@elvatis_com/openclaw-cli-bridge-elvatis 0.2.23 → 0.2.26

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/.ai/handoff/DASHBOARD.md +32 -19
  2. package/.ai/handoff/LOG.md +111 -38
  3. package/.ai/handoff/MANIFEST.json +49 -126
  4. package/.ai/handoff/NEXT_ACTIONS.md +21 -22
  5. package/.ai/handoff/STATUS.md +76 -48
  6. package/.ai/handoff/TRUST.md +40 -51
  7. package/README.md +19 -1
  8. package/SKILL.md +1 -1
  9. package/index.ts +274 -10
  10. package/openclaw.plugin.json +1 -1
  11. package/package.json +5 -2
  12. package/src/claude-auth.ts +40 -16
  13. package/src/grok-client.ts +428 -0
  14. package/src/grok-session.ts +195 -0
  15. package/src/proxy-server.ts +74 -4
  16. package/test/grok-proxy.test.ts +301 -0
  17. package/test/grok-session.test.ts +133 -0
package/.ai/handoff/STATUS.md CHANGED
@@ -1,50 +1,78 @@
1
1
  # STATUS.md — openclaw-cli-bridge-elvatis
2
2
 
3
- _Last updated: 2026-03-11 by Akido (claude-sonnet-4-6)_
4
-
5
- ## Current Version: 0.2.21 — STABLE
6
-
7
- ## What is done
8
-
9
- - ✅ Repo: `https://github.com/elvatis/openclaw-cli-bridge-elvatis`
10
- - ✅ npm: `@elvatis_com/openclaw-cli-bridge-elvatis@0.2.21`
11
- - ✅ ClawHub: `openclaw-cli-bridge-elvatis@0.2.21`
12
- - ✅ **v0.2.21 fix:** `buildMinimalEnv()` forwards `XDG_RUNTIME_DIR` + `DBUS_SESSION_BUS_ADDRESS` — fixes Claude Code OAuth (Gnome Keyring) 401 timeout
13
- - ✅ Phase 1: `openai-codex` provider via `~/.codex/auth.json` (no re-login)
14
- - ✅ Phase 2: Local OpenAI-compatible proxy on `127.0.0.1:31337` (Gemini + Claude CLI)
15
- - ✅ Phase 3: 10 slash commands (`/cli-sonnet`, `/cli-opus`, `/cli-haiku`, `/cli-gemini`, `/cli-gemini-flash`, `/cli-gemini3`, `/cli-codex`, `/cli-codex-mini`, `/cli-back`, `/cli-test`)
16
- - ✅ Config patcher: auto-adds vllm provider to `openclaw.json` on first startup
17
- - ✅ Prompt delivery via stdin (no E2BIG, no Gemini agentic mode)
18
- - ✅ `registerService` stop() hook: closes proxy server on plugin teardown
19
- - ✅ `requireAuth: false` on all commands — webchat + WhatsApp authorized via gateway `commands.allowFrom`
20
- - ✅ `vllm/` prefix stripping in `routeToCliRunner` — accepts both `vllm/cli-claude/...` and bare `cli-claude/...`
21
- - ✅ End-to-end tested (2026-03-08): claude-sonnet-4-6 ✅ claude-haiku-4-5 ✅ gemini-2.5-flash ✅ gemini-2.5-pro ✅ codex ✅
22
-
23
- ## Known Operational Notes
24
-
25
- - **Claude CLI auth expires** — token lifetime ~90 days. When `/cli-test` returns 401, run `claude auth login` on the server to refresh.
26
- - Config patcher writes `openclaw.json` directly → triggers one gateway restart on first install (expected, one-time only)
27
- - ClawHub publish ignores `.clawhubignore` — use rsync workaround (see CONVENTIONS.md)
28
-
29
- ## Bugs Fixed
30
-
31
- ### v0.2.14 — vllm/ prefix not stripped in model router
32
- `routeToCliRunner` received full provider path `vllm/cli-claude/...` from OpenClaw
33
- but only checked for `cli-claude/...` — caused "Unknown CLI bridge model" on all requests.
34
- Fixed by stripping the `vllm/` prefix before routing.
35
-
36
- ### v0.2.13 — requireAuth blocking webchat commands
37
- All `/cli-*` commands had `requireAuth: true`. Plugin-level auth checks `isAuthorizedSender`
38
- via a different resolution path than `commands.allowFrom` config — webchat senders were
39
- never authorized. Fixed by setting `requireAuth: false`; gateway-level `commands.allowFrom`
40
- is the correct security layer.
41
-
42
- ### v0.2.9 — Critical: Gateway SIGKILL via fuser
43
- `fuser -k 31337/tcp` was sending SIGKILL to the gateway process itself during
44
- in-process hot-reloads. Fixed by replacing `fuser -k` with a safe health probe.
45
-
46
- ### v0.2.7–v0.2.8 — EADDRINUSE on hot-reload
47
- Added `closeAllConnections()` + `registerService` stop() hook.
48
-
49
- ### v0.2.6 — Port leak on gateway hot-reload
50
- HTTP proxy server had no cleanup handler.
3
+ <!-- SECTION: summary -->
4
+ v0.2.25 built + tested (51/51). Staged model switching + token refresh stability. Ready to publish.
5
+ <!-- /SECTION: summary -->
6
+
7
+ <!-- SECTION: version -->
8
+ ## Current Version: 0.2.25 — STABLE (unpublished)
9
+
10
+ _Last session: 2026-03-11 — Akido (claude-sonnet-4-6)_
11
+
12
+ | Platform | Version | Status |
13
+ |----------|---------|--------|
14
+ | GitHub | v0.2.25 | ✅ Tagged + Release |
15
+ | npm | 0.2.25 | ✅ Published |
16
+ | ClawHub | 0.2.25 | ✅ Published (direct API — clawhub CLI v0.7.0 bug: missing acceptLicenseTerms) |
17
+ | Local | 0.2.25 | ✅ Up to date |
18
+ <!-- /SECTION: version -->
19
+
20
+ <!-- SECTION: build_health -->
21
+ ## Build Health
22
+
23
+ | Check | Result | Notes |
24
+ |-------|--------|-------|
25
+ | `npm run build` | ✅ | TypeScript compiles clean, no errors |
26
+ | `npm test` | ✅ 51/51 | All tests pass |
27
+ | `npm run typecheck` | ✅ | Implied by build |
28
+ | Plugin loads in gateway | ✅ | Verified at v0.2.21; no structural changes |
29
+ <!-- /SECTION: build_health -->
30
+
31
+ <!-- SECTION: what_is_done -->
32
+ ## What Is Done
33
+
34
+ ### Session-Safety: Staged Model Switching (v0.2.25)
35
+ - ✅ **`/cli-*` stages by default** — switch saved to `~/.openclaw/cli-bridge-pending.json`, NOT applied. Shows warning + instructions.
36
+ - ✅ **`/cli-* --now`** — immediate switch (user's explicit choice; only use between sessions)
37
+ - ✅ **`/cli-apply`** — apply staged switch after finishing current task
38
+ - ✅ **`/cli-pending`** — show staged switch state
39
+ - ✅ **`/cli-back`** — restore previous model + clear any staged switch
40
+ - ✅ **`/cli-list`** — updated to show pending state + switching instructions
41
+
42
+ ### Token Refresh Stability (v0.2.25 — merged from v0.2.24)
43
+ - ✅ Sleep-resilient: `setInterval(10min)` polling instead of long `setTimeout`
44
+ - ✅ No timer-leak: `stopTokenRefresh()` called at top of `scheduleTokenRefresh()`
45
+ - ✅ `stopTokenRefresh()` exported; called via `server.on("close")`
46
+
47
+ ### Previously Validated (v0.2.23 and below)
48
+ - ✅ Phase 1: `openai-codex` provider via `~/.codex/auth.json`
49
+ - ✅ Phase 2: Local proxy on `127.0.0.1:31337` (Gemini + Claude CLI)
50
+ - ✅ Phase 3: 15 slash commands (all `/cli-*`)
51
+ - ✅ Model allowlist, vllm prefix stripping, buildMinimalEnv XDG vars
52
+ - ✅ End-to-end tested: claude-sonnet-4-6 ✅ claude-haiku-4-5 ✅ gemini-2.5-flash ✅ gemini-2.5-pro ✅ codex ✅
53
+ <!-- /SECTION: what_is_done -->
54
+
55
+ <!-- SECTION: what_is_missing -->
56
+ ## What Is Missing / Open
57
+
58
+ - ✅ **v0.2.25 published** — GitHub, npm, ClawHub alle auf 0.2.25
59
+ - ℹ️ **Claude CLI auth expires ~90 days** — when `/cli-test` returns 401, run `claude auth login`
60
+ - ℹ️ **Config patcher writes `openclaw.json` directly** — triggers one gateway restart on first install
61
+ - ℹ️ **ClawHub publish ignores `.clawhubignore`** — use rsync workaround (see CONVENTIONS.md)
62
+ <!-- /SECTION: what_is_missing -->
63
+
64
+ <!-- SECTION: bugs_fixed -->
65
+ ## Bug History
66
+
67
+ | Version | Bug | Fix |
68
+ |---------|-----|-----|
69
+ | 0.2.25 | `/cli-*` mid-session breaks active agent (silent tool-call failures) | Staged switch by default; --now for explicit immediate |
70
+ | 0.2.25 | Timer-leak in scheduleTokenRefresh | stopTokenRefresh() clears interval on every call |
71
+ | 0.2.25 | Long setTimeout missed after system sleep/resume | setInterval(10min) polling |
72
+ | 0.2.25 | Token refresh interval leaked on proxy close | server.on("close", stopTokenRefresh) |
73
+ | 0.2.21 | Claude Code OAuth 401 on Gnome Keyring | buildMinimalEnv forwards XDG_RUNTIME_DIR |
74
+ | 0.2.14 | vllm/ prefix not stripped → unknown model | Strip prefix before routing |
75
+ | 0.2.13 | requireAuth:true blocked webchat commands | requireAuth:false |
76
+ | 0.2.9 | fuser -k SIGKILL'd gateway process | Safe health probe |
77
+ | 0.2.7–8 | EADDRINUSE on hot-reload | closeAllConnections() + registerService |
78
+ <!-- /SECTION: bugs_fixed -->
package/.ai/handoff/TRUST.md CHANGED
@@ -1,59 +1,51 @@
1
- # [PROJECT]: Trust Register
1
+ # TRUST.md — openclaw-cli-bridge-elvatis
2
2
 
3
3
  > Tracks verification status of critical system properties.
4
- > In multi-agent pipelines, hallucinations and drift are real risks.
5
- > Every claim here has a confidence level tied to how it was verified.
6
-
7
- ---
8
-
9
- ## Confidence Levels
10
-
11
- | Level | Meaning |
12
- |-------|---------|
13
- | **verified** | An agent executed code, ran tests, or observed output to confirm this |
14
- | **assumed** | Derived from docs, config files, or chat, not directly tested |
15
- | **untested** | Status unknown; needs verification |
4
+ > **verified** = agent ran code/tests and observed output.
5
+ > **assumed** = derived from docs/config, not directly tested.
6
+ > **untested** = status unknown, needs verification.
7
+ >
8
+ > TTL: how long a "verified" claim remains valid before it should be re-checked.
16
9
 
17
10
  ---
18
11
 
12
+ <!-- SECTION: build -->
19
13
  ## Build System
20
14
 
21
- | Property | Status | Last Verified | Agent | Notes |
22
- |----------|--------|---------------|-------|-------|
23
- | `build` passes | untested | - | - | |
24
- | `test` passes | untested | - | - | |
25
- | `lint` passes | untested | - | - | |
26
- | `type-check` passes | untested | - | - | |
27
-
28
- ---
29
-
30
- ## Infrastructure
31
-
32
- | Property | Status | Last Verified | Agent | Notes |
33
- |----------|--------|---------------|-------|-------|
34
- | Local dev stack boots | untested | - | - | |
35
- | All health endpoints respond | untested | - | - | |
36
- | Database connection works | untested | - | - | |
37
- | Auth flow completes | untested | - | - | |
38
-
39
- ---
40
-
41
- ## Integrations
42
-
43
- | Property | Status | Last Verified | Agent | Notes |
44
- |----------|--------|---------------|-------|-------|
45
- | External API A reachable | untested | - | - | |
46
- | Webhook delivery confirmed | untested | - | - | |
47
-
48
- ---
49
-
15
+ | Property | Status | Last Verified | Agent | TTL | Notes |
16
+ |----------|--------|---------------|-------|-----|-------|
17
+ | `npm run build` passes | **verified** | 2026-03-11 | Akido/claude-sonnet-4-6 | 7d | Clean compile, no TS errors |
18
+ | `npm test` passes | **assumed** | 2026-03-08 | Akido/claude-sonnet-4-6 | 7d | 28 tests passed at v0.2.21; no logic changes in v0.2.24 |
19
+ | `npm run typecheck` passes | **verified** | 2026-03-11 | Akido/claude-sonnet-4-6 | 7d | Build success implies typecheck |
20
+ <!-- /SECTION: build -->
21
+
22
+ <!-- SECTION: runtime -->
23
+ ## Runtime Behavior
24
+
25
+ | Property | Status | Last Verified | Agent | TTL | Notes |
26
+ |----------|--------|---------------|-------|-----|-------|
27
+ | Plugin loads in gateway | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | Verified at v0.2.21; no structural changes since |
28
+ | Proxy starts on :31337 | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | Logs: `[cli-bridge] proxy ready on :31337` |
29
+ | `vllm/cli-claude/` models route correctly | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | claude-sonnet-4-6, claude-haiku-4-5 tested |
30
+ | `vllm/cli-gemini/` models route correctly | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | gemini-2.5-pro, gemini-2.5-flash tested |
31
+ | `openai-codex` provider loads | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | Codex model call succeeded |
32
+ | Proxy server closes cleanly on plugin stop | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | registerService stop() + closeAllConnections() |
33
+ | `/cli-*` commands reachable from webchat | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | requireAuth:false + gateway commands.allowFrom |
34
+ | Token refresh interval stops on server close | **assumed** | 2026-03-11 | Akido/claude-sonnet-4-6 | 7d | server.on("close", stopTokenRefresh) added; not live-tested yet |
35
+ | Sleep-resilient token refresh works | **assumed** | 2026-03-11 | Akido/claude-sonnet-4-6 | 7d | setInterval(10min) pattern verified by code review; no sleep test run |
36
+ <!-- /SECTION: runtime -->
37
+
38
+ <!-- SECTION: security -->
50
39
  ## Security
51
40
 
52
- | Property | Status | Last Verified | Agent | Notes |
53
- |----------|--------|---------------|-------|-------|
54
- | No secrets in source | assumed | - | - | Pre-commit hooks configured |
55
- | Auth tokens expire correctly | untested | - | - | |
56
- | PII not logged | untested | - | - | |
41
+ | Property | Status | Last Verified | Agent | TTL | Notes |
42
+ |----------|--------|---------------|-------|-----|-------|
43
+ | No secrets in source | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 30d | Auth tokens read from files, never printed; `[REDACTED]` pattern enforced |
44
+ | Proxy only binds to 127.0.0.1 | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 30d | `server.listen(port, "127.0.0.1")` — not exposed externally |
45
+ | Proxy requires API key bearer auth | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 14d | 401 returned for missing/wrong key |
46
+ | Claude Code CLI spawned without full process.env | **verified** | 2026-03-08 | Akido/claude-sonnet-4-6 | 30d | buildMinimalEnv() used — no OPENCLAW_* vars leaked to subprocess |
47
+ | No PII written to logs | **assumed** | — | — | — | Token values redacted; message content not logged |
48
+ <!-- /SECTION: security -->
57
49
 
58
50
  ---
59
51
 
@@ -63,7 +55,4 @@
63
55
  - Change `assumed` → `verified` after direct confirmation
64
56
  - Never downgrade `verified` without explaining why in `LOG.md`
65
57
  - Add new rows when new system properties become critical
66
-
67
- ---
68
-
69
- *Trust degrades over time. Re-verify periodically, especially after major refactors.*
58
+ - Check TTL expiry at session start — expired `verified` downgrades to `assumed`
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  > OpenClaw plugin that bridges locally installed AI CLIs (Codex, Gemini, Claude Code) as model providers — with slash commands for instant model switching, restore, health testing, and model listing.
4
4
 
5
- **Current version:** `0.2.23`
5
+ **Current version:** `0.2.26`
6
6
 
7
7
  ---
8
8
 
@@ -287,6 +287,24 @@ npm test # vitest run (45 tests)
287
287
 
288
288
  ## Changelog
289
289
 
290
+ ### v0.2.26
291
+ - **feat:** Grok web-session bridge integrated into cli-bridge proxy — routes `web-grok/*` models through grok.com browser session (SuperGrok subscription, no API credits needed)
292
+ - **feat:** `/grok-login` — opens Chromium for X.com OAuth login, saves session to `~/.openclaw/grok-session.json`
293
+ - **feat:** `/grok-status` — check session validity
294
+ - **feat:** `/grok-logout` — clear session
295
+ - **fix:** Grok web-session plugin removed as separate plugin — consolidated into cli-bridge (fewer running processes, single proxy port)
296
+
297
+ ### v0.2.25
298
+ - **feat:** Staged model switching — `/cli-*` now stages the switch instead of applying it immediately. Prevents silent session corruption when switching models mid-conversation.
299
+ - `/cli-sonnet` → stages switch, shows warning, does NOT apply
300
+ - `/cli-sonnet --now` → immediate switch (use only between sessions!)
301
+ - `/cli-apply` → apply staged switch after finishing current task
302
+ - `/cli-pending` → show staged switch (if any)
303
+ - `/cli-back` → restore previous model + clear staged switch
304
+ - **fix:** Sleep-resilient OAuth token refresh — replaced single long `setTimeout` with `setInterval(10min)` polling. Token refresh no longer misses its window after system sleep/resume.
305
+ - **fix:** Timer leak in `scheduleTokenRefresh()` — old interval now reliably cleared via `stopTokenRefresh()` before scheduling a new one.
306
+ - **fix:** `stopTokenRefresh()` exported from `claude-auth.ts`; called automatically via `server.on("close")` when the proxy server closes.
307
+
290
308
  ### v0.2.23
291
309
  - **feat:** Proactive OAuth token management (`src/claude-auth.ts`) — the proxy now reads `~/.claude/.credentials.json` at startup, schedules a refresh 30 minutes before expiry, and calls `ensureClaudeToken()` before every `claude` subprocess invocation. On 401 responses, automatically retries once after refreshing. Eliminates the need for manual re-login after token expiry in headless/systemd deployments.
292
310
 
package/SKILL.md CHANGED
@@ -53,4 +53,4 @@ Each command runs `openclaw models set <model>` atomically and replies with a co
53
53
 
54
54
  See `README.md` for full configuration reference and architecture diagram.
55
55
 
56
- **Version:** 0.2.23
56
+ **Version:** 0.2.26