@clawscarf/cli 0.1.0-alpha.2 → 0.1.0-alpha.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +116 -2
- package/THIRD_PARTY_NOTICES.md +18 -11
- package/package.json +1 -1
- package/pnpm-lock.yaml +194 -3594
- package/recipes/team-server/recipe.json +1 -1
- package/release/README.md +57 -21
- package/release/components.json +10 -2
- package/release/operator.md +16 -2
- package/runtime/releases/{0.1.0-alpha.2.json → 0.1.0-alpha.4.json} +16 -16
- package/scripts/deployment/certificates.js +2 -1
- package/scripts/deployment/configuration.js +2 -4
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"id": "team-server",
|
|
3
3
|
"version": "0.1.0",
|
|
4
|
-
"runtime": "../../runtime/releases/0.1.0-alpha.
|
|
4
|
+
"runtime": "../../runtime/releases/0.1.0-alpha.4.json",
|
|
5
5
|
"name": "Team server",
|
|
6
6
|
"description": "A protected OpenClaw server for your team, with hosted login, managed models and optional Connections.",
|
|
7
7
|
"maturity": "supported",
|
package/release/README.md
CHANGED
|
@@ -52,7 +52,9 @@ Release candidates contain:
|
|
|
52
52
|
|
|
53
53
|
- npm `@clawscarf/cli`: compiled CLI, recipes, pack files, model catalog and runtime
|
|
54
54
|
definitions. No Docker images or large OpenShell executables in npm.
|
|
55
|
-
- GitHub Releases:
|
|
55
|
+
- GitHub Releases: standalone CLI archives with a private Node runtime and installed
|
|
56
|
+
dependencies, an installer, runtime tool archives, checksums, required notices and
|
|
57
|
+
the OpenClaw source provenance and patch series used by the image build.
|
|
56
58
|
- GHCR: runtime/companion images referenced by immutable registry digest.
|
|
57
59
|
|
|
58
60
|
Installing a newer CLI supplies newer recipes. Each recipe still selects an exact
|
|
@@ -73,14 +75,33 @@ silently replaced. Docker verifies image digests. No start command resolves late
|
|
|
73
75
|
with an exact version, such as `0.1.0-alpha.1`. It:
|
|
74
76
|
|
|
75
77
|
1. Runs checks and tests the compiled operator outside the checkout on macOS arm64.
|
|
76
|
-
2.
|
|
78
|
+
2. Reconstructs OpenClaw from the pinned upstream commit and the ordered
|
|
79
|
+
[patch series](../runtime/openclaw/README.md), verifies the resulting source tree,
|
|
80
|
+
then builds ClawScarf images on Linux arm64 and x86-64,
|
|
77
81
|
checks runtime capabilities and the Chromium sandbox, then starts a protected
|
|
78
|
-
installation with private LiteLLM networking
|
|
79
|
-
|
|
82
|
+
installation with private LiteLLM networking, exercises native administrator
|
|
83
|
+
access through the companion, and verifies stop/start retention.
|
|
84
|
+
Both architectures must report identical OpenClaw source provenance and patch
|
|
85
|
+
archives before it publishes image indexes containing both architectures to GHCR.
|
|
80
86
|
3. Downloads checksum-pinned OpenShell tools, records the image digests, and assembles
|
|
81
87
|
one runtime archive per host platform, individual executable assets, npm CLI,
|
|
82
|
-
checksums and notices.
|
|
88
|
+
checksums and notices. Candidate assembly verifies the image builds' patch archive
|
|
89
|
+
and provenance against this checkout before including them in the release.
|
|
83
90
|
4. Installs the resulting npm archive into a temporary prefix and checks its CLI/catalog.
|
|
91
|
+
5. Builds standalone CLI archives on macOS ARM64 and Linux ARM64/x86-64 using the
|
|
92
|
+
same npm payload and frozen production dependency lockfile. Downloads Node using
|
|
93
|
+
the checksums in [components.json](components.json), retains its license, and
|
|
94
|
+
tests the installer and packaged CLI with system Node deliberately unavailable.
|
|
95
|
+
Only after all three platform checks pass does it assemble `release-candidate`.
|
|
96
|
+
|
|
97
|
+
[Standalone packaging](../scripts/release/standalone.ts) adds a private Node executable
|
|
98
|
+
and a small launcher; it does not change the CLI implementation. The
|
|
99
|
+
[installer](install.sh) is versioned with each release and downloads only that
|
|
100
|
+
version's archive, verifies SHA-256, and installs under `~/.local` by default.
|
|
101
|
+
`--prefix` selects another absolute directory. It never installs a host service,
|
|
102
|
+
changes system Node, edits shell profiles or needs sudo. To upgrade the CLI, run
|
|
103
|
+
the newer release's installer; it switches the command and retains the old version.
|
|
104
|
+
Runtime upgrades and installation data are separate from CLI installation.
|
|
84
105
|
|
|
85
106
|
The [image builder](../scripts/release/build-images.sh) and
|
|
86
107
|
[candidate assembler](../scripts/release/candidate.ts) contain the build commands;
|
|
@@ -89,6 +110,15 @@ and Linux installation checks use Depot ARM64/x86-64 runners; macOS checks and p
|
|
|
89
110
|
use GitHub-hosted runners. The Depot Managed Runners app connects the ClawScarf organization
|
|
90
111
|
to the RAW Labs Depot organization. The image job installs Docker 29.5.3 on its
|
|
91
112
|
disposable runner for the network features required by installations.
|
|
113
|
+
The generated source-provenance JSON records the upstream commit, reconstructed commit, source tree,
|
|
114
|
+
ordered patch and intent hashes, and the complete patch-set digest.
|
|
115
|
+
`openclaw-patches.tgz` contains the exact `series`, patches and their regeneration
|
|
116
|
+
instructions. Both files are checksummed candidate assets and included in each runtime
|
|
117
|
+
archive. The runtime definition's `sourceRevision` still identifies the ClawScarf
|
|
118
|
+
commit, which owns those inputs; there is no second moving OpenClaw release branch.
|
|
119
|
+
This provenance describes the Gateway source build; the separate browser-node image
|
|
120
|
+
retains its upstream published image pin.
|
|
121
|
+
See the [patch workflow](../runtime/openclaw/README.md) for editing and upgrading them.
|
|
92
122
|
The source recipe pins the development
|
|
93
123
|
runtime. Packaging resolves that same runtime to the candidate's immutable definition;
|
|
94
124
|
it does not make recipes select latest. The first release uses the same CLI/runtime
|
|
@@ -98,8 +128,9 @@ or the selected runtime changes. Published definitions must not be overwritten.
|
|
|
98
128
|
The `release-candidate` Actions artifact is the reviewable output. Download it and test
|
|
99
129
|
a fresh supported installation, administrator login, real inference and stop/start
|
|
100
130
|
before publication. GitHub's macOS runner does not provide our Docker Desktop journey;
|
|
101
|
-
its packaging checks alone do not establish that journey.
|
|
102
|
-
|
|
131
|
+
its packaging checks alone do not establish that journey. Model-selected browsing
|
|
132
|
+
through the patched release images still needs qualification; the Team server recipe
|
|
133
|
+
leaves browser disabled.
|
|
103
134
|
|
|
104
135
|
[Publish release candidate](../.github/workflows/publish-release.yml) accepts a successful
|
|
105
136
|
build run from `main`. It checks the source commit and artifact checksums, creates the
|
|
@@ -115,25 +146,30 @@ Repository setup:
|
|
|
115
146
|
organization `@clawscarf` owns the public `@clawscarf/cli` package.
|
|
116
147
|
- npm trusted publishing is configured for repository `clawscarf/clawscarf`, workflow
|
|
117
148
|
[publish-release.yml](../.github/workflows/publish-release.yml), environment `release`.
|
|
118
|
-
|
|
119
|
-
npm requires a package to exist before configuring trust. Subsequent publication
|
|
120
|
-
uses the workflow's short-lived identity rather than a stored npm token. That next
|
|
121
|
-
workflow publication has not yet been exercised.
|
|
149
|
+
Publication uses the workflow's short-lived identity rather than a stored npm token.
|
|
122
150
|
- Transitive notices/source review remains open in [TODO.md](../TODO.md).
|
|
123
151
|
Debian copyright files remain in the images; runtime assets include upstream notices
|
|
124
152
|
and the image build exports its network-tool sources. Those files are not a claim of
|
|
125
153
|
a completed license audit. Pinned Debian packages still depend on mirror retention.
|
|
126
154
|
|
|
127
|
-
[
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
155
|
+
[0.1.0-alpha.3](https://github.com/clawscarf/clawscarf/releases/tag/v0.1.0-alpha.3)
|
|
156
|
+
includes the standalone installer and CLI archives. Its
|
|
157
|
+
[candidate build](https://github.com/clawscarf/clawscarf/actions/runs/35536122174)
|
|
158
|
+
passed full checks, npm archive installation, all eight image builds on both
|
|
159
|
+
architectures, and standalone installation without system Node on all three host
|
|
160
|
+
platforms. The public macOS installer also passed download verification, catalog
|
|
161
|
+
loading and read-only status against an existing installation.
|
|
162
|
+
|
|
163
|
+
Both Linux architectures passed protected runtime startup, native WebSocket forwarding,
|
|
164
|
+
authenticated TLS to the private model gateway, retained stop/start and deletion on
|
|
165
|
+
Docker 29.5.3. Real GPT-6 Astra inference and retained restart on macOS Docker Desktop
|
|
166
|
+
were verified with alpha.2. Disposable test containers, volumes and networks were
|
|
167
|
+
deleted afterward.
|
|
168
|
+
|
|
169
|
+
Staging hosted administrator login and the packaged interactive setup previously
|
|
170
|
+
passed on macOS with alpha.1. Hosted login and real provider inference on Linux,
|
|
171
|
+
actual Windows/WSL2 installation, production first-time signup and changed-version
|
|
172
|
+
upgrades remain unverified; see [TODO.md](../TODO.md).
|
|
137
173
|
|
|
138
174
|
## Assemble runtime artifacts
|
|
139
175
|
|
package/release/components.json
CHANGED
|
@@ -1,8 +1,8 @@
|
|
|
1
1
|
{
|
|
2
2
|
"openclaw": {
|
|
3
|
+
"sourceTree": "b4ea62c5851510a4914ac95878f6e657344e6caf",
|
|
3
4
|
"version": "2026.9.4",
|
|
4
|
-
"sourceRevision": "7bc487d39dc9e059bb9b19ea08152883022f83fe"
|
|
5
|
-
"image": "clawscarf-openclaw:7bc487d39dc9e059bb9b19ea08152883022f83fe"
|
|
5
|
+
"sourceRevision": "7bc487d39dc9e059bb9b19ea08152883022f83fe"
|
|
6
6
|
},
|
|
7
7
|
"openshell": {
|
|
8
8
|
"version": "0.0.116",
|
|
@@ -38,6 +38,14 @@
|
|
|
38
38
|
},
|
|
39
39
|
"gatewayImage": "ghcr.io/nvidia/openshell/gateway:0.0.116@sha256:05cf77bbb022a739aed6f22daa0e7e164415f4ab273b5f84319e46d91eb8f645"
|
|
40
40
|
},
|
|
41
|
+
"cliNode": {
|
|
42
|
+
"version": "24.19.0",
|
|
43
|
+
"archives": {
|
|
44
|
+
"darwin-arm64": "8294b7aa9b03997481c06babf1e8b270c859358f27da57a11509afe537ac381d",
|
|
45
|
+
"linux-arm64": "d28c8a5bf0a808f0ed434a1dce8c54ae98f0371c0bd86ac58abc613f73e6643f",
|
|
46
|
+
"linux-x64": "f625d97cd707df4ff96254916fbc5ff014f09c09effe5a1e0ca8f6d41a8789d4"
|
|
47
|
+
}
|
|
48
|
+
},
|
|
41
49
|
"companionNode": {
|
|
42
50
|
"version": "24.19.0",
|
|
43
51
|
"image": "node@sha256:4196d66a565c6f195728d9952f161f4adfe2ad753052a08b7ec7f1c5a6bda42b"
|
package/release/operator.md
CHANGED
|
@@ -20,10 +20,24 @@ The `next` tag selects the current alpha. Use an exact version instead when need
|
|
|
20
20
|
npm installs the CLI dependencies; runtime images and tools are fetched during setup.
|
|
21
21
|
See [release contents](README.md) for supported platforms and verification.
|
|
22
22
|
|
|
23
|
-
##
|
|
23
|
+
## Standalone download
|
|
24
|
+
|
|
25
|
+
Standalone CLI archives include Node and installed dependencies. Download the archive
|
|
26
|
+
for your platform and its `SHA256SUMS` from the same GitHub Release. The release's
|
|
27
|
+
[installer](install.sh) selects the correct archive, verifies it and installs
|
|
28
|
+
`clawscarf` under `~/.local/bin`. It accepts `--prefix /absolute/directory`.
|
|
29
|
+
No system Node, npm or pnpm is required. These archives are separate from both the
|
|
30
|
+
npm package and the runtime-tool archives.
|
|
31
|
+
|
|
32
|
+
The layout is `clawscarf/` containing the launcher, `node/bin/node`, Node's LICENSE,
|
|
33
|
+
and `package/` with the CLI, dependencies and catalogs. You can also verify and
|
|
34
|
+
extract the archive yourself, then run `./clawscarf/clawscarf configure`.
|
|
35
|
+
Moving the whole directory preserves the bundled runtime and dependencies.
|
|
36
|
+
|
|
37
|
+
## Run the JavaScript archive
|
|
24
38
|
|
|
25
39
|
Verify the archive against its accompanying `SHA256SUMS`, then extract it into a new
|
|
26
|
-
directory.
|
|
40
|
+
directory. Unlike the standalone download, this requires Node 24.16 or later in the Node 24 line, or Node 26.1 or later, and
|
|
27
41
|
pnpm 10.33.0. In the extracted `package` directory:
|
|
28
42
|
|
|
29
43
|
```sh
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"schemaVersion": 1,
|
|
3
|
-
"version": "0.1.0-alpha.
|
|
4
|
-
"sourceRevision": "
|
|
3
|
+
"version": "0.1.0-alpha.4",
|
|
4
|
+
"sourceRevision": "6ef49bb49eb9cbf67f2dc1fc9cd46bfc37769344",
|
|
5
5
|
"platforms": [
|
|
6
6
|
"darwin-arm64",
|
|
7
7
|
"linux-arm64",
|
|
@@ -9,16 +9,16 @@
|
|
|
9
9
|
],
|
|
10
10
|
"images": {
|
|
11
11
|
"postgres": "postgres@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193",
|
|
12
|
-
"gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:
|
|
13
|
-
"companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:
|
|
14
|
-
"openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:
|
|
15
|
-
"relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:
|
|
12
|
+
"gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:cd216ee3f3301da011da5b3594ffb94bf8f5b33931ba1a9359f7902beadaf172",
|
|
13
|
+
"companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:355d032e5d16048b421c909e759774c01472e15f4af3db4cbbeaaafc7bde9b43",
|
|
14
|
+
"openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:d662ce37531c007180ad08b0e20348a43ed26b7d21edf261550a02a80f1eeaac",
|
|
15
|
+
"relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:cb6a6021f391ee309236202fb5e7557a22f47825417cea1ebeeefbf5b4fafe78",
|
|
16
16
|
"models": "ghcr.io/berriai/litellm:v1.100.1@sha256:a3715fa7ad8387941ab697259bd2881d68931657247a41984f90fae6d11c62bf",
|
|
17
17
|
"browser": {
|
|
18
|
-
"chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:
|
|
19
|
-
"node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:
|
|
20
|
-
"dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:
|
|
21
|
-
"egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:
|
|
18
|
+
"chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:783b32a513a20ca5ae81a3dc9d5e23e7ac736b7130abfd412ca04a336a9bc538",
|
|
19
|
+
"node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:89e5c96dd598363bee81f44b585a9340e5449f878daf93a334180ed096250611",
|
|
20
|
+
"dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:ed44079311c2c245ea303947a4295f1948a182a07d162bedc88bb16ceca81295",
|
|
21
|
+
"egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:a2c0c18a1a398a6a16a427b6de9aa639cea44fa676679f01b188303cd191cbd5"
|
|
22
22
|
}
|
|
23
23
|
},
|
|
24
24
|
"tools": {
|
|
@@ -28,34 +28,34 @@
|
|
|
28
28
|
"darwin-arm64": {
|
|
29
29
|
"file": "tools/darwin-arm64/openshell",
|
|
30
30
|
"sha256": "0baeeffe0e4c184b08fde910ac9e8815fb0b8cfb808e49c0e634d7db65fb03bb",
|
|
31
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
31
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-darwin-arm64"
|
|
32
32
|
},
|
|
33
33
|
"linux-arm64": {
|
|
34
34
|
"file": "tools/linux-arm64/openshell",
|
|
35
35
|
"sha256": "84df9f059b16b66c83748606cc87d9edcda84b57effea19543f5c368aba7eb18",
|
|
36
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
36
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-linux-arm64"
|
|
37
37
|
},
|
|
38
38
|
"linux-x64": {
|
|
39
39
|
"file": "tools/linux-x64/openshell",
|
|
40
40
|
"sha256": "24e85062073d512d1951c76cd3890b7bce1ab01cc36a08f88b3b43c067a402da",
|
|
41
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
41
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-linux-x64"
|
|
42
42
|
}
|
|
43
43
|
},
|
|
44
44
|
"gateway": {
|
|
45
45
|
"darwin-arm64": {
|
|
46
46
|
"file": "tools/darwin-arm64/openshell-gateway",
|
|
47
47
|
"sha256": "298706259ef18350f334c222e981e91583558511d50bce22727c689d261203e6",
|
|
48
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
48
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-gateway-darwin-arm64"
|
|
49
49
|
},
|
|
50
50
|
"linux-arm64": {
|
|
51
51
|
"file": "tools/linux-arm64/openshell-gateway",
|
|
52
52
|
"sha256": "0e660428e655e7481f34ba8a4b351554400baf791863d32555c98dddb3f09ae2",
|
|
53
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
53
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-gateway-linux-arm64"
|
|
54
54
|
},
|
|
55
55
|
"linux-x64": {
|
|
56
56
|
"file": "tools/linux-x64/openshell-gateway",
|
|
57
57
|
"sha256": "780fc7ad871e2163f3fb866a2d0254ee682fc0d83e6261a84b350c8dcdd9f47b",
|
|
58
|
-
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.
|
|
58
|
+
"url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.4/openshell-gateway-linux-x64"
|
|
59
59
|
}
|
|
60
60
|
}
|
|
61
61
|
}
|
|
@@ -32,6 +32,7 @@ export async function ensureCertificates(directory) {
|
|
|
32
32
|
const key = createPrivateKey(await readFile(join(directory, "management-key.pem")));
|
|
33
33
|
if (!cert.checkPrivateKey(key) ||
|
|
34
34
|
!cert.checkHost("host.docker.internal") ||
|
|
35
|
+
!cert.checkHost("companion") ||
|
|
35
36
|
!cert.checkIP("127.0.0.1") ||
|
|
36
37
|
!cert.raw.equals(ca.raw) ||
|
|
37
38
|
!cert.ca ||
|
|
@@ -64,7 +65,7 @@ export async function ensureCertificates(directory) {
|
|
|
64
65
|
"-subj",
|
|
65
66
|
"/CN=ClawScarf local management",
|
|
66
67
|
"-addext",
|
|
67
|
-
"subjectAltName=DNS:localhost,DNS:host.docker.internal,DNS:models.clawscarf.internal,IP:127.0.0.1",
|
|
68
|
+
"subjectAltName=DNS:localhost,DNS:companion,DNS:host.docker.internal,DNS:models.clawscarf.internal,IP:127.0.0.1",
|
|
68
69
|
"-addext",
|
|
69
70
|
"basicConstraints=critical,CA:TRUE",
|
|
70
71
|
]);
|
|
@@ -187,9 +187,6 @@ export const localInput = z
|
|
|
187
187
|
export function parseLocalInput(value) {
|
|
188
188
|
return localInput.parse(value);
|
|
189
189
|
}
|
|
190
|
-
export function managementOrigin() {
|
|
191
|
-
return "https://localhost:18801";
|
|
192
|
-
}
|
|
193
190
|
function mountedPrivateFile(directory, path, name) {
|
|
194
191
|
absolutePath.parse(path);
|
|
195
192
|
if (resolve(path) !== join(directory, name))
|
|
@@ -225,7 +222,8 @@ export function generateLocalConfiguration(options) {
|
|
|
225
222
|
},
|
|
226
223
|
runtime: {
|
|
227
224
|
origin: `http://application:${String(input.ports.native)}`,
|
|
228
|
-
|
|
225
|
+
// Native proxy attribution needs the real Docker peer, not a loopback client.
|
|
226
|
+
managementOrigin: "https://companion:18801",
|
|
229
227
|
widgetOrigin,
|
|
230
228
|
widgetUpstream: `http://widgets:${String(input.ports.nativeWidgets)}`,
|
|
231
229
|
},
|