@xfxstudio/claworld 2026.6.10-testing.5 → 2026.6.26-testing.1

package/src/openclaw/plugin/managed-config.js

@@ -336,25 +336,6 @@ function inferExistingAgentId(config = {}, accountId = DEFAULT_CLAWORLD_ACCOUNT_
   return DEFAULT_CLAWORLD_AGENT_ID;
 }
 
-const MANAGED_LEGACY_BUNDLED_SKILL_NAMES = Object.freeze([
-  'claworld-main-session',
-  'claworld-manage-worlds',
-  'claworld-help',
-]);
-
-function hasOnlyManagedBundledSkills(value) {
-  if (!Array.isArray(value) || value.length === 0) return false;
-  return value.every((skillName) => MANAGED_LEGACY_BUNDLED_SKILL_NAMES.includes(skillName));
-}
-
-function buildManagedAgentEntry(options = {}) {
-  return {
-    id: options.agentId,
-    workspace: options.workspace,
-    ...(options.agentDirExplicit && options.agentDir ? { agentDir: options.agentDir } : {}),
-  };
-}
-
 function buildManagedRoutingEntry(options = {}, existingRouting = {}) {
   return {
     ...ensureObject(existingRouting),
@@ -383,21 +364,33 @@ function buildManagedAccountEntry(options = {}) {
     };
   }
 
-  if (!options.defaultTargetAgentId) {
+  const relay = {
+    ...(normalizeText(options.relayAgentId, null) ? { agentId: normalizeText(options.relayAgentId, null) } : {}),
+    ...(normalizeText(options.defaultTargetAgentId, null)
+      ? { defaultTargetAgentId: normalizeText(options.defaultTargetAgentId, null) }
+      : {}),
+  };
+  if (Object.keys(relay).length === 0) {
     return base;
   }
 
   return {
     ...base,
-    relay: {
-      defaultTargetAgentId: options.defaultTargetAgentId,
-    },
+    relay,
   };
 }
 
 function buildMergedAccountEntry(existingAccount = {}, options = {}) {
   const existingRelay = ensureObject(existingAccount.relay);
   const existingRegistration = ensureObject(existingAccount.registration);
+  const relayAgentId = normalizeText(options.relayAgentId, null);
+  const defaultTargetAgentId = normalizeText(options.defaultTargetAgentId, null);
+  const mergedRelay = {
+    ...existingRelay,
+    ...(relayAgentId ? { agentId: relayAgentId } : {}),
+    ...(defaultTargetAgentId ? { defaultTargetAgentId } : {}),
+  };
+  const shouldPersistRelay = Boolean(existingAccount.relay || relayAgentId || defaultTargetAgentId);
   const merged = {
     ...existingAccount,
     enabled: true,
@@ -406,16 +399,7 @@ function buildMergedAccountEntry(existingAccount = {}, options = {}) {
     accountId: options.accountId,
     name: normalizeText(options.name, normalizeText(existingAccount.name, normalizeText(options.displayName, null))),
     routing: buildManagedRoutingEntry(options, existingAccount.routing),
-    ...(options.defaultTargetAgentId
-      ? {
-          relay: {
-            ...existingRelay,
-            defaultTargetAgentId: options.defaultTargetAgentId,
-          },
-        }
-      : existingAccount.relay
-        ? { relay: existingRelay }
-        : {}),
+    ...(shouldPersistRelay ? { relay: mergedRelay } : {}),
   };
   delete merged.toolProfile;
 
@@ -507,60 +491,6 @@ export function resolveToolNames({ toolProfile = DEFAULT_CLAWORLD_TOOL_PROFILE }
   return [...baseProfile];
 }
 
-const MANAGED_BUNDLED_SKILL_NAMES = Object.freeze([
-  'claworld-main-session',
-  'claworld-manage-worlds',
-  'claworld-help',
-]);
-
-export function resolveManagedAgentSkills({ toolProfile = DEFAULT_CLAWORLD_TOOL_PROFILE } = {}) {
-  const normalizedProfile = normalizeClaworldToolProfile(toolProfile);
-  return normalizedProfile === 'full' ? undefined : [...MANAGED_BUNDLED_SKILL_NAMES];
-}
-
-function describeToolAllowEntries(toolNames = []) {
-  if (toolNames.length === 1) {
-    return toolNames[0] === '*' ? '1 entry (includes *)' : '1 entry';
-  }
-  return toolNames.includes('*')
-    ? `${toolNames.length} entries (includes *)`
-    : `${toolNames.length} entries`;
-}
-
-export function buildWorkspaceAgentsContent({
-  agentId,
-  accountId,
-  registrationDisplayName,
-  appToken = null,
-  defaultTargetAgentId = null,
-} = {}) {
-  const identityLine = appToken
-    ? '- relay binding is resolved from the configured appToken at runtime'
-    : registrationDisplayName
-      ? '- relay binding is created during runtime bootstrap and persists as backend-issued credentials'
-      : '- activation is pending until the user completes Claworld public identity setup';
-
-  return `# Claworld Channel Agent
-
-This workspace is dedicated to the OpenClaw \`claworld\` channel.
-
-Routing contract:
-
-- local OpenClaw agent id: \`${agentId}\`
-- claworld account id: \`${accountId}\`
-${registrationDisplayName ? `- bootstrap display name: \`${registrationDisplayName}\`` : (appToken ? '- credential mode: appToken/manual binding' : '- credential mode: activation pending')}
-${identityLine}
-${defaultTargetAgentId ? `- default outbound target agentId: \`${defaultTargetAgentId}\`` : '- outbound sends require explicit target agentId inputs'}
-
-Operating rules:
-
-- keep this workspace focused on Claworld relay and world interactions
-- use explicit \`claworld_*\` tools when they are available
-- do not treat this workspace as the user's general-purpose main agent
-- do not treat this as a separately bootstrapped OpenClaw persona
-`;
-}
-
 function buildBoundAgentEntry(existingAgent = {}, agentId) {
   const nextAgent = {
     ...ensureObject(existingAgent),
@@ -570,41 +500,8 @@ function buildBoundAgentEntry(existingAgent = {}, agentId) {
   return nextAgent;
 }
 
-export function buildWorkspaceMemoryContent({
-  agentId,
-  accountId,
-  registrationDisplayName,
-  appToken = null,
-  defaultTargetAgentId = null,
-} = {}) {
-  const identityLine = appToken
-    ? '- relay binding: resolved from appToken at runtime'
-    : registrationDisplayName
-      ? '- relay binding: assigned during runtime bootstrap'
-      : '- relay binding: pending until public identity setup completes';
-
-  return `# Claworld Memory
-
-- workspace owner: \`${agentId}\`
-- claworld account: \`${accountId}\`
-${registrationDisplayName ? `- bootstrap display name: \`${registrationDisplayName}\`` : ''}
-${identityLine}
-${defaultTargetAgentId ? `- default outbound target agentId: \`${defaultTargetAgentId}\`` : ''}
-
-Use this file for durable Claworld-specific notes only.
-
-- keep world rules, pairing context, and recurring counterpart preferences here when they help future Claworld conversations
-- do not duplicate a full standalone OpenClaw bootstrap/persona here
-- prefer channel/world-specific memory over general-purpose assistant memory
-`;
-}
-
-export function resolveDefaultManagedWorkspace(agentId = DEFAULT_CLAWORLD_AGENT_ID) {
-  return `~/.openclaw/workspace-${agentId}`;
-}
-
 export function resolveDefaultManagedDisplayName(accountId = DEFAULT_CLAWORLD_ACCOUNT_ID) {
-  return `${titleCase(accountId)} Channel Agent`;
+  return `${titleCase(accountId)} Channel`;
 }
 
 export function resolveClaworldManagedRuntimeOptions({
@@ -615,7 +512,6 @@ export function resolveClaworldManagedRuntimeOptions({
   installerState = null,
 } = {}) {
   const resolvedAccountId = normalizeText(accountId, DEFAULT_CLAWORLD_ACCOUNT_ID);
-  const attachToExistingAgent = overrides.attachToExistingAgent !== false;
   const existingBackup = findClaworldManagedRuntimeBackup(installerState, resolvedAccountId);
   const inferredAgentId = inferExistingAgentId(cfg, resolvedAccountId)
     || normalizeText(existingBackup.agentId, null);
@@ -623,20 +519,7 @@ export function resolveClaworldManagedRuntimeOptions({
   const existingAgent = findAgentEntry(cfg, agentId);
   const existingAccount = findManagedAccountEntry(cfg, resolvedAccountId);
   const replaceManagedRuntime = overrides.replaceManagedRuntime !== false;
-  const explicitWorkspace = normalizeText(overrides.workspace, null);
-  const manageAgentEntry = overrides.manageAgentEntry === true
-    || overrides.agentDirExplicit === true
-    || attachToExistingAgent !== true;
-  const manageWorkspace = overrides.manageWorkspace === true
-    || Boolean(explicitWorkspace)
-    || attachToExistingAgent !== true;
-  const defaultWorkspace = manageWorkspace ? resolveDefaultManagedWorkspace(agentId) : null;
-  const workspace = normalizeText(
-    explicitWorkspace,
-    replaceManagedRuntime
-      ? normalizeText(existingAgent?.workspace, normalizeText(existingBackup.workspace, defaultWorkspace))
-      : normalizeText(existingAgent?.workspace, normalizeText(existingBackup.workspace, defaultWorkspace)),
-  );
+  const workspace = normalizeText(existingAgent?.workspace, normalizeText(existingBackup.workspace, null));
   const serverUrl = normalizeText(
     overrides.serverUrl,
     normalizeText(input.httpUrl, normalizeText(input.url, normalizeText(existingBackup.serverUrl, DEFAULT_CLAWORLD_SERVER_URL))),
@@ -680,20 +563,16 @@ export function resolveClaworldManagedRuntimeOptions({
 
   return {
     repoRoot: normalizeText(overrides.repoRoot, null),
-    attachToExistingAgent,
     agentId,
     accountId: resolvedAccountId,
     workspace,
-    manageAgentEntry,
-    manageWorkspace,
-    agentDir: normalizeText(overrides.agentDir, null),
-    agentDirExplicit: overrides.agentDirExplicit === true,
     serverUrl,
     apiKey,
     appToken,
     registrationDisplayName,
     displayName,
     name,
+    relayAgentId: normalizeText(overrides.relayAgentId, normalizeText(existingAccount?.relay?.agentId, null)),
     defaultTargetAgentId: normalizeText(overrides.defaultTargetAgentId, null),
     sessionDmScope: normalizeText(
       overrides.sessionDmScope,
@@ -715,7 +594,6 @@ export function applyClaworldManagedRuntimeConfig(inputConfig = {}, options = {}
   const replaceManagedRuntime = options.replaceManagedRuntime !== false;
   const preserveDefaultAccount = options.preserveDefaultAccount === true;
   const sessionDmScope = normalizeText(options.sessionDmScope, DEFAULT_CLAWORLD_DM_SCOPE);
-  const manageAgentEntry = options.manageAgentEntry === true;
 
   const removedManagedToolNames = new Set(CLAWORLD_PUBLIC_TOOL_NAMES);
   if (inputConfig?.tools && typeof inputConfig.tools === 'object') {
@@ -754,72 +632,18 @@ export function applyClaworldManagedRuntimeConfig(inputConfig = {}, options = {}
 
   config.agents = ensureObject(config.agents);
   const existingAgentList = Array.isArray(config.agents.list) ? [...config.agents.list] : [];
-  if (manageAgentEntry) {
-    const managedAgentEntry = buildManagedAgentEntry(options);
-    if (replaceManagedRuntime) {
-      const removedAgentEntries = existingAgentList.filter((item) => ensureObject(item).id === options.agentId).length;
-      config.agents.list = [
-        ...existingAgentList.filter((item) => ensureObject(item).id !== options.agentId),
-        {
-          ...managedAgentEntry,
-          tools: mergeManagedPluginToolExposure(managedAgentEntry.tools),
-        },
-      ];
-      summary.push(
-        removedAgentEntries > 0
-          ? `replaced managed agent entry ${options.agentId}`
-          : `added workspace-scoped agent entry ${options.agentId}`,
-      );
-    } else {
-      const agentIndex = findAgentIndex(existingAgentList, options.agentId);
-      if (agentIndex >= 0) {
-        const existingAgent = ensureObject(existingAgentList[agentIndex]);
-        const existingAgentDir = normalizeText(existingAgent.agentDir, null);
-        const keepExistingAgentDir = Boolean(
-          existingAgentDir
-          && (
-            options.agentDirExplicit
-            || existingAgentDir !== normalizeText(options.agentDir, null)
-          ),
-        );
-        const nextAgentEntry = {
-          ...existingAgent,
-          id: options.agentId,
-          workspace: normalizeText(existingAgent.workspace, options.workspace),
-          ...(keepExistingAgentDir ? { agentDir: existingAgentDir } : {}),
-        };
-        if (!keepExistingAgentDir) {
-          delete nextAgentEntry.agentDir;
-        }
-        if (hasOnlyManagedBundledSkills(existingAgent.skills)) {
-          delete nextAgentEntry.skills;
-        }
-        nextAgentEntry.tools = mergeManagedPluginToolExposure(existingAgent.tools);
-        existingAgentList[agentIndex] = nextAgentEntry;
-        summary.push(`updated existing agent entry ${options.agentId}`);
-      } else {
-        existingAgentList.push({
-          ...managedAgentEntry,
-          tools: mergeManagedPluginToolExposure(managedAgentEntry.tools),
-        });
-        summary.push(`added workspace-scoped agent entry ${options.agentId}`);
-      }
-      config.agents.list = existingAgentList;
-    }
+  const agentIndex = findAgentIndex(existingAgentList, options.agentId);
+  if (agentIndex >= 0) {
+    const existingAgent = ensureObject(existingAgentList[agentIndex]);
+    existingAgentList[agentIndex] = buildBoundAgentEntry(existingAgent, options.agentId);
+    config.agents.list = existingAgentList;
+    summary.push(`updated bound agent tool exposure ${options.agentId}`);
   } else {
-    const agentIndex = findAgentIndex(existingAgentList, options.agentId);
-    if (agentIndex >= 0) {
-      const existingAgent = ensureObject(existingAgentList[agentIndex]);
-      existingAgentList[agentIndex] = buildBoundAgentEntry(existingAgent, options.agentId);
-      config.agents.list = existingAgentList;
-      summary.push(`updated bound agent tool exposure ${options.agentId}`);
-    } else {
-      existingAgentList.push(buildBoundAgentEntry({}, options.agentId));
-      config.agents.list = existingAgentList;
-      summary.push(`added bound agent entry ${options.agentId}`);
-    }
-    summary.push(`attached claworld account ${options.accountId} to existing local agent ${options.agentId}`);
+    existingAgentList.push(buildBoundAgentEntry({}, options.agentId));
+    config.agents.list = existingAgentList;
+    summary.push(`added bound agent entry ${options.agentId}`);
   }
+  summary.push(`attached claworld account ${options.accountId} to local agent ${options.agentId}`);
 
   config.channels = ensureObject(config.channels);
   const existingClaworldRoot = ensureObject(config.channels.claworld);

package/src/openclaw/plugin/onboarding.js

@@ -10,6 +10,10 @@ import {
   inspectClaworldChannelAccount,
   listClaworldAccountIds,
 } from './config-schema.js';
+import {
+  fetchJson,
+  normalizeRelayHttpBaseUrl,
+} from '../runtime/http-boundary.js';
 
 function collectUnsupportedSetupFlags(input = {}) {
   const unsupported = [];
@@ -102,7 +106,7 @@ function hasClaworldBinding(config = {}, { agentId, accountId } = {}) {
   });
 }
 
-function isRelayBootstrapReady(account = {}) {
+function hasRuntimeCredential(account = {}) {
   return Boolean(
     account?.configured
     && normalizeText(account?.appToken, null),
@@ -129,24 +133,23 @@ export function inspectManagedClaworldInstall({
   const accountStatus = managedAccountPresent
     ? inspectClaworldChannelAccount(cfg, managedOptions.accountId)
     : inspectClaworldChannelAccount({}, managedOptions.accountId);
-  const activationReady = isRelayBootstrapReady(accountStatus);
+  const runtimeCredentialReady = hasRuntimeCredential(accountStatus);
   const setupReady = Boolean(
     managedAccountPresent
     && managedBindingPresent
-    && (managedOptions.manageAgentEntry !== true || managedAgentPresent)
   );
 
   let statusLabel = 'needs setup';
   let selectionHint = 'remote relay world channel';
   let quickstartScore = 5;
 
-  if (setupReady && activationReady) {
+  if (setupReady && runtimeCredentialReady) {
     statusLabel = 'configured';
     selectionHint = 'configured · ready';
     quickstartScore = 2;
   } else if (setupReady) {
-    statusLabel = 'configured (activation pending)';
-    selectionHint = 'configured · activation pending';
+    statusLabel = 'configured (email verification pending)';
+    selectionHint = 'configured · email verification pending';
     quickstartScore = 3;
   } else if (managedAccountPresent && !managedBindingPresent) {
     statusLabel = 'configured (binding pending)';
@@ -167,7 +170,7 @@ export function inspectManagedClaworldInstall({
     managedAgentPresent,
     managedBindingPresent,
     accountStatus,
-    activationReady,
+    runtimeCredentialReady,
     setupReady,
     statusLabel,
     selectionHint,
@@ -185,7 +188,7 @@ export function buildClaworldOnboardingStatus({
     statusLines: [`Claworld: ${inspection.statusLabel}`],
     selectionHint: inspection.selectionHint,
     quickstartScore: inspection.quickstartScore,
-    activationReady: inspection.activationReady,
+    runtimeCredentialReady: inspection.runtimeCredentialReady,
   };
 }
 
@@ -232,23 +235,172 @@ function resolveManagedOptionsFromContext({ cfg = {}, accountId = null, input =
   });
 }
 
+function resolveSetupFetchImpl(runtime = {}) {
+  const candidate = runtime?.fetchImpl
+    || runtime?.fetch
+    || (typeof globalThis.fetch === 'function' ? globalThis.fetch : null);
+  if (typeof candidate !== 'function') {
+    throw new Error('Claworld setup requires fetch support to complete email verification.');
+  }
+  return (url, init) => candidate(url, init);
+}
+
+function validateSetupEmail(value) {
+  const normalized = normalizeText(value, null);
+  if (!normalized) return 'Email is required.';
+  if (!normalized.includes('@')) return 'Enter a valid email address.';
+  return null;
+}
+
+function validateSetupVerificationCode(value) {
+  return normalizeText(value, null) ? null : 'Verification code is required.';
+}
+
+function formatSetupApiError(result, fallbackMessage) {
+  const body = ensureObject(result?.body);
+  const detail = normalizeText(
+    body.publicMessage,
+    normalizeText(body.error, normalizeText(body.message, null)),
+  );
+  return detail ? `${fallbackMessage}: ${detail}` : fallbackMessage;
+}
+
+async function startSetupEmailVerification({
+  runtimeConfig,
+  email,
+  displayName = null,
+  fetchImpl,
+} = {}) {
+  const baseUrl = normalizeRelayHttpBaseUrl(runtimeConfig.serverUrl);
+  const normalizedEmail = normalizeText(email, null);
+  const normalizedDisplayName = normalizeText(displayName, null);
+  const result = await fetchJson(fetchImpl, `${baseUrl}/v1/identity/email/start`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(runtimeConfig.apiKey ? { 'x-api-key': runtimeConfig.apiKey } : {}),
+    },
+    body: JSON.stringify({
+      email: normalizedEmail,
+      ...(normalizedDisplayName ? { displayName: normalizedDisplayName } : {}),
+    }),
+  });
+  if (!result.ok) {
+    throw new Error(formatSetupApiError(result, 'Failed to start Claworld email verification'));
+  }
+  return ensureObject(result.body);
+}
+
+async function completeSetupEmailVerification({
+  runtimeConfig,
+  email,
+  code,
+  fetchImpl,
+} = {}) {
+  const baseUrl = normalizeRelayHttpBaseUrl(runtimeConfig.serverUrl);
+  const result = await fetchJson(fetchImpl, `${baseUrl}/v1/identity/email/verify`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(runtimeConfig.apiKey ? { 'x-api-key': runtimeConfig.apiKey } : {}),
+    },
+    body: JSON.stringify({
+      email: normalizeText(email, null),
+      code: normalizeText(code, null),
+    }),
+  });
+  if (!result.ok) {
+    throw new Error(formatSetupApiError(result, 'Failed to complete Claworld email verification'));
+  }
+  return ensureObject(result.body);
+}
+
+async function resolveSetupCredential({
+  managedOptions,
+  prompter,
+  runtime = {},
+  input = {},
+} = {}) {
+  if (managedOptions.appToken) return null;
+
+  const fetchImpl = resolveSetupFetchImpl(runtime);
+  const email = normalizeText(await prompter.text({
+    message: 'Claworld account email',
+    placeholder: 'you@example.com',
+    validate: validateSetupEmail,
+  }), null);
+
+  await startSetupEmailVerification({
+    runtimeConfig: managedOptions,
+    email,
+    displayName: normalizeText(input?.name, null),
+    fetchImpl,
+  });
+
+  const code = normalizeText(await prompter.text({
+    message: `Verification code sent to ${email}`,
+    placeholder: '123456',
+    validate: validateSetupVerificationCode,
+  }), null);
+
+  const verification = await completeSetupEmailVerification({
+    runtimeConfig: managedOptions,
+    email,
+    code,
+    fetchImpl,
+  });
+  const appToken = normalizeText(verification.appToken, null);
+  const relayAgentId = normalizeText(verification.agentId, null);
+  if (!appToken || !relayAgentId) {
+    throw new Error('Claworld email verification did not return appToken and agentId.');
+  }
+  return {
+    email,
+    appToken,
+    relayAgentId,
+    created: verification.created === true,
+    recovered: verification.recovered === true,
+  };
+}
+
 async function applyManagedOnboardingConfig({
   cfg = {},
+  runtime = {},
   prompter,
   accountId = null,
   phase = 'setup',
   input = {},
 } = {}) {
-  const managedOptions = resolveManagedOptionsFromContext({ cfg, accountId, input });
+  const initialManagedOptions = resolveManagedOptionsFromContext({ cfg, accountId, input });
+  const setupCredential = await resolveSetupCredential({
+    managedOptions: initialManagedOptions,
+    prompter,
+    runtime,
+    input,
+  });
+  const managedOptions = setupCredential
+    ? {
+        ...initialManagedOptions,
+        appToken: setupCredential.appToken,
+        relayAgentId: setupCredential.relayAgentId,
+      }
+    : initialManagedOptions;
   const next = applyClaworldManagedRuntimeConfig(cfg, managedOptions);
 
   const noteLines = [
     `Bound local agent/account: ${managedOptions.agentId}`,
     `Remote backend: ${managedOptions.serverUrl}`,
-    managedOptions.appToken
-      ? 'Activation state: ready via configured appToken'
-      : 'Activation state: pending until claworld_manage_account(action=activate_account) runs',
-    'This flow refreshes plugin-side config and binds claworld onto the selected local agent. It does not run installer commands or start a backend service.',
+    setupCredential
+      ? `Email verification: completed for ${setupCredential.email}; runtime credential saved to OpenClaw config`
+      : managedOptions.appToken
+      ? 'Runtime credential: configured appToken is present'
+      : 'Email verification: pending until claworld_manage_account(action=start_email_verification|complete_email_verification) runs',
+    managedOptions.relayAgentId
+      ? `Remote agent identity: ${managedOptions.relayAgentId}`
+      : 'Remote agent identity: pending',
+    'Workspace memory: runtime prompt bootstrap maintains .claworld/ in the active host workspace',
+    'This flow refreshes plugin-side config and binds claworld onto the selected local agent.',
+    'Setup lifecycle: OpenClaw host-native setup; channel reload is handled by config reload.',
   ];
   await prompter.note(
     noteLines.join('\n'),
@@ -293,17 +445,19 @@ export const claworldOnboardingAdapter = {
       }),
     };
   },
-  configure: async ({ cfg, prompter, accountOverrides }) =>
+  configure: async ({ cfg, runtime, prompter, accountOverrides }) =>
     applyManagedOnboardingConfig({
       cfg,
+      runtime,
       prompter,
       accountId: accountOverrides?.claworld,
       phase: 'setup',
       input: {},
     }),
-  configureWhenConfigured: async ({ cfg, prompter, accountOverrides }) =>
+  configureWhenConfigured: async ({ cfg, runtime, prompter, accountOverrides }) =>
     applyManagedOnboardingConfig({
       cfg,
+      runtime,
       prompter,
       accountId: accountOverrides?.claworld,
       phase: 'refresh',