@clawops/cli 1.7.0 → 1.7.2

package/spec/integrations.yaml

@@ -0,0 +1,97 @@
+# spec/integrations.yaml — OpenClaw channel integration catalog for the setup wizard.
+# Read at runtime by src/cli/commands/setup.ts — not compiled or code-generated.
+#
+# Each integration maps to a key in openclaw.json's `channels` object.
+# infraRequired: true means a publicly reachable webhook URL must be registered
+# with the provider after the stack is deployed.
+
+integrations:
+  - id: discord
+    channelKey: discord
+    displayName: Discord
+    description: Connect OpenClaw agents to a Discord server via bot
+    infraRequired: false
+    fields:
+      - name: botToken
+        label: Bot token
+        description: Bot token from the Discord Developer Portal (Bot → Token)
+        sensitive: true
+        envDefault: OPENCLAW_DISCORD_TOKEN
+    setupUrl: https://discord.com/developers/applications
+
+  - id: telegram
+    channelKey: telegram
+    displayName: Telegram
+    description: Connect OpenClaw agents to a Telegram bot
+    infraRequired: false
+    fields:
+      - name: botToken
+        label: Bot token
+        description: Token from @BotFather (/newbot)
+        sensitive: true
+        envDefault: OPENCLAW_TELEGRAM_TOKEN
+    setupUrl: https://t.me/BotFather
+
+  - id: slack
+    channelKey: slack
+    displayName: Slack
+    description: Connect OpenClaw agents to a Slack workspace via app
+    infraRequired: true
+    infraNote: >
+      After deployment, register the gateway webhook URL in your Slack app
+      configuration at api.slack.com (Event Subscriptions → Request URL).
+    fields:
+      - name: botToken
+        label: Bot OAuth token
+        description: "Bot User OAuth Token (starts with xoxb-)"
+        sensitive: true
+        envDefault: OPENCLAW_SLACK_TOKEN
+      - name: signingSecret
+        label: Signing secret
+        description: App signing secret from Basic Information → App Credentials
+        sensitive: true
+        envDefault: OPENCLAW_SLACK_SIGNING_SECRET
+    setupUrl: https://api.slack.com/apps
+
+  - id: whatsapp
+    channelKey: whatsapp
+    displayName: WhatsApp (via WABA)
+    description: Connect OpenClaw agents to WhatsApp via the Meta Business API
+    infraRequired: true
+    infraNote: >
+      After deployment, register the gateway webhook URL in the Meta Developer
+      Console (WhatsApp → Configuration → Webhook). The gateway URL is printed
+      at the end of setup.
+    fields:
+      - name: phoneNumberId
+        label: Phone number ID
+        description: Phone Number ID from Meta Developer Console → WhatsApp → API Setup
+        sensitive: false
+        envDefault: ""
+      - name: accessToken
+        label: Access token
+        description: Permanent system user access token from Meta Business Suite
+        sensitive: true
+        envDefault: OPENCLAW_WHATSAPP_TOKEN
+    setupUrl: https://developers.facebook.com/apps
+
+  - id: teams
+    channelKey: teams
+    displayName: Microsoft Teams
+    description: Connect OpenClaw agents to a Microsoft Teams channel via bot
+    infraRequired: true
+    infraNote: >
+      After deployment, update the bot's messaging endpoint in Azure Bot Service
+      to the gateway webhook URL.
+    fields:
+      - name: appId
+        label: App (client) ID
+        description: Application ID from Azure Active Directory app registration
+        sensitive: false
+        envDefault: ""
+      - name: appPassword
+        label: App password
+        description: Client secret from the Azure app registration
+        sensitive: true
+        envDefault: OPENCLAW_TEAMS_APP_PASSWORD
+    setupUrl: https://portal.azure.com/

package/spec/invariants.yaml

@@ -0,0 +1,81 @@
+# Invariants enforced by tests.
+# tests/invariants.test.ts loads this file and asserts each rule via a corresponding check.
+# Adding an invariant here without adding the test is a CI failure.
+
+version: 1
+
+invariants:
+  - id: I1-no-secrets-in-config
+    rule: ~/.clawops/config.json schema must not include any secret-looking field
+    enforcement: tests/config/no-secrets.test.ts
+    derives_from: R6, N9
+
+  - id: I2-firewall-deny-default
+    rule: All ProviderAdapter program() outputs must produce a firewall/security group with no default 0.0.0.0/0 rules on any port
+    enforcement: tests/providers/firewall-defaults.test.ts
+    derives_from: R-meta-1, N10
+
+  - id: I3-mcp-tools-have-all-annotations
+    rule: Every tool in spec/mcp-tools.yaml has all four annotation hints AND a title
+    enforcement: tests/mcp/annotations.test.ts
+    derives_from: R10
+
+  - id: I4-mcp-tool-cap
+    rule: Total registered MCP tools across all toolsets ≤ 30
+    enforcement: tests/mcp/tool-cap.test.ts
+    derives_from: R1
+
+  - id: I5-mcp-prefix
+    rule: All MCP tool names start with `clawops_`
+    enforcement: tests/mcp/naming.test.ts
+    derives_from: R1
+
+  - id: I6-mcp-descriptions-include-when-not
+    rule: Every tool description includes the substring "Do NOT use" or "Do NOT use when"
+    enforcement: tests/mcp/descriptions.test.ts
+    derives_from: R3
+
+  - id: I7-stdio-no-stdout-writes
+    rule: No call to console.log, process.stdout.write outside of src/output/json.ts and src/output/human.ts
+    enforcement: tests/mcp/stdio-purity.test.ts (eslint rule + grep)
+    derives_from: R15
+
+  - id: I8-no-docx-in-repo
+    rule: No .docx, .pages, .rtf files committed
+    enforcement: scripts/verify-no-docx.ts (CI step)
+    derives_from: R-meta-2
+
+  - id: I9-generated-files-up-to-date
+    rule: src/providers/types.ts and src/mcp/tools/_generated.ts match output of `pnpm gen:schemas`
+    enforcement: pnpm gen:schemas --check (CI step)
+    derives_from: R-meta-1
+
+  - id: I10-deploy-plan-conforms
+    rule: Every plan produced by `clawops plan` passes ajv validation against spec/deploy-plan.schema.json
+    enforcement: tests/plan/schema.test.ts
+    derives_from: R-meta-4
+
+  - id: I11-tool-output-cap
+    rule: MCP tool outputs are <= 8KB after sanitization
+    enforcement: tests/mcp/output-size.test.ts
+    derives_from: R14
+
+  - id: I12-audit-log-sanitization
+    rule: src/mcp/audit.ts strips any field whose key matches the sensitive-key list before logging
+    enforcement: tests/mcp/audit-sanitization.test.ts
+    derives_from: R21
+
+  - id: I13-paths-absolute-on-input
+    rule: Any tool input field of type "path" rejects relative paths with a clear error
+    enforcement: tests/mcp/path-absolute.test.ts
+    derives_from: R7
+
+  - id: I14-cancellation-propagates
+    rule: Cancellation of a tool call propagates to the underlying subprocess within 5 seconds
+    enforcement: tests/integration/cancellation.test.ts
+    derives_from: R13
+
+  - id: I15-no-aws-cli-shellout
+    rule: No call to spawn/exec of "aws", "gcloud", "az", "ssh" binaries from src/. Use SDKs.
+    enforcement: scripts/lint-no-shellout.ts + grep
+    derives_from: §6 (use SDKs not shell)