@gguf/claw 2026.2.1 → 2026.2.3

package/docs/providers/anthropic.md

@@ -37,10 +37,17 @@ openclaw onboard --anthropic-api-key "$ANTHROPIC_API_KEY"
 
 ## Prompt caching (Anthropic API)
 
-OpenClaw does **not** override Anthropic’s default cache TTL unless you set it.
-This is **API-only**; subscription auth does not honor TTL settings.
+OpenClaw supports Anthropic's prompt caching feature. This is **API-only**; subscription auth does not honor cache settings.
 
-To set the TTL per model, use `cacheControlTtl` in the model `params`:
+### Configuration
+
+Use the `cacheRetention` parameter in your model config:
+
+| Value   | Cache Duration | Description                         |
+| ------- | -------------- | ----------------------------------- |
+| `none`  | No caching     | Disable prompt caching              |
+| `short` | 5 minutes      | Default for API Key auth            |
+| `long`  | 1 hour         | Extended cache (requires beta flag) |
 
 ```json5
 {
@@ -48,7 +55,7 @@ To set the TTL per model, use `cacheControlTtl` in the model `params`:
     defaults: {
       models: {
         "anthropic/claude-opus-4-5": {
-          params: { cacheControlTtl: "5m" }, // or "1h"
+          params: { cacheRetention: "long" },
         },
       },
     },
@@ -56,6 +63,19 @@ To set the TTL per model, use `cacheControlTtl` in the model `params`:
 }
 ```
 
+### Defaults
+
+When using Anthropic API Key authentication, OpenClaw automatically applies `cacheRetention: "short"` (5-minute cache) for all Anthropic models. You can override this by explicitly setting `cacheRetention` in your config.
+
+### Legacy parameter
+
+The older `cacheControlTtl` parameter is still supported for backwards compatibility:
+
+- `"5m"` maps to `short`
+- `"1h"` maps to `long`
+
+We recommend migrating to the new `cacheRetention` parameter.
+
 OpenClaw includes the `extended-cache-ttl-2025-04-11` beta flag for Anthropic API
 requests; keep it if you override provider headers (see [/gateway/configuration](/gateway/configuration)).
 

package/docs/providers/index.md

@@ -13,9 +13,9 @@ default model as `provider/model`.
 
 Looking for chat channel docs (WhatsApp/Telegram/Discord/Slack/Mattermost (plugin)/etc.)? See [Channels](/channels).
 
-## Highlight: Venius (Venice AI)
+## Highlight: Venice (Venice AI)
 
-Venius is our recommended Venice AI setup for privacy-first inference with an option to use Opus for hard tasks.
+Venice is our recommended Venice AI setup for privacy-first inference with an option to use Opus for hard tasks.
 
 - Default: `venice/llama-3.3-70b`
 - Best overall: `venice/claude-opus-45` (Opus remains the strongest)
@@ -47,7 +47,7 @@ See [Venice AI](/providers/venice).
 - [Xiaomi](/providers/xiaomi)
 - [GLM models](/providers/glm)
 - [MiniMax](/providers/minimax)
-- [Venius (Venice AI, privacy-focused)](/providers/venice)
+- [Venice (Venice AI, privacy-focused)](/providers/venice)
 - [Ollama (local models)](/providers/ollama)
 
 ## Transcription providers

package/docs/providers/minimax.md

@@ -44,9 +44,9 @@ MiniMax highlights these improvements in M2.1:
 Enable the bundled OAuth plugin and authenticate:
 
 ```bash
-moltbot plugins enable minimax-portal-auth  # skip if already loaded.
-moltbot gateway restart  # restart if gateway is already running
-moltbot onboard --auth-choice minimax-portal
+openclaw plugins enable minimax-portal-auth  # skip if already loaded.
+openclaw gateway restart  # restart if gateway is already running
+openclaw onboard --auth-choice minimax-portal
 ```
 
 You will be prompted to select an endpoint:
@@ -54,7 +54,7 @@ You will be prompted to select an endpoint:
 - **Global** - International users (`api.minimax.io`)
 - **CN** - Users in China (`api.minimaxi.com`)
 
-See [MiniMax OAuth plugin README](https://github.com/moltbot/moltbot/tree/main/extensions/minimax-portal-auth) for details.
+See [MiniMax OAuth plugin README](https://github.com/openclaw/openclaw/tree/main/extensions/minimax-portal-auth) for details.
 
 ### MiniMax M2.1 (API key)
 

package/docs/providers/models.md

@@ -11,9 +11,9 @@ title: "Model Provider Quickstart"
 OpenClaw can use many LLM providers. Pick one, authenticate, then set the default
 model as `provider/model`.
 
-## Highlight: Venius (Venice AI)
+## Highlight: Venice (Venice AI)
 
-Venius is our recommended Venice AI setup for privacy-first inference with an option to use Opus for the hardest tasks.
+Venice is our recommended Venice AI setup for privacy-first inference with an option to use Opus for the hardest tasks.
 
 - Default: `venice/llama-3.3-70b`
 - Best overall: `venice/claude-opus-45` (Opus remains the strongest)
@@ -43,7 +43,7 @@ See [Venice AI](/providers/venice).
 - [Z.AI](/providers/zai)
 - [GLM models](/providers/glm)
 - [MiniMax](/providers/minimax)
-- [Venius (Venice AI)](/providers/venice)
+- [Venice (Venice AI)](/providers/venice)
 - [Amazon Bedrock](/bedrock)
 
 For the full provider catalog (xAI, Groq, Mistral, etc.) and advanced configuration,

package/docs/providers/moonshot.md

@@ -14,14 +14,15 @@ provider and set the default model to `moonshot/kimi-k2.5`, or use
 Kimi Coding with `kimi-coding/k2p5`.
 
 Current Kimi K2 model IDs:
-{/_ moonshot-kimi-k2-ids:start _/}
+
+{/_ moonshot-kimi-k2-ids:start _/ && null}
 
 - `kimi-k2.5`
 - `kimi-k2-0905-preview`
 - `kimi-k2-turbo-preview`
 - `kimi-k2-thinking`
 - `kimi-k2-thinking-turbo`
-  {/_ moonshot-kimi-k2-ids:end _/}
+  {/_ moonshot-kimi-k2-ids:end _/ && null}
 
 ```bash
 openclaw onboard --auth-choice moonshot-api-key
@@ -138,4 +139,4 @@ Note: Moonshot and Kimi Coding are separate providers. Keys are not interchangea
 - Override pricing and context metadata in `models.providers` if needed.
 - If Moonshot publishes different context limits for a model, adjust
   `contextWindow` accordingly.
-- Use `https://api.moonshot.cn/v1` if you need the China endpoint.
+- Use `https://api.moonshot.ai/v1` for the international endpoint, and `https://api.moonshot.cn/v1` for the China endpoint.

package/docs/reference/RELEASING.md

@@ -41,14 +41,14 @@ When the operator says “release”, immediately do this preflight (no extra qu
 
 4. **Validation**
 
-- [ ] `pnpm lint`
+- [ ] `pnpm build`
+- [ ] `pnpm check`
 - [ ] `pnpm test` (or `pnpm test:coverage` if you need coverage output)
-- [ ] `pnpm run build` (last sanity check after tests)
 - [ ] `pnpm release:check` (verifies npm pack contents)
 - [ ] `OPENCLAW_INSTALL_SMOKE_SKIP_NONROOT=1 pnpm test:install:smoke` (Docker install smoke test, fast path; required before release)
   - If the immediate previous npm release is known broken, set `OPENCLAW_INSTALL_SMOKE_PREVIOUS=<last-good-version>` or `OPENCLAW_INSTALL_SMOKE_SKIP_PREVIOUS=1` for the preinstall step.
 - [ ] (Optional) Full installer smoke (adds non-root + CLI coverage): `pnpm test:install:smoke`
-- [ ] (Optional) Installer E2E (Docker, runs `curl -fsSL https://openclaw.bot/install.sh | bash`, onboards, then runs real tool calls):
+- [ ] (Optional) Installer E2E (Docker, runs `curl -fsSL https://openclaw.ai/install.sh | bash`, onboards, then runs real tool calls):
   - `pnpm test:install:e2e:openai` (requires `OPENAI_API_KEY`)
   - `pnpm test:install:e2e:anthropic` (requires `ANTHROPIC_API_KEY`)
   - `pnpm test:install:e2e` (requires both keys; runs both providers)

package/docs/reference/templates/BOOTSTRAP.md

@@ -42,6 +42,13 @@ Then open `SOUL.md` together and talk about:
 
 Write it down. Make it real.
 
+## One-time system admin check
+
+Since this is a new install, offer a choice:
+
+1. Run the recommended host healthcheck using the `healthcheck` skill.
+2. Skip for now (run later by saying “run healthcheck”).
+
 ## Connect (Optional)
 
 Ask how they want to reach you:

package/docs/reference/transcript-hygiene.md

@@ -11,11 +11,15 @@ title: "Transcript Hygiene"
 
 This document describes **provider-specific fixes** applied to transcripts before a run
 (building model context). These are **in-memory** adjustments used to satisfy strict
-provider requirements. They do **not** rewrite the stored JSONL transcript on disk.
+provider requirements. These hygiene steps do **not** rewrite the stored JSONL transcript
+on disk; however, a separate session-file repair pass may rewrite malformed JSONL files
+by dropping invalid lines before the session is loaded. When a repair occurs, the original
+file is backed up alongside the session file.
 
 Scope includes:
 
 - Tool call id sanitization
+- Tool call input validation
 - Tool result pairing repair
 - Turn validation / ordering
 - Thought signature cleanup
@@ -36,6 +40,11 @@ All transcript hygiene is centralized in the embedded runner:
 
 The policy uses `provider`, `modelApi`, and `modelId` to decide what to apply.
 
+Separate from transcript hygiene, session files are repaired (if needed) before load:
+
+- `repairSessionFileIfNeeded` in `src/agents/session-file-repair.ts`
+- Called from `run/attempt.ts` and `compact.ts` (embedded runner)
+
 ---
 
 ## Global rule: image sanitization
@@ -50,6 +59,19 @@ Implementation:
 
 ---
 
+## Global rule: malformed tool calls
+
+Assistant tool-call blocks that are missing both `input` and `arguments` are dropped
+before model context is built. This prevents provider rejections from partially
+persisted tool calls (for example, after a rate limit failure).
+
+Implementation:
+
+- `sanitizeToolCallInputs` in `src/agents/session-transcript-repair.ts`
+- Applied in `sanitizeSessionHistory` in `src/agents/pi-embedded-runner/google.ts`
+
+---
+
 ## Provider matrix (current behavior)
 
 **OpenAI / OpenAI Codex**

package/docs/start/getting-started.md

@@ -56,7 +56,7 @@ Windows: use **WSL2** (Ubuntu recommended). WSL2 is strongly recommended; native
 ## 1) Install the CLI (recommended)
 
 ```bash
-curl -fsSL https://openclaw.bot/install.sh | bash
+curl -fsSL https://openclaw.ai/install.sh | bash
 ```
 
 Installer options (install method, non-interactive, from GitHub): [Install](/install).

package/docs/start/onboarding.md

@@ -23,7 +23,11 @@ wizard, and let the agent bootstrap itself.
 7. **Onboarding chat** (dedicated session)
 8. Ready
 
-## 1) Local vs Remote
+## 1) Welcome + security notice
+
+Read the security notice displayed and decide accordingly.
+
+## 2) Local vs Remote
 
 Where does the **Gateway** run?
 
@@ -39,7 +43,7 @@ Gateway auth tip:
 - If you disable auth, any local process can connect; use that only on fully trusted machines.
 - Use a **token** for multi‑machine access or non‑loopback binds.
 
-## 2) Local-only auth (Anthropic OAuth)
+## 3) Local-only auth (Anthropic OAuth)
 
 The macOS app supports Anthropic OAuth (Claude Pro/Max). The flow:
 
@@ -50,12 +54,12 @@ The macOS app supports Anthropic OAuth (Claude Pro/Max). The flow:
 Other providers (OpenAI, custom APIs) are configured via environment variables
 or config files for now.
 
-## 3) Setup Wizard (Gateway‑driven)
+## 4) Setup Wizard (Gateway‑driven)
 
 The app can run the same setup wizard as the CLI. This keeps onboarding in sync
 with Gateway‑side behavior and avoids duplicating logic in SwiftUI.
 
-## 4) Permissions
+## 5) Permissions
 
 Onboarding requests TCC permissions needed for:
 
@@ -65,12 +69,12 @@ Onboarding requests TCC permissions needed for:
 - Microphone / Speech Recognition
 - Automation (AppleScript)
 
-## 5) CLI (optional)
+## 6) CLI (optional)
 
 The app can install the global `openclaw` CLI via npm/pnpm so terminal
 workflows and launchd tasks work out of the box.
 
-## 6) Onboarding chat (dedicated session)
+## 7) Onboarding chat (dedicated session)
 
 After setup, the app opens a dedicated onboarding chat session so the agent can
 introduce itself and guide next steps. This keeps first‑run guidance separate

package/docs/testing.md

@@ -22,7 +22,7 @@ This doc is a “how we test” guide:
 
 Most days:
 
-- Full gate (expected before push): `pnpm lint && pnpm build && pnpm test`
+- Full gate (expected before push): `pnpm build && pnpm check && pnpm test`
 
 When you touch tests or want extra confidence:
 

package/docs/token-use.md

@@ -97,7 +97,7 @@ agents:
     models:
       "anthropic/claude-opus-4-5":
         params:
-          cacheControlTtl: "1h"
+          cacheRetention: "long"
     heartbeat:
       every: "55m"
 ```

package/docs/tools/browser.md

@@ -326,6 +326,20 @@ If you see `Playwright is not available in this gateway build`, install the full
 Playwright package (not `playwright-core`) and restart the gateway, or reinstall
 OpenClaw with browser support.
 
+#### Docker Playwright install
+
+If your Gateway runs in Docker, avoid `npx playwright` (npm override conflicts).
+Use the bundled CLI instead:
+
+```bash
+docker compose run --rm openclaw-cli \
+  node /app/node_modules/playwright-core/cli.js install chromium
+```
+
+To persist browser downloads, set `PLAYWRIGHT_BROWSERS_PATH` (for example,
+`/home/node/.cache/ms-playwright`) and make sure `/home/node` is persisted via
+`OPENCLAW_HOME_VOLUME` or a bind mount. See [Docker](/install/docker).
+
 ## How it works (internal)
 
 High-level flow:

package/docs/tools/chrome-extension.md

@@ -169,6 +169,7 @@ Recommendations:
 - Prefer a dedicated Chrome profile (separate from your personal browsing) for extension relay usage.
 - Keep the Gateway and any node hosts tailnet-only; rely on Gateway auth + node pairing.
 - Avoid exposing relay ports over LAN (`0.0.0.0`) and avoid Funnel (public).
+- The relay blocks non-extension origins and requires an internal auth token for CDP clients.
 
 Related:
 

package/docs/tools/clawhub.md

@@ -11,7 +11,28 @@ title: "ClawHub"
 
 ClawHub is the **public skill registry for OpenClaw**. It is a free service: all skills are public, open, and visible to everyone for sharing and reuse. A skill is just a folder with a `SKILL.md` file (plus supporting text files). You can browse skills in the web app or use the CLI to search, install, update, and publish skills.
 
-Site: [clawhub.com](https://clawhub.com)
+Site: [clawhub.ai](https://clawhub.ai)
+
+## What ClawHub is
+
+- A public registry for OpenClaw skills.
+- A versioned store of skill bundles and metadata.
+- A discovery surface for search, tags, and usage signals.
+
+## How it works
+
+1. A user publishes a skill bundle (files + metadata).
+2. ClawHub stores the bundle, parses metadata, and assigns a version.
+3. The registry indexes the skill for search and discovery.
+4. Users browse, download, and install skills in OpenClaw.
+
+## What you can do
+
+- Publish new skills and new versions of existing skills.
+- Discover skills by name, tags, or search.
+- Download skill bundles and inspect their files.
+- Report skills that are abusive or unsafe.
+- If you are a moderator, hide, unhide, delete, or ban.
 
 ## Who this is for (beginner-friendly)
 
@@ -50,6 +71,22 @@ By default, the CLI installs skills into `./skills` under your current working d
 For more detail on how skills are loaded, shared, and gated, see
 [Skills](/tools/skills).
 
+## Skill system overview
+
+A skill is a versioned bundle of files that teaches OpenClaw how to perform a
+specific task. Each publish creates a new version, and the registry keeps a
+history of versions so users can audit changes.
+
+A typical skill includes:
+
+- A `SKILL.md` file with the primary description and usage.
+- Optional configs, scripts, or supporting files used by the skill.
+- Metadata such as tags, summary, and install requirements.
+
+ClawHub uses metadata to power discovery and safely expose skill capabilities.
+The registry also tracks usage signals (such as stars and downloads) to improve
+ranking and visibility.
+
 ## What the service provides (features)
 
 - **Public browsing** of skills and their `SKILL.md` content.
@@ -60,6 +97,24 @@ For more detail on how skills are loaded, shared, and gated, see
 - **Moderation** hooks for approvals and audits.
 - **CLI-friendly API** for automation and scripting.
 
+## Security and moderation
+
+ClawHub is open by default. Anyone can upload skills, but a GitHub account must
+be at least one week old to publish. This helps slow down abuse without blocking
+legitimate contributors.
+
+Reporting and moderation:
+
+- Any signed in user can report a skill.
+- Report reasons are required and recorded.
+- Each user can have up to 20 active reports at a time.
+- Skills with more than 3 unique reports are auto hidden by default.
+- Moderators can view hidden skills, unhide them, delete them, or ban users.
+- Abusing the report feature can result in account bans.
+
+Interested in becoming a moderator? Ask in the OpenClaw Discord and contact a
+moderator or maintainer.
+
 ## CLI commands and parameters
 
 Global options (apply to all commands):

package/docs/tools/exec-approvals.md

@@ -128,6 +128,8 @@ Shell chaining and redirections are not auto-allowed in allowlist mode.
 
 Shell chaining (`&&`, `||`, `;`) is allowed when every top-level segment satisfies the allowlist
 (including safe bins or skill auto-allow). Redirections remain unsupported in allowlist mode.
+Command substitution (`$()` / backticks) is rejected during allowlist parsing, including inside
+double quotes; use single quotes if you need literal `$()` text.
 
 Default safe bins: `jq`, `grep`, `cut`, `sort`, `uniq`, `head`, `tail`, `tr`, `wc`.
 

package/docs/tools/exec.md

@@ -36,6 +36,8 @@ Notes:
 - If multiple nodes are available, set `exec.node` or `tools.exec.node` to select one.
 - On non-Windows hosts, exec uses `SHELL` when set; if `SHELL` is `fish`, it prefers `bash` (or `sh`)
   from `PATH` to avoid fish-incompatible scripts, then falls back to `SHELL` if neither exists.
+- Host execution (`gateway`/`node`) rejects `env.PATH` and loader overrides (`LD_*`/`DYLD_*`) to
+  prevent binary hijacking or injected code.
 - Important: sandboxing is **off by default**. If sandboxing is off, `host=sandbox` runs directly on
   the gateway host (no container) and **does not require approvals**. To require approvals, run with
   `host=gateway` and configure exec approvals (or enable sandboxing).
@@ -65,16 +67,16 @@ Example:
 
 ### PATH handling
 
-- `host=gateway`: merges your login-shell `PATH` into the exec environment (unless the exec call
-  already sets `env.PATH`). The daemon itself still runs with a minimal `PATH`:
+- `host=gateway`: merges your login-shell `PATH` into the exec environment. `env.PATH` overrides are
+  rejected for host execution. The daemon itself still runs with a minimal `PATH`:
   - macOS: `/opt/homebrew/bin`, `/usr/local/bin`, `/usr/bin`, `/bin`
   - Linux: `/usr/local/bin`, `/usr/bin`, `/bin`
 - `host=sandbox`: runs `sh -lc` (login shell) inside the container, so `/etc/profile` may reset `PATH`.
   OpenClaw prepends `env.PATH` after profile sourcing via an internal env var (no shell interpolation);
   `tools.exec.pathPrepend` applies here too.
-- `host=node`: only env overrides you pass are sent to the node. `tools.exec.pathPrepend` only applies
-  if the exec call already sets `env.PATH`. Headless node hosts accept `PATH` only when it prepends
-  the node host PATH (no replacement). macOS nodes drop `PATH` overrides entirely.
+- `host=node`: only non-blocked env overrides you pass are sent to the node. `env.PATH` overrides are
+  rejected for host execution. Headless node hosts accept `PATH` only when it prepends the node host
+  PATH (no replacement). macOS nodes drop `PATH` overrides entirely.
 
 Per-agent node binding (use the agent list index in config):
 

package/docs/tools/skills.md

@@ -68,7 +68,7 @@ that up as `<workspace>/skills` on the next session.
 
 ## Security notes
 
-- Treat third-party skills as **trusted code**. Read them before enabling.
+- Treat third-party skills as **untrusted code**. Read them before enabling.
 - Prefer sandboxed runs for untrusted inputs and risky tools. See [Sandboxing](/gateway/sandboxing).
 - `skills.entries.*.env` and `skills.entries.*.apiKey` inject secrets into the **host** process
   for that agent turn (not the sandbox). Keep secrets out of prompts and logs.

package/docs/tools/subagents.md

@@ -40,6 +40,7 @@ Use `sessions_spawn`:
 - Starts a sub-agent run (`deliver: false`, global lane: `subagent`)
 - Then runs an announce step and posts the announce reply to the requester chat channel
 - Default model: inherits the caller unless you set `agents.defaults.subagents.model` (or per-agent `agents.list[].subagents.model`); an explicit `sessions_spawn.model` still wins.
+- Default thinking: inherits the caller unless you set `agents.defaults.subagents.thinking` (or per-agent `agents.list[].subagents.thinking`); an explicit `sessions_spawn.thinking` still wins.
 
 Tool params:
 

package/docs/web/control-ui.md

@@ -30,6 +30,36 @@ Auth is supplied during the WebSocket handshake via:
   The dashboard settings panel lets you store a token; passwords are not persisted.
   The onboarding wizard generates a gateway token by default, so paste it here on first connect.
 
+## Device pairing (first connection)
+
+When you connect to the Control UI from a new browser or device, the Gateway
+requires a **one-time pairing approval** — even if you're on the same Tailnet
+with `gateway.auth.allowTailscale: true`. This is a security measure to prevent
+unauthorized access.
+
+**What you'll see:** "disconnected (1008): pairing required"
+
+**To approve the device:**
+
+```bash
+# List pending requests
+openclaw devices list
+
+# Approve by request ID
+openclaw devices approve <requestId>
+```
+
+Once approved, the device is remembered and won't require re-approval unless
+you revoke it with `openclaw devices revoke --device <id> --role <role>`. See
+[Devices CLI](/cli/devices) for token rotation and revocation.
+
+**Notes:**
+
+- Local connections (`127.0.0.1`) are auto-approved.
+- Remote connections (LAN, Tailnet, etc.) require explicit approval.
+- Each browser profile generates a unique device ID, so switching browsers or
+  clearing browser data will require re-pairing.
+
 ## What it can do (today)
 
 - Chat with the model via Gateway WS (`chat.history`, `chat.send`, `chat.abort`, `chat.inject`)

package/docs/zh-CN/automation/auth-monitoring.md

@@ -0,0 +1,47 @@
+---
+read_when:
+  - 设置认证过期监控或告警
+  - 自动化 Claude Code / Codex OAuth 刷新检查
+summary: 监控模型提供商的 OAuth 过期状态
+title: 认证监控
+x-i18n:
+  generated_at: "2026-02-01T19:36:14Z"
+  model: claude-opus-4-5
+  provider: pi
+  source_hash: eef179af9545ed7ab881f3ccbef998869437fb50cdb4088de8da7223b614fa2b
+  source_path: automation/auth-monitoring.md
+  workflow: 14
+---
+
+# 认证监控
+
+OpenClaw 通过 `openclaw models status` 暴露 OAuth 过期健康状态。可将其用于自动化和告警；脚本是针对手机工作流的可选补充。
+
+## 推荐方式：CLI 检查（跨平台通用）
+
+```bash
+openclaw models status --check
+```
+
+退出码：
+
+- `0`：正常
+- `1`：凭证已过期或缺失
+- `2`：即将过期（24 小时内）
+
+适用于 cron/systemd，无需额外脚本。
+
+## 可选脚本（运维/手机工作流）
+
+这些脚本位于 `scripts/` 目录下，属于**可选项**。它们假定你可以通过 SSH 访问 Gateway网关主机，并针对 systemd + Termux 进行了调优。
+
+- `scripts/claude-auth-status.sh` 现在使用 `openclaw models status --json` 作为数据源（如果 CLI 不可用则回退到直接读取文件），因此请确保定时器中 `openclaw` 在 `PATH` 中。
+- `scripts/auth-monitor.sh`：cron/systemd 定时器目标；发送告警（ntfy 或手机）。
+- `scripts/systemd/openclaw-auth-monitor.{service,timer}`：systemd 用户定时器。
+- `scripts/claude-auth-status.sh`：Claude Code + OpenClaw 认证检查器（完整/json/简洁模式）。
+- `scripts/mobile-reauth.sh`：通过 SSH 进行引导式重新认证流程。
+- `scripts/termux-quick-auth.sh`：一键小组件状态查看 + 打开认证 URL。
+- `scripts/termux-auth-widget.sh`：完整的引导式小组件流程。
+- `scripts/termux-sync-widget.sh`：将 Claude Code 凭证同步至 OpenClaw。
+
+如果你不需要手机自动化或 systemd 定时器，可以跳过这些脚本。