@clawscarf/cli 0.1.0-alpha.3 → 0.1.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/README.md +23 -23
  2. package/THIRD_PARTY_NOTICES.md +13 -11
  3. package/package.json +1 -1
  4. package/packs/README.md +4 -11
  5. package/pnpm-lock.yaml +194 -3594
  6. package/recipes/README.md +4 -3
  7. package/recipes/team-server/recipe.json +2 -2
  8. package/release/README.md +50 -76
  9. package/release/components.json +2 -2
  10. package/release/operator.md +24 -76
  11. package/runtime/configuration.js +1 -0
  12. package/runtime/releases/{0.1.0-alpha.3.json → 0.1.0-alpha.5.json} +16 -16
  13. package/scripts/deployment/certificates.js +2 -1
  14. package/scripts/deployment/configuration.js +2 -4
  15. package/scripts/deployment/entrypoint.js +4 -1
package/README.md CHANGED
@@ -1,4 +1,6 @@
1
- # ClawScarf 🧣
1
+ <a href="https://clawscarf.com"><img src="https://clawscarf.com/clawscarf-mark.svg" alt="ClawScarf logo" width="112" height="112" /></a>
2
+
3
+ # ClawScarf
2
4
 
3
5
  ### OpenClaw, ready for your team.
4
6
 
@@ -11,7 +13,7 @@ models, connected accounts, and execution protected by NVIDIA OpenShell.
11
13
  ## Get started
12
14
 
13
15
  ```sh
14
- curl -fsSL https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.3/install.sh | sh
16
+ curl -fsSL https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.5/install.sh | sh
15
17
  export PATH="$HOME/.local/bin:$PATH"
16
18
  clawscarf configure
17
19
  ```
@@ -22,12 +24,8 @@ The terminal setup walks you through it, downloads the runtime, and opens OpenCl
22
24
  in your browser. Your sign-in becomes the first administrator account. No checkout,
23
25
  Docker configuration files or separate OpenClaw installation required.
24
26
 
25
- You’ll need **Docker Engine 29+ with Compose** (or Docker Desktop) and an **API key
26
- for your chosen model provider**. The CLI includes its own Node runtime.
27
- Available for **macOS Apple Silicon and Linux ARM64/x86-64**; Windows runs through
28
- **WSL2, currently experimental**. Add `~/.local/bin` to your shell's PATH to keep
29
- the command available in new terminals. The installer requires no sudo.
30
- [Full platform requirements →](https://github.com/clawscarf/clawscarf/blob/main/deploy/deployment/installation.md)
27
+ You’ll need Docker and a model-provider API key. Check the
28
+ [platform requirements](https://github.com/clawscarf/clawscarf/blob/main/deploy/deployment/installation.md) before installing.
31
29
 
32
30
  <details>
33
31
  <summary>Prefer npm?</summary>
@@ -37,23 +35,22 @@ npm install -g @clawscarf/cli@next
37
35
  clawscarf configure
38
36
  ```
39
37
 
40
- This alternative uses your own Node installation: Node 24.16+ within 24.x or 26.1+.
41
- The `next` tag installs the current alpha.
38
+ This alternative uses your own Node installation; see the
39
+ [requirements](https://github.com/clawscarf/clawscarf/blob/main/deploy/deployment/installation.md).
42
40
 
43
41
  </details>
44
42
 
45
43
  ## Make it your team’s workspace
46
44
 
47
- | What you want to do | Where to do it |
48
- | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
49
- | **Start working with an agent** | Open a chat in OpenClaw. Create and configure agents using its native settings. |
50
- | **Bring in your teammates** | Open **People**, create an invitation link, and assign native OpenClaw roles. Administrators can remove access there too. |
51
- | **Connect Outlook and other services** | Open **Connections**, link an account, and choose which agents can use it. Connections is included in Team server and can be turned off during setup. |
52
- | **Use your preferred models** | Choose the provider, model and reasoning level in setup. Run `clawscarf configure` again to change them. |
45
+ | What you want to do | Where to do it |
46
+ | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
47
+ | **Start working with an agent** | Open a chat in OpenClaw. Create and configure agents using its native settings. |
48
+ | **Bring in your teammates** | Open **People**, create an invitation link, and assign native OpenClaw roles. Administrators can remove access there too. |
49
+ | **Connect Outlook and other services** | Open **Connections**, link an account, and choose which agents can use it. Choose this optional capability during setup. |
50
+ | **Use your preferred models** | Choose the provider, model and reasoning level in setup. Run `clawscarf configure` again to change them. |
53
51
 
54
- The default recipe uses **GPT-6 Astra through OpenAI, with medium reasoning**.
55
- Choose another provider or model in the menu; usage is billed by your provider.
56
- Your provider API key stays outside OpenClaw, in the model gateway.
52
+ Review the [recipe settings](https://github.com/clawscarf/clawscarf/blob/main/recipes/README.md) and choose your provider and model.
53
+ Usage is billed by your provider; its API key stays outside OpenClaw.
57
54
 
58
55
  Setup opens **[http://127.0.0.1:18800](http://127.0.0.1:18800)** by default.
59
56
  That address is local to your machine. To share the server with teammates, use a
@@ -94,10 +91,10 @@ Default login and optional Connections use **ClawScarf Cloud**. You can use your
94
91
  OIDC provider and disable Connections to run without those hosted services. Original
95
92
  model-provider keys and Connections management credentials stay outside OpenClaw.
96
93
 
97
- ClawScarf is in alpha. Browser automation is off by default while an upstream routing
98
- issue remains; retained data still needs backups. See the [security boundaries](https://github.com/clawscarf/clawscarf/blob/main/deploy/openshell/README.md),
99
- [browser support](https://github.com/clawscarf/clawscarf/blob/main/deploy/execution/browser-node/README.md) and [open work](https://github.com/clawscarf/clawscarf/blob/main/TODO.md)
100
- for details.
94
+ See [published releases](https://github.com/clawscarf/clawscarf/releases),
95
+ [security implementation](https://github.com/clawscarf/clawscarf/blob/main/deploy/openshell/README.md),
96
+ [browser support](https://github.com/clawscarf/clawscarf/blob/main/deploy/execution/browser-node/README.md#verified-release-limits)
97
+ and [open work](https://github.com/clawscarf/clawscarf/blob/main/TODO.md) before choosing capabilities. Retained data still needs backups.
101
98
 
102
99
  ## Explore and contribute
103
100
 
@@ -105,6 +102,9 @@ for details.
105
102
  - **Customizing it:** [Recipes](https://github.com/clawscarf/clawscarf/blob/main/recipes/README.md) · [Packs](https://github.com/clawscarf/clawscarf/blob/main/packs/README.md) · [Runtime architecture](https://github.com/clawscarf/clawscarf/blob/main/runtime/README.md)
106
103
  - **Helping build it:** [Contributing](https://github.com/clawscarf/clawscarf/blob/main/CONTRIBUTING.md) · [Development setup](https://github.com/clawscarf/clawscarf/blob/main/scripts/README.md) · [Report a bug](https://github.com/clawscarf/clawscarf/issues)
107
104
 
105
+ ClawScarf maintains a small [OpenClaw patch series](https://github.com/clawscarf/clawscarf/blob/main/runtime/openclaw/README.md)
106
+ for selected fixes and optional capabilities. Releases include its exact source provenance.
107
+
108
108
  Built on [OpenClaw](https://github.com/openclaw/openclaw),
109
109
  [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) and
110
110
  [LiteLLM](https://github.com/BerriAI/litellm).
package/THIRD_PARTY_NOTICES.md CHANGED
@@ -12,7 +12,7 @@ the operator, companion and Connections plugin artifacts.
12
12
  AGENTS.md is adapted from RawClaw's contributor guide at commit
13
13
  [`f37a6e786fdd88857c21bd32140567874e281a8c`](https://github.com/raw-labs/rawclaw/blob/f37a6e786fdd88857c21bd32140567874e281a8c/AGENTS.md),
14
14
  with the project owner's authorization. The Connections plugin and companion,
15
- access service, UI primitives and development checks also extract or adapt donor
15
+ access service, native page flows and development checks also extract or adapt donor
16
16
  source and regressions. Their local READMEs identify the incorporated paths and
17
17
  deliberate boundary changes.
18
18
  The reviewed donor has no top-level license file; do not infer a blanket license
@@ -24,7 +24,9 @@ embedded third-party notices for each extracted component before publication.
24
24
  The runtime recipe references pinned OpenClaw and OpenShell artifacts in
25
25
  [release/components.json](release/components.json). The access adapter imports
26
26
  the published `@openclaw/gateway-client` package. Dependencies and their versions
27
- are recorded in lockfiles; upstream source is not vendored here.
27
+ are recorded in lockfiles. The [downstream patch series](runtime/openclaw/README.md)
28
+ contains selected source differences and context from MIT-licensed OpenClaw; it is
29
+ not a complete vendored source tree.
28
30
  The terminal installer uses MIT-licensed `@clack/prompts` 1.8.1. It is installed
29
31
  from the operator lockfile and retains its upstream license with the dependency;
30
32
  the installer does not vendor or modify the prompt library.
@@ -33,8 +35,10 @@ Standalone CLI archives include the unmodified Node.js 24.19.0 executable from
33
35
  SHA-256 pins in [release/components.json](release/components.json). Each archive
34
36
  retains Node's complete upstream LICENSE, including its bundled third-party notices,
35
37
  at `node/LICENSE`. JavaScript dependencies retain their licenses in `node_modules`.
36
- The Gateway uses unmodified upstream commit `7bc487d39dc9e059bb9b19ea08152883022f83fe`;
37
- the [image build instructions](deploy/images/README.md) own source packaging.
38
+ Gateway source builds apply the maintained patch series to upstream commit
39
+ `7bc487d39dc9e059bb9b19ea08152883022f83fe`. Release provenance records the
40
+ resulting tree and patch-set digest alongside the exact patches and their intent documents.
41
+ The [image build instructions](deploy/images/README.md) own source packaging.
38
42
  OpenClaw's upstream [license](https://github.com/openclaw/openclaw/blob/7bc487d39dc9e059bb9b19ea08152883022f83fe/LICENSE)
39
43
  is MIT. NVIDIA NemoClaw's [license](https://github.com/NVIDIA/NemoClaw/blob/main/LICENSE)
40
44
  is Apache-2.0. Referencing their architecture is not incorporating their code.
@@ -63,12 +67,10 @@ qualification reports. Debian package copyright files remain under `/usr/share/d
63
67
  This initial inventory does not establish complete transitive license review;
64
68
  that release requirement remains in [TODO.md](TODO.md).
65
69
 
66
- The Gateway and companion image recipes copy this file and the root [license](LICENSE) verbatim
67
- to `/usr/share/licenses/clawscarf`. The companion recipe additionally copies the
68
- incorporated [shadcn notice](ui/shadcn/LICENSE.md)
69
- there as `shadcn-MIT.txt`. A local runtime rebuild verified the root notices against its build inputs.
70
- A local companion rebuild also verified the root and shadcn notices against build inputs. Relative
71
- source links in this file refer to the source checkout, not image filesystem paths.
70
+ The Gateway and companion image recipes copy this file and the root [license](LICENSE)
71
+ verbatim to `/usr/share/licenses/clawscarf`. Native plugin pages use the shared
72
+ [page renderer](plugins/common/native-page.ts) and OpenClaw's host UI components.
73
+ Relative source links in this file refer to the source checkout, not image filesystem paths.
72
74
 
73
75
  When bundling or adapting software, record its exact version and source, retain its
74
76
  license and required notices, and identify modifications where required. Review
@@ -90,7 +92,7 @@ provenance. Paths below are relative to that donor, not files already present he
90
92
  | Runtime/defaults and plugin packaging | runtime/openclaw/, deploy/images/hetzner/scripts/install-runtime.sh, plugins/connections/ | Reuse defaults, integrity checks and packaging; replace Hetzner, systemd, rootless-engine and host-path assumptions for the selected target. |
91
93
  | Company login and entry | src/domains/access/, src/domains/installations/service/openclaw/entry/, src/apps/ingress/, src/composition/ingress.ts | Reuse OIDC/session/ingress mechanics and native identity semantics; replace organization/admission/placement wiring with standalone ownership. |
92
94
  | Connections | plugins/connections/, src/domains/connections/, src/composition/connections/, catalogs/connections/, scripts/connectors-catalog*.ts | Preserve REST tools, Composio adapter, callbacks, account selection and grants; extract required persistence without the fleet control plane. |
93
- | Connection account UI | src/apps/web/domains/connections/ and its shared visual/form dependencies | Copy the working flow and visual primitives; remove organization routing through explicit standalone composition. |
95
+ | Connection account UI | src/apps/web/domains/connections/ | Adapt the account-management flow to native OpenClaw plugin pages and generated clients; omit the donor web shell. |
94
96
  | Model gateway | runtime/ai-gateway/, deploy/ai-gateway/, src/composition/ai/ and applicable src/domains/ai/ code | Reuse LiteLLM integration/configuration and tests; replace hosted-source/admission/catalog wiring where needed. Do not recreate the removed inference proxy. |
95
97
  | Acceptance | tests/ and corresponding helpers for identity, logout, ingress, native roles, connections, model gateway and browser flows | Transfer regressions with each capability; adapt fixtures and run against the new runtime. Donor success is not new-target acceptance. |
96
98
 
package/package.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "version": "0.1.0-alpha.3",
2
+ "version": "0.1.0-alpha.5",
3
3
  "engines": {
4
4
  "node": ">=24.16.0 <25 || >=26.1.0"
5
5
  },
package/packs/README.md CHANGED
@@ -26,7 +26,7 @@ It preserves edited and unmanaged files, checks plan integrity and does not repl
26
26
  uncertain mutations. Removing an agent remains destructive. Native monitor cleanup
27
27
  uses OpenClaw's direct-local password authentication supplied by the
28
28
  [runtime launcher](../runtime/README.md); trusted-proxy login remains in place for
29
- people. Retained installations need the updated runtime image and a Gateway restart.
29
+ people. Use a runtime release containing that launcher contract.
30
30
 
31
31
  The private runtime helper only inspects packaged source. Individual portable Claws
32
32
  can be built with native `openclaw claws build <member-directory> --out <artifact.tgz>`.
@@ -106,8 +106,7 @@ after a Gateway restart, preservation of edited files and rejection of forwarded
106
106
  password authentication. The copied fixture omits the model prerequisite; no model
107
107
  inference is purchased. Set `CLAWSCARF_TEST_NATIVE_PACKS=1` to run it, optionally
108
108
  with `CLAWSCARF_TEST_OPENCLAW` pointing at the packaged runtime launcher. The same
109
- fixture has passed inside a disposable OpenShell runtime using the pinned upstream
110
- image plus the updated launcher.
109
+ fixture can also run inside a disposable OpenShell runtime to verify its packaged launcher.
111
110
  [Operator binding checks](../tests/packs/connections.test.ts) cover current session,
112
111
  exact grants and revision drift. [Transport checks](../tests/packs/transport.test.ts)
113
112
  cover UUID dispatch and uncertain failure without replay. The optional
@@ -120,11 +119,5 @@ qualify trusted-proxy removal, external OAuth or connector execution.
120
119
  [Execution-target checks](../tests/packs/execution-target.test.ts) use controlled operator
121
120
  processes to verify unified runtime dispatch, missing binaries, denied policy
122
121
  and runtime replacement. They do not replace live OpenShell qualification.
123
- A disposable runtime with the image's nftables 1.1.3/libnftnl 1.2.9 dependencies
124
- loaded an explicit TCP policy: verification accepted its exact process/host/port
125
- and rejected a different port. This qualifies policy observation and matching;
126
- it does not establish a successful connector request or application execution.
127
-
128
- Run `CLAWSCARF_TEST_NATIVE_PACKS=1 pnpm exec tsx --test tests/packs/native.test.ts`
129
- for the disposable native test. It writes isolated temporary state and uses the
130
- pinned OpenClaw dependency installed for the Connections plugin.
122
+ [Network-tool verification](../deploy/images/network-tools/README.md) owns the native
123
+ TCP dependency check; successful policy matching does not establish endpoint reachability.