@formthefog/stratus 2026.2.20 → 2026.2.24
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/publish.yml +28 -0
- package/README.md +63 -0
- package/SECURITY.md +74 -0
- package/package.json +1 -1
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
name: Publish to npm
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
push:
|
|
5
|
+
tags:
|
|
6
|
+
- 'v*'
|
|
7
|
+
|
|
8
|
+
jobs:
|
|
9
|
+
publish:
|
|
10
|
+
runs-on: ubuntu-latest
|
|
11
|
+
environment: npm-publish
|
|
12
|
+
permissions:
|
|
13
|
+
contents: read
|
|
14
|
+
id-token: write
|
|
15
|
+
|
|
16
|
+
steps:
|
|
17
|
+
- uses: actions/checkout@v4
|
|
18
|
+
|
|
19
|
+
- uses: actions/setup-node@v4
|
|
20
|
+
with:
|
|
21
|
+
node-version: '20'
|
|
22
|
+
registry-url: 'https://registry.npmjs.org'
|
|
23
|
+
|
|
24
|
+
- run: npm install -g npm@latest
|
|
25
|
+
|
|
26
|
+
- run: npm ci
|
|
27
|
+
|
|
28
|
+
- run: npm publish --provenance --access public
|
package/README.md
CHANGED
|
@@ -16,6 +16,8 @@ Integrate Stratus V3 (X1-AC), a state-of-the-art action-conditioned JEPA (Joint-
|
|
|
16
16
|
- **Secure**: API key authentication with automatic validation
|
|
17
17
|
- **Opt-in Tools**: Tools are optional and require explicit allowlisting
|
|
18
18
|
|
|
19
|
+
> See [SECURITY.md](./SECURITY.md) for a full accounting of credentials accessed, network calls made, and files written.
|
|
20
|
+
|
|
19
21
|
## Support
|
|
20
22
|
|
|
21
23
|
- **Documentation**: [https://stratus.run/docs](https://stratus.run/docs)
|
|
@@ -28,6 +30,19 @@ Integrate Stratus V3 (X1-AC), a state-of-the-art action-conditioned JEPA (Joint-
|
|
|
28
30
|
|
|
29
31
|
> **Note:** This plugin does NOT have an automatic postinstall script. You must run setup manually.
|
|
30
32
|
|
|
33
|
+
**Before you begin**, export your Stratus API key. Get one at [stratus.run](https://stratus.run).
|
|
34
|
+
|
|
35
|
+
```bash
|
|
36
|
+
export STRATUS_API_KEY=stratus_sk_your_key_here
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
To persist it across sessions, add it to your shell config:
|
|
40
|
+
|
|
41
|
+
```bash
|
|
42
|
+
echo 'export STRATUS_API_KEY=stratus_sk_your_key_here' >> ~/.zshrc
|
|
43
|
+
source ~/.zshrc
|
|
44
|
+
```
|
|
45
|
+
|
|
31
46
|
```bash
|
|
32
47
|
# 1. Install the plugin
|
|
33
48
|
openclaw plugins install @formthefog/stratus
|
|
@@ -52,6 +67,54 @@ openclaw plugins install @formthefog/stratus
|
|
|
52
67
|
|
|
53
68
|
---
|
|
54
69
|
|
|
70
|
+
## Using the API directly
|
|
71
|
+
|
|
72
|
+
Stratus is drop-in compatible with OpenAI and Anthropic SDKs. Just change the `baseURL` and use your `STRATUS_API_KEY`.
|
|
73
|
+
|
|
74
|
+
**OpenAI SDK (TypeScript)**
|
|
75
|
+
```typescript
|
|
76
|
+
import OpenAI from 'openai';
|
|
77
|
+
|
|
78
|
+
const client = new OpenAI({
|
|
79
|
+
baseURL: 'https://api.stratus.run/v1',
|
|
80
|
+
apiKey: process.env.STRATUS_API_KEY
|
|
81
|
+
});
|
|
82
|
+
|
|
83
|
+
const response = await client.chat.completions.create({
|
|
84
|
+
model: 'stratus-x1ac-base-claude-sonnet-4-5',
|
|
85
|
+
messages: [{ role: 'user', content: 'Plan a route through 20 cities' }]
|
|
86
|
+
});
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
**Anthropic SDK (TypeScript)**
|
|
90
|
+
```typescript
|
|
91
|
+
import Anthropic from '@anthropic-ai/sdk';
|
|
92
|
+
|
|
93
|
+
const client = new Anthropic({
|
|
94
|
+
baseURL: 'https://api.stratus.run/v1',
|
|
95
|
+
apiKey: process.env.STRATUS_API_KEY
|
|
96
|
+
});
|
|
97
|
+
|
|
98
|
+
const response = await client.messages.create({
|
|
99
|
+
model: 'stratus-x1ac-base-claude-sonnet-4-5',
|
|
100
|
+
max_tokens: 1024,
|
|
101
|
+
messages: [{ role: 'user', content: 'Plan a route through 20 cities' }]
|
|
102
|
+
});
|
|
103
|
+
```
|
|
104
|
+
|
|
105
|
+
**cURL**
|
|
106
|
+
```bash
|
|
107
|
+
curl https://api.stratus.run/v1/chat/completions \
|
|
108
|
+
-H "Content-Type: application/json" \
|
|
109
|
+
-H "Authorization: Bearer $STRATUS_API_KEY" \
|
|
110
|
+
-d '{
|
|
111
|
+
"model": "stratus-x1ac-base-claude-sonnet-4-5",
|
|
112
|
+
"messages": [{ "role": "user", "content": "Plan a route through 20 cities" }]
|
|
113
|
+
}'
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
---
|
|
117
|
+
|
|
55
118
|
## Available Commands
|
|
56
119
|
|
|
57
120
|
Use these slash commands in any OpenClaw chat (TUI, Telegram, Discord, etc.):
|
package/SECURITY.md
ADDED
|
@@ -0,0 +1,74 @@
|
|
|
1
|
+
# Security Policy
|
|
2
|
+
|
|
3
|
+
## What This Plugin Does
|
|
4
|
+
|
|
5
|
+
`@formthefog/stratus` is an OpenClaw plugin that integrates the Stratus X1 world model API. This document provides a transparent accounting of all security-relevant behavior.
|
|
6
|
+
|
|
7
|
+
---
|
|
8
|
+
|
|
9
|
+
## Credentials
|
|
10
|
+
|
|
11
|
+
**What is accessed:**
|
|
12
|
+
- `STRATUS_API_KEY` — read from environment or OpenClaw config (`plugins.stratus.apiKey`)
|
|
13
|
+
|
|
14
|
+
**What is validated:**
|
|
15
|
+
- Key must be present before any network call is made
|
|
16
|
+
- Key must match the format `stratus_sk_*` — requests with malformed keys are rejected locally, no network call is made
|
|
17
|
+
|
|
18
|
+
**What is written to disk:**
|
|
19
|
+
- During setup, the API key is stored in `~/.openclaw/agents/main/agent/auth-profiles.json`
|
|
20
|
+
- This is the standard OpenClaw credential store, equivalent in scope to `~/.aws/credentials` or `~/.npmrc`
|
|
21
|
+
- A timestamped backup of any existing file is created before writing
|
|
22
|
+
- The key is never logged, printed, or written anywhere else by this plugin
|
|
23
|
+
|
|
24
|
+
**What is never accessed:**
|
|
25
|
+
- `~/.ssh` or any SSH keys or known_hosts — nothing in this plugin reads or touches SSH paths
|
|
26
|
+
- Other environment variables beyond `STRATUS_API_KEY`, `STRATUS_BASE_URL`, and `SHELL`
|
|
27
|
+
- Browser storage, keychains, or system credential managers
|
|
28
|
+
|
|
29
|
+
---
|
|
30
|
+
|
|
31
|
+
## Network
|
|
32
|
+
|
|
33
|
+
**Outbound endpoints:**
|
|
34
|
+
| Endpoint | When | What is sent |
|
|
35
|
+
|---|---|---|
|
|
36
|
+
| `https://api.stratus.run/v1/embeddings` | `stratus_embeddings` tool call | `Authorization: Bearer <key>`, text input |
|
|
37
|
+
| `https://api.stratus.run/v1/rollout` | `stratus_rollout` tool call | `Authorization: Bearer <key>`, goal + state |
|
|
38
|
+
|
|
39
|
+
**What is never done:**
|
|
40
|
+
- No calls to any endpoint other than `api.stratus.run`
|
|
41
|
+
- No telemetry, analytics, or usage reporting
|
|
42
|
+
- No data is sent to third parties
|
|
43
|
+
- All connections are HTTPS-only
|
|
44
|
+
|
|
45
|
+
Data handling is governed by the [Stratus privacy policy](https://stratus.run/privacy).
|
|
46
|
+
|
|
47
|
+
---
|
|
48
|
+
|
|
49
|
+
## File System
|
|
50
|
+
|
|
51
|
+
**Files read during setup/verify:**
|
|
52
|
+
- `~/.openclaw/openclaw.json` — OpenClaw's own config, to add the Stratus provider entry
|
|
53
|
+
- `~/.openclaw/agents/main/agent/auth-profiles.json` — OpenClaw's own auth store, to add Stratus credentials
|
|
54
|
+
- `~/Library/LaunchAgents/ai.openclaw.gateway.plist` — macOS only, if the user explicitly opts in during `install.sh`
|
|
55
|
+
|
|
56
|
+
**Files written during setup:**
|
|
57
|
+
- Same paths as above, plus timestamped `.backup-*` copies before any modification
|
|
58
|
+
- Optionally appends `export STRATUS_API_KEY=...` to `~/.zshrc` / `~/.bashrc` / `~/.bash_profile` — only when the user explicitly answers `y` at the prompt
|
|
59
|
+
|
|
60
|
+
**What is never touched:**
|
|
61
|
+
- No files outside `~/.openclaw/`, the shell config the user selects, or the LaunchAgent plist
|
|
62
|
+
- No `/etc/`, `/usr/`, `/Library/` (system paths)
|
|
63
|
+
- No other dotfiles or home directory contents
|
|
64
|
+
|
|
65
|
+
---
|
|
66
|
+
|
|
67
|
+
## Reporting a Vulnerability
|
|
68
|
+
|
|
69
|
+
If you discover a security issue, please report it privately:
|
|
70
|
+
|
|
71
|
+
- Email: security@stratus.run
|
|
72
|
+
- GitHub: [open a private security advisory](https://github.com/formthefog/openclaw-stratus-x1-plugin/security/advisories/new)
|
|
73
|
+
|
|
74
|
+
Please do not open a public issue for security vulnerabilities. We aim to respond within 72 hours.
|