@reefclaw/connect 0.1.0 → 0.1.2

package/assets/bridge/bridge.d.ts

@@ -22,6 +22,8 @@ export declare class Bridge {
      *  round-trip. `null` means "unknown yet" — the plugin is the authority. */
     private lastKnownTradingMode;
     private readonly listeners;
+    /** rc_ connection token — also authenticates the webapp skill-content pull */
+    private readonly connectionToken;
     constructor(provider: OpenClawProvider, connectorConfig: ConnectorConfig);
     /** Start the bridge: connect to relay + start provider */
     start(): void;
@@ -91,6 +93,17 @@ export declare class Bridge {
      * has nothing stored; throws on transport error.
      */
     private pullAndApplySkillUpdate;
+    /**
+     * Pull the full SKILL.md from the webapp's authenticated endpoint and apply
+     * it when newer than local. This is how a FRESH install upgrades from the
+     * bundled bootstrap (v0.0.x) to the real trading instructions — the relay's
+     * per-room Durable-Object store is empty for a new user, so the relay push
+     * channel alone can never deliver the first full copy. Token-gated: no valid
+     * rc_ token → 401 → no content (the full SKILL.md never ships unauthenticated).
+     * Same downgrade guard + applySkillUpdate pipeline (incl. the C1 signature
+     * gate when enforced) as the relay pull path.
+     */
+    private pullSkillContentFromWebapp;
     /** Check relay's latest SKILL.md version against local and auto-update if stale */
     private handleConnectAck;
 }

package/assets/bridge/bridge.js

@@ -77,10 +77,13 @@ export class Bridge {
     // Bound listeners for cleanup
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     listeners = [];
+    /** rc_ connection token — also authenticates the webapp skill-content pull */
+    connectionToken;
     constructor(provider, connectorConfig) {
         this.provider = provider;
         this.currentSkillVersion = readLocalSkillVersion();
         logger.info(TAG, `Local SKILL.md version: ${this.currentSkillVersion ?? 'unknown'}`);
+        this.connectionToken = connectorConfig.token;
         this.connector = new Connector(connectorConfig, {
             onRequest: (frame) => this.handleRequest(frame),
             onStateChange: (state) => this.handleStateChange(state),
@@ -94,6 +97,11 @@ export class Bridge {
         this.startThrottleTimer();
         this.provider.start();
         this.connector.connect();
+        // Fresh installs ship only the thin BOOTSTRAP SKILL.md (v0.0.x) — the full
+        // trading instructions live behind the authenticated webapp endpoint, not
+        // in the public npm package. Fire-and-forget with retries; the relay OTA
+        // path (handleConnectAck) remains the push channel for updates.
+        void this.pullSkillContentFromWebapp();
     }
     /** Stop the bridge: disconnect + stop provider */
     stop() {
@@ -897,6 +905,65 @@ export class Bridge {
         });
         return updateResult;
     }
+    /**
+     * Pull the full SKILL.md from the webapp's authenticated endpoint and apply
+     * it when newer than local. This is how a FRESH install upgrades from the
+     * bundled bootstrap (v0.0.x) to the real trading instructions — the relay's
+     * per-room Durable-Object store is empty for a new user, so the relay push
+     * channel alone can never deliver the first full copy. Token-gated: no valid
+     * rc_ token → 401 → no content (the full SKILL.md never ships unauthenticated).
+     * Same downgrade guard + applySkillUpdate pipeline (incl. the C1 signature
+     * gate when enforced) as the relay pull path.
+     */
+    async pullSkillContentFromWebapp(attempt = 1) {
+        const MAX_ATTEMPTS = 5;
+        // www is load-bearing: reefclaw.com 307-redirects and Node fetch strips the
+        // Authorization header on cross-origin redirect (verified 2026-03-18).
+        const base = (process.env.REEFCLAW_API_URL || 'https://www.reefclaw.com').replace(/\/$/, '');
+        try {
+            const res = await fetch(`${base}/api/internal/skill-content`, {
+                headers: { Authorization: `Bearer ${this.connectionToken}` },
+                signal: AbortSignal.timeout(15_000),
+            });
+            if (res.status === 401 || res.status === 403) {
+                logger.warn(TAG, `SKILL.md webapp pull: not authorized (${res.status}) — connect the account first`);
+                return; // A bad token won't get better by retrying.
+            }
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            const body = (await res.json());
+            if (!body?.version || !body?.content) {
+                logger.warn(TAG, 'SKILL.md webapp pull: response missing version/content');
+                return;
+            }
+            this.currentSkillVersion = readLocalSkillVersion();
+            if (compareSemver(body.version, this.currentSkillVersion) <= 0) {
+                logger.info(TAG, `SKILL.md webapp pull: local v${this.currentSkillVersion ?? 'unknown'} already >= webapp v${body.version} — nothing to do`);
+                return;
+            }
+            logger.info(TAG, `SKILL.md webapp pull: local v${this.currentSkillVersion ?? 'unknown'} behind webapp v${body.version} — applying`);
+            const result = await this.applySkillUpdate({ version: body.version, content: body.content });
+            this.emit('agent_state', 'skill_update_applied', {
+                event: 'skill_update_applied',
+                version: body.version,
+                success: result.success,
+                source: 'webapp_pull',
+                timestamp: new Date().toISOString(),
+            });
+            if (!result.success)
+                logger.error(TAG, `SKILL.md webapp pull: apply failed: ${result.message}`);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (attempt >= MAX_ATTEMPTS) {
+                logger.error(TAG, `SKILL.md webapp pull failed after ${MAX_ATTEMPTS} attempts: ${msg}`);
+                return;
+            }
+            const delayMs = attempt * 30_000;
+            logger.warn(TAG, `SKILL.md webapp pull failed (attempt ${attempt}/${MAX_ATTEMPTS}): ${msg} — retrying in ${delayMs / 1000}s`);
+            setTimeout(() => void this.pullSkillContentFromWebapp(attempt + 1), delayMs).unref?.();
+        }
+    }
     /** Check relay's latest SKILL.md version against local and auto-update if stale */
     async handleConnectAck(payload) {
         const latestVersion = payload.latestSkillVersion;

package/assets/bridge/utils/skill-version.js

@@ -18,7 +18,10 @@ export function readLocalSkillVersion() {
         return null;
     }
 }
-const MAX_SKILL_CONTENT_SIZE = 100_000; // 100KB
+// 120KB — the full SKILL.md crossed 100KB at v2.20.0 (103.7KB), which silently
+// broke every OTA apply against the old 100KB cap. Keep comfortably under the
+// 128KiB Cloudflare Durable-Object per-value hard limit the relay stores into.
+const MAX_SKILL_CONTENT_SIZE = 120_000;
 const SEMVER_REGEX = /^\d+\.\d+\.\d+$/;
 /**
  * Compare two semver strings.