agenticros 0.0.1 → 0.1.1

package/runtime/scripts/pack-runtime.mjs

@@ -0,0 +1,245 @@
+#!/usr/bin/env node
+/**
+ * pack-runtime.mjs
+ *
+ * Pre-publish helper for the `agenticros` npm package.
+ *
+ * Produces `packages/agenticros-cli/runtime/`: a near-complete snapshot of the
+ * monorepo source that ships inside the published tarball. After
+ * `npx agenticros init`, this runtime/ tree is copied into ~/agenticros (or
+ * $AGENTICROS_HOME) and treated as the user's workspace - so the layout
+ * matches the live repo exactly. Contributors get live edits without ever
+ * going through this script.
+ *
+ * What ships:
+ *   - scripts/                      shell helpers, install scripts, sim entrypoints
+ *   - ros2_ws/src/agenticros_*      our ROS 2 packages (msgs + Python nodes)
+ *   - packages/{core,ros-camera,agenticros,agenticros-claude-code,agenticros-gemini}
+ *                                   TypeScript sources for the workspace, NO dist or node_modules
+ *   - packages/agenticros-claude-code/dist  (pre-built so `npx agenticros` works without colcon)
+ *   - package.json / pnpm-workspace.yaml / tsconfig.base.json   monorepo manifests
+ *   - docs/cli.md                   reference for the CLI (used by `agenticros logs --help`)
+ *   - README.md / LICENSE           top-level docs
+ *
+ * What we deliberately drop:
+ *   - .git/                         massive, and `agenticros init` doesn't need history
+ *   - node_modules/                 reinstalled by `agenticros init`
+ *   - All packages/* dist/ except agenticros-claude-code/dist
+ *   - ros2_ws/build / install / log
+ *   - The CLI's own source (it's already installed by npm)
+ *   - .pnpm-store, .cache, .ccache, generated logs
+ *
+ * Invocation:
+ *   node scripts/pack-runtime.mjs            # from repo root
+ *   pnpm --filter agenticros pack:runtime    # via the CLI package's scripts
+ */
+
+import { execSync } from "node:child_process";
+import { cpSync, existsSync, mkdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const REPO_ROOT = resolve(__dirname, "..");
+const CLI_PKG_DIR = join(REPO_ROOT, "packages", "agenticros-cli");
+const RUNTIME_DIR = join(CLI_PKG_DIR, "runtime");
+
+const INCLUDED_PACKAGES = [
+  "core",
+  "ros-camera",
+  "agenticros",
+  "agenticros-claude-code",
+  "agenticros-gemini",
+];
+
+const TOP_LEVEL_FILES = [
+  "package.json",
+  "pnpm-workspace.yaml",
+  "pnpm-lock.yaml",
+  "tsconfig.base.json",
+  "LICENSE",
+  "README.md",
+  ".npmrc",
+];
+
+const DOCS_FILES = ["cli.md", "architecture.md", "robot-setup.md", "memory.md"];
+
+const EXCLUDED_DIR_NAMES = new Set([
+  "node_modules",
+  ".git",
+  ".pnpm-store",
+  ".cache",
+  ".ccache",
+  ".turbo",
+  "build",
+  "install",
+  "log",
+  ".tsbuildinfo",
+]);
+
+const EXCLUDED_FILE_GLOBS = [
+  /^\.DS_Store$/,
+  /\.tsbuildinfo$/,
+  /^\.env(\.|$)/,
+  /^npm-debug\.log/,
+];
+
+function logStep(message) {
+  process.stdout.write(`[pack-runtime] ${message}\n`);
+}
+
+function logSubstep(message) {
+  process.stdout.write(`[pack-runtime]   ${message}\n`);
+}
+
+function isExcluded(srcPath) {
+  const base = srcPath.split("/").pop() ?? "";
+  if (EXCLUDED_DIR_NAMES.has(base)) return true;
+  for (const re of EXCLUDED_FILE_GLOBS) if (re.test(base)) return true;
+  return false;
+}
+
+function copyTree(src, dest, opts = {}) {
+  const { allowDist = false } = opts;
+  if (!existsSync(src)) {
+    logSubstep(`skip (missing): ${relative(REPO_ROOT, src)}`);
+    return;
+  }
+  mkdirSync(dirname(dest), { recursive: true });
+  cpSync(src, dest, {
+    recursive: true,
+    dereference: false,
+    errorOnExist: false,
+    force: true,
+    filter: (s, _d) => {
+      const rel = s.startsWith(src + "/") ? s.slice(src.length + 1) : "";
+      const parts = rel.split("/");
+      for (const p of parts) {
+        if (EXCLUDED_DIR_NAMES.has(p)) return false;
+      }
+      // Drop dist/ from every package except the explicitly allowed ones.
+      if (!allowDist && parts.includes("dist")) return false;
+      const base = parts[parts.length - 1] ?? "";
+      for (const re of EXCLUDED_FILE_GLOBS) if (re.test(base)) return false;
+      return true;
+    },
+  });
+}
+
+function reset() {
+  if (existsSync(RUNTIME_DIR)) {
+    logStep(`Clearing existing runtime/ at ${relative(REPO_ROOT, RUNTIME_DIR)}`);
+    rmSync(RUNTIME_DIR, { recursive: true, force: true });
+  }
+  mkdirSync(RUNTIME_DIR, { recursive: true });
+}
+
+function copyScripts() {
+  logStep("Copying scripts/");
+  copyTree(join(REPO_ROOT, "scripts"), join(RUNTIME_DIR, "scripts"));
+}
+
+function copyRos2Ws() {
+  logStep("Copying ros2_ws/src/agenticros_*");
+  const dest = join(RUNTIME_DIR, "ros2_ws", "src");
+  mkdirSync(dest, { recursive: true });
+  // Only include AgenticROS packages, not arbitrary upstream sources.
+  const srcRoot = join(REPO_ROOT, "ros2_ws", "src");
+  if (!existsSync(srcRoot)) {
+    logSubstep("skip (missing ros2_ws/src)");
+    return;
+  }
+  for (const entry of readdirSync(srcRoot)) {
+    if (!entry.startsWith("agenticros_")) {
+      logSubstep(`skip non-agenticros pkg: ${entry}`);
+      continue;
+    }
+    copyTree(join(srcRoot, entry), join(dest, entry));
+  }
+}
+
+function copyPackages() {
+  logStep("Copying packages/*");
+  const pkgRoot = join(REPO_ROOT, "packages");
+  const dest = join(RUNTIME_DIR, "packages");
+  mkdirSync(dest, { recursive: true });
+  for (const pkg of INCLUDED_PACKAGES) {
+    const allowDist = pkg === "agenticros-claude-code";
+    if (allowDist) {
+      logSubstep(`${pkg} (including pre-built dist/)`);
+    } else {
+      logSubstep(`${pkg} (src only)`);
+    }
+    copyTree(join(pkgRoot, pkg), join(dest, pkg), { allowDist });
+  }
+}
+
+function copyTopLevel() {
+  logStep("Copying top-level manifests");
+  for (const file of TOP_LEVEL_FILES) {
+    const src = join(REPO_ROOT, file);
+    if (existsSync(src) && statSync(src).isFile()) {
+      const dest = join(RUNTIME_DIR, file);
+      mkdirSync(dirname(dest), { recursive: true });
+      cpSync(src, dest);
+      logSubstep(file);
+    }
+  }
+}
+
+function copyDocs() {
+  logStep("Copying selected docs/");
+  const docsSrc = join(REPO_ROOT, "docs");
+  const docsDest = join(RUNTIME_DIR, "docs");
+  mkdirSync(docsDest, { recursive: true });
+  for (const file of DOCS_FILES) {
+    const src = join(docsSrc, file);
+    if (existsSync(src)) {
+      cpSync(src, join(docsDest, file));
+      logSubstep(file);
+    } else {
+      logSubstep(`skip (missing): docs/${file}`);
+    }
+  }
+}
+
+function writeBundleManifest() {
+  const manifestPath = join(RUNTIME_DIR, "BUNDLE.json");
+  const manifest = {
+    packedAt: new Date().toISOString(),
+    repo: "https://github.com/PlaiPin/agenticros",
+    note: "This directory is a snapshot of the agenticros monorepo source. `agenticros init` will copy it to ~/agenticros and run pnpm install + colcon build there.",
+    layout: {
+      scripts: "scripts/",
+      ros2_packages: "ros2_ws/src/agenticros_*",
+      js_packages: "packages/*",
+      mcp_prebuilt: "packages/agenticros-claude-code/dist/index.js",
+    },
+  };
+  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+  logStep(`Wrote BUNDLE.json`);
+}
+
+function reportSize() {
+  try {
+    const out = execSync(`du -sh ${RUNTIME_DIR}`, { encoding: "utf8" });
+    const size = out.split(/\s+/)[0];
+    logStep(`runtime/ size: ${size}`);
+  } catch {
+    // du missing — skip
+  }
+}
+
+// Lazy import for readdirSync to keep the top of the file tidy.
+import { readdirSync } from "node:fs";
+
+reset();
+copyScripts();
+copyRos2Ws();
+copyPackages();
+copyTopLevel();
+copyDocs();
+writeBundleManifest();
+reportSize();
+logStep("Done.");

package/runtime/scripts/run_demo_native.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# run_demo_native.sh - Start rosbridge + discovery for AgenticROS demo (no Docker)
+#
+# Prerequisites (one-time):
+#   sudo apt install -y ros-jazzy-rosbridge-suite   # or ros-humble-rosbridge-suite
+#
+# Usage: ./scripts/run_demo_native.sh [jazzy|humble]
+# Default: jazzy
+
+set -e
+
+ROS_DISTRO="${1:-jazzy}"
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+source "$REPO_ROOT/scripts/lib/agenticros-banner.sh"
+agenticros_banner
+echo "Starting AgenticROS native ROS bridge stack"
+echo ""
+
+source "/opt/ros/$ROS_DISTRO/setup.bash"
+[[ -f "$REPO_ROOT/ros2_ws/install/setup.bash" ]] && source "$REPO_ROOT/ros2_ws/install/setup.bash"
+
+# If rosbridge was built from source, use venv's Python deps
+for _d in "$REPO_ROOT/ros2_ws/venv_rosbridge/lib/python"*/site-packages; do
+    [[ -d "$_d" ]] && export PYTHONPATH="$_d:${PYTHONPATH:-}" && break
+done
+
+if ! ros2 pkg list 2>/dev/null | grep -q rosbridge_server; then
+    echo "rosbridge_suite is not installed. Run once (then re-run this script):"
+    echo "  sudo apt install -y ros-$ROS_DISTRO-rosbridge-suite"
+    exit 1
+fi
+
+echo "Starting rosbridge WebSocket on port 9090 and agenticros_discovery..."
+echo "Connect OpenClaw plugin to: ws://localhost:9090"
+echo "Press Ctrl+C to stop."
+echo ""
+
+# Start discovery in background; rosbridge in foreground so we see logs
+ros2 run agenticros_discovery discovery_node &
+DISC_PID=$!
+trap "kill $DISC_PID 2>/dev/null" EXIT
+
+ros2 launch rosbridge_server rosbridge_websocket_launch.xml

package/runtime/scripts/run_nemoclaw_host_stack.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+#
+# Start the host-side ROS 2 stack the NemoClaw sandbox talks to:
+#
+#   RealSense (realsense2_camera) + rosbridge_server + cmd_vel relay
+#
+# Architecture (hybrid NemoClaw setup):
+#
+#     ┌──────────────── host (Jetson) ────────────────┐
+#     │  /opt/ros/humble  +  librealsense2            │
+#     │  ros2 launch agenticros_bringup …             │
+#     │      realsense2_camera   → /camera/camera/*   │
+#     │      rosbridge_server    on 0.0.0.0:9090      │
+#     │      cmd_vel_relay       /<ns>/cmd_vel→/cmd_vel│
+#     └───────────────────┬───────────────────────────┘
+#                         │  ws on 172.19.0.1:9090
+#                         ▼
+#     ┌──────────── NemoClaw sandbox ─────────────────┐
+#     │  OpenClaw + AgenticROS plugin                 │
+#     │  rosbridge.url = ws://host.docker.internal:9090│
+#     └───────────────────────────────────────────────┘
+#
+# Usage:   ./scripts/run_nemoclaw_host_stack.sh [ros_distro] [extra args...]
+#
+# Example: ./scripts/run_nemoclaw_host_stack.sh humble \
+#              robot_namespace:=3946b404-c33e-4aa3-9a8d-16deb1c5c593 \
+#              align_depth:=true
+#
+# Defaults to ROS 2 Humble (matches what's installed on a Jetson Orin Nano).
+# Pass jazzy etc. if your host runs a different distro.
+
+set -e
+
+ROS_DISTRO="${1:-humble}"
+shift || true
+
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+source "$REPO_ROOT/scripts/lib/agenticros-banner.sh"
+agenticros_banner
+echo "Starting AgenticROS host stack for NemoClaw"
+echo ""
+SETUP="/opt/ros/${ROS_DISTRO}/setup.bash"
+
+if [[ ! -f "$SETUP" ]]; then
+  echo "ROS 2 ${ROS_DISTRO} not found at ${SETUP}." >&2
+  echo "Install ROS 2 (e.g. ros-${ROS_DISTRO}-desktop) or pass a different distro: $0 jazzy ..." >&2
+  exit 1
+fi
+
+# shellcheck disable=SC1090
+source "$SETUP"
+
+WS_INSTALL="$REPO_ROOT/ros2_ws/install/setup.bash"
+if [[ ! -f "$WS_INSTALL" ]]; then
+  echo "agenticros_bringup not built yet. Building agenticros_msgs + agenticros_bringup …"
+  (
+    cd "$REPO_ROOT/ros2_ws"
+    colcon build --packages-select agenticros_msgs agenticros_bringup
+  )
+fi
+# shellcheck disable=SC1090
+source "$WS_INSTALL"
+
+for pkg in rosbridge_server realsense2_camera image_transport_plugins; do
+  if ! ros2 pkg prefix "$pkg" >/dev/null 2>&1; then
+    case "$pkg" in
+      rosbridge_server)
+        echo "Missing ros-${ROS_DISTRO}-rosbridge-suite. Install with:" >&2
+        echo "    sudo apt-get install -y ros-${ROS_DISTRO}-rosbridge-suite" >&2
+        ;;
+      realsense2_camera)
+        echo "Missing ros-${ROS_DISTRO}-realsense2-camera. Install with:" >&2
+        echo "    sudo apt-get install -y ros-${ROS_DISTRO}-realsense2-camera" >&2
+        ;;
+      image_transport_plugins)
+        echo "Missing ros-${ROS_DISTRO}-image-transport-plugins (needed for compressed camera topic). Install with:" >&2
+        echo "    sudo apt-get install -y ros-${ROS_DISTRO}-image-transport-plugins" >&2
+        ;;
+    esac
+    exit 1
+  fi
+done
+
+echo "── agenticros: host stack for NemoClaw ─────────────────────────"
+echo "  ROS:        ${ROS_DISTRO}"
+echo "  RealSense:  realsense2_camera (color + depth, aligned)"
+echo "  Rosbridge:  ws://0.0.0.0:9090   (sandbox connects via host.docker.internal:9090)"
+echo "  cmd_vel:    /<robot_namespace>/cmd_vel → /cmd_vel"
+echo "────────────────────────────────────────────────────────────────"
+
+exec ros2 launch agenticros_bringup realsense_rosbridge.launch.py "$@"

package/runtime/scripts/run_robot_rosbridge.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# run_robot_rosbridge.sh - Start rosbridge WebSocket server on the robot
+#
+# Run this on the robot so the AgenticROS plugin (OpenClaw) can connect to ROS2.
+# Usage: ./scripts/run_robot_rosbridge.sh [humble|jazzy]
+# Default ROS distro: humble
+
+set -e
+
+ROS_DISTRO="${1:-jazzy}"
+REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+
+if [[ -f "/opt/ros/$ROS_DISTRO/setup.bash" ]]; then
+    source "/opt/ros/$ROS_DISTRO/setup.bash"
+else
+    echo "ROS2 $ROS_DISTRO not found. Usage: $0 [humble|jazzy]"
+    exit 1
+fi
+
+if [[ -f "$REPO_ROOT/ros2_ws/install/setup.bash" ]]; then
+    source "$REPO_ROOT/ros2_ws/install/setup.bash"
+fi
+
+# If rosbridge was built from source, use venv's Python deps (tornado, pymongo, cbor2)
+for _d in "$REPO_ROOT/ros2_ws/venv_rosbridge/lib/python"*/site-packages; do
+    [[ -d "$_d" ]] && export PYTHONPATH="$_d:${PYTHONPATH:-}" && break
+done
+
+if ! ros2 pkg list 2>/dev/null | grep -q rosbridge_server; then
+    echo "rosbridge_suite not found. Install it with:"
+    echo "  sudo apt install -y ros-$ROS_DISTRO-rosbridge-suite"
+    exit 1
+fi
+
+echo "Starting rosbridge WebSocket server on port 9090 (ROS_DISTRO=$ROS_DISTRO)"
+exec ros2 launch rosbridge_server rosbridge_websocket_launch.xml

package/runtime/scripts/sandbox_rosbridge_relay.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""TCP relay: 10.200.0.1:9090 -> 172.19.0.1:9090.
+
+Why this exists:
+
+    In a NemoClaw / OpenShell hybrid setup, the AgenticROS plugin runs
+    inside the gateway process, which lives in the OpenShell-created
+    sandbox network namespace. From that netns:
+
+      * 10.200.0.0/24 is routable (the sandbox-host veth pair lives here).
+      * 172.19.0.0/16 (Docker bridge, where host.docker.internal resolves)
+        is NOT routable directly. All non-bypass traffic is forced through
+        the OPA policy proxy at 10.200.0.1:3128.
+
+    Custom policy presets added via ``nemoclaw policy-add --from-file``
+    are *recorded* but not actually activated for proxy enforcement
+    decisions in current NemoClaw releases. So the plugin's WebSocket
+    upgrade requests to ws://host.docker.internal:9090 get policy_denied
+    even with a custom preset in place.
+
+    This relay sidesteps the policy proxy entirely by binding inside the
+    sandbox *container's main netns* (where 10.200.0.1 is owned by the
+    veth-h interface that connects to the sandbox netns) and forwarding
+    every connection to the rosbridge_server on the Docker host.
+
+How the connection flows:
+
+    AgenticROS plugin (sandbox netns)
+        |
+        | ws://10.200.0.1:9090
+        v
+    relay listening on 10.200.0.1:9090 (container main netns)
+        |
+        | TCP forward
+        v
+    172.19.0.1:9090 (Docker bridge gateway IP — the host's rosbridge)
+
+Run inside the sandbox container::
+
+    docker exec -d <container> python3 /tmp/sandbox_rosbridge_relay.py \\
+        --bind 10.200.0.1:9090 --target 172.19.0.1:9090
+
+The matching plugin config (``~/.openclaw/openclaw.json`` inside the
+sandbox) uses::
+
+    "rosbridge": { "url": "ws://10.200.0.1:9090" }
+"""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import select
+import socket
+import threading
+from typing import Tuple
+
+
+def _parse_addr(value: str, default_port: int) -> Tuple[str, int]:
+    if ":" in value:
+        host, port_str = value.rsplit(":", 1)
+        return host, int(port_str)
+    return value, default_port
+
+
+def _pipe(src: socket.socket, dst: socket.socket, label: str) -> None:
+    try:
+        while True:
+            chunk = src.recv(65536)
+            if not chunk:
+                break
+            dst.sendall(chunk)
+    except (OSError, ConnectionError) as exc:
+        logging.debug("%s pipe closed: %s", label, exc)
+    finally:
+        try:
+            dst.shutdown(socket.SHUT_WR)
+        except OSError:
+            pass
+
+
+def _handle(client: socket.socket, peer: Tuple[str, int], target: Tuple[str, int]) -> None:
+    logging.info("accept %s -> %s:%d", peer, *target)
+    upstream = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    try:
+        upstream.connect(target)
+    except OSError as exc:
+        logging.warning("upstream %s:%d unreachable: %s", *target, exc)
+        client.close()
+        return
+    t1 = threading.Thread(target=_pipe, args=(client, upstream, "c->u"), daemon=True)
+    t2 = threading.Thread(target=_pipe, args=(upstream, client, "u->c"), daemon=True)
+    t1.start()
+    t2.start()
+    t1.join()
+    t2.join()
+    client.close()
+    upstream.close()
+    logging.info("closed  %s", peer)
+
+
+def serve(bind: Tuple[str, int], target: Tuple[str, int]) -> None:
+    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+    srv.bind(bind)
+    srv.listen(64)
+    logging.info("relay listening on %s:%d -> %s:%d", *bind, *target)
+    try:
+        while True:
+            client, peer = srv.accept()
+            threading.Thread(target=_handle, args=(client, peer, target), daemon=True).start()
+    except KeyboardInterrupt:
+        logging.info("shutting down")
+    finally:
+        srv.close()
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser(description=__doc__)
+    ap.add_argument("--bind", default="10.200.0.1:9090", help="host:port to listen on")
+    ap.add_argument("--target", default="172.19.0.1:9090", help="host:port to forward to")
+    ap.add_argument(
+        "--log-level",
+        default="INFO",
+        choices=["DEBUG", "INFO", "WARNING", "ERROR"],
+        help="logging verbosity",
+    )
+    args = ap.parse_args()
+    logging.basicConfig(
+        level=getattr(logging, args.log_level),
+        format="%(asctime)s relay %(levelname)s %(message)s",
+    )
+    serve(_parse_addr(args.bind, 9090), _parse_addr(args.target, 9090))
+
+
+if __name__ == "__main__":
+    main()

package/runtime/scripts/setup-openclaw-local.cjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Set OpenClaw gateway to no-auth mode for local development so that:
+ * - Web chat (Control UI) loads without a token
+ * - AgenticROS plugin routes (config, teleop) are accepted and load at /plugins/agenticros/
+ *
+ * In OpenClaw 2026.3.2, when gateway.auth is token-based, the gateway rejects plugin
+ * HTTP route registration ("missing or invalid auth"), so plugin pages return 404.
+ * Setting gateway.auth.mode to "none" fixes this for loopback-only use.
+ *
+ * Usage:
+ *   node scripts/setup-openclaw-local.cjs
+ *   # Restart the gateway: openclaw gateway
+ *   # Then open: http://127.0.0.1:18789/ (web chat) and http://127.0.0.1:18789/plugins/agenticros/
+ *
+ * WARNING: Only use on a gateway bound to 127.0.0.1. Do not use on a LAN/internet-facing gateway.
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+const configPath = process.env.OPENCLAW_CONFIG || path.join(process.env.HOME || '', '.openclaw', 'openclaw.json');
+
+let config;
+try {
+  const raw = fs.readFileSync(configPath, 'utf8');
+  config = JSON.parse(raw);
+} catch (e) {
+  console.error('Could not read OpenClaw config:', configPath, e.message);
+  process.exit(1);
+}
+
+if (!config.gateway) {
+  config.gateway = {};
+}
+if (!config.gateway.auth) {
+  config.gateway.auth = {};
+}
+
+const prev = config.gateway.auth.mode;
+config.gateway.auth.mode = 'none';
+// Remove token so the gateway does not re-enable token auth; with mode "none" it is ignored anyway
+if (config.gateway.auth.token) {
+  delete config.gateway.auth.token;
+}
+
+if (prev === 'none' && !config.gateway.auth.token) {
+  console.log('OpenClaw is already set to auth.mode "none" at', configPath);
+  process.exit(0);
+}
+
+// Backup
+const backupPath = configPath + '.bak.' + Date.now();
+try {
+  fs.copyFileSync(configPath, backupPath);
+  console.log('Backed up config to', backupPath);
+} catch (e) {
+  console.warn('Could not create backup:', e.message);
+}
+
+try {
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+} catch (e) {
+  console.error('Could not write config:', e.message);
+  process.exit(1);
+}
+
+console.log('');
+console.log('  Set gateway.auth.mode to "none" in', configPath);
+console.log('  Restart the gateway (openclaw gateway), then open:');
+console.log('    - Web chat:  http://127.0.0.1:18789/');
+console.log('    - AgenticROS config & teleop:  http://127.0.0.1:18789/plugins/agenticros/');
+console.log('');
+console.log('  For local use only (127.0.0.1). To restore token auth later, set gateway.auth.mode to "token" and add gateway.auth.token.');
+console.log('');