@flame0510/project-aether 1.3.0 → 1.4.0

package/README.md

@@ -81,6 +81,7 @@ already filled in — you normally never set these by hand. See
 | `REV4A_DATA_DIR` | `~/.config/rev4a` | No | Root of all persistent data |
 | `REV4A_DB` | `<data dir>/data/events.db` | No | SQLite database path |
 | `REV4A_WORKSPACE_ROOT` | — | No | Root exposed by the local file explorer |
+| `REV4A_AGENT_IMAGE_REGISTRY` | `ghcr.io/flame0510/rev4a/openclaw-agent-base` | No | Registry repository agent images are pulled from, as `<repository>:<OpenClaw version>`. A `localhost` registry is reached over plain HTTP |
 | `REV4A_DOCKER_WAIT_SECONDS` | `90` | No | How long `rev4a serve` waits for the Docker daemon at start-up before starting without it. Capped at 600; `0` checks once; a negative or non-numeric value means 90. Read from the process environment, not from the `.env` file |
 
 ---

package/agent-templates/README.md

@@ -1,37 +1,57 @@
 # Agent Templates
 
-## Base Image: `openclaw-agent-base`
+## Base image: `openclaw-agent-base`
 
-The base image for all agent containers in the Rev4a ecosystem.
+The image every agent container runs, built from
+[`base-image/Dockerfile`](base-image/Dockerfile).
 
-### Traefik Integration
+It contains Node 24, OpenClaw, `gh`, `vercel`, `trello`, `supabase`, the plugins
+shipped with the image under `/opt/openclaw-plugins` (DuckDuckGo web search), and
+the entrypoint. The OpenClaw release is the `OPENCLAW_VERSION` build argument, also
+recorded as the `org.opencontainers.image.version` label:
 
-The image includes the minimum static labels required by Traefik:
-- `traefik.enable=true`
+```bash
+docker image inspect openclaw-agent-base:<tag> \
+  --format '{{index .Config.Labels "org.opencontainers.image.version"}}'
+```
+
+The agent's persistent volume is mounted at `/root`. Anything the image puts under
+`/root` reaches only agents created on an empty volume. That is why plugins live
+under `/opt`, why the entrypoint applies the image defaults on every boot, and why
+Rev4a re-applies its own settings at create and recreate. Entrypoint behaviour:
+[docs/REV4A.md](../docs/REV4A.md#agent-templates).
 
-Dynamic labels (router rule, hostname, certresolver) must be passed at
-`docker run` time. The Rev4a agent creation wizard (`/agents/create`)
-generates them automatically.
+### Access
 
-### Required Traefik Labels
+An agent's Control UI is reached on its published host port,
+`http://<host>:<port>`, with the gateway token. The Agents page opens it with a
+one-time link that also approves the browser; any other browser needs approval once
+in the agent's Browser access section.
 
-When creating an agent manually with `docker run`, add these labels:
+Rev4a sets no reverse-proxy labels. For HTTPS or a domain, put your own reverse
+proxy in front of the published port.
+
+### Creating an agent by hand
+
+Use the creation wizard (`/agents/create`): it copies the template files, mounts
+the shared volumes, writes the model and provider configuration and waits for the
+gateway. A bare container, for testing the image only:
 
 ```bash
 docker run -d \
-  --name agent-<id> \
-  --network openclaw-core_default \
+  --name <id> \
+  --network rev4a-network \
   --restart unless-stopped \
+  --add-host host.docker.internal:host-gateway \
+  -v agent-<id>-data:/root \
   -l "AGENT_ID=<id>" \
-  -l "traefik.enable=true" \
-  -l "traefik.http.routers.agent-<id>.entrypoints=websecure" \
-  -l "traefik.http.routers.agent-<id>.rule=Host(\`<id>.<your-domain>\`)" \
-  -l "traefik.http.routers.agent-<id>.tls.certresolver=letsencrypt" \
-  -l "traefik.http.services.agent-<id>.loadbalancer.server.port=3000" \
-  -e AGENT_ID=<id> \
-  openclaw-agent-base:latest
+  -e OPENCLAW_GATEWAY_TOKEN=<token> \
+  -p <port>:3000 \
+  openclaw-agent-base:<tag>
 ```
 
-After creation:
-- The agent is reachable at `https://<agent_id>.<your-domain>`
-- The Rev4a Agents page shows it with the Traefik link and a copyable token
+## Template directories
+
+Each subdirectory (`atlas/`, `argus/`, `prometheus/`, `custom/`) holds the files
+copied into a new agent's workspace. See
+[docs/REV4A.md](../docs/REV4A.md#template-directories).

package/agent-templates/base-image/Dockerfile

@@ -1,42 +1,30 @@
 # OpenClaw Agent Base Image
 #
 # Base image for agent containers in the Rev4a ecosystem.
-# Includes: Node, OpenClaw, gh CLI, Vercel CLI, Trello CLI, entrypoint.
+# Includes: Node, OpenClaw, gh CLI, Vercel CLI, Trello CLI, Supabase CLI, entrypoint.
 #
-# Traefik integration:
-#   - Static enablement is baked into the image.
-#   - Dynamic router/service labels are provided
-#     at container creation time via `docker run -l ...`.
-#   - See agent-templates/README.md for the full label set.
+# The agent's persistent volume is mounted at /root. Whatever this image writes
+# under /root (openclaw.json, installed plugins) reaches only agents created on an
+# empty volume. Settings every agent must have are re-applied by Rev4a at create
+# and recreate (lib/agent-setup.ts); the config patches below only seed new volumes.
 #
 # Build:
-#   docker build -t openclaw-agent-base:latest -f Dockerfile .
+#   docker build -t openclaw-agent-base:2026.9.3 -f Dockerfile .
+#   docker build --build-arg OPENCLAW_VERSION=<version> -t openclaw-agent-base:<version> .
 #
 # Test:
-#   docker run --rm openclaw-agent-base:latest openclaw --version
-#
-# Run with Traefik support:
-#   docker run -d \
-#     --name agent-<id> \
-#     --network openclaw-core_default \
-#     --restart unless-stopped \
-#     -l "AGENT_ID=<id>" \
-#     -l "traefik.enable=true" \
-#     -l "traefik.http.routers.agent-<id>.entrypoints=websecure" \
-#     -l "traefik.http.routers.agent-<id>.rule=Host(`<id>.<your-domain>`)" \
-#     -l "traefik.http.routers.agent-<id>.tls.certresolver=letsencrypt" \
-#     -l "traefik.http.services.agent-<id>.loadbalancer.server.port=3000" \
-#     -e AGENT_ID=<id> \
-#     openclaw-agent-base:latest
+#   docker run --rm openclaw-agent-base:2026.9.3 openclaw --version
 
 FROM node:24-bookworm-slim
 
+# The OpenClaw release this image runs, also recorded as a label so it can be read
+# with `docker image inspect` without starting a container.
+ARG OPENCLAW_VERSION=2026.9.3
+ARG SUPABASE_VERSION=2.109.1
+
 LABEL description="OpenClaw Agent Base — Rev4a multicontainer ecosystem"
 LABEL maintainer="Rev4a Agency"
-
-# Traefik static labels — enable proxy support by default.
-# Dynamic router/service labels must be provided at container creation.
-LABEL traefik.enable="true"
+LABEL org.opencontainers.image.version="${OPENCLAW_VERSION}"
 
 # Avoid interactive prompts
 ENV DEBIAN_FRONTEND=noninteractive
@@ -55,15 +43,24 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && apt-get update && apt-get install -y --no-install-recommends gh \
     && rm -rf /var/lib/apt/lists/*
 
-# Agent containers route model requests through Rev4a provider proxy
-RUN npm install -g openclaw@2026.7.1-2 vercel trello-cli \
-# Supabase CLI — installed via official GitHub release (npm global no longer supported on Linux)
-# Pinned to v2.109.1. Bump the version here to update.
-    && curl -fsSL https://github.com/supabase/cli/releases/download/v2.109.1/supabase_linux_amd64.tar.gz -o /tmp/supabase.tar.gz \
+# Agent containers route model requests through Rev4a provider proxy.
+#
+# --allow-scripts=openclaw: npm 11.16+ blocks install scripts unless allowed, and
+# without them the OpenClaw install is silently incomplete (native prebuilds and
+# bundled-plugin postinstall steps never run).
+#
+# Supabase CLI comes from its GitHub release (npm global is not supported on Linux),
+# for the architecture being built: amd64 in CI, arm64 on an Apple Silicon machine.
+#
+# gateway.controlUi.dangerouslyDisableDeviceAuth is not set: OpenClaw 9.x retired
+# it, ignores it and `doctor --fix` removes it. Browsers pair through device approval.
+RUN npm install -g "openclaw@${OPENCLAW_VERSION}" vercel trello-cli --allow-scripts=openclaw \
+    && ARCH="$(dpkg --print-architecture)" \
+    && curl -fsSL "https://github.com/supabase/cli/releases/download/v${SUPABASE_VERSION}/supabase_linux_${ARCH}.tar.gz" -o /tmp/supabase.tar.gz \
     && tar xzf /tmp/supabase.tar.gz -C /usr/local/bin supabase \
     && chmod +x /usr/local/bin/supabase \
     && rm /tmp/supabase.tar.gz \
-    && echo '{"gateway":{"mode":"local","controlUi":{"dangerouslyAllowHostHeaderOriginFallback":true,"dangerouslyDisableDeviceAuth":true}}}' \
+    && echo '{"gateway":{"mode":"local","controlUi":{"dangerouslyAllowHostHeaderOriginFallback":true}}}' \
        | openclaw config patch --stdin
 
 # Default config directory + shared-skills extraDirs pre-wired.
@@ -78,6 +75,19 @@ RUN mkdir -p /data/.openclaw \
     && echo '{"hooks":{"internal":{"entries":{"bootstrap-extra-files":{"enabled":true,"paths":[".rev4a/*.md"]}}}}}' \
        | openclaw config patch --stdin
 
+# Plugins shipped with the image live outside /root, where the agent volume cannot
+# hide them, so they reach existing agents too. Each is pinned to the OpenClaw
+# release: a newer plugin can require a newer plugin API, and OpenClaw then skips it
+# at load. Install scripts stay disabled, as `openclaw plugins install` does.
+# The entrypoint adds these directories to plugins.load.paths.
+#
+# duckduckgo: key-free web_search provider. OpenClaw never auto-selects it, so the
+# entrypoint sets it as the provider when none is configured.
+RUN mkdir -p /opt/openclaw-plugins \
+    && cd /opt/openclaw-plugins \
+    && npm install --no-save --ignore-scripts "@openclaw/duckduckgo-plugin@${OPENCLAW_VERSION}" \
+    && test -f node_modules/@openclaw/duckduckgo-plugin/openclaw.plugin.json
+
 # Standard entrypoint
 COPY entrypoint.sh /agent-entrypoint.sh
 RUN chmod +x /agent-entrypoint.sh
@@ -87,4 +97,3 @@ EXPOSE 3000
 
 ENTRYPOINT ["/agent-entrypoint.sh"]
 CMD ["openclaw", "gateway", "--bind", "lan", "--port", "3000"]
-

package/agent-templates/base-image/entrypoint.sh

@@ -1,9 +1,10 @@
 #!/bin/bash
 # Agent Container Entrypoint
 #
-# Resolves the gateway auth token and starts the OpenClaw gateway.
-# controlUi settings (dangerouslyUseHostHeaderOrigin, dangerouslyDisableDeviceAuth)
-# are baked into openclaw.json during the image build — this script does NOT touch it.
+# Resolves the gateway auth token, applies OpenClaw's migrations after a version
+# change, and starts the OpenClaw gateway. The gateway settings baked in at build
+# time (gateway.mode, controlUi Host-header origin fallback) live in openclaw.json;
+# this script does not edit that file.
 
 set -e
 
@@ -19,18 +20,72 @@ if [ -z "$AGENT_TOKEN" ]; then
   AGENT_TOKEN=$(openssl rand -hex 16 2>/dev/null || echo "agent-$(date +%s)-$$-${RANDOM}")
 fi
 
-# Run OpenClaw safe migrations only when the version changed since last boot
-# (i.e. after the image was rebuilt to a newer OpenClaw). This aligns the
-# persistent volume's state/config to the binary shipped in the image.
-# --non-interactive applies only safe migrations and SKIPS restart/service
-# actions, so it never restarts the gateway from under us. Runs BEFORE the
-# gateway starts, while state is at rest. Best-effort: never blocks boot.
+# Apply OpenClaw's migrations when the version changed since the last boot: after
+# the image moved to a newer OpenClaw, or on a new volume. Runs before the gateway
+# starts, while state is at rest.
+#
+# `--fix` is required. From 2026.9.x the agent database schema is migrated only by
+# `doctor --fix` with the gateway stopped; the gateway refuses the old schema rather
+# than migrating it. `--non-interactive` applies the supported migrations and skips
+# restart and service actions, so it never restarts the gateway from under us.
+#
+# The version is recorded only after a successful run, so a failed migration is
+# retried on the next boot instead of being skipped for good. A failure does not
+# block boot: the gateway starts and reports the problem itself.
 CUR_VER=$(openclaw --version 2>/dev/null || true)
 PREV_VER=$(cat /root/.openclaw/.last-version 2>/dev/null || true)
 if [ -n "$CUR_VER" ] && [ "$CUR_VER" != "$PREV_VER" ]; then
-  echo "[entrypoint] OpenClaw version changed ('${PREV_VER}' -> '${CUR_VER}') — running safe migrations"
-  openclaw doctor --non-interactive || echo "[entrypoint] doctor returned non-zero (ignored)"
-  mkdir -p /root/.openclaw && printf '%s' "$CUR_VER" > /root/.openclaw/.last-version
+  echo "[entrypoint] OpenClaw version changed ('${PREV_VER}' -> '${CUR_VER}') — running migrations"
+  if openclaw doctor --fix --non-interactive; then
+    mkdir -p /root/.openclaw && printf '%s' "$CUR_VER" > /root/.openclaw/.last-version
+  else
+    echo "[entrypoint] doctor --fix failed; migrations will be retried on the next boot"
+  fi
+fi
+
+# Image defaults, applied before the gateway starts so none of them needs a restart.
+# Each is written only when missing, so an explicit choice survives every boot and
+# recreate:
+#   - plugins.load.paths includes the plugins shipped under /opt/openclaw-plugins
+#   - tools.web.search.provider is "duckduckgo" when no provider is set
+#   - agents.defaults.heartbeat.every is "0m" when unset: every heartbeat tick is a
+#     model-calling turn, so the recurring cadence is opt-in
+#
+# The config is read with one node process and written only through
+# `openclaw config patch`, which validates. The plugin path goes in first: the
+# provider is refused at validation unless its plugin is already discoverable.
+# Nothing here blocks boot.
+DDG_PLUGIN_DIR=/opt/openclaw-plugins/node_modules/@openclaw/duckduckgo-plugin
+DEFAULTS=$(DDG_PLUGIN_DIR="$DDG_PLUGIN_DIR" node -e '
+  const fs = require("fs");
+  const dir = process.env.DDG_PLUGIN_DIR;
+  let cfg = {};
+  try {
+    const file = "/root/.openclaw/openclaw.json";
+    if (fs.existsSync(file)) cfg = JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    console.log("unreadable");
+    process.exit(0);
+  }
+  const hasPlugin = fs.existsSync(dir + "/openclaw.plugin.json");
+  const paths = Array.isArray(cfg.plugins?.load?.paths) ? cfg.plugins.load.paths : [];
+  const out = {};
+  if (hasPlugin && !paths.includes(dir)) out.paths = { plugins: { load: { paths: [...paths, dir] } } };
+  if (hasPlugin && !cfg.tools?.web?.search?.provider) out.provider = { tools: { web: { search: { provider: "duckduckgo" } } } };
+  if (cfg.agents?.defaults?.heartbeat?.every === undefined) out.heartbeat = { agents: { defaults: { heartbeat: { every: "0m" } } } };
+  for (const [name, patch] of Object.entries(out)) console.log(name + " " + JSON.stringify(patch));
+' 2>/dev/null || echo "unreadable")
+
+if [ "$DEFAULTS" = "unreadable" ]; then
+  echo "[entrypoint] openclaw.json could not be read as JSON; image defaults not applied"
+elif [ -n "$DEFAULTS" ]; then
+  while read -r name patch; do
+    if printf '%s' "$patch" | openclaw config patch --stdin >/dev/null 2>&1; then
+      echo "[entrypoint] image default applied: $name"
+    else
+      echo "[entrypoint] image default not applied: $name (config patch refused it)"
+    fi
+  done <<< "$DEFAULTS"
 fi
 
 echo "[entrypoint] Starting gateway with auth token"