [string]$Url,
+        [string]$Branch = ""
+    )
+    $dir = Join-Path $ReposDir $Name
+
+    if (Test-Path (Join-Path $dir ".git")) {
+        Write-Host "  Updating $Name..." -ForegroundColor Cyan
+        git -C $dir pull --ff-only 2>$null
+        if ($LASTEXITCODE -ne 0) { Write-Warning "Could not fast-forward $Name" }
+    } else {
+        Write-Host "  Cloning $Name..." -ForegroundColor Cyan
+        if ($Branch) {
+            git clone --depth 1 --branch $Branch $Url $dir
+        } else {
+            git clone --depth 1 $Url $dir
+        }
+    }
+}
+
+Write-Host ""
+Write-Host "Cloning/updating SaaS boilerplate repositories..." -ForegroundColor Cyan
+Write-Host ""
+
+${psEntries}
+
+Write-Host ""
+Write-Host "All repositories ready." -ForegroundColor Green
+`;
+
+	return files;
+}