agenticros 0.0.1 → 0.1.1

package/runtime/scripts/configure_agenticros.sh

@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+# configure_agenticros.sh — Configure AgenticROS plugin: transport mode, namespace, and optional Docker
+#
+# Updates ~/.openclaw/openclaw.json (or OPENCLAW_CONFIG) with plugins.entries.agenticros.config
+# so that transport.mode, rosbridge.url, zenoh.routerEndpoint, robot.namespace, etc. are set.
+#
+# Usage:
+#   ./scripts/configure_agenticros.sh [OPTIONS]
+#   ./scripts/configure_agenticros.sh --interactive
+#
+# Options:
+#   --mode MODE       A|B|C|D or local|rosbridge|webrtc|zenoh
+#   --namespace NS    Robot namespace (e.g. robot-uuid) → topics like /robot-uuid/cmd_vel
+#   --robot-ip IP     For Mode B: robot IP/hostname (sets rosbridge.url = ws://IP:9090)
+#   --zenoh-endpoint  For Mode D: Zenoh router endpoint (e.g. ws://localhost:10000)
+#   --zenoh-domain    For Mode D: domain ID (default 0)
+#   --docker          For demo: use Mode B and start Docker ROS2+rosbridge (ws://localhost:9090)
+#   --interactive     Prompt for mode and namespace
+#   --config FILE     OpenClaw config path (default: $HOME/.openclaw/openclaw.json or OPENCLAW_CONFIG)
+#
+# Mode summary:
+#   A / local   — Everything on robot (OpenClaw + ROS2 on same machine)
+#   B / rosbridge — Robot on network; plugin connects via rosbridge (ws://robot-ip:9090)
+#   C / webrtc  — Remote robot (WebRTC); set signaling URL, robot ID/key in plugin config
+#   D / zenoh   — Robot uses Zenoh RMW; plugin connects to Zenoh router
+
+set -e
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+source "$REPO_ROOT/scripts/lib/agenticros-banner.sh"
+OPENCLAW_JSON="${OPENCLAW_CONFIG:-$HOME/.openclaw/openclaw.json}"
+MODE=""
+NAMESPACE=""
+ROBOT_IP=""
+ZENOH_ENDPOINT=""
+ZENOH_DOMAIN="0"
+DOCKER=false
+INTERACTIVE=false
+
+usage() {
+  sed -n '2,28p' "$0" | sed 's/^# \?//'
+  echo ""
+  echo "Examples:"
+  echo "  ./scripts/configure_agenticros.sh --mode B --robot-ip 192.168.1.50 --namespace mybot"
+  echo "  ./scripts/configure_agenticros.sh --mode D --zenoh-endpoint ws://localhost:10000"
+  echo "  ./scripts/configure_agenticros.sh --docker"
+  echo "  ./scripts/configure_agenticros.sh --interactive"
+  exit 0
+}
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    -h|--help) usage ;;
+    --mode)        MODE="$2";   shift 2 ;;
+    --namespace)   NAMESPACE="$2"; shift 2 ;;
+    --robot-ip)    ROBOT_IP="$2";   shift 2 ;;
+    --zenoh-endpoint) ZENOH_ENDPOINT="$2"; shift 2 ;;
+    --zenoh-domain)   ZENOH_DOMAIN="${2:-0}"; shift 2 ;;
+    --docker)      DOCKER=true; shift ;;
+    --interactive) INTERACTIVE=true; shift ;;
+    --config)      OPENCLAW_JSON="$2"; shift 2 ;;
+    *) echo "Unknown option: $1"; usage ;;
+  esac
+done
+
+# Map friendly mode to transport mode
+resolve_mode() {
+  local m="$1"
+  case "$m" in
+    A|local)       echo "local" ;;
+    B|rosbridge)   echo "rosbridge" ;;
+    C|webrtc)      echo "webrtc" ;;
+    D|zenoh)       echo "zenoh" ;;
+    *)             echo "$m" ;;
+  esac
+}
+
+if [[ "$INTERACTIVE" == true ]]; then
+  agenticros_banner
+  echo "AgenticROS configuration"
+  echo ""
+  echo "Mode A — Everything on robot (OpenClaw on robot, transport = local)"
+  echo "Mode B — Connected robot (OpenClaw here, robot on network; transport = rosbridge)"
+  echo "Mode C — Remote robot / WebRTC (robot behind NAT; transport = webrtc)"
+  echo "Mode D — Zenoh (robot uses Zenoh RMW; transport = zenoh)"
+  echo ""
+  read -r -p "Choose mode (A/B/C/D) [B]: " mode_choice
+  mode_choice="${mode_choice:-B}"
+  MODE=$(resolve_mode "$mode_choice")
+
+  read -r -p "Robot namespace (empty for global topics) []: " NAMESPACE
+
+  if [[ "$MODE" == "rosbridge" ]]; then
+    if [[ "$DOCKER" != true ]]; then
+      read -r -p "Robot IP or hostname (for rosbridge URL) [localhost]: " ROBOT_IP
+      ROBOT_IP="${ROBOT_IP:-localhost}"
+    else
+      ROBOT_IP="localhost"
+    fi
+  fi
+
+  if [[ "$MODE" == "zenoh" ]]; then
+    read -r -p "Zenoh router endpoint (e.g. ws://localhost:10000) [ws://localhost:10000]: " ZENOH_ENDPOINT
+    ZENOH_ENDPOINT="${ZENOH_ENDPOINT:-ws://localhost:10000}"
+  fi
+fi
+
+# Docker implies Mode B + localhost
+if [[ "$DOCKER" == true ]]; then
+  MODE="rosbridge"
+  ROBOT_IP="localhost"
+fi
+
+# If no mode chosen, show current config and exit
+if [[ -z "$MODE" ]]; then
+  echo "Config file: $OPENCLAW_JSON"
+  if [[ -f "$OPENCLAW_JSON" ]] && command -v jq &>/dev/null; then
+    echo ""
+    jq '.plugins.entries.agenticros.config // "not set"' "$OPENCLAW_JSON" 2>/dev/null || echo "Could not read plugin config."
+  else
+    echo "Use --mode, --interactive, or --help."
+  fi
+  exit 0
+fi
+
+TRANSPORT_MODE=$(resolve_mode "$MODE")
+
+echo "=============================================="
+echo "  AgenticROS configuration"
+echo "=============================================="
+echo "  Config: $OPENCLAW_JSON"
+echo "  Mode:   $TRANSPORT_MODE"
+[[ -n "$NAMESPACE" ]]    && echo "  Namespace: $NAMESPACE"
+[[ -n "$ROBOT_IP" ]]     && echo "  Rosbridge: ws://${ROBOT_IP}:9090"
+[[ -n "$ZENOH_ENDPOINT" ]] && echo "  Zenoh:     $ZENOH_ENDPOINT"
+echo ""
+
+# Ensure config file and plugins.entries.agenticros exist
+if [[ ! -f "$OPENCLAW_JSON" ]]; then
+  echo "Config file not found: $OPENCLAW_JSON"
+  echo "Create it by running OpenClaw configure once, or set OPENCLAW_CONFIG."
+  exit 1
+fi
+
+if ! command -v jq &>/dev/null; then
+  echo "jq is required to update the config file. Install jq or edit $OPENCLAW_JSON manually:"
+  echo ""
+  echo "  transport.mode: $TRANSPORT_MODE"
+  [[ -n "$NAMESPACE" ]]    && echo "  robot.namespace: $NAMESPACE"
+  if [[ "$TRANSPORT_MODE" == "rosbridge" ]]; then
+    echo "  rosbridge.url: ws://${ROBOT_IP:-localhost}:9090"
+  fi
+  if [[ "$TRANSPORT_MODE" == "zenoh" ]]; then
+    echo "  zenoh.routerEndpoint: ${ZENOH_ENDPOINT:-ws://localhost:10000}"
+    echo "  zenoh.domainId: $ZENOH_DOMAIN"
+  fi
+  exit 1
+fi
+
+# Build the config fragment we want under plugins.entries.agenticros.config
+# jq: merge existing config with our overrides
+CONFIG_OVERRIDES='.transport.mode = "'"$TRANSPORT_MODE"'"'
+[[ -n "$NAMESPACE" ]] && CONFIG_OVERRIDES="$CONFIG_OVERRIDES | .robot.namespace = \"$NAMESPACE\""
+
+if [[ "$TRANSPORT_MODE" == "rosbridge" ]]; then
+  CONFIG_OVERRIDES="$CONFIG_OVERRIDES | .rosbridge.url = \"ws://${ROBOT_IP:-localhost}:9090\""
+fi
+
+if [[ "$TRANSPORT_MODE" == "zenoh" ]]; then
+  CONFIG_OVERRIDES="$CONFIG_OVERRIDES | .zenoh.routerEndpoint = \"${ZENOH_ENDPOINT:-ws://localhost:10000}\""
+  CONFIG_OVERRIDES="$CONFIG_OVERRIDES | .zenoh.domainId = ($ZENOH_DOMAIN | tonumber)"
+  CONFIG_OVERRIDES="$CONFIG_OVERRIDES | .zenoh.keyFormat = \"ros2dds\""
+fi
+
+# Read current config, ensure structure, merge, write back
+TMP=$(mktemp)
+jq '
+  .plugins.entries.agenticros.config = ((.plugins.entries.agenticros.config // {}) | '"$CONFIG_OVERRIDES"')
+' "$OPENCLAW_JSON" > "$TMP" && mv "$TMP" "$OPENCLAW_JSON"
+
+echo "Updated $OPENCLAW_JSON with transport.mode=$TRANSPORT_MODE and selected options."
+echo ""
+
+if [[ "$DOCKER" == true ]]; then
+  echo "Starting Docker stack (ROS2 + rosbridge) in background..."
+  if [[ -f "$REPO_ROOT/docker/docker-compose.yml" ]]; then
+    (cd "$REPO_ROOT" && docker compose -f docker/docker-compose.yml up -d ros2) || true
+    echo "Run: docker compose -f docker/docker-compose.yml logs -f ros2"
+  else
+    echo "docker/docker-compose.yml not found; start your ROS2+rosbridge stack manually."
+  fi
+  echo ""
+fi
+
+echo "Next steps:"
+echo "  1. Restart the OpenClaw gateway so the plugin picks up the new config."
+echo "  2. For Mode B: ensure rosbridge is running on the robot (e.g. ros2 launch rosbridge_server rosbridge_websocket_launch.xml)."
+echo "  3. For Mode D: ensure Zenoh router is running with zenoh-plugin-remote-api and ROS2 uses RMW_IMPLEMENTATION=rmw_zenoh_cpp."
+echo ""
+echo "See docs/robot-setup.md for details."

package/runtime/scripts/configure_for_sim.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# configure_for_sim.sh
+#
+# One-shot helper: copy the simulation-tuned AgenticROS config template into
+# ~/.agenticros/config.json. Use this when you want the MCP server + OpenClaw
+# plugin to talk to the sim AMR's topics (which use no robot-namespace
+# prefix - so a fresh "real robot" config with a UUID namespace would miss
+# every topic).
+#
+# Usage:
+#   ./scripts/configure_for_sim.sh            # writes ~/.agenticros/config.json
+#   ./scripts/configure_for_sim.sh --backup   # back up an existing config first
+#   ./scripts/configure_for_sim.sh --print    # print the template to stdout
+#
+# After running, restart the MCP server (or run `agenticros up sim-amr`).
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+SRC="$ROOT/ros2_ws/src/agenticros_sim/config/agenticros-sim.config.json"
+DEST_DIR="$HOME/.agenticros"
+DEST="$DEST_DIR/config.json"
+
+PRINT_ONLY=false
+DO_BACKUP=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --print)   PRINT_ONLY=true; shift ;;
+    --backup)  DO_BACKUP=true; shift ;;
+    -h|--help) sed -n '2,16p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+if [[ ! -f "$SRC" ]]; then
+  echo "Template missing: $SRC" >&2
+  echo "Did you build the ros2 workspace? (cd $ROOT/ros2_ws && colcon build)" >&2
+  exit 1
+fi
+
+if [[ "$PRINT_ONLY" == "true" ]]; then
+  cat "$SRC"
+  exit 0
+fi
+
+mkdir -p "$DEST_DIR"
+
+if [[ -f "$DEST" ]]; then
+  if [[ "$DO_BACKUP" == "true" ]]; then
+    BAK="${DEST}.real.$(date +%Y%m%d-%H%M%S).bak"
+    cp -a "$DEST" "$BAK"
+    echo "[configure_for_sim] Backed up existing config -> $BAK"
+  else
+    echo "[configure_for_sim] $DEST already exists. Re-run with --backup to keep a copy." >&2
+    echo "[configure_for_sim] Aborting (use --backup to overwrite)." >&2
+    exit 1
+  fi
+fi
+
+cp "$SRC" "$DEST"
+echo "[configure_for_sim] Wrote $DEST"
+echo "[configure_for_sim] Inspect with: agenticros config show"
+echo "[configure_for_sim] Bring up sim with: agenticros up sim-amr"

package/runtime/scripts/fix-openclaw-control-ui-path.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Fix Control UI 404 when OpenClaw is installed globally (npm install -g openclaw).
+# The gateway's path resolver often fails to find dist/control-ui; this symlink fixes it.
+# See: https://getclawkit.com/docs/troubleshooting/control-ui-assets-not-found
+set -e
+OPENCLAW_ROOT=$(npm root -g)/openclaw
+if [[ ! -d "$OPENCLAW_ROOT" ]]; then
+  echo "OpenClaw not found at $OPENCLAW_ROOT. Install it first: npm install -g openclaw@2026.2.26"
+  exit 1
+fi
+if [[ ! -d "$OPENCLAW_ROOT/dist/control-ui" ]]; then
+  echo "No dist/control-ui at $OPENCLAW_ROOT — reinstall OpenClaw: npm install -g openclaw@2026.2.26"
+  exit 1
+fi
+ln -sf "$OPENCLAW_ROOT/dist/control-ui" "$OPENCLAW_ROOT/control-ui"
+echo ""
+echo "  Symlink created: $OPENCLAW_ROOT/control-ui -> dist/control-ui"
+echo "  Restart the gateway, then open the dashboard URL (with #token=...)."
+echo "  If you need the URL: node scripts/openclaw-dashboard-url.cjs"
+echo ""

package/runtime/scripts/install_cli.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# install_cli.sh - put the AgenticROS CLI on PATH for the current user.
+#
+# Three install strategies are tried, in order of preference:
+#   1. `pnpm link --global` against the workspace package (best for contributors;
+#      live edits to packages/agenticros-cli/src/ are visible immediately after
+#      `pnpm --filter agenticros build`).
+#   2. PATH symlink under ~/.local/bin pointing at the repo's ./agenticros shim
+#      (works without a global pnpm prefix).
+#   3. Print clear next-step instructions.
+#
+# Usage:
+#   ./scripts/install_cli.sh           # auto-pick the best strategy
+#   ./scripts/install_cli.sh --method symlink   # force one
+#
+# After install, run `agenticros --version` to confirm.
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CLI_DIR="$ROOT/packages/agenticros-cli"
+ROOT_SHIM="$ROOT/agenticros"
+METHOD="auto"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --method) METHOD="$2"; shift 2 ;;
+    --help|-h)
+      sed -n '2,16p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+      exit 0 ;;
+    *) echo "Unknown flag: $1" >&2; exit 2 ;;
+  esac
+done
+
+log() { printf "\033[36m[install-cli]\033[0m %s\n" "$*"; }
+ok()  { printf "\033[32m[install-cli]\033[0m %s\n" "$*"; }
+warn(){ printf "\033[33m[install-cli]\033[0m %s\n" "$*"; }
+err() { printf "\033[31m[install-cli]\033[0m %s\n" "$*" >&2; }
+
+ensure_built() {
+  if [[ ! -f "$CLI_DIR/dist/index.js" ]]; then
+    log "Building the CLI (one-time)..."
+    (cd "$ROOT" && pnpm --filter agenticros build)
+  fi
+}
+
+try_pnpm_link() {
+  command -v pnpm >/dev/null || return 1
+  ensure_built
+  log "Installing via pnpm link --global from $CLI_DIR"
+  (cd "$CLI_DIR" && pnpm link --global) || return 1
+  ok  "Linked. Run: agenticros --version"
+  return 0
+}
+
+try_symlink() {
+  local target="$HOME/.local/bin"
+  mkdir -p "$target"
+  ensure_built
+  if ln -sf "$ROOT_SHIM" "$target/agenticros"; then
+    ok "Symlinked $ROOT_SHIM -> $target/agenticros"
+    case ":$PATH:" in
+      *":$target:"*) ok "$target is already on PATH." ;;
+      *) warn "Add $target to PATH (e.g. add 'export PATH=\"\$HOME/.local/bin:\$PATH\"' to your shell rc)." ;;
+    esac
+    return 0
+  fi
+  return 1
+}
+
+print_instructions() {
+  cat <<EOF >&2
+Failed to install the CLI automatically. Manual options:
+
+  1. Add the repo's shim to PATH for this shell:
+       export PATH="$ROOT:\$PATH"
+
+  2. Use pnpm directly:
+       cd "$ROOT" && pnpm --filter agenticros build && pnpm --filter agenticros link --global
+
+  3. Use the bundled root shim ad-hoc:
+       $ROOT_SHIM --help
+
+After any of the above, run: agenticros --version
+EOF
+  return 1
+}
+
+case "$METHOD" in
+  pnpm-link) try_pnpm_link || print_instructions ;;
+  symlink)   try_symlink   || print_instructions ;;
+  auto)      try_pnpm_link || try_symlink || print_instructions ;;
+  *)         err "Unknown --method $METHOD"; exit 2 ;;
+esac

package/runtime/scripts/install_rosbridge_from_source.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+# install_rosbridge_from_source.sh - Build and install rosbridge_suite from source
+#
+# Use this when apt install ros-<distro>-rosbridge-suite fails (e.g. 404).
+# Usage: ./scripts/install_rosbridge_from_source.sh [jazzy|humble]
+# Default: jazzy
+
+set -e
+
+ROS_DISTRO="${1:-jazzy}"
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+ROS2_WS="$REPO_ROOT/ros2_ws"
+SRC="$ROS2_WS/src"
+BRIDGE_REPO="$SRC/rosbridge_suite_repo"
+
+echo "Installing rosbridge_suite from source for ROS2 $ROS_DISTRO"
+echo "Workspace: $ROS2_WS"
+echo ""
+
+source "/opt/ros/$ROS_DISTRO/setup.bash"
+
+# Python deps required by rosbridge_server (tornado). Use a venv to avoid touching system Python.
+VENV_ROSBRIDGE="$ROS2_WS/venv_rosbridge"
+if [[ ! -d "$VENV_ROSBRIDGE" ]]; then
+    echo "Creating venv for rosbridge at $VENV_ROSBRIDGE..."
+    python3 -m venv "$VENV_ROSBRIDGE"
+fi
+echo "Installing Python deps in venv (tornado, pymongo, cbor2, ujson)..."
+"$VENV_ROSBRIDGE/bin/pip" install --quiet tornado pymongo cbor2 ujson
+echo "Venv ready. Run scripts will set PYTHONPATH automatically."
+
+# Clone repo (ros2 branch) if not present
+if [[ ! -d "$BRIDGE_REPO" ]]; then
+    echo "Cloning RobotWebTools/rosbridge_suite (branch ros2)..."
+    git clone -b ros2 --depth 1 https://github.com/RobotWebTools/rosbridge_suite.git "$BRIDGE_REPO"
+else
+    echo "Repo already at $BRIDGE_REPO, pulling latest..."
+    (cd "$BRIDGE_REPO" && git fetch origin ros2 && git checkout ros2 && git pull --ff-only)
+fi
+
+# Symlink packages into src so colcon finds them (avoid name clash: repo dir is rosbridge_suite_repo)
+for pkg in rosapi_msgs rosbridge_msgs rosbridge_library rosapi rosbridge_server rosbridge_suite; do
+    if [[ -d "$BRIDGE_REPO/$pkg" ]]; then
+        if [[ -L "$SRC/$pkg" ]]; then
+            rm -f "$SRC/$pkg"
+        fi
+        if [[ ! -e "$SRC/$pkg" ]]; then
+            ln -sf "$(basename "$BRIDGE_REPO")/$pkg" "$SRC/$pkg"
+            echo "Linked $pkg"
+        fi
+    fi
+done
+
+# Build (skip tests so we don't need ament_cmake_mypy)
+echo ""
+echo "Building workspace (this may take a few minutes)..."
+cd "$ROS2_WS"
+colcon build --symlink-install --packages-up-to rosbridge_server --cmake-args -DBUILD_TESTING=OFF
+
+echo ""
+echo "Done. Source and run rosbridge with:"
+echo "  source /opt/ros/$ROS_DISTRO/setup.bash"
+echo "  source $ROS2_WS/install/setup.bash"
+echo "  ros2 launch rosbridge_server rosbridge_websocket_launch.xml"
+echo ""
+echo "Or use: ./scripts/run_robot_rosbridge.sh $ROS_DISTRO"
+echo "Or:     ./scripts/run_demo_native.sh $ROS_DISTRO"

package/runtime/scripts/lib/agenticros-banner.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+agenticros_banner() {
+  if [[ "${AGENTICROS_NO_BANNER:-}" == "1" ]]; then
+    return 0
+  fi
+
+  local reset=""
+  local green=""
+  local yellow=""
+  local dim=""
+  if [[ -t 1 ]] && command -v tput >/dev/null 2>&1; then
+    reset="$(tput sgr0 || true)"
+    green="$(tput setaf 10 || true)"
+    yellow="$(tput setaf 11 || true)"
+    dim="$(tput dim || true)"
+  fi
+
+  cat <<EOF
+${green}    _                     _   _       ____   ___  ____
+   / \   __ _  ___ _ __ | |_(_) ___ |  _ \ / _ \/ ___|
+  / _ \ / _\` |/ _ \ '_ \| __| |/ __|| |_) | | | \___ \\
+ / ___ \ (_| |  __/ | | | |_| | (__ |  _ <| |_| |___) |
+/_/   \_\__, |\___|_| |_|\__|_|\___||_| \_\\___/|____/
+        |___/${reset}
+${yellow}  AgenticROS${reset} ${dim}- agentic AI for ROS-powered robots${reset}
+EOF
+}

package/runtime/scripts/onboard_robot.sh

@@ -0,0 +1,75 @@
+#!/bin/bash
+# onboard_robot.sh - Interactive onboarding for a new AgenticROS robot
+#
+# Run from the agenticros repo root. Asks whether you're on the robot or the
+# gateway, then runs the right setup and prints a checklist.
+#
+# Usage: ./scripts/onboard_robot.sh
+
+set -e
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+cd "$REPO_ROOT"
+source "$REPO_ROOT/scripts/lib/agenticros-banner.sh"
+
+echo ""
+agenticros_banner
+echo ""
+echo "  AgenticROS - Onboard a new robot"
+echo ""
+
+# Where are we?
+echo "Where is this script running?"
+echo "  1) On the ROBOT (Ubuntu + ROS2) — set up rosbridge and run bridges"
+echo "  2) On the GATEWAY (where OpenClaw runs) — set up the AgenticROS plugin"
+echo "  3) Do BOTH (robot and gateway on this machine)"
+echo ""
+read -p "Choice [1/2/3]: " choice
+choice=${choice:-1}
+
+run_robot() {
+  echo ""
+  echo "--- Robot setup ---"
+  read -p "ROS2 distro (jazzy/humble) [auto]: " distro
+  if [[ -n "$distro" ]]; then
+    "$REPO_ROOT/scripts/setup_robot.sh" --ros-distro "$distro"
+  else
+    "$REPO_ROOT/scripts/setup_robot.sh"
+  fi
+}
+
+run_gateway() {
+  echo ""
+  echo "--- Gateway plugin setup ---"
+  read -p "Rosbridge URL (e.g. ws://localhost:9090 or ws://ROBOT_IP:9090) [skip]: " url
+  read -p "Robot namespace for cmd_vel (e.g. robot3946b404c33e4aa39a8d16deb1c5c593) [skip]: " ns
+  args=()
+  [[ -n "$url" ]] && args+=(--rosbridge-url "$url")
+  [[ -n "$ns" ]]  && args+=(--robot-namespace "$ns")
+  "$REPO_ROOT/scripts/setup_gateway_plugin.sh" "${args[@]}"
+}
+
+case "$choice" in
+  1) run_robot ;;
+  2) run_gateway ;;
+  3) run_robot; run_gateway ;;
+  *) echo "Invalid choice."; exit 1 ;;
+esac
+
+echo ""
+echo "  Onboarding checklist"
+echo ""
+if [[ "$choice" == "1" || "$choice" == "3" ]]; then
+  echo "  On the robot:"
+  echo "    [ ] Start bridges:  ./scripts/run_demo_native.sh"
+  echo "    [ ] (Optional) Open firewall for port 9090 if gateway is remote: sudo ufw allow 9090/tcp"
+fi
+if [[ "$choice" == "2" || "$choice" == "3" ]]; then
+  echo "  On the gateway:"
+  echo "    [ ] Restart OpenClaw:  systemctl --user restart openclaw-gateway.service"
+  echo "    [ ] Enable AgenticROS plugin in the dashboard (Plugins, not Channels)"
+  echo "    [ ] Set plugin config: rosbridge URL, robot namespace (if needed)"
+fi
+echo ""
+echo "  Full guide: docs/robot-setup.md"
+echo ""

package/runtime/scripts/openai.policy.yaml

@@ -0,0 +1,77 @@
+# NemoClaw policy preset: opens api.openai.com / cdn.openai.com for the
+# OpenClaw gateway when running OpenAI as the inference provider.
+#
+# Why this is required:
+#   By default the sandbox egress policy doesn't include any OpenAI host.
+#   Without this preset, requests fail in /var/log/openshell.*.log with:
+#       DENIED /usr/local/bin/node(...) -> api.openai.com:443
+#       [policy:- engine:opa]
+#       [reason:endpoint api.openai.com:443 not in policy '...']
+#
+# Apply with:
+#   nemoclaw nemo policy-add --yes \
+#       --from-file scripts/openai.policy.yaml \
+#       "$(docker ps --format '{{.Names}}' | grep '^openshell-nemo-')"
+#
+# After applying, the gateway hot-reloads automatically — no need to
+# `nemoclaw nemo recover` (and that command's probe gives false negatives
+# in this sandbox anyway; see docs/nemoclaw.md troubleshooting).
+#
+# Note 1: unlike the rosbridge preset, no `allowed_ips` block is needed —
+# api.openai.com resolves to PUBLIC IPs, so the OpenShell SSRF guard
+# (which only default-denies private/RFC1918 destinations) doesn't fire.
+#
+# Note 2: NO `binaries:` allowlist on this preset, and that is intentional.
+# The actual code path is:
+#   OpenClaw (node) → CONNECT inference.local:443 via OPA proxy
+#                  → openshell-router (Rust) → api.openai.com:443
+# The hop that crosses api.openai.com is made by the openshell-router
+# binary (/opt/openshell/bin/openshell-sandbox), not Node. If you restrict
+# `binaries:` to openclaw/node, OPA can't attribute the router's outbound
+# connection to any allowed binary and denies the request with
+#   DENIED -(0) -> api.openai.com:443
+#   [reason:failed to resolve peer binary: No ESTABLISHED TCP connection
+#    found for port ...]
+# Removing the binaries clause lets any process inside the sandbox
+# netns reach the listed hosts — fine because the hosts themselves are
+# narrowly scoped to OpenAI's public endpoints.
+
+preset:
+  name: openai
+  description: "OpenAI API access for inference (api.openai.com + cdn.openai.com)"
+
+network_policies:
+  openai:
+    name: openai
+    endpoints:
+      # Chat completions, embeddings, files, images — everything in the
+      # standard OpenAI REST surface goes through api.openai.com.
+      # We use the REST-aware shape (protocol/rules) that the built-in
+      # `managed_inference` and `local_inference` policies use, NOT the
+      # raw L4 `access: full` shape. The REST-aware shape tells OpenShell
+      # to terminate TLS at its proxy, inspect the HTTP layer, and route
+      # the request itself — which lets the openshell-router make the
+      # outbound api.openai.com hop on behalf of the sandbox without
+      # tripping OPA's peer-binary attribution check (which fails for
+      # router-originated connections — see "OpenAI inference fails with
+      # 'failed to resolve peer binary'" in docs/nemoclaw.md).
+      - host: api.openai.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**
+          - allow:
+              method: POST
+              path: /**
+      # OpenAI's CDN host for binary downloads (file responses, etc.).
+      - host: cdn.openai.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        rules:
+          - allow:
+              method: GET
+              path: /**

package/runtime/scripts/openclaw-dashboard-url.cjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+/**
+ * Ensure OpenClaw config has a gateway auth token and print the dashboard URL
+ * so the web chat can connect (required in 2026.2.26 when using a token for WS auth).
+ *
+ * Usage: node scripts/openclaw-dashboard-url.cjs
+ * Then open the printed URL in your browser.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const configPath = process.env.OPENCLAW_CONFIG || path.join(process.env.HOME || '', '.openclaw', 'openclaw.json');
+
+let config;
+try {
+  const raw = fs.readFileSync(configPath, 'utf8');
+  config = JSON.parse(raw);
+} catch (e) {
+  console.error('Could not read OpenClaw config:', configPath, e.message);
+  process.exit(1);
+}
+
+if (!config.gateway) config.gateway = {};
+if (!config.gateway.auth) config.gateway.auth = {};
+const auth = config.gateway.auth;
+
+let token = auth.token;
+if (!token || typeof token !== 'string' || token.length === 0) {
+  token = crypto.randomBytes(24).toString('base64url');
+  auth.token = token;
+  try {
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+    console.log('Added gateway.auth.token to', configPath);
+  } catch (e) {
+    console.error('Could not write config:', e.message);
+    process.exit(1);
+  }
+}
+
+const baseUrl = (config.gateway.url || 'http://127.0.0.1:18789').replace(/\/$/, '');
+const dashboardUrl = baseUrl + '/#token=' + encodeURIComponent(token);
+console.log('');
+console.log('  Open this URL in your browser for the web chat:');
+console.log('  ' + dashboardUrl);
+console.log('');
+console.log('  (Restart the gateway if it was already running when the token was added.)');
+console.log('');