@totalreclaw/totalreclaw 3.3.11-rc.6 → 3.3.12-rc.2

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to `@totalreclaw/totalreclaw` (the OpenClaw plugin) are docu
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.3.12-rc.2] — 2026-05-08
+
+Hot-fix on rc.1's F flip. Pair flow regression: rc.1 set `pairRelayUrl`'s default to `wss://api.totalreclaw.xyz` (production) independently of `serverUrl`. RC users who set `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz` (per the staging-opt-in flow) had pair WS go to **prod**, which pre-dates the pair feature → 404 on WS upgrade → `totalreclaw_pair failed: Unexpected server response: 404`. End-to-end blocker: pair never completed → no credentials → no memories.
+
+### Fixed
+
+- **`config.ts pairRelayUrl` now derives from `TOTALRECLAW_SERVER_URL`** when `TOTALRECLAW_PAIR_RELAY_URL` is not explicitly set. Pair WS endpoint lives on the SAME relay as the rest of the API; previous independent default broke staging users.
+
+### Verified
+
+- WS upgrade to `wss://api-staging.totalreclaw.xyz/pair/session/open` returns 101 (real ws lib; curl with manual headers gets blocked by Cloudflare, irrelevant to plugin).
+- VPS install via `openclaw plugins install /tmp/totalreclaw-totalreclaw-3.3.12-rc.2.tgz` clean.
+- `totalreclaw_pair` tool now returns staging URL (`https://api-staging.totalreclaw.xyz/pair/p/<token>#pk=...`) + 6-digit PIN, 0 failures.
+
+## [3.3.12-rc.1] — 2026-05-07
+
+Install-flow architectural fix. Three changes:
+
+### Changed
+
+- **Prose-rewrite public quickstart guide** — drop LLM-imperative tone, all behavioral rules stay in bundled SKILL.md (loads via trusted skill-loader path, no WebFetch, no PI flag).
+- **F flip — RC + stable both default to prod URL.** Source default flipped from `api-staging.totalreclaw.xyz` → `api.totalreclaw.xyz`. Staging access via `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz` env override. Removes "RC users land on staging chain with stranded memories" footgun.
+- **Compat bump** `>=2026.5.5` (peer-link reassertion fix in upstream OpenClaw).
+- **`skill.json` reconciled** — dropped stale `openclaw.minVersion: 0.1.0 / maxVersion: 1.0.0`; aligned with `package.json` compat range.
+
+### Known issue (fixed in rc.2)
+
+- Pair URL didn't follow `TOTALRECLAW_SERVER_URL` env. Staging users got pair WS to prod → 404. See rc.2 entry above.
+
 ## [3.3.11-rc.6] — 2026-05-07
 
 UX fix: mandatory ack-before-first-tool-call on install. Pedro's rc.5 user QA found the agent went silent for ~60 s while running `openclaw plugins install` before emitting the first user-visible line. From the user's POV the prompt looked unanswered. This RC strengthens SKILL.md + the quickstart guide to require line 1 BEFORE the first shell tool call, with reassuring wait-time copy.

package/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: totalreclaw
 description: "Install + set up TotalReclaw encrypted memory for OpenClaw, then use tr CLI for remember / recall. Trigger on 'install TotalReclaw', 'set up TotalReclaw', 'restore my recovery phrase', or any remember / recall request."
-version: 3.3.11-rc.6
+version: 3.3.12-rc.2
 author: TotalReclaw Team
 license: MIT
 homepage: https://totalreclaw.xyz
@@ -226,7 +226,7 @@ After you emit user-visible line 3, the user opens the URL on their phone or des
 
 Common user-side issues during pair (recover gracefully — emit ONE tight line, don't pre-narrate):
 
-- **"The page won't load"** → check the URL is the staging URL (`api-staging.totalreclaw.xyz` for RC builds, `api.totalreclaw.xyz` for stable). If they used the wrong stub host, generate a fresh URL.
+- **"The page won't load"** → confirm the URL host is `api.totalreclaw.xyz` (the default for both stable and RC post-3.3.12-rc.1). If a `TOTALRECLAW_SERVER_URL` env override was set, the host might be `api-staging.totalreclaw.xyz` (staging, opt-in) or a self-hosted relay. Wrong stub host → generate a fresh URL.
 - **"PIN says expired"** or countdown ran out → re-run the pair block (Step 4 above) and emit line 3 again with the fresh URL+PIN. The previous session is dead.
 - **"It says invalid phrase"** during Log in → the user pasted a phrase that isn't BIP-39 valid (typo or wrong source). Tell them to double-check and re-paste; or switch to **Set up** tab to generate a fresh one (loses existing memories).
 - **"I clicked Set up TotalReclaw but nothing happened"** / **502** → the gateway WS dropped before respond. The pair subprocess is alive (you used `setsid -f`). Wait 30s; if the user still sees the 502, re-run Step 4 (the deferred reload should have completed by then).

package/config.ts

@@ -138,15 +138,14 @@ export const CONFIG = {
   get sessionId(): string | null {
     return getSessionId();
   },
-  // 3.3.3-rc.1: source default is `api-staging.totalreclaw.xyz` per the
-  // codified RC=staging / stable=production rule (PR #165). The workflow
-  // step "Bind stable to production URLs" in `npm-publish.yml` /
-  // `publish-clawhub.yml` sed-replaces `api-staging.totalreclaw.xyz` ->
-  // `api.totalreclaw.xyz` across the built `dist/` tree (and skill.json /
-  // SKILL.md / CHANGELOG / CLAWHUB.md / package.json) when
-  // `release-type=stable`. RC publishes leave the staging URL untouched.
+  // 3.3.12-rc.1 (F flip): source default is `api.totalreclaw.xyz` (production)
+  // for BOTH stable and RC builds. Previously RC defaulted to staging, which
+  // stranded users who picked `@rc` with their memories on staging. Staging
+  // access is now opt-in via `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz`.
+  // No more publish-time URL rewrites — both release-types ship the same
+  // production default, and the workflow guard rails simply assert that.
   // User overrides via `TOTALRECLAW_SERVER_URL=...` always win.
-  serverUrl: (process.env.TOTALRECLAW_SERVER_URL || 'https://api-staging.totalreclaw.xyz').replace(/\/+$/, ''),
+  serverUrl: (process.env.TOTALRECLAW_SERVER_URL || 'https://api.totalreclaw.xyz').replace(/\/+$/, ''),
   selfHosted: process.env.TOTALRECLAW_SELF_HOSTED === 'true',
   credentialsPath: process.env.TOTALRECLAW_CREDENTIALS_PATH || path.join(home, '.totalreclaw', 'credentials.json'),
   // 3.2.0 onboarding state file — separate from credentials.json so it
@@ -171,8 +170,20 @@ export const CONFIG = {
   })() as 'relay' | 'local',
   // 3.3.1-rc.11 — relay base URL for the WebSocket-brokered pair flow.
   // `wss://` preferred; `https://` is rewritten in the remote-client.
-  pairRelayUrl: (process.env.TOTALRECLAW_PAIR_RELAY_URL
-    || 'wss://api-staging.totalreclaw.xyz').replace(/\/+$/, ''),
+  //
+  // 3.3.12-rc.2 fix: derive from `TOTALRECLAW_SERVER_URL` when
+  // `TOTALRECLAW_PAIR_RELAY_URL` is not explicitly set. Pair WS endpoint
+  // lives on the SAME relay as the rest of the API — RC users who set
+  // `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz` (per F
+  // flip / staging-opt-in flow) need pair to follow. Previous behavior
+  // had pair default to prod independently, which 404'd on WS upgrade
+  // because production relay version pre-dates the pair feature.
+  pairRelayUrl: (
+    process.env.TOTALRECLAW_PAIR_RELAY_URL
+    || (process.env.TOTALRECLAW_SERVER_URL
+      ? process.env.TOTALRECLAW_SERVER_URL.replace(/^https?:\/\//, 'wss://').replace(/^http:/, 'ws:')
+      : 'wss://api.totalreclaw.xyz')
+  ).replace(/\/+$/, ''),
 
   // Chain — chainId is no longer user-configurable. It is auto-detected from
   // the relay billing response (free = Base Sepolia / 84532, Pro = Gnosis /

package/dist/config.js

@@ -123,15 +123,14 @@ export const CONFIG = {
     get sessionId() {
         return getSessionId();
     },
-    // 3.3.3-rc.1: source default is `api-staging.totalreclaw.xyz` per the
-    // codified RC=staging / stable=production rule (PR #165). The workflow
-    // step "Bind stable to production URLs" in `npm-publish.yml` /
-    // `publish-clawhub.yml` sed-replaces `api-staging.totalreclaw.xyz` ->
-    // `api.totalreclaw.xyz` across the built `dist/` tree (and skill.json /
-    // SKILL.md / CHANGELOG / CLAWHUB.md / package.json) when
-    // `release-type=stable`. RC publishes leave the staging URL untouched.
+    // 3.3.12-rc.1 (F flip): source default is `api.totalreclaw.xyz` (production)
+    // for BOTH stable and RC builds. Previously RC defaulted to staging, which
+    // stranded users who picked `@rc` with their memories on staging. Staging
+    // access is now opt-in via `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz`.
+    // No more publish-time URL rewrites — both release-types ship the same
+    // production default, and the workflow guard rails simply assert that.
     // User overrides via `TOTALRECLAW_SERVER_URL=...` always win.
-    serverUrl: (process.env.TOTALRECLAW_SERVER_URL || 'https://api-staging.totalreclaw.xyz').replace(/\/+$/, ''),
+    serverUrl: (process.env.TOTALRECLAW_SERVER_URL || 'https://api.totalreclaw.xyz').replace(/\/+$/, ''),
     selfHosted: process.env.TOTALRECLAW_SELF_HOSTED === 'true',
     credentialsPath: process.env.TOTALRECLAW_CREDENTIALS_PATH || path.join(home, '.totalreclaw', 'credentials.json'),
     // 3.2.0 onboarding state file — separate from credentials.json so it
@@ -155,8 +154,18 @@ export const CONFIG = {
     })(),
     // 3.3.1-rc.11 — relay base URL for the WebSocket-brokered pair flow.
     // `wss://` preferred; `https://` is rewritten in the remote-client.
+    //
+    // 3.3.12-rc.2 fix: derive from `TOTALRECLAW_SERVER_URL` when
+    // `TOTALRECLAW_PAIR_RELAY_URL` is not explicitly set. Pair WS endpoint
+    // lives on the SAME relay as the rest of the API — RC users who set
+    // `TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz` (per F
+    // flip / staging-opt-in flow) need pair to follow. Previous behavior
+    // had pair default to prod independently, which 404'd on WS upgrade
+    // because production relay version pre-dates the pair feature.
     pairRelayUrl: (process.env.TOTALRECLAW_PAIR_RELAY_URL
-        || 'wss://api-staging.totalreclaw.xyz').replace(/\/+$/, ''),
+        || (process.env.TOTALRECLAW_SERVER_URL
+            ? process.env.TOTALRECLAW_SERVER_URL.replace(/^https?:\/\//, 'wss://').replace(/^http:/, 'ws:')
+            : 'wss://api.totalreclaw.xyz')).replace(/\/+$/, ''),
     // Chain — chainId is no longer user-configurable. It is auto-detected from
     // the relay billing response (free = Base Sepolia / 84532, Pro = Gnosis /
     // 100). The default here is used only before the first billing lookup

package/dist/index.js

@@ -547,9 +547,9 @@ let stagingBannerLogged = false;
  * directs the caller to `openclaw totalreclaw onboard`.
  */
 async function initialize(logger) {
-    // 3.3.3-rc.1: staging is the source default per #165. Stable build-time
-    // sed-replace flips `api-staging` -> `api` in dist/.
-    const serverUrl = CONFIG.serverUrl || 'https://api-staging.totalreclaw.xyz';
+    // 3.3.12-rc.1 (F flip): production is the source default for all builds.
+    // Staging is opt-in via TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz.
+    const serverUrl = CONFIG.serverUrl || 'https://api.totalreclaw.xyz';
     let masterPassword = CONFIG.recoveryPhrase;
     // 3.2.0: if the env var is unset, probe credentials.json for a
     // pre-existing mnemonic (written either by the CLI wizard on this machine
@@ -5374,25 +5374,29 @@ const plugin = {
                     let stagingBannerSuppressed = false;
                     if (!stagingBannerShown) {
                         try {
-                            const usingStagingDefault = CONFIG.serverUrl.includes('api-staging.totalreclaw.xyz');
-                            const userOverrode = CONFIG.serverUrlEnvOverridden;
-                            if (usingStagingDefault && !userOverrode) {
+                            // 3.3.12-rc.1 (F flip): banner now fires when serverUrl resolves
+                            // to api-staging.totalreclaw.xyz, which under the new contract
+                            // can ONLY happen if (a) user opted in via env override, or
+                            // (b) the artifact is broken / accidentally bound to staging.
+                            // Either way the user benefits from seeing the warning.
+                            const usingStaging = CONFIG.serverUrl.includes('api-staging.totalreclaw.xyz');
+                            if (usingStaging) {
                                 stagingBannerBlock =
-                                    '## ⚠️ TotalReclaw is running in RC / staging mode\n\n' +
-                                        'This build is bound to `api-staging.totalreclaw.xyz`. Staging has **no SLA** ' +
+                                    '## ⚠️ TotalReclaw is running in staging mode\n\n' +
+                                        'This session is bound to `api-staging.totalreclaw.xyz`. Staging has **no SLA** ' +
                                         'and may be wiped between QA cycles. Do **NOT** use this build for real data.\n\n' +
-                                        'For production, install the stable release: `openclaw plugins install ' +
-                                        '@totalreclaw/totalreclaw` (no `@rc` suffix). To pin a custom server, set ' +
-                                        '`TOTALRECLAW_SERVER_URL=https://api.totalreclaw.xyz` in your env.\n\n';
-                                // Do NOT set stagingBannerShown=true here — see comment above.
-                                // Logger emits once per gateway process; this is fine to
-                                // gate on the same flag because the logger is operator-
-                                // facing, not user-facing.
+                                        'The default relay is `api.totalreclaw.xyz` (production). To return to production, ' +
+                                        'unset `TOTALRECLAW_SERVER_URL`. To stay on staging, leave it set to ' +
+                                        '`https://api-staging.totalreclaw.xyz`.\n\n';
+                                // Do NOT set stagingBannerShown=true here — see comment in
+                                // staging-banner-gate.test.ts. Banner-shown flips only via
+                                // consumeBannerForPrepend() once a return path actually
+                                // delivers the block.
                                 stagingBannerSuppressed = true;
                             }
                             else {
-                                // Non-RC artifact OR user override — never fire the banner this
-                                // gateway-process lifetime.
+                                // Production default OR custom URL — never fire the banner
+                                // this gateway-process lifetime.
                                 stagingBannerShown = true;
                             }
                         }
@@ -5401,13 +5405,12 @@ const plugin = {
                             stagingBannerShown = true;
                         }
                     }
-                    // Operator-facing log: once per process, when we DETECT the
-                    // staging build (banner-shown semantics are about user
-                    // delivery; this log is independent).
+                    // Operator-facing log: once per process, when we DETECT staging.
                     if (stagingBannerSuppressed && !stagingBannerLogged) {
                         stagingBannerLogged = true;
-                        api.logger.warn('TotalReclaw: RC/staging build active (api-staging.totalreclaw.xyz). ' +
-                            'See docs/guides/release-process.md for the RC=staging / stable=production rule.');
+                        api.logger.warn('TotalReclaw: staging mode active (api-staging.totalreclaw.xyz). ' +
+                            'Default is production (api.totalreclaw.xyz); staging is opt-in via ' +
+                            'TOTALRECLAW_SERVER_URL.');
                     }
                     /**
                      * Helper — invoked inline at any `prependContext` site that

package/dist/pair-remote-client.js

@@ -48,7 +48,7 @@ import { decryptPairingPayload, generateGatewayKeypair, } from './pair-crypto.js
 // Constants
 // ---------------------------------------------------------------------------
 /** Default relay endpoint. Caller passes `TOTALRECLAW_PAIR_RELAY_URL` via config. */
-export const DEFAULT_RELAY_URL = 'wss://api-staging.totalreclaw.xyz';
+export const DEFAULT_RELAY_URL = 'wss://api.totalreclaw.xyz';
 /** WebSocket connect + handshake timeout (ms). */
 const OPEN_TIMEOUT_MS = 10_000;
 /** Default blocking-await-for-forward timeout (5 minutes — matches relay TTL). */

package/dist/subgraph-store.js

@@ -675,7 +675,7 @@ export function isSubgraphMode() {
  *
  * After the v1 env var cleanup, clients only need:
  *   - TOTALRECLAW_RECOVERY_PHRASE -- BIP-39 mnemonic
- *   - TOTALRECLAW_SERVER_URL -- relay server URL (source default: https://api-staging.totalreclaw.xyz; stable build: https://api.totalreclaw.xyz — swapped in at publish time per PR #165)
+ *   - TOTALRECLAW_SERVER_URL -- relay server URL (default: https://api.totalreclaw.xyz; staging via override: https://api-staging.totalreclaw.xyz)
  *   - TOTALRECLAW_SELF_HOSTED -- set "true" to use self-hosted server (default: managed service)
  *
  * Chain ID is no longer configurable via env — it is auto-detected from the
@@ -683,8 +683,8 @@ export function isSubgraphMode() {
  */
 export function getSubgraphConfig() {
     return {
-        // 3.3.3-rc.1: staging by default in source; stable workflow seds.
-        relayUrl: CONFIG.serverUrl || 'https://api-staging.totalreclaw.xyz',
+        // 3.3.12-rc.1 (F flip): production default for both release-types.
+        relayUrl: CONFIG.serverUrl || 'https://api.totalreclaw.xyz',
         mnemonic: CONFIG.recoveryPhrase,
         cachePath: CONFIG.cachePath,
         chainId: CONFIG.chainId,

package/dist/tr-cli.js

@@ -41,7 +41,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.11-rc.6';
+const PLUGIN_VERSION = '3.3.12-rc.2';
 function die(msg, code = 1) {
     process.stderr.write(`tr: ${msg}\n`);
     process.exit(code);
@@ -367,7 +367,7 @@ async function main() {
                 '  remember: {"ok":true,"id":"...","claim_count":N}\n' +
                 '  recall:   {"results":[{"text":"...","score":0.8}]}\n\n' +
                 'Environment:\n' +
-                '  TOTALRECLAW_SERVER_URL           — relay URL (default: api-staging.totalreclaw.xyz)\n' +
+                '  TOTALRECLAW_SERVER_URL           — relay URL (default: api.totalreclaw.xyz; staging: api-staging.totalreclaw.xyz)\n' +
                 '  TOTALRECLAW_CREDENTIALS_PATH     — override credentials.json path\n');
             break;
         default:

package/index.ts

@@ -807,9 +807,9 @@ let stagingBannerLogged = false;
  * directs the caller to `openclaw totalreclaw onboard`.
  */
 async function initialize(logger: OpenClawPluginApi['logger']): Promise<void> {
-  // 3.3.3-rc.1: staging is the source default per #165. Stable build-time
-  // sed-replace flips `api-staging` -> `api` in dist/.
-  const serverUrl = CONFIG.serverUrl || 'https://api-staging.totalreclaw.xyz';
+  // 3.3.12-rc.1 (F flip): production is the source default for all builds.
+  // Staging is opt-in via TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz.
+  const serverUrl = CONFIG.serverUrl || 'https://api.totalreclaw.xyz';
   let masterPassword = CONFIG.recoveryPhrase;
 
   // 3.2.0: if the env var is unset, probe credentials.json for a
@@ -6262,24 +6262,28 @@ const plugin = {
           let stagingBannerSuppressed = false;
           if (!stagingBannerShown) {
             try {
-              const usingStagingDefault = CONFIG.serverUrl.includes('api-staging.totalreclaw.xyz');
-              const userOverrode = CONFIG.serverUrlEnvOverridden;
-              if (usingStagingDefault && !userOverrode) {
+              // 3.3.12-rc.1 (F flip): banner now fires when serverUrl resolves
+              // to api-staging.totalreclaw.xyz, which under the new contract
+              // can ONLY happen if (a) user opted in via env override, or
+              // (b) the artifact is broken / accidentally bound to staging.
+              // Either way the user benefits from seeing the warning.
+              const usingStaging = CONFIG.serverUrl.includes('api-staging.totalreclaw.xyz');
+              if (usingStaging) {
                 stagingBannerBlock =
-                  '## ⚠️ TotalReclaw is running in RC / staging mode\n\n' +
-                  'This build is bound to `api-staging.totalreclaw.xyz`. Staging has **no SLA** ' +
+                  '## ⚠️ TotalReclaw is running in staging mode\n\n' +
+                  'This session is bound to `api-staging.totalreclaw.xyz`. Staging has **no SLA** ' +
                   'and may be wiped between QA cycles. Do **NOT** use this build for real data.\n\n' +
-                  'For production, install the stable release: `openclaw plugins install ' +
-                  '@totalreclaw/totalreclaw` (no `@rc` suffix). To pin a custom server, set ' +
-                  '`TOTALRECLAW_SERVER_URL=https://api.totalreclaw.xyz` in your env.\n\n';
-                // Do NOT set stagingBannerShown=true here — see comment above.
-                // Logger emits once per gateway process; this is fine to
-                // gate on the same flag because the logger is operator-
-                // facing, not user-facing.
+                  'The default relay is `api.totalreclaw.xyz` (production). To return to production, ' +
+                  'unset `TOTALRECLAW_SERVER_URL`. To stay on staging, leave it set to ' +
+                  '`https://api-staging.totalreclaw.xyz`.\n\n';
+                // Do NOT set stagingBannerShown=true here — see comment in
+                // staging-banner-gate.test.ts. Banner-shown flips only via
+                // consumeBannerForPrepend() once a return path actually
+                // delivers the block.
                 stagingBannerSuppressed = true;
               } else {
-                // Non-RC artifact OR user override — never fire the banner this
-                // gateway-process lifetime.
+                // Production default OR custom URL — never fire the banner
+                // this gateway-process lifetime.
                 stagingBannerShown = true;
               }
             } catch {
@@ -6287,14 +6291,13 @@ const plugin = {
               stagingBannerShown = true;
             }
           }
-          // Operator-facing log: once per process, when we DETECT the
-          // staging build (banner-shown semantics are about user
-          // delivery; this log is independent).
+          // Operator-facing log: once per process, when we DETECT staging.
           if (stagingBannerSuppressed && !stagingBannerLogged) {
             stagingBannerLogged = true;
             api.logger.warn(
-              'TotalReclaw: RC/staging build active (api-staging.totalreclaw.xyz). ' +
-              'See docs/guides/release-process.md for the RC=staging / stable=production rule.',
+              'TotalReclaw: staging mode active (api-staging.totalreclaw.xyz). ' +
+              'Default is production (api.totalreclaw.xyz); staging is opt-in via ' +
+              'TOTALRECLAW_SERVER_URL.',
             );
           }
           /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totalreclaw/totalreclaw",
-  "version": "3.3.11-rc.6",
+  "version": "3.3.12-rc.2",
   "description": "End-to-end encrypted, agent-portable memory for OpenClaw and any LLM-agent runtime. XChaCha20-Poly1305 with protobuf v4 + on-chain Memory Taxonomy v1 (claim / preference / directive / commitment / episode / summary).",
   "type": "module",
   "keywords": [
@@ -81,7 +81,7 @@
       "./dist/index.js"
     ],
     "compat": {
-      "pluginApi": ">=2026.3.22"
+      "pluginApi": ">=2026.5.5"
     },
     "build": {
       "openclawVersion": "2026.4.24"

package/pair-remote-client.ts

@@ -57,7 +57,7 @@ import {
 // ---------------------------------------------------------------------------
 
 /** Default relay endpoint. Caller passes `TOTALRECLAW_PAIR_RELAY_URL` via config. */
-export const DEFAULT_RELAY_URL = 'wss://api-staging.totalreclaw.xyz';
+export const DEFAULT_RELAY_URL = 'wss://api.totalreclaw.xyz';
 
 /** WebSocket connect + handshake timeout (ms). */
 const OPEN_TIMEOUT_MS = 10_000;

package/skill.json

@@ -1,6 +1,6 @@
 {
   "name": "totalreclaw",
-  "version": "3.3.11-rc.6",
+  "version": "3.3.12-rc.2",
   "description": "End-to-end encrypted memory for AI agents — portable, yours forever. XChaCha20-Poly1305 E2EE: server never sees plaintext.",
   "author": "TotalReclaw Team",
   "license": "MIT",
@@ -141,8 +141,9 @@
     }
   ],
   "openclaw": {
-    "minVersion": "0.1.0",
-    "maxVersion": "1.0.0",
+    "compat": {
+      "pluginApi": ">=2026.5.5"
+    },
     "requires": {
       "env": [],
       "bins": []
@@ -318,8 +319,8 @@
     "config": {
       "serverUrl": {
         "type": "string",
-        "default": "https://api-staging.totalreclaw.xyz",
-        "description": "TotalReclaw server URL (only change for self-hosted mode). Source default points at staging; stable releases swap to https://api.totalreclaw.xyz at publish time per PR #165."
+        "default": "https://api.totalreclaw.xyz",
+        "description": "TotalReclaw server URL. Both stable and RC builds default to production (api.totalreclaw.xyz). Set TOTALRECLAW_SERVER_URL=https://api-staging.totalreclaw.xyz to test against staging."
       },
       "autoExtractEveryTurns": {
         "type": "number",

package/subgraph-store.ts

@@ -805,7 +805,7 @@ export function isSubgraphMode(): boolean {
  *
  * After the v1 env var cleanup, clients only need:
  *   - TOTALRECLAW_RECOVERY_PHRASE -- BIP-39 mnemonic
- *   - TOTALRECLAW_SERVER_URL -- relay server URL (source default: https://api-staging.totalreclaw.xyz; stable build: https://api.totalreclaw.xyz — swapped in at publish time per PR #165)
+ *   - TOTALRECLAW_SERVER_URL -- relay server URL (default: https://api.totalreclaw.xyz; staging via override: https://api-staging.totalreclaw.xyz)
  *   - TOTALRECLAW_SELF_HOSTED -- set "true" to use self-hosted server (default: managed service)
  *
  * Chain ID is no longer configurable via env — it is auto-detected from the
@@ -813,8 +813,8 @@ export function isSubgraphMode(): boolean {
  */
 export function getSubgraphConfig(): SubgraphStoreConfig {
   return {
-    // 3.3.3-rc.1: staging by default in source; stable workflow seds.
-    relayUrl: CONFIG.serverUrl || 'https://api-staging.totalreclaw.xyz',
+    // 3.3.12-rc.1 (F flip): production default for both release-types.
+    relayUrl: CONFIG.serverUrl || 'https://api.totalreclaw.xyz',
     mnemonic: CONFIG.recoveryPhrase,
     cachePath: CONFIG.cachePath,
     chainId: CONFIG.chainId,

package/tr-cli.ts

@@ -52,7 +52,7 @@ const STATE_PATH = CONFIG.onboardingStatePath;
 // Auto-synced by skill/scripts/sync-version.mjs from skill/plugin/package.json::version.
 // Do not edit by hand — running tests will catch drift but the publish workflow
 // rewrites this constant at the start of every npm/ClawHub publish.
-const PLUGIN_VERSION = '3.3.11-rc.6';
+const PLUGIN_VERSION = '3.3.12-rc.2';
 
 function die(msg: string, code = 1): never {
   process.stderr.write(`tr: ${msg}\n`);
@@ -431,7 +431,7 @@ async function main(): Promise<void> {
         '  remember: {"ok":true,"id":"...","claim_count":N}\n' +
         '  recall:   {"results":[{"text":"...","score":0.8}]}\n\n' +
         'Environment:\n' +
-        '  TOTALRECLAW_SERVER_URL           — relay URL (default: api-staging.totalreclaw.xyz)\n' +
+        '  TOTALRECLAW_SERVER_URL           — relay URL (default: api.totalreclaw.xyz; staging: api-staging.totalreclaw.xyz)\n' +
         '  TOTALRECLAW_CREDENTIALS_PATH     — override credentials.json path\n',
       );
       break;