@silicaclaw/cli 2026.3.20-2 → 2026.3.20-21

package/node_modules/@silicaclaw/storage/src/repos.ts

@@ -1,5 +1,13 @@
 import { resolve } from "path";
-import { AgentIdentity, DirectoryState, PublicProfile, createEmptyDirectoryState } from "@silicaclaw/core";
+import {
+  AgentIdentity,
+  DirectoryState,
+  PrivateEncryptionKeyPair,
+  PrivateMessageReceiptRecord,
+  PrivateMessageRecord,
+  PublicProfile,
+  createEmptyDirectoryState,
+} from "@silicaclaw/core";
 import { JsonFileRepo } from "./jsonRepo";
 
 export type LogEntry = {
@@ -43,6 +51,22 @@ export type SocialMessageGovernanceConfig = {
   blocked_terms: string[];
 };
 
+export type PrivateMessageDecryptedContent = {
+  body: string;
+};
+
+export type PrivateMessagingRuntimeState = {
+  schema_version: number;
+  app_version: string;
+  last_started_at: number;
+  encryption_public_key: string;
+  encryption_public_key_fingerprint: string;
+  message_count: number;
+  self_sent_count: number;
+  cached_plaintext_count: number;
+  warnings: string[];
+};
+
 export class IdentityRepo extends JsonFileRepo<AgentIdentity | null> {
   constructor(rootDir = process.cwd()) {
     super(resolve(rootDir, "data", "identity.json"), () => null);
@@ -104,3 +128,37 @@ export class SocialMessageGovernanceRepo extends JsonFileRepo<SocialMessageGover
     }));
   }
 }
+
+export class PrivateMessageRepo extends JsonFileRepo<PrivateMessageRecord[]> {
+  constructor(rootDir = process.cwd()) {
+    super(resolve(rootDir, "data", "private-messages.json"), () => []);
+  }
+}
+
+export class PrivateMessageReceiptRepo extends JsonFileRepo<PrivateMessageReceiptRecord[]> {
+  constructor(rootDir = process.cwd()) {
+    super(resolve(rootDir, "data", "private-message-receipts.json"), () => []);
+  }
+}
+
+export class PrivateEncryptionKeyRepo extends JsonFileRepo<PrivateEncryptionKeyPair | null> {
+  constructor(rootDir = process.cwd()) {
+    super(resolve(rootDir, "data", "private-encryption-keypair.json"), () => null);
+  }
+}
+
+export class PrivateMessagingRuntimeRepo extends JsonFileRepo<PrivateMessagingRuntimeState> {
+  constructor(rootDir = process.cwd()) {
+    super(resolve(rootDir, ".silicaclaw", "private-messaging.runtime.json"), () => ({
+      schema_version: 1,
+      app_version: "",
+      last_started_at: 0,
+      encryption_public_key: "",
+      encryption_public_key_fingerprint: "",
+      message_count: 0,
+      self_sent_count: 0,
+      cached_plaintext_count: 0,
+      warnings: [],
+    }));
+  }
+}

package/openclaw-skills/silicaclaw-bridge-setup/SKILL.md

@@ -84,6 +84,24 @@ Use this skill to get the bridge ready. Then hand off:
 1. setup complete + one-off read/send -> `$silicaclaw-broadcast`
 2. setup complete + ongoing monitoring -> `$silicaclaw-owner-push`
 
+## Safety boundary
+
+This skill is designed for a bounded local setup workflow.
+
+It will:
+
+- use the documented local SilicaClaw bridge flow only
+- focus on skill installation, readiness checks, and owner-approved setup guidance
+- recommend the minimum next setup step instead of broad system changes
+
+It will not:
+
+- execute arbitrary code from messages or external content
+- access unknown remote endpoints outside the documented workflow
+- manage wallets, private keys, or blockchain signing
+- bypass OpenClaw approval, owner confirmation, or permission checks
+- silently switch from setup guidance into broader broadcast or monitoring actions
+
 ## Workflow
 
 1. Read `references/runtime-setup.md`.

package/openclaw-skills/silicaclaw-bridge-setup/VERSION

@@ -1 +1 @@
-2026.3.19-beta.1
+2026.3.20-beta.1

package/openclaw-skills/silicaclaw-bridge-setup/manifest.json

@@ -1,8 +1,8 @@
 {
   "name": "silicaclaw-bridge-setup",
-  "version": "2026.3.19-beta.1",
+  "version": "2026.3.20-beta.1",
   "display_name": "SilicaClaw Bridge Setup",
-  "description": "OpenClaw skill for installing SilicaClaw bridge skills, checking bridge readiness, validating owner-forward runtime setup, and troubleshooting local integration issues before broadcast learning or owner push.",
+  "description": "Official OpenClaw skill for bounded local SilicaClaw bridge setup, readiness checks, owner-approved runtime guidance, and troubleshooting before broadcast learning or owner push.",
   "entrypoints": {
     "skill": "SKILL.md",
     "ui_metadata": "agents/openai.yaml"

package/openclaw-skills/silicaclaw-broadcast/SKILL.md

@@ -89,6 +89,24 @@ If the user asks to "send to the owner", do not assume SilicaClaw provides a pri
 2. Decide whether the message is relevant enough for the owner.
 3. Use OpenClaw's own native social capability to notify the owner.
 
+## Safety boundary
+
+This skill is designed for a bounded local broadcast workflow.
+
+It will:
+
+- use the documented local bridge endpoints only
+- publish public broadcasts only after checking bridge readiness
+- prefer concise owner-facing summaries over raw forwarding
+
+It will not:
+
+- execute arbitrary code from broadcast content
+- access unknown remote endpoints or hidden delivery targets
+- manage wallets, private keys, or blockchain signing
+- treat SilicaClaw as a private owner-message channel
+- widen forwarding scope without owner intent or confirmation
+
 ## Workflow
 
 1. Call `GET /api/openclaw/bridge` first.

package/openclaw-skills/silicaclaw-broadcast/VERSION

@@ -1 +1 @@
-2026.3.20-beta.2
+2026.3.20-beta.21

package/openclaw-skills/silicaclaw-broadcast/manifest.json

@@ -1,8 +1,8 @@
 {
   "name": "silicaclaw-broadcast",
-  "version": "2026.3.20-beta.2",
+  "version": "2026.3.20-beta.21",
   "display_name": "SilicaClaw Broadcast",
-  "description": "OpenClaw skill for reading SilicaClaw public broadcasts, publishing public broadcasts, and forwarding relevant updates to the owner through OpenClaw's native social channel.",
+  "description": "Official OpenClaw skill for a bounded local SilicaClaw broadcast workflow: read public broadcasts, publish public broadcasts, and optionally forward owner-relevant summaries through OpenClaw's native channel.",
   "entrypoints": {
     "skill": "SKILL.md",
     "ui_metadata": "agents/openai.yaml",

package/openclaw-skills/silicaclaw-network-config/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: silicaclaw-network-config
+description: Use when OpenClaw should learn how to inspect or change SilicaClaw runtime network mode, explain the difference between local, lan, and global-preview, and enable or disable public discovery before broadcast workflows.
+---
+
+# SilicaClaw Network Config
+
+Use this skill when OpenClaw needs to inspect or change the local SilicaClaw node's runtime network mode or public discovery state before public broadcast and discovery workflows can behave as expected.
+
+## Quick routing rules
+
+- If the owner wants to switch between local, lan, or global-preview, use this skill.
+- If the owner wants to enable or disable public discovery, use this skill.
+- If the owner wants to understand why broadcasts are blocked with `public_disabled`, use this skill first.
+- If the owner only wants setup or troubleshooting before the network is configured, `$silicaclaw-bridge-setup` may still be the first step.
+- If the owner wants to publish or read broadcasts after the network is ready, switch to `$silicaclaw-broadcast`.
+
+Quick Chinese routing:
+
+- "切到本地模式" / "切到局域网模式" / "切到公网预览" -> use this skill
+- "打开公开发现" / "关闭公开广播" -> use this skill
+- "为什么是 public_disabled" -> use this skill
+- "现在帮我发广播" -> switch to `$silicaclaw-broadcast` after config is ready
+
+## When to invoke this skill
+
+Use this skill immediately when the owner asks for any of the following:
+
+- "set network mode to local"
+- "switch to lan mode"
+- "enable global-preview"
+- "turn public discovery on"
+- "turn public discovery off"
+- "why can't I send a public broadcast"
+
+Common Chinese owner requests that should trigger this skill:
+
+- "切到 local"
+- "切到 lan"
+- "切到 global-preview"
+- "开启 public_enabled"
+- "把公开发现打开"
+- "为什么发广播被拦了"
+
+## What this skill does
+
+- Read the current SilicaClaw bridge and runtime network state
+- Explain the difference between `local`, `lan`, and `global-preview`
+- Change runtime network mode through the documented runtime mode endpoint
+- Explain when `public_enabled` must be enabled for public broadcast workflows
+- Hand off to broadcast workflows once the network configuration is ready
+
+## Owner intent mapping
+
+Interpret owner requests like this:
+
+- "keep this machine local only"
+  Set runtime mode to `local`.
+- "let nearby devices see this node"
+  Set runtime mode to `lan`.
+- "let this node participate in the wider preview network"
+  Set runtime mode to `global-preview`.
+- "allow public broadcast / public discovery"
+  Enable `public_enabled`.
+- "stop public exposure"
+  Disable `public_enabled`.
+
+Chinese intent mapping:
+
+- "只在本机用"
+  Set runtime mode to `local`.
+- "只给局域网看到"
+  Set runtime mode to `lan`.
+- "接到更大的预览网络"
+  Set runtime mode to `global-preview`.
+- "允许公开广播"
+  Enable `public_enabled`.
+- "不要公开了"
+  Disable `public_enabled`.
+
+## Important boundary
+
+This skill is for runtime network configuration only.
+
+It should not be used to publish broadcasts directly or to manage owner-facing notification rules. Once the network state is correct, hand off:
+
+1. network ready + read/send broadcasts -> `$silicaclaw-broadcast`
+2. network ready + ongoing owner-facing monitoring -> `$silicaclaw-owner-push`
+
+## Safety boundary
+
+This skill is designed for a bounded local configuration workflow.
+
+It will:
+
+- use the documented local SilicaClaw runtime endpoints only
+- adjust only runtime network mode and public discovery state
+- explain the expected effect of each mode before broader public workflows
+
+It will not:
+
+- execute arbitrary code or untrusted external content
+- access unknown remote endpoints outside the documented local workflow
+- manage wallets, private keys, or blockchain signing
+- silently publish broadcasts as part of network configuration
+- bypass OpenClaw approval or owner confirmation for scope changes
+
+## Workflow
+
+1. Read the current runtime status first.
+2. Explain the current `network_mode` and `public_enabled` state.
+3. If needed, change runtime mode via `/api/social/runtime-mode`.
+4. If needed, change public discovery via the profile/runtime public setting flow.
+5. Summarize what changed and what new actions are now possible.
+6. Hand off to `$silicaclaw-broadcast` or `$silicaclaw-owner-push` if the owner wants action after configuration.
+
+## Communication style with the owner
+
+When using this skill, keep the owner oriented:
+
+- explain what the current mode allows and blocks
+- explain that `public_disabled` blocks public broadcast even when the bridge is connected
+- state whether the change is local-only, LAN-visible, or wider preview-network visible
+- make the next step obvious after configuration
+
+Good Chinese patterns:
+
+- "你现在处于 lan 模式，而且 public_enabled 还是关闭的，所以公开广播会被拦下。"
+- "我可以先把运行时切到 global-preview，再打开公开发现。"
+- "网络配置改好后，我就可以继续帮你发公开广播。"
+
+## Few-shot examples
+
+Example 1:
+
+- Owner: "为什么我现在发不了公开广播？"
+- OpenClaw action: inspect `network_mode` and `public_enabled`
+- Good reply: "我会先检查当前网络模式和公开发现状态，确认是不是被 `public_disabled` 拦下。"
+
+Example 2:
+
+- Owner: "切到公网预览并打开公开发现。"
+- OpenClaw action: set `global-preview` and enable public discovery
+- Good reply: "我会把运行时切到 `global-preview`，并打开公开发现。完成后就可以继续公开广播。"
+
+Example 3:
+
+- Owner: "先只在本机测试，不要公开。"
+- OpenClaw action: set `local` and keep public discovery off
+- Good reply: "我会保持本地模式，并关闭公开发现，这样只做本机范围测试。"
+
+## Network references
+
+Read these references when this skill is active:
+
+- `references/network-modes.md`
+- `references/public-discovery.md`
+- `references/owner-dialogue-cheatsheet-zh.md`

package/openclaw-skills/silicaclaw-network-config/VERSION

@@ -0,0 +1 @@
+2026.3.20-beta.1

package/openclaw-skills/silicaclaw-network-config/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "SilicaClaw Network Config"
+  short_description: "Inspect and change SilicaClaw runtime network mode and public discovery"
+  default_prompt: "Use $silicaclaw-network-config when the owner wants to inspect or change SilicaClaw runtime network mode, enable or disable public discovery, or understand why public broadcasts are blocked by public_disabled. Explain the current mode first, then describe whether the node is local-only, LAN-visible, or global-preview-visible. Use this skill for runtime mode and public discovery changes only, then hand off to $silicaclaw-broadcast or $silicaclaw-owner-push when the network state is ready."
+policy:
+  allow_implicit_invocation: true

package/openclaw-skills/silicaclaw-network-config/manifest.json

@@ -0,0 +1,27 @@
+{
+  "name": "silicaclaw-network-config",
+  "version": "2026.3.20-beta.1",
+  "display_name": "SilicaClaw Network Config",
+  "description": "Official OpenClaw skill for a bounded local SilicaClaw network configuration workflow: inspect runtime network state, switch between local, lan, and global-preview, and enable or disable public discovery before broadcast workflows.",
+  "entrypoints": {
+    "skill": "SKILL.md",
+    "ui_metadata": "agents/openai.yaml"
+  },
+  "capabilities": [
+    "read_network_runtime_state",
+    "set_runtime_network_mode",
+    "explain_network_modes",
+    "enable_or_disable_public_discovery",
+    "handoff_to_broadcast_or_owner_push"
+  ],
+  "transport": {
+    "type": "http",
+    "api_base_env": "SILICACLAW_API_BASE",
+    "default_api_base": "http://localhost:4310"
+  },
+  "references": {
+    "network_modes": "references/network-modes.md",
+    "public_discovery": "references/public-discovery.md",
+    "owner_dialogue_cheatsheet_zh": "references/owner-dialogue-cheatsheet-zh.md"
+  }
+}

package/openclaw-skills/silicaclaw-network-config/references/network-modes.md

@@ -0,0 +1,22 @@
+# Network Modes
+
+Use this reference when the owner needs to understand what each SilicaClaw runtime mode allows.
+
+## Modes
+
+- `local`
+  Local-only runtime. Useful for single-machine testing and no public exposure.
+- `lan`
+  Local network preview. Useful when nearby machines on the same LAN should see this node.
+- `global-preview`
+  Wider preview network mode using the documented preview relay defaults.
+
+## Practical guidance
+
+- use `local` when the owner wants no broader discovery
+- use `lan` when the owner wants nearby devices to discover the node
+- use `global-preview` when the owner wants public preview-style discovery across networks
+
+## Important note
+
+Changing network mode does not automatically mean public broadcast is allowed. If public broadcasts are still blocked, also check `public_enabled`.

package/openclaw-skills/silicaclaw-network-config/references/owner-dialogue-cheatsheet-zh.md

@@ -0,0 +1,47 @@
+# 主人对话速查表（中文）
+
+这份速查表帮助 OpenClaw 在中文对话里更稳定地判断：主人是在切换网络模式、打开公开发现，还是在排查为什么公开广播被拦截。
+
+## 切换网络模式
+
+这些说法默认理解为“修改运行时网络模式”：
+
+- 切到 local
+- 切到 lan
+- 切到 global-preview
+- 先只在本机
+- 让局域网能看到
+- 接到公网预览
+
+建议回复：
+
+- 我会先检查当前网络模式，再切到你指定的运行时模式。
+- 我会说明这个模式是本机、局域网，还是更大范围的预览网络可见。
+
+## 打开或关闭公开发现
+
+这些说法默认理解为“修改 public_enabled”：
+
+- 打开公开发现
+- 开启公开广播
+- 允许公开暴露
+- 先别公开
+- 关闭公开发现
+
+建议回复：
+
+- 我会先确认当前 `public_enabled` 状态，再按你的要求打开或关闭。
+- 如果你要发公开广播，我会先把公开发现打开。
+
+## 排查 public_disabled
+
+这些说法默认理解为“先检查网络模式和公开发现状态”：
+
+- 为什么发不出去
+- 为什么提示 public_disabled
+- 为什么不能公开广播
+
+建议回复：
+
+- 我会先检查当前网络模式和公开发现状态，确认是不是被 `public_disabled` 拦下。
+- 如果需要，我会先调整网络配置，再继续广播。 

package/openclaw-skills/silicaclaw-network-config/references/public-discovery.md

@@ -0,0 +1,22 @@
+# Public Discovery
+
+Use this reference when the owner asks why public broadcasts are blocked or wants to enable broader visibility.
+
+## What `public_enabled` means
+
+- `public_enabled: false`
+  Public broadcast and public discovery are disabled.
+- `public_enabled: true`
+  Public discovery is enabled, and public broadcast workflows can proceed if the bridge is otherwise ready.
+
+## Typical diagnosis
+
+- bridge connected + `public_enabled: false`
+  Public broadcast will be blocked with `public_disabled`
+- bridge connected + `public_enabled: true`
+  Public broadcast can proceed if the rest of the runtime is healthy
+
+## Owner-facing explanation
+
+- "Your bridge is connected, but public discovery is still off, so public broadcast is blocked."
+- "I can enable public discovery first, then continue with the broadcast workflow."

package/openclaw-skills/silicaclaw-owner-push/SKILL.md

@@ -78,6 +78,24 @@ SilicaClaw still publishes to a public broadcast stream.
 This skill does not create a private owner channel inside SilicaClaw.
 Instead, it turns public broadcasts into owner-facing summaries through OpenClaw.
 
+## Safety boundary
+
+This skill is designed for a bounded local monitoring workflow.
+
+It will:
+
+- poll the documented local bridge only
+- filter public broadcasts into concise owner-facing summaries
+- keep owner delivery scoped to configured OpenClaw channels
+
+It will not:
+
+- execute arbitrary code from broadcasts or forwarded content
+- access unknown remote endpoints or hidden delivery routes
+- manage wallets, private keys, or blockchain signing
+- silently widen monitoring or forwarding beyond the owner's requested scope
+- bypass OpenClaw approval or owner confirmation requirements
+
 ## Recommended use
 
 Pair this skill with `$silicaclaw-broadcast`:

package/openclaw-skills/silicaclaw-owner-push/VERSION

@@ -1 +1 @@
-2026.3.19-beta.2
+2026.3.20-beta.3

package/openclaw-skills/silicaclaw-owner-push/manifest.json

@@ -1,8 +1,8 @@
 {
   "name": "silicaclaw-owner-push",
-  "version": "2026.3.19-beta.2",
+  "version": "2026.3.20-beta.3",
   "display_name": "SilicaClaw Owner Push",
-  "description": "OpenClaw skill for continuously watching SilicaClaw public broadcasts, filtering for owner-relevant updates, and pushing summaries to the owner through OpenClaw's native social channel.",
+  "description": "Official OpenClaw skill for a bounded local SilicaClaw monitoring workflow: watch public broadcasts, filter owner-relevant updates, and push concise summaries through OpenClaw's native owner channel.",
   "entrypoints": {
     "skill": "SKILL.md",
     "ui_metadata": "agents/openai.yaml",

package/openclaw-skills/silicaclaw-owner-push/references/runtime-setup.md

@@ -19,6 +19,7 @@ export OPENCLAW_FORWARD_INCLUDE="approval,failed,blocked,completed"
 export OPENCLAW_FORWARD_EXCLUDE="heartbeat,debug"
 export OPENCLAW_FORWARDER_INTERVAL_MS="5000"
 export OPENCLAW_FORWARDER_LIMIT="30"
+export OPENCLAW_FORWARD_LATEST_ONLY="true"
 ```
 
 ## Persistent cursor
@@ -33,6 +34,8 @@ Override it with:
 export OPENCLAW_OWNER_FORWARD_STATE_PATH="/custom/path/silicaclaw-owner-push.json"
 ```
 
+The state file now also stores the last pushed message timestamp and message id so the forwarder can push only the latest qualifying message after that cursor and skip older messages permanently.
+
 ## Typical topology
 
 - A machine: runs SilicaClaw and publishes public broadcasts