@clawkeepers/cli 0.1.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ControlStackAI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,206 @@
+OpenClaw OS
+Copyright (c) 2026 ControlStackAI
+Original project contributions are licensed under the MIT License; see LICENSE.
+Third-party and adapted material retains its applicable license terms.
+
+OpenClaw (https://github.com/openclaw/openclaw) provides the separately installed,
+unmodified agent runtime, Gateway and public plugin interfaces. Its pinned
+v2026.9.2 license is MIT, copyright (c) 2026 OpenClaw Foundation; its own
+THIRD_PARTY_NOTICES.md applies to incorporated upstream dependencies.
+
+Cloudflare OS (https://github.com/cloudflare/cloudflare-os), by Cloudflare and
+its contributors, provides architectural foundations and adapted material:
+capability introductions, gatekeepers, approval/simulation contracts, observers,
+and kernel review/authoring guidance. OpenClaw OS contributors modified these
+contracts and documents for a self-hosted, single-process, tool-calling plugin
+runtime. Cloudflare OS Starter (https://github.com/cloudflare/cloudflare-os-starter)
+informed wrapper-owned customization and the upgrade discipline.
+
+Cloudflare OS and Cloudflare OS Starter are Apache-2.0 licensed. Their retained
+material is not relicensed by the project's MIT license. The applicable Apache
+License 2.0 text is reproduced below. The original source distribution includes
+further provenance in docs/acknowledgments.md. Other dependencies retain their
+respective licenses and notices, including generated THIRD-PARTY-NOTICES for
+bundled dependencies.
+
+This is an independent project, not an upstream-endorsed product. No affiliation,
+endorsement or rights to upstream trademarks are implied.
+
+--- Apache License 2.0: retained Cloudflare material ---
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,52 @@
+# @clawkeepers/cli — `clawos`
+
+Host orchestration uses upstream CLI/config APIs. Capability operations use the live
+Gateway's paired-device operator RPCs; the CLI never opens the kernel database.
+
+Implemented commands:
+
+```text
+clawos install [--yes]                 clawos cell create|list
+clawos status                         clawos doctor
+clawos config apply [--dry-run]        clawos backup create|restore
+clawos kernel status                  clawos gatekeeper list|connect <vendor>
+clawos grant add --agent <id> <url> [--title <title>] [--audience owner-only]
+clawos grant list [--agent <id>]        clawos grant revoke <handle>
+clawos approvals list                  clawos approvals apply|reject|revert <id,id|all>
+clawos approvals grant|reject-request <id,id|all>
+clawos audit tail [--limit 1–1000]
+```
+
+All accept `--cell <name>` (default: `default`) and `--json`. `audit tail` is a
+bounded, newest-first snapshot, not a follow stream; time filtering is not yet
+implemented and unsupported options are rejected. Approval commands expose the
+kernel's existing decisions, not a promise that a driver can apply or revert:
+real filesystem writes remain disabled. These mutating commands are not all
+idempotent.
+
+The cell registry selects the loopback port; cell naming selects both state and
+config paths. No arbitrary endpoint, token, or operator-identity option is accepted.
+The installed public SDK runs in a separate explicitly cell-scoped process. It
+bootstraps using the cell's local token, closes that connection, reconnects with the
+SDK-issued device credential, and only then sends the operator request. Pairing
+failure, invalid input, an absent Gateway, or a malformed response fails closed.
+The client resolves installer-created `CLAWOS_GATEWAY_TOKEN` env SecretRefs from the
+cell's `.env`, or a directly configured local token; other authentication providers
+are not yet supported. Credentials remain in process memory and never enter argv,
+stdout, or error messages. RPC parameters travel to the helper on stdin.
+
+With the kernel plugin enabled, `openclaw os status|grants|approvals|audit --json`
+forwards to this same client. Both the CLI package and a registered cell are required.
+Static plugin manifest metadata owns the `os` root command discovery.
+
+The source installer projects the bundled kernel/filesystem plugins and configures
+the cell-local install policy. `clawos install-policy` evaluates installation
+requests for upstream; it is not a general plugin-management interface.
+
+`clawos gatekeeper connect <vendor>` starts the kernel's single-use connection
+flow. Static filesystem account connection has live Phase 3 evidence; real GitHub
+OAuth and effects require Phase 4 acceptance. No connection grants resources by
+itself. Shared grants are rejected under the owner-only beta boundary.
+
+Blueprint application, the full update/rollback pipeline and general gatekeeper
+installation commands remain later-phase work; they are not successful stubs.

package/dist/bin/clawos.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import("../index.js").then((m) => m.main(process.argv.slice(2))).catch((e) => { console.error(e?.message ?? e); process.exit(1); });

package/dist/bin/config-transaction.mjs

@@ -0,0 +1,56 @@
+// Runs only in the target cell process. Resolve the PUBLIC SDK from the installed upstream binary;
+// never bundle upstream, use a private subpath, or load it into the development-host test process.
+import { createRequire } from "node:module";
+import { realpathSync, readFileSync } from "node:fs";
+import { pathToFileURL } from "node:url";
+
+const [upstreamBin, patchFile, baseHash] = process.argv.slice(2);
+const object = v => v !== null && typeof v === "object" && !Array.isArray(v);
+function merge(base, patch) {
+  const out = object(base) ? structuredClone(base) : {};
+  for (const [key, value] of Object.entries(patch)) {
+    if (["__proto__", "prototype", "constructor"].includes(key)) throw new Error("invalid key");
+    if (value === null) delete out[key];
+    else out[key] = object(value) ? merge(out[key], value) : structuredClone(value);
+  }
+  return out;
+}
+function paths(value, prefix = []) {
+  return Object.entries(value).flatMap(([key, val]) => {
+    const path = [...prefix, key];
+    return object(val) && Object.keys(val).length ? paths(val, path) : [path];
+  });
+}
+try {
+  if (!/^[a-f0-9]{64}$/.test(baseHash ?? "")) throw new Error("missing snapshot");
+  const require = createRequire(realpathSync(upstreamBin));
+  const { mutateConfigFile } = await import(pathToFileURL(require.resolve("openclaw/plugin-sdk/config-mutation")).href);
+  const patch = JSON.parse(readFileSync(patchFile, "utf8"));
+  if (!object(patch)) throw new Error("invalid patch");
+  const leafPaths = paths(patch);
+  const unsetPaths = leafPaths.filter(path => path.reduce((v, k) => v[k], patch) === null);
+  const result = await mutateConfigFile({
+    base: "source",
+    baseHash,
+    writeOptions: {
+      auditOrigin: "cli",
+      skipOutputLogs: true,
+      explicitSetPaths: leafPaths.filter(path => !unsetPaths.includes(path)),
+      explicitSetValueSource: patch,
+      unsetPaths,
+      // Require upstream's guarded atomic root publication; redirected includes fail closed.
+      beforeCommit: () => {},
+    },
+    mutate(draft) {
+      const next = merge(draft, patch);
+      for (const key of Object.keys(draft)) delete draft[key];
+      Object.assign(draft, next);
+    },
+  });
+  if (!result.persistedHash) throw new Error("missing persisted snapshot");
+  process.stdout.write(JSON.stringify({ persistedHash: result.persistedHash }));
+} catch {
+  // SDK errors may contain source values. Never relay them, even through a pattern redactor.
+  process.stderr.write("transaction refused: config changed or upstream validation failed; no checkpoint recorded\n");
+  process.exitCode = 1;
+}

package/dist/bin/gateway-rpc.mjs

@@ -0,0 +1,57 @@
+// Target-cell subprocess: only the installed public SDK is imported. No tokens or RPC bodies in argv/logs.
+import { createRequire } from 'node:module';
+import { realpathSync, readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { join } from 'node:path';
+const [upstreamBin] = process.argv.slice(2);
+let client;
+try {
+  const state = process.env.OPENCLAW_STATE_DIR;
+  if (!state || process.env.OPENCLAW_CONFIG_PATH !== join(state, 'openclaw.json')) throw new Error();
+  const port = Number(process.env.OPENCLAW_GATEWAY_PORT);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error();
+  let input = '';
+  for await (const chunk of process.stdin) { input += chunk; if (input.length > 65536) throw new Error(); }
+  const { method, params } = JSON.parse(input);
+  if (!['os.maintenance.set', 'os.status', 'os.grants.list', 'os.grants.introduce', 'os.grants.revoke', 'os.audit.query', 'os.approvals.list', 'os.approvals.apply', 'os.approvals.reject', 'os.approvals.revert', 'os.gatekeepers.list', 'os.gatekeepers.connect', 'os.requests.approve', 'os.requests.reject'].includes(method)) throw new Error();
+  // Installer-created cells use an env SecretRef. Resolve only that exact local field, never arbitrary providers.
+  const config = JSON.parse(readFileSync(process.env.OPENCLAW_CONFIG_PATH, 'utf8'));
+  const auth = config.gateway?.auth;
+  let token;
+  if (auth?.mode !== 'token') throw new Error();
+  if (typeof auth.token === 'string') token = auth.token;
+  else if (auth.token?.source === 'env' && auth.token.provider === 'default' && auth.token.id === 'CLAWOS_GATEWAY_TOKEN') {
+    token = readFileSync(join(state, '.env'), 'utf8').split('\n').find(line => line.startsWith('CLAWOS_GATEWAY_TOKEN='))?.slice('CLAWOS_GATEWAY_TOKEN='.length);
+  }
+  if (!token) throw new Error();
+  const require = createRequire(realpathSync(upstreamBin));
+  const { GatewayClient } = await import(pathToFileURL(require.resolve('openclaw/plugin-sdk/gateway-runtime')).href);
+  async function connect(credentials) {
+    let timer;
+    try {
+      return await new Promise((resolve, reject) => {
+        timer = setTimeout(() => reject(new Error()), 30000);
+        client = new GatewayClient({ url: `ws://127.0.0.1:${port}`, ...credentials, env: process.env,
+          clientName: 'cli', mode: 'cli', role: 'operator', scopes: ['operator.admin'], requestTimeoutMs: 30000,
+          hostDeps: { logDebug() {}, logError() {} }, onHelloOk: resolve,
+          onConnectError: () => reject(new Error()), onClose: () => reject(new Error()) });
+        client.start();
+      });
+    } finally { clearTimeout(timer); }
+  }
+  const hello = await connect({ token });
+  if (!hello.auth?.deviceToken) throw new Error();
+  await client.stopAndWait({ timeoutMs: 5000 });
+  await connect({ deviceToken: hello.auth.deviceToken });
+  let result = await client.request(method, params);
+  if (method === 'os.gatekeepers.connect') {
+    if (typeof result?.url !== 'string' || !/^\/os\/gatekeeper\/[a-z][a-z0-9_]{0,63}\/oauth\/start\?state=[A-Za-z0-9_-]{32}$/.test(result.url)) throw new Error();
+    result = { url: new URL(result.url, `http://127.0.0.1:${port}`).href };
+  }
+  process.stdout.write(JSON.stringify({ ok: true, result }));
+} catch {
+  process.stderr.write('Kernel RPC unavailable or unauthorized; verify this cell and its device pairing.\n');
+  process.exitCode = 1;
+} finally {
+  try { await client?.stopAndWait({ timeoutMs: 5000 }); } catch { process.exitCode = 1; }
+}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `clawos` CLI entry point.
+ *
+ * Host layer: install, cell, status, doctor, config apply, backup. Kernel administration uses paired operator RPC. Blueprints provision versioned agent workspaces. Update and rollback remain separate-phase work.
+ */
+declare function main(argv: string[]): Promise<void>;
+
+export { main };