@reefclaw/openclaw-plugin 0.1.16 → 0.1.17

package/bridge/bridge.js

@@ -788,7 +788,11 @@ export class Bridge {
             // 0. SIGNATURE GATE (C1) — verify BEFORE touching disk. The relay is a
             //    dumb transport: only a payload signed by the operator's offline key
             //    is applied. Fail closed when enforced.
-            if (signatureRequired()) {
+            // A PRESENT signature is ALWAYS verified, enforcement flag or not: the
+            // break-glass exists to tolerate an update that arrives unsigned, never to
+            // accept one whose signature fails. Otherwise `=off` would downgrade a
+            // forged-signature attack into an applied update.
+            if (signatureRequired() || env.signature) {
                 const verdict = verifySkillSignature(env);
                 if (!verdict.ok) {
                     logger.error(TAG, `OTA SKILL.md REJECTED (signature): ${verdict.reason}`);
@@ -802,10 +806,10 @@ export class Bridge {
                 }
                 signatureVerified = true;
             }
-            else if (!env.signature) {
-                // C1 (signed OTA) is ON HOLD → verification off by default, so OTA works
-                // unsigned as before. To enforce: pin a key + SKILL_OTA_REQUIRE_SIGNATURE=on.
-                logger.warn(TAG, 'OTA SKILL.md applied WITHOUT signature verification — signed-OTA (C1) is disabled');
+            else {
+                // Unsigned AND the operator explicitly set SKILL_OTA_REQUIRE_SIGNATURE=off.
+                logger.warn(TAG, 'OTA SKILL.md applied WITHOUT signature verification — SKILL_OTA_REQUIRE_SIGNATURE=off. ' +
+                    'This accepts instructions nobody signed; unset the flag to restore the default (enforced).');
             }
             // 1. Validate content
             const validation = validateSkillContent(content);
@@ -1043,7 +1047,15 @@ export class Bridge {
             else {
                 logger.info(TAG, `SKILL.md webapp pull: local v${this.currentSkillVersion ?? 'unknown'} behind webapp v${body.version} — applying`);
             }
-            const result = await this.applySkillUpdate({ version: body.version, content: body.content });
+            // Carry the offline signature through so the C1 gate can verify it. The
+            // webapp holds no signing key — it only relays what was signed offline.
+            const result = await this.applySkillUpdate({
+                version: body.version,
+                content: body.content,
+                contentSha256: body.contentSha256,
+                signedAt: body.signedAt,
+                signature: body.signature,
+            });
             this.emit('agent_state', 'skill_update_applied', {
                 event: 'skill_update_applied',
                 version: body.version,

package/bridge/config.d.ts

@@ -11,13 +11,27 @@ export declare function readOpenClawConfig(): {
     userId?: string;
     relayUrl?: string;
 } | null;
-/** Write/merge token (and optional fields) into OpenClaw config */
+/** Write/merge the ReefClaw connection (token + optional userId/relayUrl) into
+ *  OpenClaw's config. Touches nothing else — see the scope contract above. */
 export declare function writeOpenClawConfig(token: string, userId?: string, relayUrl?: string): void;
+/** True when the bridge lacks the write scope it needs to trade — i.e. the
+ *  gateway granted a scope set without `operator.write`. Read from the
+ *  handshake, so it reflects what the gateway ACTUALLY did, not a version
+ *  guess. An empty/absent list is treated as "no evidence" (not a downgrade
+ *  trigger): some builds omit the field, and acting on silence would recreate
+ *  the speculative relaxation this replaced. */
+export declare function handshakeLacksWriteScope(scopes: readonly string[] | undefined): boolean;
 /**
- * Check and fix gateway scope config on startup. Runs once — reads openclaw.json,
- * applies missing settings if needed, writes back. No-op if already correct.
+ * LAST RESORT: relax the local gateway's device-identity auth because a
+ * completed handshake proved the gateway is withholding `operator.write`
+ * (without it the bridge cannot place or cancel orders). Idempotent, and a
+ * no-op once the flags are set — so it warns exactly once per box, at the
+ * moment the need is demonstrated.
+ *
+ * Returns true if it changed the config (⇒ the gateway must be restarted for
+ * the flags to take effect; they are read at gateway boot).
  */
-export declare function ensureGatewayScopeConfigOnStartup(): void;
+export declare function relaxGatewayDeviceAuth(reason: string): boolean;
 export interface CliArgs {
     provider: 'mock' | 'gateway';
     token?: string;

package/bridge/config.js

@@ -12,11 +12,18 @@ const CONFIG_PATH = join(OPENCLAW_DIR, 'openclaw.json');
 const DEFAULT_RELAY_URL = 'wss://reefclaw.radunlupsa.partykit.dev';
 // ---- Read/write OpenClaw config ----
 //
-// Scope contract: these helpers touch ONLY the ReefClaw skill entry
-// (skills.entries.reefclaw.config — the token/userId/relayUrl the USER pasted
-// during onboarding) and preserve every other key verbatim. They exist so the
-// connector can pick up a connection the user saved via chat and persist it
-// across restarts — not to manage OpenClaw's own configuration.
+// Scope contract — writeOpenClawConfig touches ONLY
+// skills.entries.reefclaw.config (the token/userId/relayUrl the USER pasted
+// during onboarding, so the connector can pick the connection up and persist
+// it across restarts). Every other key in the file is preserved verbatim.
+//
+// It deliberately does NOT weaken the local gateway's auth. Until 2026-07-29
+// it also set gateway.controlUi.{dangerouslyDisableDeviceAuth,
+// allowInsecureAuth} = true on EVERY write — a security-relevant downgrade of
+// the user's own gateway, applied pre-emptively whether or not their OpenClaw
+// needed it. That relaxation now happens only on PROVEN need, via
+// relaxGatewayDeviceAuth() below, which the bridge calls if and only if a
+// completed handshake shows the gateway actually withheld `operator.write`.
 /** Read the OpenClaw config file and extract ReefClaw skill settings.
  *  Prefers the schema-valid nested shape (entry.config.*), falls back to the
  *  legacy flat shape per-field. */
@@ -40,7 +47,8 @@ export function readOpenClawConfig() {
         return null;
     }
 }
-/** Write/merge token (and optional fields) into OpenClaw config */
+/** Write/merge the ReefClaw connection (token + optional userId/relayUrl) into
+ *  OpenClaw's config. Touches nothing else — see the scope contract above. */
 export function writeOpenClawConfig(token, userId, relayUrl) {
     let config = {};
     // Read existing config to merge
@@ -72,9 +80,8 @@ export function writeOpenClawConfig(token, userId, relayUrl) {
     delete entry.token;
     delete entry.userId;
     delete entry.relayUrl;
-    // Ensure gateway.controlUi settings for OpenClaw v2026.4.2+ scope compatibility.
-    // Without these, the skill's WS connection gets scopes cleared (missing scope: operator.write).
-    ensureGatewayScopeConfig(config);
+    // NOTE: no gateway.controlUi relaxation here. Saving a connection must not
+    // change the user's gateway security posture — see relaxGatewayDeviceAuth().
     // Write — file holds the connection token, so restrict to owner.
     mkdirSync(OPENCLAW_DIR, { recursive: true, mode: 0o700 });
     writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
@@ -97,13 +104,26 @@ function restrictConfigPermissions() {
         logger.debug(TAG, `Could not chmod ${CONFIG_PATH} to 0600: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-// ---- Gateway scope compatibility (OpenClaw v2026.4.2+) ----
-/**
- * Ensure gateway.controlUi has the required settings for WS scope preservation.
- * Without these, OpenClaw v2026.4.2+ clears operator.write scopes on connections
- * without device identity, breaking mission presentation and chat RPCs.
- */
-function ensureGatewayScopeConfig(config) {
+// ---- Gateway device-auth relaxation (LAST RESORT, proven need only) ----
+//
+// Some OpenClaw builds (observed on v2026.4.2) clear `operator.write` from a WS
+// connection that carries no device identity — the bridge then cannot place or
+// cancel orders. The historical workaround was to set
+// gateway.controlUi.{dangerouslyDisableDeviceAuth, allowInsecureAuth} = true
+// on every install and every config save, whether or not the user's OpenClaw
+// actually behaved that way. That is a real downgrade of the user's gateway
+// applied on speculation, and the flag name says so.
+//
+// Since 2026-07-29 the relaxation is applied ONLY when a completed handshake
+// proves it is needed: the bridge inspects the granted scopes from hello-ok and
+// calls relaxGatewayDeviceAuth() if `operator.write` is missing. On the
+// supported range (the plugin's compat floor is pluginApi >=2026.6.0) the
+// handshake keeps its scopes and these flags are never written at all. Boxes
+// that already have them keep them — nothing here removes an existing flag,
+// because clearing it mid-session would strip the running bridge's scopes.
+/** Set the two relaxation flags on an in-memory config. Returns true if either
+ *  changed, so callers only write + disclose when something actually flipped. */
+function applyGatewayAuthRelaxation(config) {
     if (!config.gateway)
         config.gateway = {};
     const gw = config.gateway;
@@ -119,32 +139,49 @@ function ensureGatewayScopeConfig(config) {
         cui.allowInsecureAuth = true;
         changed = true;
     }
-    // Write-once: only flip (and disclose) when a flag was absent/false, so the
-    // security-relevant downgrade is announced the one time it actually happens,
-    // never on every boot. These flags relax the local gateway's device-identity
-    // auth (required for OpenClaw v2026.4.2+ WS scope preservation) — the
-    // operator should know they were set.
-    if (changed) {
-        logger.warn(TAG, 'Enabled gateway.controlUi.{dangerouslyDisableDeviceAuth,allowInsecureAuth} — this relaxes local gateway device-identity auth (needed for OpenClaw v2026.4.2+ WS scope preservation). Keep the gateway bound to localhost.');
-    }
     return changed;
 }
+/** True when the bridge lacks the write scope it needs to trade — i.e. the
+ *  gateway granted a scope set without `operator.write`. Read from the
+ *  handshake, so it reflects what the gateway ACTUALLY did, not a version
+ *  guess. An empty/absent list is treated as "no evidence" (not a downgrade
+ *  trigger): some builds omit the field, and acting on silence would recreate
+ *  the speculative relaxation this replaced. */
+export function handshakeLacksWriteScope(scopes) {
+    if (!Array.isArray(scopes) || scopes.length === 0)
+        return false;
+    return !scopes.includes('operator.write');
+}
 /**
- * Check and fix gateway scope config on startup. Runs once — reads openclaw.json,
- * applies missing settings if needed, writes back. No-op if already correct.
+ * LAST RESORT: relax the local gateway's device-identity auth because a
+ * completed handshake proved the gateway is withholding `operator.write`
+ * (without it the bridge cannot place or cancel orders). Idempotent, and a
+ * no-op once the flags are set — so it warns exactly once per box, at the
+ * moment the need is demonstrated.
+ *
+ * Returns true if it changed the config (⇒ the gateway must be restarted for
+ * the flags to take effect; they are read at gateway boot).
  */
-export function ensureGatewayScopeConfigOnStartup() {
+export function relaxGatewayDeviceAuth(reason) {
     try {
         const raw = readFileSync(CONFIG_PATH, 'utf-8');
         const config = JSON5.parse(raw);
-        if (ensureGatewayScopeConfig(config)) {
-            writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
-            restrictConfigPermissions(); // mode above is ignored on an existing file
-            logger.info(TAG, 'Applied gateway scope config for OpenClaw v2026.4.2+ compatibility');
-        }
+        if (!applyGatewayAuthRelaxation(config))
+            return false; // already relaxed
+        writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
+        restrictConfigPermissions(); // mode above is ignored on an existing file
+        logger.warn(TAG, `Enabled gateway.controlUi.{dangerouslyDisableDeviceAuth,allowInsecureAuth} in ` +
+            `${CONFIG_PATH} because ${reason}. This RELAXES your local gateway's ` +
+            `device-identity auth — it is the only way this OpenClaw build will keep ` +
+            `operator.write on the bridge connection, which trading requires. Keep the ` +
+            `gateway bound to localhost. RESTART the gateway for it to take effect. If ` +
+            `you would rather not run with it, upgrade OpenClaw (builds meeting the ` +
+            `plugin's compat floor keep the scope without this) and remove both flags.`);
+        return true;
     }
     catch {
-        // Config doesn't exist or can't be parsed — skip (setup hasn't run yet)
+        // Config missing/unparseable — setup hasn't run yet; nothing to relax.
+        return false;
     }
 }
 /**

package/bridge/index.js

@@ -14,7 +14,7 @@ import { logger, setLogLevel } from './logger.js';
 import { Bridge } from './bridge.js';
 import { MockProvider } from './providers/mock.js';
 import { GatewayProvider } from './providers/gateway.js';
-import { resolveConfig, ensureGatewayScopeConfigOnStartup } from './config.js';
+import { resolveConfig } from './config.js';
 import { resolveGatewayConfig, validateGatewayConfig } from './gateway/gateway-config.js';
 import { runSetup } from './setup.js';
 const TAG = 'main';
@@ -150,7 +150,6 @@ Gateway config resolution (for --provider gateway):
 // ---- Main ----
 async function main() {
     loadEnvFile();
-    ensureGatewayScopeConfigOnStartup();
     const { cli: args, gateway: gatewayArgs } = parseArgs();
     if (args.logLevel) {
         setLogLevel(args.logLevel);

package/bridge/providers/gateway.d.ts

@@ -245,6 +245,16 @@ export declare class GatewayProvider implements OpenClawProvider {
     private startToolRetry;
     private createPoller;
     private wireWsEvents;
+    /** Whether we've already acted on a missing write scope this process. */
+    private writeScopeRelaxationApplied;
+    /** Least-privilege escalation, gated on evidence. Some OpenClaw builds strip
+     *  `operator.write` from a WS connection with no device identity; without it
+     *  the bridge cannot place or cancel orders. Rather than pre-emptively
+     *  relaxing every user's gateway auth at install time (what we did until
+     *  2026-07-29), we read the scopes the gateway ACTUALLY granted and relax
+     *  only when it demonstrably withheld the one we need. On the supported
+     *  range the scope survives and nothing is written. */
+    private checkGrantedScopes;
     private onWsConnected;
     private onAgentEvent;
     private onPollerTicker;

package/bridge/providers/gateway.js

@@ -6,6 +6,7 @@ import { join } from 'path';
 import { homedir } from 'os';
 import { logger, formatError } from '../logger.js';
 import { isTradingMode } from '../types.js';
+import { handshakeLacksWriteScope, relaxGatewayDeviceAuth } from '../config.js';
 import { toIntelSymbol } from '@reefclaw/shared';
 import { GatewayHttpClient } from '../gateway/gateway-http-client.js';
 import { GatewayWsClient } from '../gateway/gateway-ws-client.js';
@@ -1001,6 +1002,10 @@ export class GatewayProvider {
                 if (token) {
                     logger.info(TAG, 'Got device token from WS handshake');
                 }
+                // FIRST handshake of the process — the one that matters on a fresh
+                // install. onWsConnected() only fires on RECONNECT, so without this the
+                // proven-need scope check would never run on a box that needs it.
+                this.checkGrantedScopes(helloOk);
                 settle(token);
             };
             const onFailed = () => {
@@ -1140,6 +1145,35 @@ export class GatewayProvider {
         });
         this.wsClient.on('agent', (payload) => this.onAgentEvent(payload));
     }
+    /** Whether we've already acted on a missing write scope this process. */
+    writeScopeRelaxationApplied = false;
+    /** Least-privilege escalation, gated on evidence. Some OpenClaw builds strip
+     *  `operator.write` from a WS connection with no device identity; without it
+     *  the bridge cannot place or cancel orders. Rather than pre-emptively
+     *  relaxing every user's gateway auth at install time (what we did until
+     *  2026-07-29), we read the scopes the gateway ACTUALLY granted and relax
+     *  only when it demonstrably withheld the one we need. On the supported
+     *  range the scope survives and nothing is written. */
+    checkGrantedScopes(helloOk) {
+        const scopes = helloOk.auth?.scopes;
+        if (!handshakeLacksWriteScope(scopes))
+            return;
+        if (this.writeScopeRelaxationApplied)
+            return;
+        this.writeScopeRelaxationApplied = true;
+        logger.warn(TAG, `Gateway granted [${(scopes ?? []).join(', ')}] — operator.write is MISSING, ` +
+            `so order placement and cancellation would fail on this connection.`);
+        const changed = relaxGatewayDeviceAuth('the gateway completed a handshake without granting operator.write');
+        if (changed) {
+            logger.warn(TAG, 'Gateway config updated — RESTART the OpenClaw gateway to regain operator.write. ' +
+                'Trading tools will keep failing until you do.');
+        }
+        else {
+            logger.error(TAG, 'operator.write is missing and the relaxation flags are ALREADY set — this is ' +
+                'not the known device-identity case. Check gateway auth config; trading is ' +
+                'blocked until the gateway grants operator.write.');
+        }
+    }
     onWsConnected(helloOk) {
         if (!this.started)
             return; // Guard: stop() called before WS connected
@@ -1153,6 +1187,7 @@ export class GatewayProvider {
         if (helloOk.auth?.deviceToken && this.http) {
             this.http.setToken(helloOk.auth.deviceToken);
         }
+        this.checkGrantedScopes(helloOk);
         // Resume poller on reconnect (initial poller creation is in initialize())
         if (this.poller) {
             this.poller.resume();

package/bridge/utils/skill-signing.d.ts

@@ -24,15 +24,24 @@ export declare function signedMessage(version: string, contentSha256: string, si
 /**
  * Is OTA signature verification enforced?
  *
- * Default **OFF** while C1 (signed OTA) is ON HOLD — see
- * docs/PRE_LAUNCH_SECURITY_HARDENING.md §2.5. Keeping it off by default makes
- * this whole module DORMANT, so deploying skill/relay for UNRELATED reasons can
- * never break the existing (unsigned) OTA flow — no env flag to remember.
+ * **Default ON since 2026-07-29** — C1 is live. A SKILL.md update is applied
+ * only if it carries a valid Ed25519 signature from a key pinned in
+ * TRUSTED_SKILL_SIGNING_KEYS above, whose private half exists only on the
+ * operator's machine. Neither the relay, the webapp, nor CI can forge one, so a
+ * compromise of any of them cannot rewrite an agent's trading instructions.
  *
- * To ENABLE signed-OTA (when the agent-update mechanism is finalized): pin a
- * public key in TRUSTED_SKILL_SIGNING_KEYS **and** set
- * SKILL_OTA_REQUIRE_SIGNATURE=on. Both are required — a pinned key alone does
- * nothing without the flag, and the flag alone fails closed (no key → reject).
+ * ★ RELEASE ORDER (load-bearing): the content endpoint must be serving
+ * signatures BEFORE a build with this default reaches boxes. Deploy the webapp
+ * first (its build step verifies the signature and fails on mismatch), confirm
+ * GET /api/internal/skill-content returns `signature`, and only then publish the
+ * plugin/bridge. Ship them the other way round and every box rejects its
+ * instructions and stays on the bootstrap skill.
+ *
+ * Break-glass: SKILL_OTA_REQUIRE_SIGNATURE=off restores the old unsigned
+ * behaviour on a single box. It is a diagnostic escape hatch for the operator,
+ * not a supported mode — an unsigned update is exactly what this gate exists to
+ * refuse. Note the flag alone cannot weaken a *bad* signature: an update that
+ * carries an INVALID signature is refused regardless of this setting.
  */
 export declare function signatureRequired(): boolean;
 /**

package/bridge/utils/skill-signing.js

@@ -34,7 +34,11 @@ import { parseSkillVersion } from './skill-version.js';
  * one — see the header for provisioning.
  */
 export const TRUSTED_SKILL_SIGNING_KEYS = [
-// 'Base64OfRaw32BytePublicKey=' ← paste from scripts/gen-skill-signing-key.py
+    // Pinned 2026-07-29. Private half lives ONLY in the operator's .env.deploy
+    // (gitignored, never on a server or in CI) — scripts/rotate-skill-signing-key.py
+    // writes it without printing it. Rotation: ADD the new key here, ship the
+    // build to every box, re-sign, then remove the old entry.
+    '3ptLQsSKT9/8GX4yTeRagGpXO5yCEdjVMnDex/qV66M=',
 ];
 const OTA_STATE_PATH = join(homedir(), '.openclaw', 'workspace', '.skill-ota-state.json');
 /** Lowercase hex SHA-256 of the UTF-8 content. MUST match the Python signer. */
@@ -48,18 +52,27 @@ export function signedMessage(version, contentSha256, signedAt) {
 /**
  * Is OTA signature verification enforced?
  *
- * Default **OFF** while C1 (signed OTA) is ON HOLD — see
- * docs/PRE_LAUNCH_SECURITY_HARDENING.md §2.5. Keeping it off by default makes
- * this whole module DORMANT, so deploying skill/relay for UNRELATED reasons can
- * never break the existing (unsigned) OTA flow — no env flag to remember.
+ * **Default ON since 2026-07-29** — C1 is live. A SKILL.md update is applied
+ * only if it carries a valid Ed25519 signature from a key pinned in
+ * TRUSTED_SKILL_SIGNING_KEYS above, whose private half exists only on the
+ * operator's machine. Neither the relay, the webapp, nor CI can forge one, so a
+ * compromise of any of them cannot rewrite an agent's trading instructions.
  *
- * To ENABLE signed-OTA (when the agent-update mechanism is finalized): pin a
- * public key in TRUSTED_SKILL_SIGNING_KEYS **and** set
- * SKILL_OTA_REQUIRE_SIGNATURE=on. Both are required — a pinned key alone does
- * nothing without the flag, and the flag alone fails closed (no key → reject).
+ * ★ RELEASE ORDER (load-bearing): the content endpoint must be serving
+ * signatures BEFORE a build with this default reaches boxes. Deploy the webapp
+ * first (its build step verifies the signature and fails on mismatch), confirm
+ * GET /api/internal/skill-content returns `signature`, and only then publish the
+ * plugin/bridge. Ship them the other way round and every box rejects its
+ * instructions and stays on the bootstrap skill.
+ *
+ * Break-glass: SKILL_OTA_REQUIRE_SIGNATURE=off restores the old unsigned
+ * behaviour on a single box. It is a diagnostic escape hatch for the operator,
+ * not a supported mode — an unsigned update is exactly what this gate exists to
+ * refuse. Note the flag alone cannot weaken a *bad* signature: an update that
+ * carries an INVALID signature is refused regardless of this setting.
  */
 export function signatureRequired() {
-    return (process.env.SKILL_OTA_REQUIRE_SIGNATURE ?? 'off').toLowerCase() === 'on';
+    return (process.env.SKILL_OTA_REQUIRE_SIGNATURE ?? 'on').toLowerCase() !== 'off';
 }
 function publicKeyFromRawB64(b64) {
     try {

package/ccxt/binance-private.js

@@ -101,54 +101,25 @@ export class BinancePrivateApi {
         if (this.testnet) {
             this.exchange.setSandboxMode(true);
         }
-        // ---- WIDENED CANCEL TRACER (2026-05-16) ------------------------------
-        // The narrow chokepoint (fapiPrivateDeleteAlgoOrder + the
-        // cancelOrderByClientId ATTRIBUTION) is deployed and PROVEN working
-        // (it caught the one bracket_integrity flush with a full stack) yet is
-        // SILENT for the recurring ~20s rc-* bracket kills — while a clean
-        // NON-rc closePosition STOP+TP pair, identical in shape to the agent's,
-        // survived 3.6 min untouched on the SAME symbol (controlled prod test
-        // 2026-05-16). => the kill is keyed to the rc-* cid and BYPASSES every
-        // BinancePrivateApi cancel method, i.e. something cancels directly on
-        // the raw ccxt client. Wrap EVERY cancel surface on the raw instance so
-        // no caller (this class, the reconciler, the agent, a ccxt cross-call,
-        // anything holding `exchange`) can bypass it; log method + args + full
-        // caller stack. Pure observability — each wrapper calls straight through
-        // (same `this`, same return Promise), zero behaviour change. Remove
-        // once the proven source is fixed and soaked.
-        {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const ex = this.exchange;
-            const cancelSurfaces = [
-                'cancelOrder', 'cancelOrders', 'cancelAllOrders', 'cancelOrdersForSymbols',
-                'fapiPrivateDeleteOrder', 'fapiPrivateDeleteAllOpenOrders',
-                'fapiPrivateDeleteAlgoOrder', 'fapiPrivateDeleteBatchOrders',
-                'fapiPrivateDeleteAlgoFuturesOrder',
-            ];
-            let armed = 0;
-            for (const m of cancelSurfaces) {
-                const orig = ex[m];
-                if (typeof orig !== 'function')
-                    continue;
-                ex[m] = (...args) => {
-                    let argStr;
-                    try {
-                        argStr = JSON.stringify(args).slice(0, 600);
-                    }
-                    catch {
-                        argStr = '(unserializable)';
-                    }
-                    const stack = new Error('wide-cancel-trace').stack ?? '(no stack)';
-                    logger.warn(TAG, `WIDE-CANCEL-TRACE — raw ccxt ${m}(${argStr}) invoked. If this ` +
-                        `carries an rc-*-{s,t} cid/algoId, THIS is the bracket ` +
-                        `stripper (the narrow chokepoint never sees it). Caller ` +
-                        `stack follows:\n${stack}`);
-                    return orig.apply(ex, args);
-                };
-                armed++;
-            }
-            logger.info(TAG, `WIDE-CANCEL-TRACE armed on ${armed} raw cancel surface(s)`);
-        }
+        // ---- WIDE CANCEL TRACER: REMOVED 2026-07-29 --------------------------
+        // A temporary investigation tool (armed 2026-05-16) monkey-patched all
+        // nine raw ccxt cancel surfaces and logged `JSON.stringify(args)` plus a
+        // full caller stack on every cancel. It did its job: the cause was proven
+        // to be an EXTERNAL actor auto-cancelling any order with an `rc-`
+        // clientOrderId, fixed by renaming bracket cids to `bkt<16hex><role>`
+        // (docs/BRACKET_CANCEL_ROOT_CAUSE_2026-05-16.md). Its own note said
+        // "remove once the proven source is fixed and soaked" — it then shipped
+        // for ten more weeks, logging order ids, symbols and quantities into
+        // every operator's journal on a live trading system.
+        //
+        // Deleted, not merely quieted: patching the shared ccxt instance is an
+        // invasive global side effect, and the two NARROW attribution tracers
+        // that remain (logAlgoCancelChokepoint + the cancelOrderByClientId
+        // bracket-cid trace) already cover the bracket-disappearance class. Those
+        // log only OUR OWN call stack — no order arguments — which is what makes
+        // them safe to keep. Do not re-add an args-logging wrapper; if a future
+        // investigation needs one, scope it to a symbol and gate it behind an
+        // explicit env flag with an expiry.
         logger.info(TAG, `Binance private API initialized (${this.testnet ? 'testnet' : 'mainnet'})`);
     }
     /**

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "reefclaw-paper-trading",
   "name": "ReefClaw Trading",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Supervised trading plugin for the ReefClaw dashboard: paper trading with real market data (no API keys required), and optional live trading on Binance or Hyperliquid behind explicit operator opt-in, exchange API credentials, and always-on protective stop brackets. Includes the dashboard connector bridge, heartbeat automation, and remote SKILL.md instruction updates from the ReefClaw webapp.",
   "author": "ReefClaw",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reefclaw/openclaw-plugin",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "ReefClaw supervised trading plugin for OpenClaw — paper trading with real market data, optional live trading on Binance or Hyperliquid (operator opt-in, API keys, always-on protective brackets), plus the ReefClaw dashboard connector with heartbeat automation and remote SKILL.md updates from the ReefClaw webapp. Install: /plugins install clawhub:@reefclaw/openclaw-plugin",
   "type": "module",
   "main": "index.js",

package/skills/reefclaw/SKILL.md

@@ -30,7 +30,9 @@ config:
 
 This is the thin BOOTSTRAP copy shipped in the `@reefclaw/connect` npm package. It covers **installing the ReefClaw plugin and connecting to the user's ReefClaw account** — nothing else. The FULL trading instructions (versioned 2.x.y) are delivered automatically by the ReefClaw connector minutes after the first successful connect, over the authenticated update channel — they replace this file in place (a 0.0.x version always loses the semver comparison). Maintainers: the "Connecting (first run)" section below MUST stay in sync with the same section in `skill/SKILL.md`.
 
-You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard. Some steps below change host configuration or install software; they exist solely to complete the setup **the user initiated by pasting their connect message**. Tell the user what each step changes before you do it, do it only for that user, and revert any temporary permission (like elevated exec) as soon as the install completes.
+You are being connected to **ReefClaw**, a supervised trading control room. Your operator watches everything you do on the ReefClaw dashboard.
+
+**Your part of the setup is one thing only: save the connection settings the user pastes to you.** You do not install software, change OpenClaw's security settings, grant yourself permissions, or restart anything. Installation is a human step, run deliberately in a terminal (below). If you cannot complete a step, say so and stop — never work around a permission boundary.
 
 **Do not attempt to trade before the full instructions arrive.** If trading tools are visible but this file is still a bootstrap version (0.0.x), the connection has not completed — finish connecting first.
 
@@ -67,34 +69,21 @@ When a user gives you this message (or just a bare `Here's my ReefClaw token: rc
 - After saving, the connector picks the config up within seconds (it restarts until a token appears). The user does not need to run any command.
 - If you cannot write the config yourself (e.g. exec or file access is restricted in this session), show the user this exact JSON snippet and where it goes, and offer to verify it after they save it.
 
-## Installing without any terminal (preferred)
-
-OpenClaw can install the ReefClaw plugin through its own owner chat command — no exec, no terminal:
-
-1. In `~/.openclaw/openclaw.json` set `commands.plugins: true` and add the user's **sender id** (visible in this session) to `commands.ownerAllowFrom`.
-2. Tell the user to type `/restart` in this chat.
-3. Then the user types: `/plugins install clawhub:@reefclaw/openclaw-plugin` — the install restarts OpenClaw automatically; the bundled connector starts by itself and the dashboard flips to Connected.
+## Installing the plugin — a human step, in a terminal
 
-If that install is **cancelled with a ClawHub security warning** ("Security scan: suspicious"): this is expected — ReefClaw is a trading plugin with disclosed live-trading capability, exchange-credential storage, and remote instruction updates, and ClawHub flags that capability set for review (the linked security page shows the details; VirusTotal reports it clean). **The chat command cannot acknowledge the warning — do NOT retry it in chat.** Two working paths, in order of preference:
+If the ReefClaw trading tools are not present yet, the **user** installs them by running this once, in a terminal on the machine running OpenClaw (inside the container, if OpenClaw runs in Docker):
 
-1. Run `npx --yes @reefclaw/connect` — it does not go through ClawHub. Use your exec tool if permitted (see the elevated-exec section below if it is not), or ask the user to run it once in a terminal.
-2. A human who has reviewed the warning runs `openclaw plugins install clawhub:@reefclaw/openclaw-plugin --acknowledge-clawhub-risk` in a terminal (the acknowledgement is accepted from a trusted shell, only refused from chat).
-
-Only fall back to `npx @reefclaw/connect` (below) when the chat install is unavailable or cancelled as above.
+```
+npx --yes @reefclaw/connect
+```
 
-## If you cannot run the installer (elevated exec disabled)
+That is the whole install. It places the plugin, sets up the connector, restarts the gateway, and prints what it changed. It needs no ReefClaw token — the connection is the separate paste step above, and the connector picks it up on its own.
 
-Fresh OpenClaw installs deny elevated (host) exec from chat sessions. If `npx @reefclaw/connect` is blocked, do NOT dead-end — offer the user this choice:
+**Do not attempt to perform this install yourself, and do not work around it if it is unavailable to you.** Specifically: do not edit OpenClaw's configuration to enable chat install commands, do not add anyone to an owner or elevated-exec allowlist, do not enable elevated mode, and do not restart the gateway to widen your own permissions. If you cannot run the command, the correct outcome is to hand the user the one line above and let them run it deliberately. A trading integration is exactly the kind of software whose installation a human should perform knowingly.
 
-1. **Self-service (no terminal)**:
-   - Add the user's **sender id** (visible in this session's context) to `tools.elevated.allowFrom.<this channel>` in `~/.openclaw/openclaw.json`. This is an **array of sender ids per provider** — e.g. `"tools": { "elevated": { "allowFrom": { "telegram": ["12345678"] } } }` — NOT a boolean.
-   - Tell the user to type `/restart` in this chat (OpenClaw's built-in in-process restart).
-   - Then the user types `/elevated full` — elevated exec is **per-session and off until the user activates it**; OpenClaw confirms with "Elevated mode set to full". If it replies that the sender is not on the allowlist, re-check the allowFrom shape.
-   - **RETRY the install command — do not assume it is still blocked.**
-   - After the install succeeds: the user types `/elevated off` and you remove the allowFrom entry (the installed system never needs elevated exec — only the install did).
-2. **Manual (last resort)**: the user runs `npx @reefclaw/connect` themselves in a terminal on this machine — one command, nothing else.
+**If the user installs via ClawHub instead** and sees a security warning ("Security scan: suspicious"): that is expected and honest — ReefClaw is a trading plugin, and it discloses live-trading capability, exchange-credential storage, and remote instruction updates, which ClawHub flags for review (its linked security page has the details; VirusTotal reports the artifact clean). The chat command cannot acknowledge that warning, so the user should either use the `npx` line above, or — having read the warning — run `openclaw plugins install clawhub:@reefclaw/openclaw-plugin --acknowledge-clawhub-risk` themselves in a terminal.
 
-Either way, **save the connection config regardless** — the connector picks it up automatically the moment the install completes.
+Whatever the install path, **save the connection settings anyway** — the connector picks them up automatically the moment the plugin is running.
 
 ## After connecting