@clawscarf/cli 0.1.0-alpha.6 → 0.1.0-alpha.7

package/README.md

@@ -90,6 +90,11 @@ execution files and browser accounts. Native roles control application permissio
 people allowed to run code share the Gateway’s authority. Use separate installations
 for teams that must be isolated from one another.
 
+The Team server recipe enables public web access for agents and shell tools. Operators
+can turn it off; private destinations remain restricted to explicitly configured services.
+Public web access permits sending team data to public services. See the
+[network boundary](https://github.com/clawscarf/clawscarf/blob/main/deploy/openshell/README.md#public-web-access) for enforcement and limits.
+
 Default login and optional Connections use **ClawScarf Cloud**. You can use your own
 OIDC provider and disable Connections to run without those hosted services. Original
 model-provider keys and Connections management credentials stay outside OpenClaw.

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0-alpha.6",
+  "version": "0.1.0-alpha.7",
   "engines": {
     "node": ">=24.16.0 <25 || >=26.1.0"
   },

package/recipes/README.md

@@ -21,7 +21,7 @@ no executable hooks, secrets or user identities.
 
 - `models` selects model ID, provider and reasoning from the bundled
   [model catalog](../deploy/models/catalog.json).
-- `defaults` selects resources, browser and Connections enablement.
+- `defaults` selects resources, public web access, browser and Connections enablement.
 - `packs: [{ id, members }]` selects agents from the bundled [packs](../packs/README.md).
   The installer checks members and collects required credentials after settings review.
 

package/recipes/team-server/recipe.json

@@ -1,7 +1,7 @@
 {
   "id": "team-server",
-  "version": "0.1.1",
-  "runtime": "../../runtime/releases/0.1.0-alpha.6.json",
+  "version": "0.1.2",
+  "runtime": "../../runtime/releases/0.1.0-alpha.7.json",
   "name": "Team server",
   "description": "A protected OpenClaw server for your team, with hosted login, managed models and optional Connections.",
   "maturity": "supported",
@@ -15,6 +15,7 @@
     "browser": {
       "enabled": false
     },
+    "publicWeb": true,
     "connections": {
       "enabled": true
     }

package/release/components.json

@@ -1,6 +1,6 @@
 {
   "openclaw": {
-    "sourceTree": "9270b569864b1036a69d3080e628b68f4f4c048a",
+    "sourceTree": "57d9c7394530b0468c0ccc3f163297c6669e0d5a",
     "version": "2026.9.4",
     "sourceRevision": "7bc487d39dc9e059bb9b19ea08152883022f83fe"
   },

package/runtime/releases/{0.1.0-alpha.6.json → 0.1.0-alpha.7.json}

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "version": "0.1.0-alpha.6",
-  "sourceRevision": "3527b1e4ce8218d5b144f267cafe4115aa160b85",
+  "version": "0.1.0-alpha.7",
+  "sourceRevision": "681655cc3e931209cb56b9f6866c9d780055c709",
   "platforms": [
     "darwin-arm64",
     "linux-arm64",
@@ -9,16 +9,16 @@
   ],
   "images": {
     "postgres": "postgres@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193",
-    "gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:24a7ef582b70cff88e09aed5d1ef7350e3a2afcfad251590a7740bf7c8b8c28b",
-    "companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:5821b3770d19a19cfdb9faf3ee357a47c790fcc79a43d3ba4cf59f6962dc5428",
-    "openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:69c6fb88be2b14fa0fd5ac8b5c5274195cdb5182b256aeffe8955bbd501db0db",
-    "relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:cf07a39071b22cb362125bc000edef8c4694b9089c075df42fdb4235cd25c12a",
+    "gateway": "ghcr.io/clawscarf/clawscarf/runtime@sha256:05a2341c36ca49d4a83d24a5f3bffff74dd54944b9fc3e13b7a5113d9ecda5f0",
+    "companion": "ghcr.io/clawscarf/clawscarf/companion@sha256:94a134f1f88eaacc785d1f0b5d7715725506f5c2e9f1d822916ada86513fb3aa",
+    "openshellClient": "ghcr.io/clawscarf/clawscarf/openshell-client@sha256:1ed1c3db878f5dc11045442319e3ff667aaebbf98977e042ace7486aff6a5b7a",
+    "relay": "ghcr.io/clawscarf/clawscarf/browser-relay@sha256:96101feea8be108c25eb2df1847a99b4a4cab2ca632d9895b36ea665bbd5f5ac",
     "models": "ghcr.io/berriai/litellm:v1.100.1@sha256:a3715fa7ad8387941ab697259bd2881d68931657247a41984f90fae6d11c62bf",
     "browser": {
-      "chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:6289b18228ff6bd56a59fe4a7974299e64726696c8c7a10f42bff35a919bc9bb",
-      "node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:daf1e454db411836e595c167f924a9c951b4e6cdd40b8891d3fbd0e7a328afbb",
-      "dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:dd543e51e8a1c52e2165bda661c2a866bcffaf198bc961f7a537c7af8b90e244",
-      "egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:cca3d28d58002f91a03a548032a30ae5da726bcaee1ec65062581bbfb03dcbd9"
+      "chromium": "ghcr.io/clawscarf/clawscarf/browser@sha256:c0b9a423829a990c805fdee6af55597ec02a9dc0a8aed35590fc43a75d5fe60f",
+      "node": "ghcr.io/clawscarf/clawscarf/browser-node@sha256:2102a3bb15cb8c828ae09c91271f67b7e963d8bacd21f848044782e7c33f9d42",
+      "dns": "ghcr.io/clawscarf/clawscarf/browser-dns@sha256:bc877b4bc0635a1dd4b4d3dba11e1142a38d0c1ff51bb90fc58ebf42fa57562d",
+      "egress": "ghcr.io/clawscarf/clawscarf/browser-egress@sha256:7519c3dc6c54afadf5104ae92ecc5f6af6983fb308e16e2c81b7df593a8c6f8d"
     }
   },
   "tools": {
@@ -28,34 +28,34 @@
         "darwin-arm64": {
           "file": "tools/darwin-arm64/openshell",
           "sha256": "0baeeffe0e4c184b08fde910ac9e8815fb0b8cfb808e49c0e634d7db65fb03bb",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-darwin-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-darwin-arm64"
         },
         "linux-arm64": {
           "file": "tools/linux-arm64/openshell",
           "sha256": "84df9f059b16b66c83748606cc87d9edcda84b57effea19543f5c368aba7eb18",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-linux-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-linux-arm64"
         },
         "linux-x64": {
           "file": "tools/linux-x64/openshell",
           "sha256": "24e85062073d512d1951c76cd3890b7bce1ab01cc36a08f88b3b43c067a402da",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-linux-x64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-linux-x64"
         }
       },
       "gateway": {
         "darwin-arm64": {
           "file": "tools/darwin-arm64/openshell-gateway",
           "sha256": "298706259ef18350f334c222e981e91583558511d50bce22727c689d261203e6",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-darwin-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-gateway-darwin-arm64"
         },
         "linux-arm64": {
           "file": "tools/linux-arm64/openshell-gateway",
           "sha256": "0e660428e655e7481f34ba8a4b351554400baf791863d32555c98dddb3f09ae2",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-linux-arm64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-gateway-linux-arm64"
         },
         "linux-x64": {
           "file": "tools/linux-x64/openshell-gateway",
           "sha256": "780fc7ad871e2163f3fb866a2d0254ee682fc0d83e6261a84b350c8dcdd9f47b",
-          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.6/openshell-gateway-linux-x64"
+          "url": "https://github.com/clawscarf/clawscarf/releases/download/v0.1.0-alpha.7/openshell-gateway-linux-x64"
         }
       }
     }

package/scripts/deployment/configuration.js

@@ -139,6 +139,7 @@ export const localInput = z
         .optional(),
     cpu,
     memory,
+    publicWeb: z.boolean().default(false),
     relayImage: image.optional(),
     browser: z
         .strictObject({

package/scripts/deployment/connection-settings.js

@@ -5,6 +5,7 @@ import { companionConfiguration } from "./configuration.js";
 import { loadInitialConnections, prepareInitialConnections, readInitialConnectionToken, } from "./connections.js";
 import { configureConnectionsVolume } from "./connections-runtime.js";
 import { writePrivate } from "./state.js";
+import { stageNetworkPolicyChange } from "./network-policy.js";
 import { initialRuntimePolicy } from "./policy.js";
 /** Explicit capability edit, with the installation stopped and its operator lock held. */
 export async function applyConnectionSettings(directory, state, previous, credentialFile) {
@@ -56,5 +57,7 @@ export async function applyConnectionSettings(directory, state, previous, creden
     await writePrivate(file, JSON.stringify(config));
     const rule = initialRuntimePolicy("network_policies: {}", undefined, endpoint)
         .network_policies.connections_broker ?? null;
-    await writePrivate(join(directory, "private/connection-policy-change.json"), JSON.stringify({ ownerId: state.ownerId, rule }));
+    await stageNetworkPolicyChange(directory, state, {
+        connections_broker: rule,
+    });
 }

package/scripts/deployment/launch.js

@@ -1,4 +1,4 @@
-import { applyConnectionPolicy } from "./connection-policy.js";
+import { applyNetworkPolicy } from "./network-policy.js";
 import { verifyRuntimeImage } from "./images.js";
 import { startBrowserNode } from "./browser-node-pairing.js";
 import { verifyBrowserNode } from "./browser-node.js";
@@ -83,7 +83,7 @@ export async function launchLocal(directoryInput, report, control = {}) {
         await waitFor(async () => {
             await run(state.input.openshellCli, ["sandbox", "list", "--gateway", name, "--output", "json"], { env, timeout: 5000 });
         });
-        await applyConnectionPolicy(directory, state, env);
+        await applyNetworkPolicy(directory, state, env);
         if (state.input.modelGateway) {
             report("Starting model gateway…");
             await compose(directory, [
@@ -113,7 +113,7 @@ export async function launchLocal(directoryInput, report, control = {}) {
             await response.body?.cancel();
         });
         await verifyRuntimeBinding(state, runtime);
-        await applyConnectionPolicy(directory, state, env, true);
+        await waitFor(() => applyNetworkPolicy(directory, state, env, true));
         if (state.input.browser) {
             report("Starting native browser node…");
             await startBrowserNode(directory, state, cancellation.signal);

package/scripts/deployment/network-policy.js

@@ -0,0 +1,120 @@
+import { isDeepStrictEqual } from "node:util";
+import { readFile, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { z } from "zod";
+import { run } from "./process.js";
+import { resourceNames, writePrivate } from "./state.js";
+import { runtimeManager } from "./runtime.js";
+const connectionRuleSchema = z.object({
+    name: z.string(),
+    endpoints: z.array(z.object({ host: z.string(), port: z.number(), tls: z.string() })),
+    binaries: z.array(z.object({ path: z.string() })),
+});
+const publicRuleSchema = z.object({
+    name: z.string(),
+    endpoints: z.array(z.object({
+        ports: z.array(z.number()),
+        allowed_ips: z.array(z.string()),
+        tls: z.string(),
+    })),
+    binaries: z.array(z.object({ path: z.string() })),
+});
+const changesSchema = z.strictObject({
+    connections_broker: connectionRuleSchema.nullable().optional(),
+    public_web: publicRuleSchema.nullable().optional(),
+});
+export async function stageNetworkPolicyChange(directory, state, rules) {
+    const file = join(directory, "private/network-policy-change.json");
+    let previous = {};
+    try {
+        previous = z
+            .strictObject({ ownerId: z.literal(state.ownerId), rules: changesSchema })
+            .parse(JSON.parse(await readFile(file, "utf8"))).rules;
+    }
+    catch (error) {
+        if (!(error instanceof Error && "code" in error && error.code === "ENOENT"))
+            throw error;
+    }
+    await writePrivate(file, JSON.stringify({
+        ownerId: state.ownerId,
+        rules: changesSchema.parse({ ...previous, ...rules }),
+    }));
+}
+const policySchema = z.looseObject({
+    network_policies: z.record(z.string(), z.unknown()),
+});
+/** Apply only explicitly selected managed rules; never regenerate an operator's other policies. */
+export async function applyNetworkPolicy(directory, state, env, verify = false, command = run) {
+    const pending = join(directory, "private/network-policy-change.json");
+    let text;
+    try {
+        text = await readFile(pending, "utf8");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    const change = z
+        .strictObject({
+        ownerId: z.literal(state.ownerId),
+        rules: changesSchema,
+    })
+        .parse(JSON.parse(text));
+    const base = join(directory, "private/runtime-policy.json");
+    const update = (policy) => {
+        return {
+            ...policy,
+            network_policies: Object.fromEntries([
+                ...Object.entries(policy.network_policies).filter(([key]) => !Object.hasOwn(change.rules, key)),
+                ...Object.entries(change.rules).filter(([, rule]) => rule !== null),
+            ]),
+        };
+    };
+    const matches = (policy) => Object.entries(change.rules).every(([key, rule]) => {
+        const observed = policy.network_policies[key];
+        if (rule === null)
+            return observed === undefined;
+        const parsed = (key === "public_web" ? publicRuleSchema : connectionRuleSchema).safeParse(observed);
+        return parsed.success && isDeepStrictEqual(parsed.data, rule);
+    });
+    const name = resourceNames(state).sandbox;
+    if (!(await runtimeManager(directory, state, env, command).recorded()).receipt) {
+        if (verify)
+            throw Error("The configured runtime has not been recorded.");
+        await writePrivate(base, JSON.stringify(update(policySchema.parse(JSON.parse(await readFile(base, "utf8"))))));
+        return;
+    }
+    const observed = z
+        .object({
+        sandbox: z.literal(name),
+        policy_source: z.literal("sandbox"),
+        version: z.number().int(),
+        active_version: z.number().int(),
+        status: z.string(),
+        policy: policySchema,
+    })
+        .parse(JSON.parse(await command(state.input.openshellCli, [
+        "policy",
+        "get",
+        name,
+        "--gateway",
+        name,
+        "--base",
+        "--output",
+        "json",
+    ], { env })));
+    if (matches(observed.policy)) {
+        if (verify) {
+            if (observed.active_version !== observed.version ||
+                observed.status !== "effective")
+                throw Error("The selected network policy has not become effective in the runtime.");
+            await rm(pending);
+        }
+        return;
+    }
+    if (verify)
+        throw Error("The selected network policy was not confirmed. The installation remains unavailable.");
+    await writePrivate(base, JSON.stringify(update(observed.policy)));
+    await command(state.input.openshellCli, ["policy", "set", name, "--gateway", name, "--policy", base], { env });
+}

package/scripts/deployment/policy.js

@@ -4,7 +4,8 @@ import { parseDocument } from "yaml";
 import { z } from "zod";
 import { LocalSetupError } from "./process.js";
 import { ensurePrivateFile } from "./state.js";
-export function initialRuntimePolicy(source, models, connections) {
+import { publicWebPolicy } from "./public-web.js";
+export function initialRuntimePolicy(source, models, connections, publicWeb = false) {
     const document = parseDocument(source);
     if (document.errors.length || document.warnings.length)
         throw new LocalSetupError("invalid_runtime_policy", "The shipped runtime policy is invalid.");
@@ -17,6 +18,7 @@ export function initialRuntimePolicy(source, models, connections) {
     return {
         ...parsed.data,
         network_policies: {
+            ...(publicWeb ? { public_web: publicWebPolicy(true) } : {}),
             ...(connections
                 ? {
                     connections_broker: {
@@ -50,7 +52,7 @@ export function initialRuntimePolicy(source, models, connections) {
         },
     };
 }
-export async function prepareRuntimePolicy(directory, models, connections) {
-    const policy = initialRuntimePolicy(await readFile(new URL("../../deploy/openshell/policy.yaml", import.meta.url), "utf8"), models, connections);
+export async function prepareRuntimePolicy(directory, models, connections, publicWeb = false) {
+    const policy = initialRuntimePolicy(await readFile(new URL("../../deploy/openshell/policy.yaml", import.meta.url), "utf8"), models, connections, publicWeb);
     await ensurePrivateFile(join(directory, "private/runtime-policy.json"), JSON.stringify(policy));
 }

package/scripts/deployment/prepare.js

@@ -93,7 +93,7 @@ export async function prepareLocal(directoryInput, inputValue, capabilities) {
         : 0), null, 2));
     await prepareModelCredential(directory, state);
     const models = await prepareInitialModels(directory, input.models);
-    await prepareRuntimePolicy(directory, models, connectionsEndpoint);
+    await prepareRuntimePolicy(directory, models, connectionsEndpoint, state.input.publicWeb);
     await withPreparedDatabase(directory, state, async (pool, runtimeUrl) => {
         const store = new PostgresAccessStore(pool, await readFile(join(privateDirectory, "encryption.key")), {
             issuer: input.team.issuer,

package/scripts/deployment/public-web.js

@@ -0,0 +1,176 @@
+// Public unicast ranges, excluding private and special-use destinations.
+// Keep aligned with the browser egress boundary in deploy/execution/network/squid.conf.
+export const publicWebAddresses = [
+    "1.0.0.0/8",
+    "2.0.0.0/7",
+    "4.0.0.0/6",
+    "8.0.0.0/7",
+    "11.0.0.0/8",
+    "12.0.0.0/6",
+    "16.0.0.0/4",
+    "32.0.0.0/3",
+    "64.0.0.0/3",
+    "96.0.0.0/6",
+    "100.0.0.0/10",
+    "100.128.0.0/9",
+    "101.0.0.0/8",
+    "102.0.0.0/7",
+    "104.0.0.0/5",
+    "112.0.0.0/5",
+    "120.0.0.0/6",
+    "124.0.0.0/7",
+    "126.0.0.0/8",
+    "128.0.0.0/3",
+    "160.0.0.0/5",
+    "168.0.0.0/8",
+    "169.0.0.0/9",
+    "169.128.0.0/10",
+    "169.192.0.0/11",
+    "169.224.0.0/12",
+    "169.240.0.0/13",
+    "169.248.0.0/14",
+    "169.252.0.0/15",
+    "169.255.0.0/16",
+    "170.0.0.0/7",
+    "172.0.0.0/12",
+    "172.32.0.0/11",
+    "172.64.0.0/10",
+    "172.128.0.0/9",
+    "173.0.0.0/8",
+    "174.0.0.0/7",
+    "176.0.0.0/4",
+    "192.0.1.0/24",
+    "192.0.3.0/24",
+    "192.0.4.0/22",
+    "192.0.8.0/21",
+    "192.0.16.0/20",
+    "192.0.32.0/19",
+    "192.0.64.0/18",
+    "192.0.128.0/17",
+    "192.1.0.0/16",
+    "192.2.0.0/15",
+    "192.4.0.0/14",
+    "192.8.0.0/13",
+    "192.16.0.0/12",
+    "192.32.0.0/11",
+    "192.64.0.0/12",
+    "192.80.0.0/13",
+    "192.88.0.0/18",
+    "192.88.64.0/19",
+    "192.88.96.0/23",
+    "192.88.98.0/24",
+    "192.88.100.0/22",
+    "192.88.104.0/21",
+    "192.88.112.0/20",
+    "192.88.128.0/17",
+    "192.89.0.0/16",
+    "192.90.0.0/15",
+    "192.92.0.0/14",
+    "192.96.0.0/11",
+    "192.128.0.0/11",
+    "192.160.0.0/13",
+    "192.169.0.0/16",
+    "192.170.0.0/15",
+    "192.172.0.0/14",
+    "192.176.0.0/12",
+    "192.192.0.0/10",
+    "193.0.0.0/8",
+    "194.0.0.0/7",
+    "196.0.0.0/7",
+    "198.0.0.0/12",
+    "198.16.0.0/15",
+    "198.20.0.0/14",
+    "198.24.0.0/13",
+    "198.32.0.0/12",
+    "198.48.0.0/15",
+    "198.50.0.0/16",
+    "198.51.0.0/18",
+    "198.51.64.0/19",
+    "198.51.96.0/22",
+    "198.51.101.0/24",
+    "198.51.102.0/23",
+    "198.51.104.0/21",
+    "198.51.112.0/20",
+    "198.51.128.0/17",
+    "198.52.0.0/14",
+    "198.56.0.0/13",
+    "198.64.0.0/10",
+    "198.128.0.0/9",
+    "199.0.0.0/8",
+    "200.0.0.0/7",
+    "202.0.0.0/8",
+    "203.0.0.0/18",
+    "203.0.64.0/19",
+    "203.0.96.0/20",
+    "203.0.112.0/24",
+    "203.0.114.0/23",
+    "203.0.116.0/22",
+    "203.0.120.0/21",
+    "203.0.128.0/17",
+    "203.1.0.0/16",
+    "203.2.0.0/15",
+    "203.4.0.0/14",
+    "203.8.0.0/13",
+    "203.16.0.0/12",
+    "203.32.0.0/11",
+    "203.64.0.0/10",
+    "203.128.0.0/9",
+    "204.0.0.0/6",
+    "208.0.0.0/4",
+    "2000::/16",
+    "2001:200::/23",
+    "2001:400::/22",
+    "2001:800::/22",
+    "2001:c00::/24",
+    "2001:d00::/25",
+    "2001:d80::/27",
+    "2001:da0::/28",
+    "2001:db0::/29",
+    "2001:db9::/32",
+    "2001:dba::/31",
+    "2001:dbc::/30",
+    "2001:dc0::/26",
+    "2001:e00::/23",
+    "2001:1000::/20",
+    "2001:2000::/19",
+    "2001:4000::/18",
+    "2001:8000::/17",
+    "2003::/16",
+    "2004::/14",
+    "2008::/13",
+    "2010::/12",
+    "2020::/11",
+    "2040::/10",
+    "2080::/9",
+    "2100::/8",
+    "2200::/7",
+    "2400::/6",
+    "2800::/5",
+    "3000::/5",
+    "3800::/6",
+    "3c00::/7",
+    "3e00::/8",
+    "3f00::/9",
+    "3f80::/10",
+    "3fc0::/11",
+    "3fe0::/12",
+    "3ff0::/13",
+    "3ff8::/14",
+    "3ffc::/15",
+    "3ffe::/16",
+    "3fff:1000::/20",
+    "3fff:2000::/19",
+    "3fff:4000::/18",
+    "3fff:8000::/17",
+];
+export function publicWebPolicy(enabled) {
+    return enabled
+        ? {
+            name: "Public web",
+            endpoints: [
+                { ports: [80, 443], allowed_ips: publicWebAddresses, tls: "skip" },
+            ],
+            binaries: [{ path: "/**" }],
+        }
+        : null;
+}

package/scripts/installation/command.js

@@ -94,7 +94,7 @@ export function installationCommand(observation) {
                 });
                 const directory = await resolveLocation(options);
                 const result = await progress("Deleting installation", (signal) => deleteInstallation(directory, signal), program.opts());
-                output(result, "Installation deleted from Docker. You can now remove its installation folder.");
+                output(result, "Installation deleted from Docker. The local folder still contains configuration and credentials. To install again, move or remove that folder, or configure a new --directory.");
                 return;
             }
             if (options.confirmDelete !== undefined || options.acceptDataLoss)

package/scripts/installation/configuration.js

@@ -65,6 +65,7 @@ export const installationSchema = z
         }),
     ]),
     resources: z.strictObject({ runtime: resources }),
+    publicWeb: z.boolean().default(false),
     browser: z.strictObject({ enabled: z.boolean() }),
     models: z.discriminatedUnion("mode", [
         externalLiteLlmSchema,

package/scripts/installation/configure.js

@@ -117,6 +117,7 @@ export async function configurationChanges(before, after) {
     return {
         models: !isDeepStrictEqual(await models(before), await models(after)),
         connections: !isDeepStrictEqual(before.connections, after.connections),
+        publicWeb: before.publicWeb !== after.publicWeb,
         packs: !isDeepStrictEqual(await packs(before), await packs(after)),
     };
 }

package/scripts/installation/installer/collect.js

@@ -175,6 +175,21 @@ export async function collectInstallation(ui, options, retained) {
                     case "resources":
                         config.resources = await collectResources(ui, config.resources);
                         break;
+                    case "public-web":
+                        config.publicWeb =
+                            (await ui.select("Public web access", [
+                                {
+                                    value: "on",
+                                    label: "On",
+                                    hint: "Public HTTP(S); agents can send team data to public services",
+                                },
+                                {
+                                    value: "off",
+                                    label: "Off",
+                                    hint: "Only configured services and explicit policies",
+                                },
+                            ], config.publicWeb ? "on" : "off")) === "on";
+                        break;
                     case "browser":
                         ui.note("Explicit browser node use works. Ordinary model-selected browsing is not qualified because of an upstream routing issue.", "Experimental browser");
                         config.browser.enabled =

package/scripts/installation/installer/menu.js

@@ -25,6 +25,7 @@ export function installationMenu(config, directory, browserAvailable, packIssues
         row("exposure", "Network", config.exposure.mode === "local"
             ? "This computer"
             : config.exposure.applicationOrigin),
+        row("public-web", "Public web", config.publicWeb ? "On" : "Off", "HTTP(S) for agents and tools; private destinations blocked"),
         row("models", "Models", modelSummary ?? "Choose a model"),
         row("connections", "Connections", config.connections.mode === "disabled" ? "Off" : "On"),
         row("packs", "Packs", packIssues.length
@@ -42,7 +43,7 @@ export function installationMenu(config, directory, browserAvailable, packIssues
     ];
     return existing
         ? [
-            ...choices.filter(({ value }) => ["review", "models", "connections", "packs"].includes(value)),
+            ...choices.filter(({ value }) => ["review", "models", "connections", "packs", "public-web"].includes(value)),
             { value: "model-credentials", label: "Change LLM API keys" },
         ]
         : choices;

package/scripts/installation/installer/run.js

@@ -193,6 +193,18 @@ export async function runConfiguration(options, observeMode) {
                     throw error;
             }
         }
+        if (existing && state) {
+            try {
+                await access(join(state, "prepared.json"));
+            }
+            catch (error) {
+                if (!(error instanceof Error &&
+                    "code" in error &&
+                    error.code === "ENOENT"))
+                    throw error;
+                throw new InstallationError("invalid_configuration", `This folder retains settings but the installation is no longer prepared. If deletion failed, finish it with clawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)} --delete. After successful deletion, move or remove the installation folder before configuring it again, or choose a new --directory.`);
+            }
+        }
         observeMode?.(existing ? "edit" : "new");
         let result = existing && state
             ? await editInstallationSettings(state, ui, options)
@@ -219,14 +231,17 @@ export async function runConfiguration(options, observeMode) {
                     : undefined;
             if (result.state === "cancelled")
                 clack.cancel("Cancelled.");
-            else
+            else {
+                if ("ready" in result && result.ready)
+                    ui.note(`clawscarf status --directory ${quote(options.directory ?? defaultInstallationDirectory)}\nclawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)}`, "Manage this installation");
                 clack.outro("ready" in result
                     ? result.ready
-                        ? `ClawScarf is ready.${applicationUrl ? ` Visit ${terminalLink(applicationUrl)}` : ""}\n\nManage this installation:\n  clawscarf status --directory ${quote(options.directory ?? defaultInstallationDirectory)}\n  clawscarf stop --directory ${quote(options.directory ?? defaultInstallationDirectory)}`
+                        ? `ClawScarf is ready.${applicationUrl ? ` Visit ${terminalLink(applicationUrl)}` : ""}`
                         : "ClawScarf needs attention. Check status for details."
                     : result.state === "unchanged"
                         ? "No changes. Server left as it was."
                         : "Configuration saved. Server stopped.");
+            }
             if ("ready" in result && result.ready && applicationUrl)
                 await ui.openBrowser(applicationUrl);
         }

package/scripts/installation/installer/settings.js

@@ -21,7 +21,7 @@ import { withInstallationLock, writePrivate } from "../../deployment/state.js";
 export async function editInstallationSettings(directory, ui, options = {}, prerequisites = { host: checkHost, check: checkInstallationPrerequisites }) {
     directory = resolve(directory);
     if (options.recipe || options.cloudUrl)
-        throw new InstallationError("change_unsupported", "Existing installations keep their recipe, software release and login service. Change models, keys, Connections or packs instead.");
+        throw new InstallationError("change_unsupported", "Existing installations keep their recipe, software release and login service. Change models, keys, Connections, public web or packs instead.");
     if (options.nonInteractive && !options.yes)
         throw new InstallationError("invalid_configuration", "Changing an existing installation noninteractively requires --yes. The server may restart and deselected packs may be removed.");
     const task = (message, work) => progress(message, work, options);
@@ -114,6 +114,9 @@ export async function editInstallationSettings(directory, ui, options = {}, prer
                     `Connections: ${plan.changes.connections.to === "disabled" ? "Off" : "On"}`,
                 ]
                 : []),
+            ...(plan.scopes.publicWeb
+                ? [`Public web: ${plan.changes.publicWeb.to ? "On" : "Off"}`]
+                : []),
             ...(plan.scopes.packs
                 ? [`Packs: ${plan.changes.packs.selected.join(", ") || "None"}`]
                 : []),

package/scripts/installation/installer/summary.js

@@ -39,6 +39,7 @@ export async function installationSummary(config, inputs) {
         `Administrator: ${config.access.administratorName} · ${config.access.mode === "hosted" ? "ClawScarf login" : "Custom OIDC"}`,
         `Models: ${model}`,
         `Connections: ${config.connections.mode === "disabled" ? "Off" : "On"}`,
+        `Public web: ${config.publicWeb ? "On" : "Off"} (private destinations blocked)`,
         `Browser: ${config.browser.enabled ? "Experimental" : "Off"} · Packs: ${config.packs.flatMap((pack) => pack.members).join(", ") || "None"}`,
     ].join("\n");
 }

package/scripts/installation/options.js

@@ -36,6 +36,7 @@ export const selectionSchema = z.object({
     connections: z.boolean().optional(),
     connectionsCloudUrl: cloudUrlSchema.optional(),
     browser: z.boolean().optional(),
+    publicWeb: z.boolean().optional(),
     model: text.optional(),
     provider: text.optional(),
     reasoning: z.enum(["low", "medium", "high"]).optional(),
@@ -79,6 +80,8 @@ export function installationOptions(command) {
         .option("--connections-cloud-url <url>", "Use a separate Connections service")
         .option("--browser", "Enable experimental browser capability")
         .option("--no-browser", "Disable browser capability")
+        .option("--public-web", "Allow public HTTP(S) from agents and tools")
+        .option("--no-public-web", "Restrict runtime egress to configured services")
         .option("--model <id>", "Default model from the model catalog")
         .option("--provider <id>", "Model provider, for example openai or openrouter")
         .addOption(new Option("--reasoning <level>", "Model reasoning level").choices([
@@ -116,6 +119,7 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
             "modelGatewayKeyFile",
             "modelGatewayCaFile",
             "connections",
+            "publicWeb",
             "connectionsCloudUrl",
             "pack",
             "packs",
@@ -123,7 +127,7 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
             "packPython",
         ]);
         if (Object.entries(o).some(([key, value]) => value !== undefined && !mutable.has(key)))
-            invalid("Existing installations support changes to models, keys, Connections and packs only.");
+            invalid("Existing installations support changes to models, keys, Connections, public web and packs only.");
     }
     const config = structuredClone(retained ?? recipeConfiguration(context, recipe));
     if (o.name !== undefined)
@@ -136,6 +140,8 @@ export async function selectedDraft(context, recipe, selections, inputs, retaine
         config.resources.runtime.memory = o.memory;
     if (o.browser !== undefined)
         config.browser.enabled = o.browser;
+    if (o.publicWeb !== undefined)
+        config.publicWeb = o.publicWeb;
     if (o.connections !== undefined)
         config.connections.mode = o.connections ? "hosted" : "disabled";
     if (o.connectionsCloudUrl)

package/scripts/installation/recipes/definition.js

@@ -11,6 +11,7 @@ export const recipeSchema = z.strictObject({
     defaults: z.strictObject({
         resources: installationSchema.shape.resources,
         browser: installationSchema.shape.browser,
+        publicWeb: z.boolean().default(false),
         connections: z.strictObject({ enabled: z.boolean() }).optional(),
     }),
     models: z.strictObject({

package/scripts/installation/reconfigure.js

@@ -1,3 +1,5 @@
+import { publicWebPolicy } from "../deployment/public-web.js";
+import { stageNetworkPolicyChange } from "../deployment/network-policy.js";
 import { applyConnectionSettings } from "../deployment/connection-settings.js";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
@@ -41,8 +43,8 @@ export async function planSettingsChange(configFile, reapply) {
     const previousPacks = selectionSchema.parse(await readJson(join(directory, "packs.json")));
     if (!desired.packSelection.python && previousPacks.python)
         desired.packSelection.python = previousPacks.python;
-    const { models: _oldModels, modelGateway: oldGateway, connections: oldConnections, ...oldFixed } = old;
-    const { models: _nextModels, modelGateway: nextGateway, connections: nextConnections, ...nextFixed } = next;
+    const { models: _oldModels, modelGateway: oldGateway, connections: oldConnections, publicWeb: oldPublicWeb, ...oldFixed } = old;
+    const { models: _nextModels, modelGateway: nextGateway, connections: nextConnections, publicWeb: nextPublicWeb, ...nextFixed } = next;
     if (!isDeepStrictEqual(oldFixed, nextFixed) ||
         !isDeepStrictEqual(await readJson(join(directory, "release.json")), desired.release))
         unsupported("Settings changes cannot replace the release, identity, addresses, access, resources or execution protection.");
@@ -92,6 +94,7 @@ export async function planSettingsChange(configFile, reapply) {
         scopes,
         reapply,
         changes: {
+            publicWeb: { from: oldPublicWeb, to: nextPublicWeb },
             models: modelConfiguration
                 ? {
                     enabled: modelConfiguration.models
@@ -235,6 +238,11 @@ export async function reconfigureInstallation(configFile, expectedFingerprint, r
             if (scopes.connections &&
                 (state.input.connections || desired.input.connections))
                 await applyConnectionSettings(directory, { ...state, input: desired.input }, checked.previousEndpoint, desired.connectorCredentialFile);
+            stage = "public web policy";
+            if (scopes.publicWeb)
+                await stageNetworkPolicyChange(directory, state, {
+                    public_web: publicWebPolicy(desired.input.publicWeb),
+                });
             stage = "accepted settings";
             if (scopes.models)
                 await writePrivate(join(directory, "private/model-bootstrap.json"), JSON.stringify(models));

package/scripts/installation/resolve.js

@@ -73,6 +73,7 @@ export async function resolveInstallation(configFile, internalPorts) {
         name: config.name,
         administratorName: access.administratorName,
         runtimeImage: release.images.gateway,
+        publicWeb: config.publicWeb,
         companionImage: release.images.companion,
         ...(config.browser.enabled ? { relayImage: release.images.relay } : {}),
         openshellCli: cli,

package/scripts/installation/setup.js

@@ -57,6 +57,7 @@ export function recipeConfiguration(context, recipeId) {
         },
         resources: structuredClone(recipe.defaults.resources),
         browser: structuredClone(recipe.defaults.browser),
+        publicWeb: recipe.defaults.publicWeb,
         connections: {
             mode: recipe.defaults.connections?.enabled ? "hosted" : "disabled",
             cloudUrl: context.cloudUrl,

package/scripts/deployment/connection-policy.js

@@ -1,80 +0,0 @@
-import { isDeepStrictEqual } from "node:util";
-import { readFile, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { z } from "zod";
-import { run } from "./process.js";
-import { resourceNames, writePrivate } from "./state.js";
-import { runtimeManager } from "./runtime.js";
-const ruleSchema = z.object({
-    name: z.string(),
-    endpoints: z.array(z.object({ host: z.string(), port: z.number(), tls: z.string() })),
-    binaries: z.array(z.object({ path: z.string() })),
-});
-const policySchema = z.looseObject({
-    network_policies: z.record(z.string(), z.unknown()),
-});
-/** Apply only the explicitly selected broker rule; never regenerate an operator's other policies. */
-export async function applyConnectionPolicy(directory, state, env, verify = false) {
-    const pending = join(directory, "private/connection-policy-change.json");
-    let text;
-    try {
-        text = await readFile(pending, "utf8");
-    }
-    catch (error) {
-        if (error instanceof Error && "code" in error && error.code === "ENOENT")
-            return;
-        throw error;
-    }
-    const change = z
-        .strictObject({
-        ownerId: z.literal(state.ownerId),
-        rule: ruleSchema.nullable(),
-    })
-        .parse(JSON.parse(text));
-    const base = join(directory, "private/runtime-policy.json");
-    const update = (policy) => {
-        if (change.rule)
-            policy.network_policies.connections_broker = change.rule;
-        else
-            delete policy.network_policies.connections_broker;
-        return policy;
-    };
-    const matches = (rule) => {
-        if (change.rule === null)
-            return rule === undefined;
-        const parsed = ruleSchema.safeParse(rule);
-        return parsed.success && isDeepStrictEqual(parsed.data, change.rule);
-    };
-    const name = resourceNames(state).sandbox;
-    if (!(await runtimeManager(directory, state, env, run).recorded()).receipt) {
-        if (verify)
-            throw Error("The configured runtime has not been recorded.");
-        await writePrivate(base, JSON.stringify(update(policySchema.parse(JSON.parse(await readFile(base, "utf8"))))));
-        return;
-    }
-    const observed = z
-        .object({
-        sandbox: z.literal(name),
-        policy_source: z.literal("sandbox"),
-        policy: policySchema,
-    })
-        .parse(JSON.parse(await run(state.input.openshellCli, [
-        "policy",
-        "get",
-        name,
-        "--gateway",
-        name,
-        "--base",
-        "--output",
-        "json",
-    ], { env })));
-    if (matches(observed.policy.network_policies.connections_broker)) {
-        if (verify)
-            await rm(pending);
-        return;
-    }
-    if (verify)
-        throw Error("The Connections network permission was not confirmed. The installation remains unavailable.");
-    await writePrivate(base, JSON.stringify(update(observed.policy)));
-    await run(state.input.openshellCli, ["policy", "set", name, "--gateway", name, "--policy", base], { env });
-}