@reefclaw/openclaw-plugin 0.1.14 → 0.1.16

package/risk/pre-trade-check.js

@@ -57,9 +57,22 @@ export function adjustLimitByVol(defaultLimit, volFactor) {
         return defaultLimit;
     return defaultLimit / volFactor;
 }
+/** Strip a CCXT settle suffix ('AVAX/USDC:USDC' → 'AVAX/USDC') before any
+ *  same-symbol comparison. Live adapter positions carry SUFFIXED ccxt symbols
+ *  while the agent's order symbol is canonical/unsuffixed — an exact string
+ *  match therefore NEVER matched on live, so a close-shaped order was
+ *  misclassified as a fresh entry (entry-gated, breaking "exits always work"),
+ *  a flip was never netted, and a scale-in's existing leg was invisible to the
+ *  resulting-notional cap. Paper positions are unsuffixed, so paper was
+ *  unaffected — exactly the CLAUDE.md symbol-normalization trap. Inline copy
+ *  of venues/symbols.ts stripSettleSuffix (module-private there; this module
+ *  stays dependency-light like bracket-ledger.ts). */
+function canonSymbol(symbol) {
+    return symbol.replace(/:[A-Z]+$/, '');
+}
 /** Check if an order is closing an existing position (partial or full). */
 export function isClosingOrder(order, positions) {
-    const pos = positions.find(p => p.symbol === order.symbol);
+    const pos = positions.find(p => canonSymbol(p.symbol) === canonSymbol(order.symbol));
     if (!pos)
         return false;
     // Sell against a long = closing; buy against a short = closing
@@ -103,7 +116,7 @@ export function preTradeRiskCheck(order, portfolio, limits = DEFAULT_PRE_TRADE_L
     //     exposure — even in the RED zone (M6).
     //   - same-direction add (scale-in) / fresh entry → full entry checks (M5).
     // Emergency flatten bypasses this function entirely (EmergencyControls → adapter.createOrder).
-    const closingPos = portfolio.positions.find(p => p.symbol === order.symbol &&
+    const closingPos = portfolio.positions.find(p => canonSymbol(p.symbol) === canonSymbol(order.symbol) &&
         ((p.side === 'long' && order.side === 'sell') || (p.side === 'short' && order.side === 'buy')));
     const flipAmount = closingPos ? order.amount - closingPos.quantity : 0;
     const isFlip = closingPos != null && flipAmount > 1e-9 * Math.max(closingPos.quantity, 1);
@@ -211,7 +224,7 @@ export function preTradeRiskCheck(order, portfolio, limits = DEFAULT_PRE_TRADE_L
     //    is only the new opposite leg (the old leg is closed), so the existing
     //    notional is NOT added there.
     const entryNotional = entryOrder.amount * order.price;
-    const sameSymbolPos = portfolio.positions.find(p => p.symbol === order.symbol);
+    const sameSymbolPos = portfolio.positions.find(p => canonSymbol(p.symbol) === canonSymbol(order.symbol));
     const isScaleIn = sameSymbolPos != null &&
         ((sameSymbolPos.side === 'long' && order.side === 'buy') ||
             (sameSymbolPos.side === 'short' && order.side === 'sell'));
@@ -228,8 +241,8 @@ export function preTradeRiskCheck(order, portfolio, limits = DEFAULT_PRE_TRADE_L
         });
     }
     // 2. Open positions count (would a new symbol exceed limit?)
-    const existingSymbols = new Set(portfolio.positions.map(p => p.symbol));
-    if (!existingSymbols.has(order.symbol)) {
+    const existingSymbols = new Set(portfolio.positions.map(p => canonSymbol(p.symbol)));
+    if (!existingSymbols.has(canonSymbol(order.symbol))) {
         const newCount = existingSymbols.size + 1;
         if (newCount > limits.maxOpenPositions) {
             violations.push({

package/skills/reefclaw/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reefclaw
-version: 0.0.6
+version: 0.0.7
 description: ReefClaw trading control room — bootstrap (connects your agent; full trading instructions arrive automatically after first connect)
 author: ReefClaw
 homepage: https://reefclaw.com
@@ -24,18 +24,13 @@ config:
     description: ReefClaw relay WebSocket URL. Defaults to the production relay when omitted.
 ---
 
-<!-- BOOTSTRAP SKILL.md — this is the thin installer copy shipped in the
-     @reefclaw/connect npm package. It carries ONLY the config schema and the
-     connect instructions. The FULL trading instructions (versioned 2.x.y) are
-     delivered automatically by the ReefClaw connector minutes after the first
-     successful connect, over the authenticated update channel — they replace
-     this file in place (a 0.0.x version always loses the semver comparison).
-     The "Connecting (first run)" section below MUST stay in sync with the
-     same section in skill/SKILL.md. -->
-
 # ReefClaw — Connect Your Agent (Bootstrap)
 
-You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard. This bootstrap file only covers **connecting**; your full trading instructions arrive automatically a few minutes after the connection succeeds.
+## About this file
+
+This is the thin BOOTSTRAP copy shipped in the `@reefclaw/connect` npm package. It covers **installing the ReefClaw plugin and connecting to the user's ReefClaw account** — nothing else. The FULL trading instructions (versioned 2.x.y) are delivered automatically by the ReefClaw connector minutes after the first successful connect, over the authenticated update channel — they replace this file in place (a 0.0.x version always loses the semver comparison). Maintainers: the "Connecting (first run)" section below MUST stay in sync with the same section in `skill/SKILL.md`.
+
+You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard. Some steps below change host configuration or install software; they exist solely to complete the setup **the user initiated by pasting their connect message**. Tell the user what each step changes before you do it, do it only for that user, and revert any temporary permission (like elevated exec) as soon as the install completes.
 
 **Do not attempt to trade before the full instructions arrive.** If trading tools are visible but this file is still a bootstrap version (0.0.x), the connection has not completed — finish connecting first.
 

package/strategy/condition-registry.js

@@ -36,20 +36,27 @@ register('oi_slope', (fact) => ({
     name: 'oi_slope',
     met: fact.conditions.oi_slope_up ?? false,
 }));
-// 5. no_liquidation_cluster — always passes in scan context (no live data)
+// 5. no_liquidation_cluster — FAIL-OPEN PLACEHOLDER in scan context: the
+// fact-computer ships no liquidation data, so this preview cannot evaluate
+// it. `note` marks the gap explicitly (never a silent pass); the
+// authoritative evaluation runs in the central signal engine, which reads the
+// live liquidation-levels feed.
 register('no_liquidation_cluster', () => ({
     name: 'no_liquidation_cluster',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 6. price_sweep
 register('price_sweep', (fact) => ({
     name: 'price_sweep',
     met: (fact.conditions.price_sweep_high ?? false) || (fact.conditions.price_sweep_low ?? false),
 }));
-// 7. liquidations_at_sweep — always passes in scan context
+// 7. liquidations_at_sweep — FAIL-OPEN PLACEHOLDER in scan context, same gap
+// and same note contract as no_liquidation_cluster above.
 register('liquidations_at_sweep', () => ({
     name: 'liquidations_at_sweep',
     met: true,
+    note: 'not evaluated in scan preview (no liquidation data in facts) — authoritative check runs in the signal engine',
 }));
 // 8. order_flow_absorption
 register('order_flow_absorption', (fact) => ({

package/strategy/evaluator.d.ts

@@ -45,6 +45,11 @@ export interface ConditionEvalResult {
     name: string;
     met: boolean;
     value?: number;
+    /** Set when `met` is a fail-open placeholder rather than a real evaluation
+     *  (e.g. the scan facts carry no data for this condition). Surfaces the gap
+     *  to any consumer instead of letting a pass silently impersonate a check —
+     *  the authoritative evaluation runs in the central signal engine. */
+    note?: string;
 }
 export interface StrategyEvalResult {
     strategy: string;

package/tools/cancel-all-orders.js

@@ -1,5 +1,13 @@
 // Tool: cancel_all_orders — cancel all open orders (paper or live)
-// NO readiness gate — emergency control (kill switch), must always work.
+//
+// NO readiness gate and NO confirmation prompt — BY DESIGN, not an oversight:
+// this is the safety floor's kill-switch primitive ("Hard controls NEVER
+// disabled or hidden"). Any gate added here becomes a failure mode of the
+// emergency path itself — a wedged confirmation would strand live orders
+// during the exact incident the kill switch exists for. Risk-reducing only:
+// it cancels WORKING orders; the adapter layer preserves protective bracket
+// legs (parseBracketCid skip in cancelAllOrders) so positions are never left
+// naked, and it never opens or increases exposure.
 export async function cancelAllOrdersTool(args, deps) {
     const cancel = () => deps.adapter.cancelAllOrders(args.symbol);
     return deps.adapter.isLive && deps.operationLock

package/tools/create-order.js

@@ -1008,11 +1008,28 @@ export async function createOrderTool(args, deps) {
         }
         // Bracket enforcement only applies in live mode when the feature is enabled.
         // Paper mode uses the stop-watcher and doesn't care about these flags.
+        //
+        // ★ `brackets.mode` is a BINANCE-only knob — it is only ever passed to
+        // LiveAdapter, and it defaults to 'off'. Gating solely on it meant an HL
+        // live rig skipped the mandatory-stop check entirely: a stopless entry
+        // passed the gate, and HL only attaches legs when stop/target metadata is
+        // present (`wireBracketsAfterSubmit`), so the position went on the book
+        // NAKED. Venues that always enforce brackets declare it on the adapter.
         let bracketEnforcement;
-        if (deps.adapter.isLive && bracketsEnabled(loadBracketMode())) {
+        if (deps.adapter.isLive && (deps.adapter.bracketsAlwaysEnforced || bracketsEnabled(loadBracketMode()))) {
             bracketEnforcement = wave9Claimed
                 ? { requireStopLoss: true, requireTakeProfit: false }
                 : loadBracketRequirements();
+            // On a venue-enforced adapter the stop requirement is NOT operator-
+            // waivable: `requireStopLoss: false` in plugin-config is a Binance-era
+            // toggle whose documented risk assumed a watcher fallback existed. HL has
+            // none — a waved-through stopless entry would sit naked. This also keeps
+            // the gate consistent with get_bracket_config, which reports
+            // requireStopLoss=true for venue-enforced adapters. The TP flag stays
+            // operator-controlled (stop-only "let winners run" is legitimate).
+            if (deps.adapter.bracketsAlwaysEnforced) {
+                bracketEnforcement = { ...bracketEnforcement, requireStopLoss: true };
+            }
         }
         const riskCheck = preTradeRiskCheck(proposed, portfolio, getDefaultPreTradeLimits(), {
             volFactor: !deps.adapter.isLive ? deps.adapter.getSimulator().getVolFactor() : 1.0,

package/tools/get-bracket-config.d.ts

@@ -3,9 +3,28 @@ export interface GetBracketConfigResult {
     mode: BracketMode;
     requireStopLoss: boolean;
     requireTakeProfit: boolean;
+    /** True when the mode reported above is the VENUE's unconditional
+     *  enforcement rather than the `brackets.mode` config value. Lets the
+     *  dashboard explain why the toggles are inert. */
+    venueEnforced?: boolean;
 }
-export declare function getBracketConfigTool(_args: Record<string, never>, deps?: {
+export interface GetBracketConfigDeps {
     configPath?: string;
-}): GetBracketConfigResult | {
+    /** Active adapter. Its `bracketsAlwaysEnforced` capability overrides the
+     *  config-file mode — see below. */
+    adapter?: {
+        readonly bracketsAlwaysEnforced?: boolean;
+    };
+}
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
+export declare function getBracketConfigTool(_args: Record<string, never>, deps?: GetBracketConfigDeps): GetBracketConfigResult | {
     error: string;
 };

package/tools/get-bracket-config.js

@@ -6,13 +6,29 @@
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { getBracketMode, getBracketRequirements } from '../config/brackets-config.js';
 import { formatError } from '../logger.js';
+/**
+ * ★ `brackets.mode` in plugin-config.json is a BINANCE-only lifecycle knob: it
+ * is passed to `LiveAdapter` and nowhere else. Reporting it verbatim made a
+ * Hyperliquid rig — where `HlBracketCoordinator` attaches legs unconditionally
+ * and there is no watcher fallback — render "Brackets off" on a live dashboard
+ * whose every position was in fact bracketed. A protection indicator that
+ * under-reports is exactly as dangerous as one that over-reports, so the
+ * effective venue behaviour wins over the stale config value.
+ */
 export function getBracketConfigTool(_args, deps) {
     try {
         const cfg = readPluginConfig(deps?.configPath);
-        const mode = getBracketMode(cfg);
         const req = getBracketRequirements(cfg);
+        if (deps?.adapter?.bracketsAlwaysEnforced) {
+            return {
+                mode: 'enforce',
+                requireStopLoss: true,
+                requireTakeProfit: req.requireTakeProfit,
+                venueEnforced: true,
+            };
+        }
         return {
-            mode,
+            mode: getBracketMode(cfg),
             requireStopLoss: req.requireStopLoss,
             requireTakeProfit: req.requireTakeProfit,
         };

package/tools/set-trading-mode.js

@@ -4,9 +4,12 @@
 // the one-rung-at-a-time ladder. Requires valid exchange credentials for
 // any non-PAPER target. Rebuilds the adapter via runtime.reconnect().
 //
-// The agent should NOT call this tool; PR2 will enforce operator-only scope
-// in the skill. PR1 leaves the plugin-side handler functional but unguarded
-// because the caller chain is currently controlled end-to-end by the skill.
+// GUARDED at the dispatch site (plugin/src/index.ts registration): every call
+// must carry the `operator_token` provenance proof and is refused by
+// verifyOperatorProvenance without it (audit 2026-07-26 F12). The agent cannot
+// supply that token — chat redaction strips rc_* tokens — so only the
+// dashboard operator path reaches this handler. This module stays guard-free
+// by design: the check lives once, at registration, for all operator tools.
 import { readPluginConfig } from '../config/plugin-config-io.js';
 import { validateModeTransition, modeRequiresCredentials } from '../onboarding/mode-ladder.js';
 import { parseVenue } from '../venues/registry.js';

package/venues/hyperliquid/hl-fill-ingest.js

@@ -40,7 +40,26 @@ export function hlFillToFillEvent(fill, wiring, source) {
         price === undefined || quantity === undefined || quantity <= 0 ||
         time === undefined ||
         (fill.side !== 'A' && fill.side !== 'B')) {
-        logger.warn(TAG, `Dropping unmappable HL fill (source=${source}): ${JSON.stringify(fill).slice(0, 200)}`);
+        // Log the DIAGNOSIS (which identity fields failed + what shape arrived),
+        // never the raw payload — fills carry account trading data that doesn't
+        // belong in journals.
+        const bad = [];
+        if (typeof fill.tid !== 'number' || !Number.isFinite(fill.tid))
+            bad.push('tid');
+        if (typeof fill.oid !== 'number' || !Number.isFinite(fill.oid))
+            bad.push('oid');
+        if (typeof fill.coin !== 'string' || fill.coin.length === 0)
+            bad.push('coin');
+        if (price === undefined)
+            bad.push('px');
+        if (quantity === undefined || quantity <= 0)
+            bad.push('sz');
+        if (time === undefined)
+            bad.push('time');
+        if (fill.side !== 'A' && fill.side !== 'B')
+            bad.push('side');
+        logger.warn(TAG, `Dropping unmappable HL fill (source=${source}): invalid=[${bad.join(',')}] ` +
+            `keys=[${Object.keys(fill).join(',')}]`);
         return null;
     }
     return {

package/venues/hyperliquid/hl-live-adapter.d.ts

@@ -38,6 +38,10 @@ export declare class HyperliquidLiveAdapter extends EventEmitter implements IExc
      *  the exchange-side legs ARE the safety floor. Lazily constructed so that
      *  merely constructing the adapter (registry tests) writes no ledger file. */
     private _coordinator;
+    /** Venue capability (see IExchangeAdapter): brackets are unconditional here,
+     *  so every consumer of `brackets.mode` must read this instead of the
+     *  Binance-only flag. */
+    readonly bracketsAlwaysEnforced = true;
     private userStream;
     private truthCheckTimer;
     private truthCheckRunning;

package/venues/hyperliquid/hl-live-adapter.js

@@ -66,6 +66,10 @@ export class HyperliquidLiveAdapter extends EventEmitter {
      *  the exchange-side legs ARE the safety floor. Lazily constructed so that
      *  merely constructing the adapter (registry tests) writes no ledger file. */
     _coordinator = null;
+    /** Venue capability (see IExchangeAdapter): brackets are unconditional here,
+     *  so every consumer of `brackets.mode` must read this instead of the
+     *  Binance-only flag. */
+    bracketsAlwaysEnforced = true;
     userStream = null;
     truthCheckTimer = null;
     truthCheckRunning = false;

package/venues/registry.js

@@ -1,12 +1,13 @@
 // Venue registry — the single seam where a trading venue's LIVE adapter is
-// constructed (Phase 0 of docs/HYPERLIQUID_INTEGRATION_PLAN.md §5.1/§7.1).
+// constructed (docs/HYPERLIQUID_INTEGRATION_PLAN.md §5.1/§7.1).
 //
-// Phase 0 scope: Binance is the ONLY venue this build can trade live;
-// 'hyperliquid' is a recognised-but-unsupported config value that boot handles
-// by falling back to PAPER (never by crashing register() — OpenClaw treats a
-// throwing register as "ignored" and the agent silently loses every tool).
-// Phase 3 adds the HyperliquidLiveAdapter arm HERE and nowhere else, so the
-// boot path never grows a second venue branch.
+// This build trades live on BOTH supported venues: Binance (LiveAdapter) and
+// Hyperliquid (HyperliquidLiveAdapter, Phase 3 — brackets always enforced by
+// HlBracketCoordinator). A venue with missing/invalid credentials falls back
+// to PAPER at boot (never by crashing register() — OpenClaw treats a throwing
+// register as "ignored" and the agent silently loses every tool). Any future
+// venue adds its arm HERE and nowhere else, so the boot path never grows a
+// second venue branch.
 //
 // Venue is LOCAL mechanism (TOOL_DISTRIBUTION_ARCHITECTURE.md §2 decision
 // rule: it holds keys + is part of the safety floor) — it is read from

package/wave9/paper-admission-guard.d.ts

@@ -1,7 +1,18 @@
 import type { IExchangeAdapter } from '../exchange-adapter.js';
 /** One catalog toggle represents both frozen Wave 9 strategy legs. */
 export declare const WAVE9_BUNDLE_SETUP_TYPE = "wave9_28d_momentum_reversal";
+/** TOOL-level close reason: what close_position args + beginExit redemption
+ *  requests must carry. The `wave9_` namespace keeps it from colliding with
+ *  generic CloseReason values. */
 export declare const WAVE9_MECHANICAL_EXIT_REASON = "wave9_signal_reversal";
+/** DECISION-level exit cause: what the authorization decision
+ *  (Wave9PaperExitTokenDecision.reason) records at issuance. Deliberately a
+ *  DIFFERENT string from WAVE9_MECHANICAL_EXIT_REASON — the decision names
+ *  WHY the strategy exits (its only exit cause is a signal reversal), the
+ *  tool reason names WHICH namespaced close path redeems it. issueExitBatch
+ *  validates this constant; beginExit validates the tool constant. Two fields
+ *  on two layers, each checked against its own value — not an asymmetry. */
+export declare const WAVE9_EXIT_DECISION_REASON = "signal_reversal";
 export type Wave9ExecutionMode = 'PAPER' | 'LIVE';
 /** Conservative shared identity check for current, legacy, or Wave 9-mission positions. */
 export declare function isWave9ManagedPosition(position: {
@@ -93,7 +104,7 @@ export interface Wave9PaperExitTokenDecision {
     missionId: string;
     symbol: string;
     positionSide: 'long' | 'short';
-    reason: 'signal_reversal';
+    reason: typeof WAVE9_EXIT_DECISION_REASON;
     notBeforeMs: number;
     deadlineMs: number;
     positionFingerprint: string;

package/wave9/paper-admission-guard.js

@@ -2,7 +2,18 @@ import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { WAVE9_SYMBOL_PRIORITY } from '../portfolio/wave9-policy.js';
 /** One catalog toggle represents both frozen Wave 9 strategy legs. */
 export const WAVE9_BUNDLE_SETUP_TYPE = 'wave9_28d_momentum_reversal';
+/** TOOL-level close reason: what close_position args + beginExit redemption
+ *  requests must carry. The `wave9_` namespace keeps it from colliding with
+ *  generic CloseReason values. */
 export const WAVE9_MECHANICAL_EXIT_REASON = 'wave9_signal_reversal';
+/** DECISION-level exit cause: what the authorization decision
+ *  (Wave9PaperExitTokenDecision.reason) records at issuance. Deliberately a
+ *  DIFFERENT string from WAVE9_MECHANICAL_EXIT_REASON — the decision names
+ *  WHY the strategy exits (its only exit cause is a signal reversal), the
+ *  tool reason names WHICH namespaced close path redeems it. issueExitBatch
+ *  validates this constant; beginExit validates the tool constant. Two fields
+ *  on two layers, each checked against its own value — not an asymmetry. */
+export const WAVE9_EXIT_DECISION_REASON = 'signal_reversal';
 /** Conservative shared identity check for current, legacy, or Wave 9-mission positions. */
 export function isWave9ManagedPosition(position) {
     return position.setupType === WAVE9_BUNDLE_SETUP_TYPE
@@ -615,7 +626,7 @@ export class Wave9PaperAdmissionGuard {
         exactText(decision.candidateId, 'exit candidateId');
         exactText(decision.missionId, 'missionId');
         requireExecutionMode(decision.tradingMode);
-        if (decision.reason !== 'signal_reversal')
+        if (decision.reason !== WAVE9_EXIT_DECISION_REASON)
             throw new Wave9PaperAdmissionGuardError('Wave 9 exit reason must be signal_reversal');
         if (!WAVE9_SYMBOL_PRIORITY.includes(decision.symbol)) {
             throw new Wave9PaperAdmissionGuardError(`unsupported Wave 9 symbol ${decision.symbol}`);

package/scripts/assemble.mjs

@@ -1,130 +0,0 @@
-// Assemble the publishable @reefclaw/openclaw-plugin package tree.
-//
-// This is the npm-channel distribution of the plugin — installable with ZERO
-// terminal access via OpenClaw's owner chat command:
-//   /plugins install npm:@reefclaw/openclaw-plugin
-// (requires commands.plugins: true; the install auto-restarts the gateway).
-//
-// Layout produced IN THIS DIRECTORY (package root = plugin dist root, because
-// openclaw.extensions points at ./index.js):
-//   index.js + rest of plugin/dist   — the plugin, at package root
-//   openclaw.plugin.json             — manifest + `skills` declaration (npm
-//                                      package only — the npx-installer copy
-//                                      has no skills/ subdir)
-//   bridge/                          — the connector (skill dist); the plugin's
-//                                      connector-supervisor auto-starts it when
-//                                      bundled (see connector-supervisor.ts)
-//   skills/reefclaw/SKILL.md         — the thin bootstrap skill (full playbook
-//                                      arrives token-gated post-connect)
-// Runtime deps (ccxt/ws/json5/@reefclaw/shared) are REAL npm dependencies —
-// OpenClaw's plugin installer runs the package manager, unlike gateway boot.
-
-import { cpSync, existsSync, rmSync, mkdirSync, readdirSync, statSync, readFileSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const here = dirname(fileURLToPath(import.meta.url)); // plugin-package/scripts
-const pkgRoot = join(here, '..');
-const repoRoot = join(pkgRoot, '..');
-
-function skip(name) {
-  return (
-    name === '__tests__' ||
-    name.endsWith('.test.js') ||
-    name.endsWith('.test.d.ts') ||
-    name.endsWith('.map') ||
-    name.endsWith('.tsbuildinfo')
-  );
-}
-
-function copyTree(from, to) {
-  mkdirSync(to, { recursive: true });
-  for (const entry of readdirSync(from)) {
-    if (skip(entry)) continue;
-    const s = join(from, entry);
-    const d = join(to, entry);
-    if (statSync(s).isDirectory()) copyTree(s, d);
-    else cpSync(s, d);
-  }
-}
-
-// Clean previous assembly output (everything except the package sources).
-const KEEP = new Set(['package.json', 'scripts', 'README.md', 'node_modules', '.gitignore']);
-for (const entry of readdirSync(pkgRoot)) {
-  if (!KEEP.has(entry)) rmSync(join(pkgRoot, entry), { recursive: true, force: true });
-}
-
-let missing = 0;
-
-// 1. Plugin dist at package root.
-const pluginDist = join(repoRoot, 'plugin', 'dist');
-if (!existsSync(pluginDist)) {
-  console.error('[assemble] missing plugin/dist — build the plugin first.');
-  missing += 1;
-} else {
-  copyTree(pluginDist, pkgRoot);
-  console.log('[assemble] plugin/dist -> package root');
-}
-
-// 2. Manifest, with the `skills` declaration injected (npm package only) and the
-//    release version stamped from THIS package's package.json.
-//
-//    package.json#version is the authoritative release version — that is what
-//    ClawHub's `package-manifest-version-drift` rule compares against, and what
-//    OpenClaw's own `openclaw plugins build` writes into the manifest. The repo
-//    manifest (plugin/openclaw.plugin.json) carries a workspace-local version
-//    nobody bumps at release time, so copying it verbatim published
-//    manifest:0.1.0 against package:0.1.7 and tripped the validator. Deriving it
-//    here makes that drift structurally impossible instead of a bump to remember.
-const manifestSrc = join(repoRoot, 'plugin', 'openclaw.plugin.json');
-const pkgVersion = JSON.parse(readFileSync(join(pkgRoot, 'package.json'), 'utf-8')).version;
-if (!existsSync(manifestSrc)) {
-  console.error('[assemble] missing plugin/openclaw.plugin.json.');
-  missing += 1;
-} else if (typeof pkgVersion !== 'string' || pkgVersion.length === 0) {
-  console.error('[assemble] package.json has no version — cannot stamp the manifest.');
-  missing += 1;
-} else {
-  const manifest = JSON.parse(readFileSync(manifestSrc, 'utf-8'));
-  manifest.version = pkgVersion;
-  manifest.skills = ['./skills'];
-  writeFileSync(join(pkgRoot, 'openclaw.plugin.json'), JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
-  console.log(
-    `[assemble] manifest v${pkgVersion} (+skills decl), ${manifest.contracts?.tools?.length ?? 0} contract tools`,
-  );
-}
-
-// 3. The connector, bundled — this is what flips the supervisor's auto-start.
-const skillDist = join(repoRoot, 'skill', 'dist');
-if (!existsSync(skillDist)) {
-  console.error('[assemble] missing skill/dist — build the skill first.');
-  missing += 1;
-} else {
-  copyTree(skillDist, join(pkgRoot, 'bridge'));
-  console.log('[assemble] skill/dist -> bridge/');
-}
-
-// 4. Bootstrap skill (config schema + connect instructions only — never the
-//    full trading playbook; that stays token-gated behind the webapp).
-const bootstrap = join(repoRoot, 'skill', 'SKILL-bootstrap.md');
-if (!existsSync(bootstrap)) {
-  console.error('[assemble] missing skill/SKILL-bootstrap.md.');
-  missing += 1;
-} else {
-  const size = statSync(bootstrap).size;
-  if (size > 20_000) {
-    console.error(`[assemble] bootstrap is ${size} bytes (>20KB) — is this the FULL SKILL.md? Refusing.`);
-    missing += 1;
-  } else {
-    mkdirSync(join(pkgRoot, 'skills', 'reefclaw'), { recursive: true });
-    cpSync(bootstrap, join(pkgRoot, 'skills', 'reefclaw', 'SKILL.md'));
-    console.log(`[assemble] bootstrap skill (${size} bytes) -> skills/reefclaw/SKILL.md`);
-  }
-}
-
-if (missing > 0) {
-  console.error(`[assemble] ${missing} input(s) missing — package INCOMPLETE; do not publish.`);
-  process.exitCode = 1;
-} else {
-  console.log('[assemble] package complete.');
-}