@moltbankhq/openclaw 0.1.12 → 0.1.13

package/index.ts

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from 'child_process';
 import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, type Dirent } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, basename } from 'path';
 import { homedir, userInfo } from 'os';
 const IS_WIN = process.platform === 'win32';
 
@@ -16,6 +16,7 @@ interface CredentialsOrganization {
   name?: string;
   access_token?: string;
   x402_signer_private_key?: string;
+  x402_wallet?: Record<string, unknown>;
 }
 
 interface CredentialsFile {
@@ -952,6 +953,77 @@ function getCredentialsPath(): string {
   return process.env.MOLTBANK_CREDENTIALS_PATH || join(homedir(), '.MoltBank', 'credentials.json');
 }
 
+function getSandboxCredentialsHostPath(skillDir: string): string {
+  return join(skillDir, '.sandbox', 'credentials.json');
+}
+
+function getSandboxCredentialsContainerPath(skillName: string): string {
+  return `/workspace/skills/${skillName}/.sandbox/credentials.json`;
+}
+
+function writeSandboxCredentialsFile(
+  skillDir: string,
+  activeOrg: string,
+  org: CredentialsOrganization,
+  privateKey: string,
+  api: LoggerApi
+): boolean {
+  const sandboxDir = dirname(getSandboxCredentialsHostPath(skillDir));
+  const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
+  const sandboxOrg: Record<string, unknown> = {
+    name: activeOrg,
+    access_token: org.access_token ?? ''
+  };
+
+  if (privateKey) {
+    sandboxOrg.x402_signer_private_key = privateKey;
+  }
+  if (isRecord(org.x402_wallet)) {
+    sandboxOrg.x402_wallet = org.x402_wallet;
+  }
+
+  const sandboxCredentials = {
+    active_organization: activeOrg,
+    organizations: [sandboxOrg]
+  };
+
+  try {
+    mkdirSync(sandboxDir, { recursive: true });
+    writeFileSync(sandboxCredentialsPath, JSON.stringify(sandboxCredentials, null, 2) + '\n', 'utf8');
+
+    if (!IS_WIN) {
+      try {
+        chmodSync(sandboxDir, 0o700);
+      } catch {
+        // ignore
+      }
+      try {
+        chmodSync(sandboxCredentialsPath, 0o600);
+      } catch {
+        // ignore
+      }
+    }
+
+    api.logger.info('[moltbank] ✓ sandbox credentials file updated');
+    return true;
+  } catch (e) {
+    api.logger.warn('[moltbank] ✗ could not write sandbox credentials file: ' + String(e));
+    return false;
+  }
+}
+
+function removeSandboxSecretEnvKeys(envObj: Record<string, string>, api: LoggerApi): boolean {
+  let changed = false;
+  for (const key of ['MOLTBANK', 'SIGNER']) {
+    if (key in envObj) {
+      delete envObj[key];
+      changed = true;
+      api.logger.info(`[moltbank] ✓ removed legacy sandbox secret env key ${key}`);
+    }
+  }
+  return changed;
+}
+
 function readOpenclawConfig(): OpenclawConfig {
   const configPath = join(homedir(), '.openclaw', 'openclaw.json');
   try {
@@ -1906,6 +1978,7 @@ export function ensureMcporterConfig(skillDir: string, appBaseUrl: string, api:
 
 export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
   const credsPath = getCredentialsPath();
+  const skillName = basename(skillDir);
 
   if (!existsSync(credsPath)) {
     api.logger.info('[moltbank] no credentials.json found — skipping sandbox env injection');
@@ -1933,14 +2006,7 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
     const envPath = ['agents', 'defaults', 'sandbox', 'docker', 'env'];
     setNestedValue(config, envPath, getNestedValue(config, envPath) ?? {});
     const envObj = getNestedValue(config, envPath) as Record<string, string>;
-
-    if (envObj.MOLTBANK !== org.access_token) {
-      envObj.MOLTBANK = org.access_token;
-      api.logger.info(`[moltbank] ✓ MOLTBANK injected (org: ${activeOrg})`);
-      changed = true;
-    } else {
-      api.logger.info(`[moltbank] ✓ MOLTBANK already injected (org: ${activeOrg})`);
-    }
+    changed = removeSandboxSecretEnvKeys(envObj, api) || changed;
 
     if (envObj.ACTIVE_ORG_OVERRIDE !== activeOrg) {
       envObj.ACTIVE_ORG_OVERRIDE = activeOrg;
@@ -1976,21 +2042,28 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
       }
     }
 
+    if (!writeSandboxCredentialsFile(skillDir, activeOrg, org, privateKey, api)) {
+      return false;
+    }
+
+    const sandboxCredentialsContainerPath = getSandboxCredentialsContainerPath(skillName);
+    if (envObj.MOLTBANK_CREDENTIALS_PATH !== sandboxCredentialsContainerPath) {
+      envObj.MOLTBANK_CREDENTIALS_PATH = sandboxCredentialsContainerPath;
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH injected (${sandboxCredentialsContainerPath})`);
+      changed = true;
+    } else {
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH already set (${sandboxCredentialsContainerPath})`);
+    }
+
     if (privateKey) {
-      if (envObj.SIGNER !== privateKey) {
-        envObj.SIGNER = privateKey;
-        api.logger.info('[moltbank] ✓ SIGNER injected');
-        changed = true;
-      } else {
-        api.logger.info('[moltbank] ✓ SIGNER already injected');
-      }
+      api.logger.info('[moltbank] ✓ sandbox x402 signer available via sandbox credentials file');
     } else {
-      api.logger.info('[moltbank] ℹ SIGNER not available — skipped (agent will handle on first use)');
+      api.logger.info('[moltbank] ℹ sandbox x402 signer not available yet — helper scripts will use sandbox credentials path if generated later');
     }
 
     if (changed) {
       writeOpenclawConfig(config);
-      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox env vars');
+      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox auth path only (no token/private key persisted)');
     }
 
     return changed;
@@ -2212,7 +2285,7 @@ export async function runSetup(
     api.logger.info('[moltbank] [sandbox 8/10] configuring sandbox docker settings...');
     const sandboxChanged = configureSandbox(api);
 
-    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox env vars (MOLTBANK, ACTIVE_ORG_OVERRIDE, SIGNER)...');
+    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox auth env (MOLTBANK_CREDENTIALS_PATH, ACTIVE_ORG_OVERRIDE)...');
     const envChanged = injectSandboxEnv(skillDir, api);
 
     api.logger.info('[moltbank] [sandbox 10/10] apply sandbox changes (recreate + gateway stop)...');
@@ -2379,13 +2452,18 @@ export async function runSetup(
     const finalEnv = asStringRecord(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'env']));
     const finalNetwork = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'network']));
     const finalCmd = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'setupCommand']));
+    const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
 
     api.logger.info(`[moltbank]   openclaw.json sandbox env:`);
-    api.logger.info(`[moltbank]     MOLTBANK:             ${finalEnv.MOLTBANK ? '✓ set' : '✗ missing'}`);
+    api.logger.info(
+      `[moltbank]     MOLTBANK_CREDENTIALS_PATH: ${finalEnv.MOLTBANK_CREDENTIALS_PATH ? `✓ ${finalEnv.MOLTBANK_CREDENTIALS_PATH}` : '✗ missing'}`
+    );
     api.logger.info(
       `[moltbank]     ACTIVE_ORG_OVERRIDE:  ${finalEnv.ACTIVE_ORG_OVERRIDE ? `✓ "${finalEnv.ACTIVE_ORG_OVERRIDE}"` : '✗ missing'}`
     );
-    api.logger.info(`[moltbank]     SIGNER:               ${finalEnv.SIGNER ? '✓ set' : '✗ missing (agent may generate on first use)'}`);
+    api.logger.info(
+      `[moltbank]     sandbox credentials:   ${existsSync(sandboxCredentialsPath) ? '✓ present (skill-local, 600)' : '✗ missing'}`
+    );
     api.logger.info(`[moltbank]   sandbox docker:`);
     api.logger.info(
       `[moltbank]     network:              ${finalNetwork === 'bridge' ? '✓ bridge' : `✗ "${finalNetwork}" (expected bridge)`}`

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@moltbankhq/openclaw",
-    "version": "0.1.12",
+    "version": "0.1.13",
     "description": "MoltBank stablecoin treasury CLI and OpenClaw plugin",
     "main": "index.ts",
     "bin": {