@moltbankhq/openclaw 0.1.12 → 0.1.14

package/README.md

@@ -32,11 +32,11 @@ openclaw plugins install @moltbankhq/openclaw
 
 This package connects your OpenClaw agent to MoltBank's stablecoin treasury infrastructure. During setup, it:
 
-- Downloads and configures the MoltBank skill (`skill.md` + scripts)
+- Downloads and configures the MoltBank skill (`SKILL.md` + scripts)
 - Installs and registers [mcporter](https://www.npmjs.com/package/mcporter) for MCP server connectivity
 - Handles OAuth device-code authentication to link your agent to your MoltBank account
 - Configures sandbox (Docker) or host mode automatically based on your OpenClaw setup
-- Injects required environment variables (`MOLTBANK`, `SIGNER`, `ACTIVE_ORG_OVERRIDE`)
+- Injects the sandbox auth path (`MOLTBANK_CREDENTIALS_PATH`) plus `ACTIVE_ORG_OVERRIDE`, while keeping tokens and signer keys in a skill-local credentials file
 
 Once set up, your agent can manage treasury operations, set per-agent spending limits, handle x402 payments, and interact with MoltBank's MCP server — all within OpenClaw.
 

package/index.ts

@@ -1,6 +1,6 @@
 import { spawn, spawnSync } from 'child_process';
 import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync, type Dirent } from 'fs';
-import { join, dirname } from 'path';
+import { join, dirname, basename } from 'path';
 import { homedir, userInfo } from 'os';
 const IS_WIN = process.platform === 'win32';
 
@@ -16,6 +16,7 @@ interface CredentialsOrganization {
   name?: string;
   access_token?: string;
   x402_signer_private_key?: string;
+  x402_wallet?: Record<string, unknown>;
 }
 
 interface CredentialsFile {
@@ -952,6 +953,77 @@ function getCredentialsPath(): string {
   return process.env.MOLTBANK_CREDENTIALS_PATH || join(homedir(), '.MoltBank', 'credentials.json');
 }
 
+function getSandboxCredentialsHostPath(skillDir: string): string {
+  return join(skillDir, '.sandbox', 'credentials.json');
+}
+
+function getSandboxCredentialsContainerPath(skillName: string): string {
+  return `/workspace/skills/${skillName}/.sandbox/credentials.json`;
+}
+
+function writeSandboxCredentialsFile(
+  skillDir: string,
+  activeOrg: string,
+  org: CredentialsOrganization,
+  privateKey: string,
+  api: LoggerApi
+): boolean {
+  const sandboxDir = dirname(getSandboxCredentialsHostPath(skillDir));
+  const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
+  const sandboxOrg: Record<string, unknown> = {
+    name: activeOrg,
+    access_token: org.access_token ?? ''
+  };
+
+  if (privateKey) {
+    sandboxOrg.x402_signer_private_key = privateKey;
+  }
+  if (isRecord(org.x402_wallet)) {
+    sandboxOrg.x402_wallet = org.x402_wallet;
+  }
+
+  const sandboxCredentials = {
+    active_organization: activeOrg,
+    organizations: [sandboxOrg]
+  };
+
+  try {
+    mkdirSync(sandboxDir, { recursive: true });
+    writeFileSync(sandboxCredentialsPath, JSON.stringify(sandboxCredentials, null, 2) + '\n', 'utf8');
+
+    if (!IS_WIN) {
+      try {
+        chmodSync(sandboxDir, 0o700);
+      } catch {
+        // ignore
+      }
+      try {
+        chmodSync(sandboxCredentialsPath, 0o600);
+      } catch {
+        // ignore
+      }
+    }
+
+    api.logger.info('[moltbank] ✓ sandbox credentials file updated');
+    return true;
+  } catch (e) {
+    api.logger.warn('[moltbank] ✗ could not write sandbox credentials file: ' + String(e));
+    return false;
+  }
+}
+
+function removeSandboxSecretEnvKeys(envObj: Record<string, string>, api: LoggerApi): boolean {
+  let changed = false;
+  for (const key of ['MOLTBANK', 'SIGNER']) {
+    if (key in envObj) {
+      delete envObj[key];
+      changed = true;
+      api.logger.info(`[moltbank] ✓ removed legacy sandbox secret env key ${key}`);
+    }
+  }
+  return changed;
+}
+
 function readOpenclawConfig(): OpenclawConfig {
   const configPath = join(homedir(), '.openclaw', 'openclaw.json');
   try {
@@ -1902,10 +1974,47 @@ export function ensureMcporterConfig(skillDir: string, appBaseUrl: string, api:
   api.logger.info('[moltbank] ✓ MoltBank will use skill-local mcporter config only');
 }
 
+function runHostReadinessCheck(skillDir: string, api: LoggerApi): boolean {
+  const active = parseActiveTokenFromCredentials();
+  if (!active.ok || !active.activeOrg) {
+    api.logger.warn('[moltbank] host setup incomplete: active organization could not be resolved for readiness verification');
+    return false;
+  }
+
+  const wrapperPath = IS_WIN ? join(skillDir, 'scripts', 'moltbank.ps1') : join(skillDir, 'scripts', 'moltbank.sh');
+  const readinessArgs = ['call', 'MoltBank.get_balance', `organizationName=${active.activeOrg}`, 'date=today'];
+  const readinessTimeoutMs = IS_WIN ? 30000 : 25000;
+
+  api.logger.info(`[moltbank] verifying readiness with authenticated balance read (org: ${active.activeOrg})...`);
+
+  const readiness = runCommand(wrapperPath, readinessArgs, {
+    cwd: skillDir,
+    silent: true,
+    timeoutMs: readinessTimeoutMs,
+    env: {
+      ACTIVE_ORG_OVERRIDE: active.activeOrg
+    }
+  });
+
+  if (!readiness.ok) {
+    const combined = `${readiness.stderr}\n${readiness.stdout}`.trim();
+    const detail = lastNonEmptyLine(combined);
+    if (detail) {
+      api.logger.warn(`[moltbank] readiness detail: ${detail}`);
+    }
+    api.logger.warn('[moltbank] host setup incomplete: authenticated balance-read verification failed');
+    return false;
+  }
+
+  api.logger.info('[moltbank] host readiness verified (`MoltBank.get_balance`)');
+  return true;
+}
+
 // ─── sandbox env vars ────────────────────────────────────────────────────────
 
 export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
   const credsPath = getCredentialsPath();
+  const skillName = basename(skillDir);
 
   if (!existsSync(credsPath)) {
     api.logger.info('[moltbank] no credentials.json found — skipping sandbox env injection');
@@ -1933,14 +2042,7 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
     const envPath = ['agents', 'defaults', 'sandbox', 'docker', 'env'];
     setNestedValue(config, envPath, getNestedValue(config, envPath) ?? {});
     const envObj = getNestedValue(config, envPath) as Record<string, string>;
-
-    if (envObj.MOLTBANK !== org.access_token) {
-      envObj.MOLTBANK = org.access_token;
-      api.logger.info(`[moltbank] ✓ MOLTBANK injected (org: ${activeOrg})`);
-      changed = true;
-    } else {
-      api.logger.info(`[moltbank] ✓ MOLTBANK already injected (org: ${activeOrg})`);
-    }
+    changed = removeSandboxSecretEnvKeys(envObj, api) || changed;
 
     if (envObj.ACTIVE_ORG_OVERRIDE !== activeOrg) {
       envObj.ACTIVE_ORG_OVERRIDE = activeOrg;
@@ -1976,21 +2078,28 @@ export function injectSandboxEnv(skillDir: string, api: LoggerApi): boolean {
       }
     }
 
+    if (!writeSandboxCredentialsFile(skillDir, activeOrg, org, privateKey, api)) {
+      return false;
+    }
+
+    const sandboxCredentialsContainerPath = getSandboxCredentialsContainerPath(skillName);
+    if (envObj.MOLTBANK_CREDENTIALS_PATH !== sandboxCredentialsContainerPath) {
+      envObj.MOLTBANK_CREDENTIALS_PATH = sandboxCredentialsContainerPath;
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH injected (${sandboxCredentialsContainerPath})`);
+      changed = true;
+    } else {
+      api.logger.info(`[moltbank] ✓ MOLTBANK_CREDENTIALS_PATH already set (${sandboxCredentialsContainerPath})`);
+    }
+
     if (privateKey) {
-      if (envObj.SIGNER !== privateKey) {
-        envObj.SIGNER = privateKey;
-        api.logger.info('[moltbank] ✓ SIGNER injected');
-        changed = true;
-      } else {
-        api.logger.info('[moltbank] ✓ SIGNER already injected');
-      }
+      api.logger.info('[moltbank] ✓ sandbox x402 signer available via sandbox credentials file');
     } else {
-      api.logger.info('[moltbank] ℹ SIGNER not available — skipped (agent will handle on first use)');
+      api.logger.info('[moltbank] ℹ sandbox x402 signer not available yet — helper scripts will use sandbox credentials path if generated later');
     }
 
     if (changed) {
       writeOpenclawConfig(config);
-      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox env vars');
+      api.logger.info('[moltbank] ✓ openclaw.json updated with sandbox auth path only (no token/private key persisted)');
     }
 
     return changed;
@@ -2212,7 +2321,7 @@ export async function runSetup(
     api.logger.info('[moltbank] [sandbox 8/10] configuring sandbox docker settings...');
     const sandboxChanged = configureSandbox(api);
 
-    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox env vars (MOLTBANK, ACTIVE_ORG_OVERRIDE, SIGNER)...');
+    api.logger.info('[moltbank] [sandbox 9/10] injecting sandbox auth env (MOLTBANK_CREDENTIALS_PATH, ACTIVE_ORG_OVERRIDE)...');
     const envChanged = injectSandboxEnv(skillDir, api);
 
     api.logger.info('[moltbank] [sandbox 10/10] apply sandbox changes (recreate + gateway stop)...');
@@ -2265,98 +2374,8 @@ export async function runSetup(
     api.logger.info('[moltbank] [host 7/8] writing/registering mcporter config...');
     ensureMcporterConfig(skillDir, appBaseUrl, api);
 
-    api.logger.info('[moltbank] [host 8/8] running wrapper smoke test...');
-    const smokeTimeoutMs = IS_WIN ? 15000 : 20000;
-    let smokeOk = false;
-
-    if (IS_WIN) {
-      const mcporterConfigPath = join(skillDir, 'assets', 'mcporter.json');
-      const active = parseActiveTokenFromCredentials();
-      const mcpSmoke = runCommand('mcporter', ['--config', mcporterConfigPath, 'list', 'MoltBank'], {
-        cwd: skillDir,
-        silent: true,
-        timeoutMs: smokeTimeoutMs,
-        env: {
-          MOLTBANK: active.token ?? '__MOLTBANK_PLACEHOLDER__'
-        }
-      });
-
-      if (mcpSmoke.ok) {
-        api.logger.info('[moltbank] host smoke test passed (`mcporter list MoltBank`)');
-        smokeOk = true;
-      } else {
-        const mcpCombined = `${mcpSmoke.stderr}\n${mcpSmoke.stdout}`.trim();
-        const mcpCombinedLower = mcpCombined.toLowerCase();
-        const mcpDetail = lastNonEmptyLine(mcpCombined);
-        if (mcpDetail) {
-          api.logger.warn(`[moltbank] smoke detail: ${mcpDetail}`);
-        }
-
-        const timedOut = mcpSmoke.stderr.includes('ETIMEDOUT') || mcpCombinedLower.includes('timed out');
-        if (timedOut) {
-          api.logger.warn(
-            `[moltbank] host MCP smoke timed out after ${Math.floor(smokeTimeoutMs / 1000)}s; running local fallback checks`
-          );
-
-          const ps1Path = join(skillDir, 'scripts', 'moltbank.ps1');
-          const fallback = runCommand(
-            'powershell',
-            [
-              '-NoProfile',
-              '-NonInteractive',
-              '-ExecutionPolicy',
-              'Bypass',
-              '-Command',
-              "$ErrorActionPreference = 'Stop'; if (-not (Test-Path -LiteralPath $env:MOLTBANK_WRAPPER_PATH)) { throw 'moltbank.ps1 not found' }; if (-not (Get-Command bash -ErrorAction SilentlyContinue)) { throw 'bash is not installed or not on PATH' }; if (-not (Get-Command mcporter -ErrorAction SilentlyContinue)) { throw 'mcporter is not installed or not on PATH' }; Write-Output 'ok'"
-            ],
-            {
-              cwd: skillDir,
-              silent: true,
-              timeoutMs: 10000,
-              env: { MOLTBANK_WRAPPER_PATH: ps1Path }
-            }
-          );
-
-          if (fallback.ok) {
-            api.logger.warn('[moltbank] host smoke fallback passed (wrapper prerequisites available), but MCP endpoint was not verified');
-            smokeOk = true;
-          } else {
-            const fallbackCombined = `${fallback.stderr}\n${fallback.stdout}`.trim();
-            const fallbackDetail = lastNonEmptyLine(fallbackCombined);
-            if (fallbackDetail) {
-              api.logger.warn(`[moltbank] fallback detail: ${fallbackDetail}`);
-            }
-            api.logger.warn('[moltbank] host setup incomplete: MCP smoke timed out and fallback checks failed');
-          }
-        } else if (
-          mcpCombinedLower.includes('mcporter') &&
-          (mcpCombinedLower.includes('not recognized') || mcpCombinedLower.includes('not found'))
-        ) {
-          api.logger.warn('[moltbank] mcporter binary not found in PATH during smoke test');
-        } else {
-          api.logger.warn('[moltbank] host setup incomplete: smoke test failed (`mcporter list MoltBank`)');
-        }
-      }
-    } else {
-      const smoke = runCommand(join(skillDir, 'scripts', 'moltbank.sh'), ['list', 'MoltBank'], {
-        cwd: skillDir,
-        silent: true,
-        timeoutMs: smokeTimeoutMs
-      });
-      if (!smoke.ok) {
-        const smokeCombined = `${smoke.stderr}\n${smoke.stdout}`.trim();
-        const smokeDetail = lastNonEmptyLine(smokeCombined);
-        if (smokeDetail) {
-          api.logger.warn(`[moltbank] smoke detail: ${smokeDetail}`);
-        }
-        api.logger.warn('[moltbank] host setup incomplete: smoke test failed (`moltbank list MoltBank` via platform script)');
-      } else {
-        api.logger.info('[moltbank] host smoke test passed (`moltbank list MoltBank`)');
-        smokeOk = true;
-      }
-    }
-
-    hostReady = smokeOk;
+    api.logger.info('[moltbank] [host 8/8] running readiness balance check...');
+    hostReady = runHostReadinessCheck(skillDir, api);
 
     api.logger.info('[moltbank] host mode — setup completed with onboarding flow');
 
@@ -2379,13 +2398,18 @@ export async function runSetup(
     const finalEnv = asStringRecord(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'env']));
     const finalNetwork = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'network']));
     const finalCmd = asString(getNestedValue(finalConfig, ['agents', 'defaults', 'sandbox', 'docker', 'setupCommand']));
+    const sandboxCredentialsPath = getSandboxCredentialsHostPath(skillDir);
 
     api.logger.info(`[moltbank]   openclaw.json sandbox env:`);
-    api.logger.info(`[moltbank]     MOLTBANK:             ${finalEnv.MOLTBANK ? '✓ set' : '✗ missing'}`);
+    api.logger.info(
+      `[moltbank]     MOLTBANK_CREDENTIALS_PATH: ${finalEnv.MOLTBANK_CREDENTIALS_PATH ? `✓ ${finalEnv.MOLTBANK_CREDENTIALS_PATH}` : '✗ missing'}`
+    );
     api.logger.info(
       `[moltbank]     ACTIVE_ORG_OVERRIDE:  ${finalEnv.ACTIVE_ORG_OVERRIDE ? `✓ "${finalEnv.ACTIVE_ORG_OVERRIDE}"` : '✗ missing'}`
     );
-    api.logger.info(`[moltbank]     SIGNER:               ${finalEnv.SIGNER ? '✓ set' : '✗ missing (agent may generate on first use)'}`);
+    api.logger.info(
+      `[moltbank]     sandbox credentials:   ${existsSync(sandboxCredentialsPath) ? '✓ present (skill-local, 600)' : '✗ missing'}`
+    );
     api.logger.info(`[moltbank]   sandbox docker:`);
     api.logger.info(
       `[moltbank]     network:              ${finalNetwork === 'bridge' ? '✓ bridge' : `✗ "${finalNetwork}" (expected bridge)`}`

package/package.json

@@ -1,20 +1,55 @@
 {
     "name": "@moltbankhq/openclaw",
-    "version": "0.1.12",
+    "version": "0.1.14",
     "description": "MoltBank stablecoin treasury CLI and OpenClaw plugin",
+    "homepage": "https://github.com/moltbankhq/openclaw-plugin#readme",
+    "repository": {
+        "type": "git",
+        "url": "https://github.com/moltbankhq/openclaw-plugin.git"
+    },
+    "bugs": {
+        "url": "https://github.com/moltbankhq/openclaw-plugin/issues"
+    },
     "main": "index.ts",
+    "types": "index.ts",
+    "exports": {
+        ".": "./index.ts",
+        "./cli": "./cli.ts",
+        "./package.json": "./package.json"
+    },
     "bin": {
         "moltbank": "./bin/moltbank.mjs"
     },
+    "files": [
+        "README.md",
+        "bin/",
+        "cli.ts",
+        "index.ts",
+        "openclaw.plugin.json"
+    ],
     "openclaw": {
         "extensions": [
             "./index.ts"
         ]
     },
-    "keywords": [],
+    "keywords": [
+        "moltbank",
+        "openclaw",
+        "treasury",
+        "mcp",
+        "cli",
+        "stablecoin",
+        "x402"
+    ],
     "author": "",
     "license": "ISC",
     "type": "module",
+    "engines": {
+        "node": ">=22"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
     "dependencies": {
         "tsx": "^4.20.6"
     },