@clanker-chain/clanker-cli 2026.9.12 → 2026.9.13

package/lib/resolve.mjs

@@ -78,6 +78,11 @@ export function keyPointerFromSource(opts) {
   return { type: "env", value: "OPERATOR_PRIVATE_KEY" };
 }
 
+/** Honest error when mint/pair/rotate/transfer have no owner signer. */
+export const OWNER_SIGNER_REQUIRED =
+  "Owner actions need clanker login (email vault), or a signing key (--key-file / OPERATOR_PRIVATE_KEY). " +
+  "A read-only profile can still run whoami, bots, fund, and doctor.";
+
 /**
  * Resolve the operator signing key with Anvil guard.
  *
@@ -133,11 +138,7 @@ export function resolveOperatorKey(argv = [], opts = {}) {
       key = normalizePrivateKey(ANVIL_DEFAULT_PRIVATE_KEY);
       source = "anvil-default (local RPC)";
     } else {
-      throw new Error(
-        "Operator private key required for non-local RPC. Set OPERATOR_PRIVATE_KEY, " +
-          "pass --key / --key-file, or configure ~/.clanker/operator.json key pointer. " +
-          "Anvil account #0 is not used on public networks.",
-      );
+      throw new Error(OWNER_SIGNER_REQUIRED);
     }
   }
 
@@ -216,7 +217,11 @@ export function resolveReadIdentity(argv = [], opts = {}) {
     };
   } catch (err) {
     const msg = err?.message ?? String(err);
-    if (!/private key required|Anvil account #0|Key file not found|Profile keyFile/i.test(msg)) {
+    if (
+      !/private key required|Owner actions need|clanker login|Anvil account #0|Key file not found|Profile keyFile/i.test(
+        msg,
+      )
+    ) {
       throw err;
     }
   }

package/lib/setup.mjs

@@ -3,7 +3,14 @@
  */
 
 import { stdin as input } from "node:process";
-import { existsSync } from "node:fs";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+} from "node:fs";
+import { homedir } from "node:os";
+import { basename, join } from "node:path";
 import { getAddress } from "viem";
 import * as clack from "@clack/prompts";
 import {
@@ -37,8 +44,9 @@ import {
   consumerFundHints,
   generateOperatorKeyFile,
 } from "./operator-key.mjs";
+import { wireOpenClawMqtt } from "./openclaw-wire.mjs";
+import { runLogin } from "./login.mjs";
 import { c, nextHint } from "./ui.mjs";
-import { join } from "node:path";
 
 /**
  * @param {string[]} argv
@@ -57,6 +65,7 @@ export function parseSetupFlags(argv) {
   let foundryAccount = null;
   let exportKey = false;
   let generateKey = false;
+  let botKey = null;
 
   for (let i = 0; i < argv.length; i += 1) {
     const a = argv[i];
@@ -67,6 +76,7 @@ export function parseSetupFlags(argv) {
     else if (a === "--key-env" && argv[i + 1]) keyEnv = argv[++i];
     else if (a === "--from-block" && argv[i + 1]) fromBlock = BigInt(argv[++i]);
     else if (a === "--foundry-account" && argv[i + 1]) foundryAccount = argv[++i];
+    else if (a === "--bot-key" && argv[i + 1]) botKey = argv[++i];
     else if (a === "--export-key") exportKey = true;
     else if (a === "--generate-key") generateKey = true;
     else if (a === "--force") force = true;
@@ -89,6 +99,7 @@ export function parseSetupFlags(argv) {
     foundryAccount,
     exportKey,
     generateKey,
+    botKey,
   };
 }
 
@@ -162,6 +173,39 @@ export function buildKeyPointer({ keyFile, keyEnv, skipKey, env = process.env })
   return null;
 }
 
+/**
+ * Copy a downloaded bot key into ~/.openclaw/keys and wire channels.mqtt.
+ * @param {string} botKeyPath
+ * @param {{
+ *   operatorLabel: string,
+ *   network: { rpc: string, registry: string|null, brokerUrl?: string, mqttAuthServiceUrl?: string },
+ *   openclawHome?: string,
+ * }} opts
+ */
+export function attachBotKeyFile(botKeyPath, opts) {
+  if (!existsSync(botKeyPath)) {
+    throw new Error(`Bot key file not found: ${botKeyPath}`);
+  }
+  const botId = basename(botKeyPath).replace(/\.key$/i, "");
+  if (!botId || botId.includes("/") || botId.includes("..")) {
+    throw new Error(`Invalid bot key basename: ${botKeyPath}`);
+  }
+  const openclawHome = opts.openclawHome ?? join(homedir(), ".openclaw");
+  const destDir = join(openclawHome, "keys");
+  mkdirSync(destDir, { recursive: true });
+  const dest = join(destDir, `${botId}.key`);
+  copyFileSync(botKeyPath, dest);
+  chmodSync(dest, 0o600);
+  const wired = wireOpenClawMqtt({
+    botId,
+    operatorId: opts.operatorLabel,
+    network: opts.network,
+    keyPath: dest,
+    openclawHome,
+  });
+  return { botId, keyPath: dest, openclawPath: wired.path };
+}
+
 /**
  * Apply setup choices to disk.
  */
@@ -299,7 +343,7 @@ export async function runSetupNonInteractive(argv, opts = {}) {
     }
   }
 
-  return applySetup(
+  const result = applySetup(
     {
       preset: flags.preset,
       force: flags.force || flags.yes,
@@ -311,6 +355,34 @@ export async function runSetupNonInteractive(argv, opts = {}) {
     },
     { home, env },
   );
+  return finishSetupResult(result, flags, { ...opts, quiet: true });
+}
+
+/**
+ * @param {object} result
+ * @param {{ botKey?: string|null, operator?: string|null }} flags
+ * @param {{ openclawHome?: string, quiet?: boolean }} [opts]
+ */
+async function finishSetupResult(result, flags, opts = {}) {
+  if (flags.botKey) {
+    const attached = attachBotKeyFile(flags.botKey, {
+      operatorLabel: result.operator?.label ?? flags.operator,
+      network: {
+        rpc: result.config.chainRpcUrl,
+        registry: result.config.registryAddress,
+        brokerUrl: result.config.brokerUrl,
+        mqttAuthServiceUrl: result.config.mqttAuthServiceUrl,
+      },
+      openclawHome: opts.openclawHome,
+    });
+    result.botKey = attached;
+    if (!opts.quiet) {
+      clack.log.success(
+        `Bot key → ${attached.keyPath}; wired ${attached.openclawPath}`,
+      );
+    }
+  }
+  return result;
 }
 
 /**
@@ -334,7 +406,7 @@ export async function runSetupInteractive(argv, opts = {}) {
   );
   clack.log.message(
     c.dim(
-      "New here? Create a key file — no wallet app or Foundry required. Mint needs a little test ETH later.",
+      "Sign in with email (recommended), attach an existing 0x, or create ~/.clanker/op.key.",
     ),
   );
   clack.log.message(c.dim(`Profile: ${home}`));
@@ -395,6 +467,7 @@ export async function runSetupInteractive(argv, opts = {}) {
   let address = flags.address ?? null;
   let foundryAccountUsed = null;
   let generatedKeyFile = null;
+  let privyKeyPointer = null;
   if (!address && flags.generateKey) {
     const dest = flags.keyFile || defaultOperatorKeyPath(home);
     let forceGen = flags.force;
@@ -440,10 +513,20 @@ export async function runSetupInteractive(argv, opts = {}) {
   }
   if (!address) {
     const options = [
+      {
+        value: "__login__",
+        label: "Sign in (email — recommended)",
+        hint: "Privy vault — no op.key on disk",
+      },
+      {
+        value: "__paste__",
+        label: "I already have an owner address",
+        hint: "/join or any 0x — usually read-only until login",
+      },
       {
         value: "__generate__",
         label: "Create a new operator key for me",
-        hint: "writes ~/.clanker/op.key (recommended)",
+        hint: "writes ~/.clanker/op.key (self-custody)",
       },
       {
         value: "__keyfile__",
@@ -466,21 +549,27 @@ export async function runSetupInteractive(argv, opts = {}) {
         hint: "advanced — install Foundry first",
       });
     }
-    options.push({
-      value: "__paste__",
-      label: "Paste an address…",
-      hint: "read-only unless you add a key later",
-    });
 
     const pick = cancelIf(
       await clack.select({
         message: "How do you want to set your operator identity?",
         options,
-        initialValue: "__generate__",
+        initialValue: "__login__",
       }),
     );
 
-    if (pick === "__generate__") {
+    let attachReadOnly = false;
+    if (pick === "__login__") {
+      clack.log.step("Opening browser for clanker login…");
+      const logged = await runLogin([], {
+        home,
+        env,
+      });
+      address = logged.address;
+      privyKeyPointer = { type: "privy", value: logged.walletId };
+      flags.skipKey = true;
+      clack.log.success(`Signed in as ${address}`);
+    } else if (pick === "__generate__") {
       const dest = defaultOperatorKeyPath(home);
       let forceGen = flags.force;
       if (existsSync(dest) && !forceGen) {
@@ -526,15 +615,17 @@ export async function runSetupInteractive(argv, opts = {}) {
             /^0x[0-9a-fA-F]{40}$/.test(v || "") ? undefined : "Need 0x + 40 hex",
         }),
       );
+      attachReadOnly = true;
     } else if (pick === "__paste__") {
       address = cancelIf(
         await clack.text({
-          message: "Operator owner address",
+          message: "Owner address (from /join or any EOA)",
           placeholder: "0x…",
           validate: (v) =>
             /^0x[0-9a-fA-F]{40}$/.test(v || "") ? undefined : "Need 0x + 40 hex",
         }),
       );
+      attachReadOnly = true;
     } else {
       foundryAccountUsed = pick;
       try {
@@ -557,6 +648,9 @@ export async function runSetupInteractive(argv, opts = {}) {
         );
       }
     }
+    if (attachReadOnly) {
+      flags.skipKey = true;
+    }
   }
   address = getAddress(address);
 
@@ -645,7 +739,9 @@ export async function runSetupInteractive(argv, opts = {}) {
     }
   }
 
-  const key = buildKeyPointer({ keyFile, keyEnv, skipKey, env });
+  const key =
+    privyKeyPointer ||
+    buildKeyPointer({ keyFile, keyEnv, skipKey, env });
   if (key?.type === "keyFile") {
     const fromKey = getAddress(addressFromKeyFile(key.value));
     if (fromKey !== address) {
@@ -687,11 +783,21 @@ export async function runSetupInteractive(argv, opts = {}) {
     { home, env },
   );
 
+  await finishSetupResult(result, { ...flags, operator: label }, opts);
+
   clack.outro(c.green(`Wrote ${result.configPath}\nWrote ${result.operatorPath}`));
-  if (!key) {
+  if (privyKeyPointer) {
     nextHint([
+      "clanker fund",
+      "clanker whoami",
+      "clanker pair add <peer> --yes",
+      "clanker operator mint <label> --yes   # if not minted yet",
+    ]);
+  } else if (!key) {
+    nextHint([
+      "clanker login   # to enable mint/pair with the email vault",
+      "clanker fund",
       "clanker whoami",
-      "clanker setup — choose Create a new operator key when you need mint",
     ]);
   } else if (preset === "sepolia" && generatedKeyFile) {
     nextHint(consumerFundHints({ address, label }));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clanker-chain/clanker-cli",
-  "version": "2026.9.12",
+  "version": "2026.9.13",
   "description": "CLI for wiring clanker-chain identity and MQTT into OpenClaw and other agentic stacks.",
   "type": "module",
   "bin": {
@@ -24,6 +24,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.8.0",
+    "@hpke/chacha20poly1305": "^1.8.0",
+    "@hpke/core": "^1.9.0",
+    "@noble/curves": "^1.9.7",
+    "@noble/hashes": "^1.8.0",
+    "canonicalize": "^2.1.0",
     "picocolors": "^1.1.1",
     "viem": "^2.56.3"
   },