@keychat-io/keychat 0.1.20 → 0.1.23

package/README.md

@@ -19,23 +19,34 @@ That's it. The plugin automatically downloads the bridge binary and initializes
 
 Supported platforms: macOS (ARM/x64), Linux (x64/ARM64).
 
+### Security Warnings
+
+During installation, OpenClaw will show two security warnings. **Both are expected and required:**
+
+| Warning | File | Why it's needed |
+|---------|------|----------------|
+| Shell command execution (child_process) | `bridge-client.ts` | Spawns the Rust sidecar process for Signal Protocol & MLS encryption. Keychat's cryptography runs in Rust and must be bridged to Node.js. |
+| Shell command execution (child_process) | `keychain.ts` | Stores the agent's identity mnemonic in the OS keychain (macOS Keychain / Linux libsecret) instead of plain-text files. |
+
+These warnings cannot be removed without sacrificing core functionality or security. The plugin does **not** execute arbitrary commands — it only spawns the bundled bridge binary and accesses the system keychain.
+
 Alternatively, install via shell script:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/keychat-io/keychat/main/scripts/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/keychat-io/keychat-openclaw/main/scripts/install.sh | bash
 ```
 
 ### Security Warnings
 
 During installation, OpenClaw's security scanner may show three warnings. All are expected:
 
-| Warning | Reason |
-|---------|--------|
-| Shell command execution (bridge-client.ts) | Spawns a Rust sidecar for Signal Protocol and MLS encryption. |
-| Shell command execution (keychain.ts) | Stores identity mnemonics in the OS keychain (macOS Keychain / Linux libsecret). |
-| Shell command execution (notify.ts) | Notifies the agent on startup so it can send the Keychat ID and QR code to the user. |
+| Warning                                    | Reason                                                                               |
+| ------------------------------------------ | ------------------------------------------------------------------------------------ |
+| Shell command execution (bridge-client.ts) | Spawns a Rust sidecar for Signal Protocol and MLS encryption.                        |
+| Shell command execution (keychain.ts)      | Stores identity mnemonics in the OS keychain (macOS Keychain / Linux libsecret).     |
+| Shell command execution (notify.ts)        | Notifies the agent on startup so it can send the Keychat ID and QR code to the user. |
 
-Source code is fully open: [github.com/keychat-io/keychat](https://github.com/keychat-io/keychat)
+Source code is fully open: [github.com/keychat-io/keychat-openclaw](https://github.com/keychat-io/keychat-openclaw)
 
 ### Upgrade
 
@@ -58,6 +69,16 @@ After `openclaw gateway restart`, the agent will send you its **Keychat ID**, **
 
 Open the [Keychat app](https://keychat.io) → tap the link, paste the npub, or scan the QR code to add as contact. If `dmPolicy` is `open` (default after auto-init), the agent accepts immediately.
 
+**Can't find the public key?** Check your config file or gateway logs:
+
+```bash
+# View the agent's npub in config
+cat ~/.openclaw/openclaw.json | grep npub
+
+# Or watch the gateway logs for the Keychat ID
+openclaw logs --follow
+```
+
 ## Configuration
 
 All options go under `channels.keychat` in your OpenClaw config (`~/.openclaw/openclaw.json`):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keychat-io/keychat",
-  "version": "0.1.20",
+  "version": "0.1.23",
   "description": "Keychat — E2E encrypted chat + Lightning wallet for OpenClaw agents",
   "license": "AGPL-3.0",
   "repository": {

package/src/channel.ts

@@ -714,7 +714,7 @@ export const keychatPlugin: ChannelPlugin<ResolvedKeychatAccount> = {
       ctx.log?.info(`[${account.accountId}] Bridge sidecar started`);
 
       // 2. Initialize Signal Protocol DB
-      const dbPath = `~/.openclaw/keychat-signal-${account.accountId}.db`;
+      const dbPath = `~/.openclaw/keychat/signal-${account.accountId}.db`;
       await bridge.init(dbPath);
       ctx.log?.info(`[${account.accountId}] Signal DB initialized`);
 

package/src/paths.ts

@@ -19,7 +19,7 @@ export const WORKSPACE_KEYCHAT_DIR = join(HOME, ".openclaw", "workspace", "keych
 
 /** Signal DB path for a given account */
 export function signalDbPath(accountId: string): string {
-  return join(HOME, ".openclaw", `keychat-signal-${accountId}.db`);
+  return join(KEYCHAT_DIR, `signal-${accountId}.db`);
 }
 
 /** QR code image path for a given account */