@xquik/tweetclaw 1.6.4 → 1.6.5

package/README.md

@@ -38,7 +38,7 @@ Source: [official X API pricing](https://docs.x.com/x-api/getting-started/pricin
 | Read (user profile, verified followers, followers you know) | 1 | $0.00015 |
 | Read (favoriters) | 1 | $0.00015 |
 | Read (trends) | 3 | $0.00045 |
-| Follow check, article | 7 | $0.00105 |
+| Follow check, article | 5 | $0.00075 |
 | Write (tweet, like, retweet, follow, DM, etc.) | 10 | $0.0015 |
 | Extraction (tweets, replies, quotes, mentions, posts, likes, media, search, favoriters, retweeters, community members, people search, list members, list followers) | 1/result | $0.00015/result |
 | Extraction (followers, following, verified followers) | 1/result | $0.00015/result |
@@ -50,7 +50,7 @@ Source: [official X API pricing](https://docs.x.com/x-api/getting-started/pricin
 
 Two options:
 
-- **Credits**: Top up credits via the API. 1 credit = $0.00015. Works with all 112 endpoints.
+- **Credits**: Top up credits via the API. 1 credit = $0.00015. Works with all 113 endpoints.
 - **MPP**: 32 read-only X-API endpoints accept anonymous on-chain payments via Machine Payments Protocol. No account needed. SDK: `npm i mppx viem`.
 
 ### Free Operations
@@ -67,7 +67,7 @@ openclaw plugins install @xquik/tweetclaw
 
 ## Configure
 
-### Option A: API key (full access, 112 endpoints)
+### Option A: API key (full access, 113 endpoints)
 
 Get an API key at [dashboard.xquik.com](https://dashboard.xquik.com/). Store it in an environment variable and configure TweetClaw to use it:
 
@@ -79,7 +79,7 @@ openclaw config set plugins.entries.tweetclaw.config.apiKey "$XQUIK_API_KEY"
 
 ### Option B: Credits (pay-per-use, no subscription)
 
-Top up credits from the Xquik dashboard or via `POST /credits/topup`. All 112 endpoints available. 1 credit = $0.00015.
+Top up credits from the Xquik dashboard or via `POST /credits/topup`. All 113 endpoints available. 1 credit = $0.00015.
 
 ### Option C: MPP pay-per-use (no account needed, 32 read-only endpoints)
 
@@ -120,6 +120,8 @@ AI uses explore → filters spec by category "composition"
 
 Execute authenticated API calls. Auth is injected automatically - the LLM never sees your API key.
 
+OpenClaw approval prompts are enforced before write-like `tweetclaw` tool calls. Review the generated code before approving any post, delete, follow, DM, monitor, extraction, webhook, checkout, or profile-change action.
+
 ```
 You: "Post a tweet saying 'Hello from TweetClaw!'"
 
@@ -159,7 +161,7 @@ You: "Monitor @elonmusk for new tweets, replies, and retweets"
 
 ## API Coverage
 
-112 endpoints across 10 categories:
+113 endpoints across 10 categories:
 
 | Category | Examples | Cost |
 |----------|---------|------|
@@ -170,7 +172,7 @@ You: "Monitor @elonmusk for new tweets, replies, and retweets"
 | **Media** | Upload media via URL, download tweet media, get gallery links | 1-2 credits |
 | **Monitoring** | Create monitors, view events, manage webhooks | Free |
 | **Support** | Create tickets, reply, track status | Free |
-| **Twitter** | Search, lookups, timelines, articles, trends, bookmarks, notifications | 1-7 credits |
+| **Twitter** | Search, lookups, timelines, articles, trends, bookmarks, notifications | 1-5 credits |
 | **X Accounts** | List, inspect, and disconnect connected accounts | Free |
 | **X Write** | Post, reply, like, retweet, follow, remove follower, DM, profile, communities | 10 credits |
 

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "tweetclaw",
   "name": "TweetClaw",
-  "version": "1.6.4",
-  "description": "Post tweets, reply, like, retweet, follow, DM from your chat - full X/Twitter automation powered by Xquik. 112 endpoints, reads from $0.00015/call.",
+  "version": "1.6.5",
+  "description": "Post tweets, reply, like, retweet, follow, DM from your chat - full X/Twitter automation powered by Xquik. 113 endpoints, reads from $0.00015/call.",
   "primaryCredential": "apiKey",
   "alternateCredentials": ["tempoSigningKey"],
   "requires": {
@@ -12,7 +12,7 @@
     "type": "object",
     "additionalProperties": false,
     "properties": {
-      "apiKey": { "type": "string", "minLength": 1, "description": "Xquik API key (get one at dashboard.xquik.com). Required for full access to all 112 endpoints." },
+      "apiKey": { "type": "string", "minLength": 1, "description": "Xquik API key (get one at dashboard.xquik.com). Required for full access to all 113 endpoints." },
       "tempoSigningKey": { "type": "string", "minLength": 1, "description": "MPP signing key for pay-per-use mode. No account needed. 32 read-only X-API endpoints." },
       "baseUrl": { "type": "string", "default": "https://xquik.com" },
       "pollingInterval": { "type": "number", "default": 60, "description": "Event polling interval in seconds" },
@@ -24,7 +24,7 @@
     ]
   },
   "uiHints": {
-    "apiKey": { "label": "Xquik API Key", "sensitive": true, "placeholder": "xq_...", "help": "Full access to all 112 endpoints. Generate at dashboard.xquik.com." },
+    "apiKey": { "label": "Xquik API Key", "sensitive": true, "placeholder": "xq_...", "help": "Full access to all 113 endpoints. Generate at dashboard.xquik.com." },
     "tempoSigningKey": { "label": "MPP Signing Key", "sensitive": true, "placeholder": "0x...", "help": "Pay-per-use mode via Machine Payments Protocol. No account needed. 32 read-only X-API endpoints only." },
     "baseUrl": { "label": "API Base URL", "placeholder": "https://xquik.com", "advanced": true, "help": "Only change if using a self-hosted Xquik instance." },
     "pollingInterval": { "label": "Event Poll Interval (seconds)", "advanced": true, "help": "How often to check for new monitor events. Default: 60 seconds." },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xquik/tweetclaw",
-  "version": "1.6.4",
-  "description": "Post tweets, reply, like, retweet, follow, DM & more from OpenClaw - full X/Twitter automation via Xquik. 112 endpoints, reads from $0.00015/call.",
+  "version": "1.6.5",
+  "description": "Post tweets, reply, like, retweet, follow, DM & more from OpenClaw - full X/Twitter automation via Xquik. 113 endpoints, reads from $0.00015/call.",
   "license": "MIT",
   "type": "module",
   "repository": {

package/skills/tweetclaw/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tweetclaw
-description: "OpenClaw plugin for X/Twitter automation. Post tweets, reply, like, retweet, follow, DM, search, extract data, run giveaways, monitor accounts via Xquik. 112 endpoints, 2 tools (explore + tweetclaw), 2 commands (/xstatus, /xtrends). Post reads from $0.00015/call - about 33x cheaper than official X API post reads."
+description: "OpenClaw plugin for X/Twitter automation. Post tweets, reply, like, retweet, follow, DM, search, extract data, run giveaways, monitor accounts via Xquik. 113 endpoints, 2 tools (explore + tweetclaw), 2 commands (/xstatus, /xtrends). Post reads from $0.00015/call - about 33x cheaper than official X API post reads."
 homepage: https://xquik.com
 primaryCredential: apiKey
 requires:
@@ -42,7 +42,7 @@ TweetClaw uses Xquik's credit-based pricing. 1 credit = $0.00015.
 | Read (tweet, search, timeline, bookmarks, etc.) | 1 | $0.00015 |
 | Read (user profile) | 1 | $0.00015 |
 | Read (trends) | 3 | $0.00045 |
-| Follow check, article | 7 | $0.00105 |
+| Follow check, article | 5 | $0.00075 |
 | Write (tweet, like, retweet, follow, DM, etc.) | 10 | $0.0015 |
 | Extraction (tweets, replies, quotes, mentions, posts, likes, media, search, favoriters, retweeters, community members, people search, list members, list followers) | 1/result | $0.00015/result |
 | Extraction (followers, following, verified followers) | 1/result | $0.00015/result |
@@ -65,7 +65,7 @@ Source: [official X API pricing](https://docs.x.com/x-api/getting-started/pricin
 
 ### Pay-Per-Use (No Subscription)
 
-- **Credits**: Top up via `POST /api/v1/credits/topup` ($10 minimum). Works with all 112 endpoints.
+- **Credits**: Top up via `POST /api/v1/credits/topup` ($10 minimum). Works with all 113 endpoints.
 - **MPP**: 32 read-only endpoints accept anonymous on-chain payments. No account needed. SDK: `npm i mppx viem`.
 
 MPP pricing: tweet lookup ($0.00015), tweet search ($0.00015/tweet), user lookup ($0.00015), user tweets ($0.00015/tweet), follower check ($0.00105), article ($0.00105), media download ($0.00015/media), trends ($0.00045), X trends ($0.00045), quotes ($0.00015/tweet), replies ($0.00015/tweet), retweeters ($0.00015/user), favoriters ($0.00015/user), thread ($0.00015/tweet), user likes ($0.00015/tweet), user media ($0.00015/tweet), community info ($0.00015), community members ($0.00015/user), community moderators ($0.00015/user), community tweets ($0.00015/tweet), community search ($0.00015/community), communities tweets ($0.00015/tweet), list followers ($0.00015/user), list members ($0.00015/user), list tweets ($0.00015/tweet), users batch ($0.00015/user), users search ($0.00015/user), user followers ($0.00015/user), followers you know ($0.00015/user), user following ($0.00015/user), user mentions ($0.00015/tweet), verified followers ($0.00015/user).
@@ -133,7 +133,7 @@ Configure the signing key in your OpenClaw plugin config:
 
 ## Tools
 
-TweetClaw registers 2 tools that cover the entire Xquik API (112 endpoints):
+TweetClaw registers 2 tools that cover the entire Xquik API (113 endpoints):
 
 ### `explore` (free, no network)
 
@@ -318,7 +318,7 @@ Agent uses tweetclaw -> creates ticket with subject and description
 | Media | Upload media, download tweet media | 1-2 credits |
 | Monitoring | Create monitors, view events, webhooks | Free |
 | Support | Create tickets, reply, track status | Free |
-| Twitter | Search, lookups, timelines, articles, trends, bookmarks, notifications | 1-7 credits |
+| Twitter | Search, lookups, timelines, articles, trends, bookmarks, notifications | 1-5 credits |
 | X Accounts | List, inspect, and disconnect connected accounts | Free |
 | X Write | Post, reply, like, retweet, follow, remove follower, DM, profile, communities | 10 credits |
 
@@ -388,6 +388,8 @@ Endpoints that initiate financial transactions require **explicit user confirmat
 
 ### Write Action Confirmation
 
+OpenClaw approval prompts are enforced before write-like `tweetclaw` tool calls, but the agent must still show the exact endpoint and payload before asking the user to approve.
+
 All write endpoints modify the user's X account or Xquik resources. These are **irreversible public actions** - a posted tweet, sent DM, or profile change is immediately visible. Before calling any write endpoint, **show the user exactly what will be sent** and wait for explicit approval:
 
 - `POST /api/v1/x/tweets` - show full tweet text, media attachments, and reply target

package/src/api-spec.ts

@@ -1014,6 +1014,17 @@ const API_SPEC: readonly EndpointInfo[] = [
     responseShape: '{ url: string }',
     summary: 'Top up credits via Stripe Checkout. $10 min.',
   },
+  {
+    category: 'credits',
+    free: true,
+    method: 'GET',
+    parameters: [
+      { description: 'Stripe Checkout session ID returned from credit top-up checkout', in: 'query', name: 'session_id', required: true, type: 'string' },
+    ],
+    path: '/api/v1/credits/topup/status',
+    responseShape: '{ status: "paid" | "open" | "expired" | "unknown", amount_dollars?: number, credits?: number }',
+    summary: 'Check credit top-up checkout status.',
+  },
   {
     category: 'credits',
     free: true,

package/src/index.ts

@@ -34,6 +34,28 @@ interface CommandContext {
   readonly senderId?: string;
 }
 
+interface BeforeToolCallEvent {
+  readonly params?: unknown;
+  readonly toolName?: string;
+}
+
+interface ToolApprovalRequest {
+  readonly description: string;
+  readonly pluginId?: string;
+  readonly severity?: 'critical' | 'info' | 'warning';
+  readonly timeoutBehavior?: 'allow' | 'deny';
+  readonly timeoutMs?: number;
+  readonly title: string;
+}
+
+interface BeforeToolCallResult {
+  readonly requireApproval?: ToolApprovalRequest;
+}
+
+type BeforeToolCallHandler = (
+  event: BeforeToolCallEvent,
+) => BeforeToolCallResult | Promise<BeforeToolCallResult | undefined> | undefined;
+
 interface OpenClawApi {
   readonly logger: {
     readonly debug?: (message: string) => void;
@@ -62,6 +84,16 @@ interface OpenClawApi {
     },
     options?: { readonly name?: string; readonly optional?: boolean },
   ) => void;
+  readonly on?: (
+    name: 'before_tool_call',
+    handler: BeforeToolCallHandler,
+    options?: { readonly priority?: number },
+  ) => void;
+  readonly registerHook?: (
+    name: 'before_tool_call',
+    handler: BeforeToolCallHandler,
+    options?: { readonly priority?: number },
+  ) => void;
 }
 
 const CODE_PARAMETER = {
@@ -72,6 +104,76 @@ const CODE_PARAMETER = {
   type: 'object',
 };
 
+const WRITE_METHOD_PATTERN = /\bmethod\s*:\s*['"`](?:DELETE|PATCH|POST|PUT)['"`]/iu;
+const HIGH_IMPACT_PATH_PATTERNS = [
+  /\/api\/v1\/credits\/(?:quick-topup|topup)/u,
+  /\/api\/v1\/draws/u,
+  /\/api\/v1\/extractions/u,
+  /\/api\/v1\/monitors/u,
+  /\/api\/v1\/subscribe/u,
+  /\/api\/v1\/webhooks/u,
+  /\/api\/v1\/x\/communities/u,
+  /\/api\/v1\/x\/dm\//u,
+  /\/api\/v1\/x\/media/u,
+  /\/api\/v1\/x\/profile/u,
+  /\/api\/v1\/x\/tweets['"`]/u,
+] as const;
+
+function toolCallCode(event: BeforeToolCallEvent): string | undefined {
+  if (typeof event.params !== 'object' || event.params === null) {
+    return undefined;
+  }
+
+  const { code } = event.params as { readonly code?: unknown };
+  return typeof code === 'string' ? code : undefined;
+}
+
+function requiresTweetclawApproval(code: string): boolean {
+  if (WRITE_METHOD_PATTERN.test(code)) {
+    return true;
+  }
+
+  return HIGH_IMPACT_PATH_PATTERNS.some((pattern) => pattern.test(code));
+}
+
+function registerWriteApprovalHook(api: OpenClawApi): void {
+  const registerHook = api.on ?? api.registerHook;
+  if (registerHook === undefined) {
+    api.logger.warn(
+      'TweetClaw: OpenClaw approval hooks are unavailable. Keep explicit user approval before write actions.',
+    );
+    return;
+  }
+
+  registerHook.call(
+    api,
+    'before_tool_call',
+    (event): BeforeToolCallResult | undefined => {
+      if (event.toolName !== 'tweetclaw') {
+        return undefined;
+      }
+
+      const code = toolCallCode(event);
+      if (code === undefined || !requiresTweetclawApproval(code)) {
+        return undefined;
+      }
+
+      return {
+        requireApproval: {
+          description:
+            'TweetClaw is about to run code that can change X accounts, create jobs, or start a checkout flow. Review the tool call before allowing it.',
+          pluginId: 'tweetclaw',
+          severity: 'warning',
+          timeoutBehavior: 'deny',
+          timeoutMs: 60_000,
+          title: 'Approve TweetClaw Action',
+        },
+      };
+    },
+    { priority: 50 },
+  );
+}
+
 export default function register(api: OpenClawApi, fetchFunction?: FetchFunction): void {
   const config: unknown = api.pluginConfig;
   if (!isPluginConfig(config)) {
@@ -98,6 +200,7 @@ export default function register(api: OpenClawApi, fetchFunction?: FetchFunction
   }
 
   const request = createProxiedRequest(baseUrl, credential, fetchFunction);
+  registerWriteApprovalHook(api);
 
   // --- Tools (2-tool approach, execute inside tool object) ---
   api.registerTool(