clawchef 0.1.11 → 0.1.13

package/dist/openclaw/provider.d.ts

@@ -5,6 +5,10 @@ export type ResolvedWorkspaceDef = WorkspaceDef & {
 export interface EnsureVersionResult {
     installedThisRun: boolean;
 }
+export interface ChannelAgentBinding {
+    channel: ChannelDef;
+    agent: string;
+}
 export interface OpenClawProvider {
     ensureVersion(config: OpenClawSection, dryRun: boolean, silent: boolean, preserveExistingState: boolean): Promise<EnsureVersionResult>;
     installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
@@ -12,6 +16,8 @@ export interface OpenClawProvider {
     startGateway(config: OpenClawSection, mode: GatewayMode, dryRun: boolean): Promise<void>;
     createWorkspace(config: OpenClawSection, workspace: ResolvedWorkspaceDef, dryRun: boolean): Promise<void>;
     configureChannel(config: OpenClawSection, channel: ChannelDef, dryRun: boolean): Promise<void>;
+    applyConfigPatch(config: OpenClawSection, patch: Record<string, unknown>, dryRun: boolean): Promise<void>;
+    bindChannelAgents?(config: OpenClawSection, bindings: ChannelAgentBinding[], dryRun: boolean): Promise<void>;
     bindChannelAgent(config: OpenClawSection, channel: ChannelDef, agent: string, dryRun: boolean): Promise<void>;
     loginChannel(config: OpenClawSection, channel: ChannelDef, dryRun: boolean): Promise<void>;
     materializeFile?(config: OpenClawSection, workspace: string, filePath: string, content: string, overwrite: boolean | undefined, dryRun: boolean): Promise<void>;

package/dist/openclaw/remote-provider.d.ts

@@ -3,7 +3,9 @@ import type { EnsureVersionResult, OpenClawProvider, ResolvedWorkspaceDef } from
 export declare class RemoteOpenClawProvider implements OpenClawProvider {
     private readonly stagedMessages;
     private readonly remoteConfig;
-    constructor(remoteConfig: Partial<OpenClawRemoteConfig>);
+    private readonly verboseEnabled;
+    constructor(remoteConfig: Partial<OpenClawRemoteConfig>, verboseEnabled?: boolean);
+    private debug;
     private perform;
     ensureVersion(config: OpenClawSection, dryRun: boolean, _silent: boolean, _preserveExistingState: boolean): Promise<EnsureVersionResult>;
     installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
@@ -11,6 +13,7 @@ export declare class RemoteOpenClawProvider implements OpenClawProvider {
     startGateway(config: OpenClawSection, mode: GatewayMode, dryRun: boolean): Promise<void>;
     createWorkspace(config: OpenClawSection, workspace: ResolvedWorkspaceDef, dryRun: boolean): Promise<void>;
     configureChannel(config: OpenClawSection, channel: ChannelDef, dryRun: boolean): Promise<void>;
+    applyConfigPatch(config: OpenClawSection, patch: Record<string, unknown>, dryRun: boolean): Promise<void>;
     bindChannelAgent(config: OpenClawSection, channel: ChannelDef, agent: string, dryRun: boolean): Promise<void>;
     loginChannel(config: OpenClawSection, channel: ChannelDef, dryRun: boolean): Promise<void>;
     materializeFile(config: OpenClawSection, workspace: string, filePath: string, content: string, overwrite: boolean | undefined, dryRun: boolean): Promise<void>;

package/dist/openclaw/remote-provider.js

@@ -1,6 +1,16 @@
 import { ClawChefError } from "../errors.js";
 const DEFAULT_TIMEOUT_MS = 60_000;
 const DEFAULT_OPERATION_PATH = "/v1/clawchef/operation";
+function timestamp() {
+    const now = new Date();
+    const year = now.getFullYear();
+    const month = String(now.getMonth() + 1).padStart(2, "0");
+    const day = String(now.getDate()).padStart(2, "0");
+    const hours = String(now.getHours()).padStart(2, "0");
+    const minutes = String(now.getMinutes()).padStart(2, "0");
+    const seconds = String(now.getSeconds()).padStart(2, "0");
+    return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
+}
 function parseResponseBody(raw) {
     if (!raw.trim()) {
         return {};
@@ -50,11 +60,20 @@ function assertRemoteConfig(remote) {
 export class RemoteOpenClawProvider {
     stagedMessages = new Map();
     remoteConfig;
-    constructor(remoteConfig) {
+    verboseEnabled;
+    constructor(remoteConfig, verboseEnabled = false) {
         this.remoteConfig = remoteConfig;
+        this.verboseEnabled = verboseEnabled;
+    }
+    debug(message) {
+        if (!this.verboseEnabled) {
+            return;
+        }
+        process.stdout.write(`[${timestamp()}] [DEBUG] ${message}\n`);
     }
     async perform(config, operation, payload, dryRun) {
         if (dryRun) {
+            this.debug(`REMOTE DRY-RUN op=${operation}`);
             return { ok: true };
         }
         const remote = assertRemoteConfig(this.remoteConfig);
@@ -66,6 +85,8 @@ export class RemoteOpenClawProvider {
             recipe_version: config.version,
             payload,
         };
+        const startedAt = Date.now();
+        this.debug(`REMOTE START op=${operation} url=${operationUrl(remote)}`);
         try {
             const response = await fetch(operationUrl(remote), {
                 method: "POST",
@@ -81,9 +102,11 @@ export class RemoteOpenClawProvider {
             if (parsed.ok === false) {
                 throw new ClawChefError(`Remote operation failed for ${operation}: ${parsed.message ?? "unknown error"}`);
             }
+            this.debug(`REMOTE DONE op=${operation} status=${response.status} (${Date.now() - startedAt}ms)`);
             return parsed;
         }
         catch (err) {
+            this.debug(`REMOTE FAIL op=${operation} (${Date.now() - startedAt}ms)`);
             if (err instanceof ClawChefError) {
                 throw err;
             }
@@ -122,6 +145,9 @@ export class RemoteOpenClawProvider {
     async configureChannel(config, channel, dryRun) {
         await this.perform(config, "configure_channel", { channel }, dryRun);
     }
+    async applyConfigPatch(config, patch, dryRun) {
+        await this.perform(config, "apply_config_patch", { patch }, dryRun);
+    }
     async bindChannelAgent(config, channel, agent, dryRun) {
         await this.perform(config, "bind_channel_agent", {
             channel: channel.channel,

package/dist/orchestrator.js

@@ -22,6 +22,30 @@ function truncateForLog(text, maxLength = 500) {
     }
     return `${text.slice(0, maxLength)}... [truncated ${text.length - maxLength} chars]`;
 }
+function toPosixPath(value) {
+    return value.replaceAll("\\", "/");
+}
+function wildcardToRegExp(pattern) {
+    const escaped = toPosixPath(pattern)
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*\*/g, "___DOUBLE_STAR___")
+        .replace(/\*/g, "[^/]*")
+        .replace(/___DOUBLE_STAR___/g, ".*");
+    return new RegExp(`^${escaped}$`);
+}
+function matchesFilePatterns(patterns, relativePath) {
+    if (patterns.length === 0) {
+        return true;
+    }
+    const normalized = toPosixPath(relativePath);
+    return patterns.some((pattern) => wildcardToRegExp(pattern).test(normalized));
+}
+function matchesAnyFilePattern(patterns, candidates) {
+    if (patterns.length === 0) {
+        return true;
+    }
+    return candidates.some((candidate) => matchesFilePatterns(patterns, candidate));
+}
 function renderTemplateString(input, vars, allowMissing) {
     return input.replace(/\$\{([^}]+)\}/g, (_match, rawKey) => {
         const key = String(rawKey).trim();
@@ -76,6 +100,14 @@ function isHttpUrl(value) {
         return false;
     }
 }
+function shouldAutoDisableTelegramChannel(channel) {
+    if (channel.channel !== "telegram") {
+        return false;
+    }
+    const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+    const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+    return emptyToken || emptyBotToken;
+}
 function isNotFoundError(err) {
     return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
 }
@@ -154,30 +186,37 @@ async function confirmFactoryReset(options) {
 export async function runRecipe(recipe, recipeOrigin, options, logger) {
     const provider = createProvider(options);
     const remoteMode = options.provider === "remote";
+    const filesOnlyScope = options.scope === "files";
+    const fileFilterEnabled = filesOnlyScope && options.filePatterns.length > 0;
     const workspacePaths = new Map();
     const preserveExistingState = options.scope !== "full";
     logger.info(`Running recipe: ${recipe.name}`);
-    const versionResult = await provider.ensureVersion(recipe.openclaw, options.dryRun, options.silent, preserveExistingState);
-    logger.info(`OpenClaw version ready: ${recipe.openclaw.version}`);
-    if (versionResult.installedThisRun) {
-        logger.info("OpenClaw was installed in this run; skipping factory reset");
-    }
-    else if (preserveExistingState) {
-        logger.info("Keeping existing OpenClaw state; skipping factory reset");
-    }
-    else {
-        const confirmed = await confirmFactoryReset(options);
-        if (!confirmed) {
-            throw new ClawChefError("Aborted by user before factory reset");
+    if (!filesOnlyScope) {
+        const versionResult = await provider.ensureVersion(recipe.openclaw, options.dryRun, options.silent, preserveExistingState);
+        logger.info(`OpenClaw version ready: ${recipe.openclaw.version}`);
+        if (versionResult.installedThisRun) {
+            logger.info("OpenClaw was installed in this run; skipping factory reset");
+        }
+        else if (preserveExistingState) {
+            logger.info("Keeping existing OpenClaw state; skipping factory reset");
+        }
+        else {
+            const confirmed = await confirmFactoryReset(options);
+            if (!confirmed) {
+                throw new ClawChefError("Aborted by user before factory reset");
+            }
+            await provider.factoryReset(recipe.openclaw, options.dryRun);
+            logger.info("Factory reset completed");
+        }
+        const pluginSpecs = Array.from(new Set([...(recipe.openclaw.plugins ?? []), ...options.plugins].map((v) => v.trim())))
+            .filter((v) => v.length > 0);
+        for (const pluginSpec of pluginSpecs) {
+            await provider.installPlugin(recipe.openclaw, pluginSpec, options.dryRun);
+            logger.info(`Plugin preinstalled: ${pluginSpec}`);
         }
-        await provider.factoryReset(recipe.openclaw, options.dryRun);
-        logger.info("Factory reset completed");
     }
-    const pluginSpecs = Array.from(new Set([...(recipe.openclaw.plugins ?? []), ...options.plugins].map((v) => v.trim())))
-        .filter((v) => v.length > 0);
-    for (const pluginSpec of pluginSpecs) {
-        await provider.installPlugin(recipe.openclaw, pluginSpec, options.dryRun);
-        logger.info(`Plugin preinstalled: ${pluginSpec}`);
+    else {
+        logger.info("Scope files: only syncing root/workspace assets and files");
     }
     const root = recipe.openclaw.root;
     if (root && (root.assets?.trim() || (root.files?.length ?? 0) > 0)) {
@@ -216,6 +255,11 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
             else {
                 const assetFiles = await collectLocalAssetFiles(resolvedAssets.value);
                 for (const assetFile of assetFiles) {
+                    const patternCandidates = [assetFile.relativePath, `root/${assetFile.relativePath}`];
+                    if (fileFilterEnabled && !matchesAnyFilePattern(options.filePatterns, patternCandidates)) {
+                        logger.debug(`Filtered root asset: ${assetFile.relativePath}`);
+                        continue;
+                    }
                     const target = path.resolve(openclawRootPath, assetFile.relativePath);
                     if (!options.dryRun) {
                         await mkdir(path.dirname(target), { recursive: true });
@@ -226,6 +270,11 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
             }
         }
         for (const file of root.files ?? []) {
+            const patternCandidates = [file.path, `root/${file.path}`];
+            if (fileFilterEnabled && !matchesAnyFilePattern(options.filePatterns, patternCandidates)) {
+                logger.debug(`Filtered root file: ${file.path}`);
+                continue;
+            }
             const target = path.resolve(openclawRootPath, file.path);
             const targetDir = path.dirname(target);
             if (!options.dryRun) {
@@ -262,8 +311,10 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
         if (!options.dryRun && !remoteMode) {
             await mkdir(absPath, { recursive: true });
         }
-        await provider.createWorkspace(recipe.openclaw, { ...ws, path: absPath }, options.dryRun);
-        logger.info(`Workspace created: ${ws.name}`);
+        if (!filesOnlyScope) {
+            await provider.createWorkspace(recipe.openclaw, { ...ws, path: absPath }, options.dryRun);
+            logger.info(`Workspace created: ${ws.name}`);
+        }
         if (!ws.assets?.trim()) {
             continue;
         }
@@ -288,6 +339,15 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
         }
         const assetFiles = await collectLocalAssetFiles(resolvedAssets.value);
         for (const assetFile of assetFiles) {
+            const patternCandidates = [
+                assetFile.relativePath,
+                `${ws.name}/${assetFile.relativePath}`,
+                `workspace-${ws.name}/${assetFile.relativePath}`,
+            ];
+            if (fileFilterEnabled && !matchesAnyFilePattern(options.filePatterns, patternCandidates)) {
+                logger.debug(`Filtered workspace asset: ${ws.name}/${assetFile.relativePath}`);
+                continue;
+            }
             if (provider.materializeFile) {
                 const content = await readFile(assetFile.absolutePath, "utf8");
                 await provider.materializeFile(recipe.openclaw, ws.name, assetFile.relativePath, content, true, options.dryRun);
@@ -302,31 +362,64 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
             logger.info(`Workspace asset copied: ${ws.name}/${assetFile.relativePath}`);
         }
     }
-    for (const agent of recipe.agents ?? []) {
-        const workspacePath = workspacePaths.get(agent.workspace);
-        if (!workspacePath) {
-            throw new ClawChefError(`Agent references missing workspace: ${agent.workspace}`);
+    if (!filesOnlyScope) {
+        const pendingChannelBindings = [];
+        for (const agent of recipe.agents ?? []) {
+            const workspacePath = workspacePaths.get(agent.workspace);
+            if (!workspacePath) {
+                throw new ClawChefError(`Agent references missing workspace: ${agent.workspace}`);
+            }
+            await provider.createAgent(recipe.openclaw, agent, workspacePath, options.dryRun);
+            logger.info(`Agent created: ${agent.workspace}/${agent.name}`);
         }
-        await provider.createAgent(recipe.openclaw, agent, workspacePath, options.dryRun);
-        logger.info(`Agent created: ${agent.workspace}/${agent.name}`);
-    }
-    for (const channel of recipe.channels ?? []) {
-        const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
-            ? { ...channel, account: channel.agent.trim() }
-            : channel;
-        await provider.configureChannel(recipe.openclaw, effectiveChannel, options.dryRun);
-        logger.info(`Channel configured: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
-        if (effectiveChannel.agent?.trim()) {
-            await provider.bindChannelAgent(recipe.openclaw, effectiveChannel, effectiveChannel.agent, options.dryRun);
-            logger.info(`Channel bound to agent: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""} -> ${effectiveChannel.agent}`);
+        for (const channel of recipe.channels ?? []) {
+            const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
+                ? { ...channel, account: channel.agent.trim() }
+                : channel;
+            const autoDisabledTelegram = shouldAutoDisableTelegramChannel(effectiveChannel);
+            await provider.configureChannel(recipe.openclaw, effectiveChannel, options.dryRun);
+            if (autoDisabledTelegram) {
+                logger.info(`Telegram channel disabled due to empty bot token: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
+                continue;
+            }
+            logger.info(`Channel configured: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
+            if (effectiveChannel.agent?.trim()) {
+                pendingChannelBindings.push({ channel: effectiveChannel, agent: effectiveChannel.agent });
+            }
+        }
+        if (pendingChannelBindings.length > 0) {
+            if (provider.bindChannelAgents) {
+                await provider.bindChannelAgents(recipe.openclaw, pendingChannelBindings, options.dryRun);
+            }
+            else {
+                for (const binding of pendingChannelBindings) {
+                    await provider.bindChannelAgent(recipe.openclaw, binding.channel, binding.agent, options.dryRun);
+                }
+            }
+            for (const binding of pendingChannelBindings) {
+                logger.info(`Channel bound to agent: ${binding.channel.channel}${binding.channel.account ? `/${binding.channel.account}` : ""} -> ${binding.agent}`);
+            }
         }
     }
+    if (!filesOnlyScope && recipe.openclaw.config_patch) {
+        await provider.applyConfigPatch(recipe.openclaw, recipe.openclaw.config_patch, options.dryRun);
+        logger.info("OpenClaw config patch applied");
+    }
     for (const workspace of recipe.workspaces ?? []) {
         const wsPath = workspacePaths.get(workspace.name);
         if (!wsPath) {
             throw new ClawChefError(`Workspace does not exist for files: ${workspace.name}`);
         }
         for (const file of workspace.files ?? []) {
+            const patternCandidates = [
+                file.path,
+                `${workspace.name}/${file.path}`,
+                `workspace-${workspace.name}/${file.path}`,
+            ];
+            if (fileFilterEnabled && !matchesAnyFilePattern(options.filePatterns, patternCandidates)) {
+                logger.debug(`Filtered workspace file: ${workspace.name}/${file.path}`);
+                continue;
+            }
             if (provider.materializeFile) {
                 let content = file.content;
                 if (content === undefined && file.content_from) {
@@ -385,59 +478,61 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
             logger.info(`File materialized: ${workspace.name}/${file.path}`);
         }
     }
-    for (const agent of recipe.agents ?? []) {
-        for (const skill of agent.skills ?? []) {
-            await provider.installSkill(recipe.openclaw, agent.workspace, agent.name, skill, options.dryRun);
-            logger.info(`Skill installed: ${agent.workspace}/${agent.name} -> ${skill}`);
+    if (!filesOnlyScope) {
+        for (const agent of recipe.agents ?? []) {
+            for (const skill of agent.skills ?? []) {
+                await provider.installSkill(recipe.openclaw, agent.workspace, agent.name, skill, options.dryRun);
+                logger.info(`Skill installed: ${agent.workspace}/${agent.name} -> ${skill}`);
+            }
         }
-    }
-    for (const conv of recipe.conversations ?? []) {
-        for (const msg of conv.messages) {
-            await provider.sendMessage(recipe.openclaw, conv, msg.content, options.dryRun);
-            const shouldRun = conv.run ?? Boolean(msg.expect);
-            if (shouldRun) {
-                if (options.dryRun) {
-                    logger.info(`dry-run: skipping execution and output assertions: ${conv.workspace}/${conv.agent}`);
-                    continue;
-                }
-                const reply = await provider.runAgent(recipe.openclaw, conv, options.dryRun);
-                if (msg.expect) {
-                    try {
-                        validateReply(reply, msg.expect);
-                        logger.info(`Output assertions passed: ${conv.workspace}/${conv.agent}`);
+        for (const conv of recipe.conversations ?? []) {
+            for (const msg of conv.messages) {
+                await provider.sendMessage(recipe.openclaw, conv, msg.content, options.dryRun);
+                const shouldRun = conv.run ?? Boolean(msg.expect);
+                if (shouldRun) {
+                    if (options.dryRun) {
+                        logger.info(`dry-run: skipping execution and output assertions: ${conv.workspace}/${conv.agent}`);
+                        continue;
                     }
-                    catch (err) {
-                        logger.warn(`Assertion failed reply (truncated): ${truncateForLog(reply)}`);
-                        throw err;
+                    const reply = await provider.runAgent(recipe.openclaw, conv, options.dryRun);
+                    if (msg.expect) {
+                        try {
+                            validateReply(reply, msg.expect);
+                            logger.info(`Output assertions passed: ${conv.workspace}/${conv.agent}`);
+                        }
+                        catch (err) {
+                            logger.warn(`Assertion failed reply (truncated): ${truncateForLog(reply)}`);
+                            throw err;
+                        }
                     }
+                    else {
+                        logger.info(`Agent executed: ${conv.workspace}/${conv.agent}`);
+                    }
+                    logger.debug(`Agent output: ${reply}`);
                 }
-                else {
-                    logger.info(`Agent executed: ${conv.workspace}/${conv.agent}`);
-                }
-                logger.debug(`Agent output: ${reply}`);
             }
+            logger.info(`Preset messages sent: ${conv.workspace}/${conv.agent}`);
         }
-        logger.info(`Preset messages sent: ${conv.workspace}/${conv.agent}`);
-    }
-    await provider.startGateway(recipe.openclaw, options.gatewayMode, options.dryRun);
-    if (options.gatewayMode === "none") {
-        logger.info("Gateway start skipped by gateway mode: none");
-    }
-    else {
-        logger.info(`Gateway started (${options.gatewayMode})`);
-    }
-    for (const channel of recipe.channels ?? []) {
-        const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
-            ? { ...channel, account: channel.agent.trim() }
-            : channel;
-        if (!effectiveChannel.login) {
-            continue;
+        await provider.startGateway(recipe.openclaw, options.gatewayMode, options.dryRun);
+        if (options.gatewayMode === "none") {
+            logger.info("Gateway start skipped by gateway mode: none");
+        }
+        else {
+            logger.info(`Gateway started (${options.gatewayMode})`);
         }
-        if (!options.dryRun && !input.isTTY) {
-            throw new ClawChefError(`Channel login for ${effectiveChannel.channel} requires an interactive terminal session`);
+        for (const channel of recipe.channels ?? []) {
+            const effectiveChannel = channel.agent?.trim() && !channel.account?.trim()
+                ? { ...channel, account: channel.agent.trim() }
+                : channel;
+            if (!effectiveChannel.login) {
+                continue;
+            }
+            if (!options.dryRun && !input.isTTY) {
+                throw new ClawChefError(`Channel login for ${effectiveChannel.channel} requires an interactive terminal session`);
+            }
+            await provider.loginChannel(recipe.openclaw, effectiveChannel, options.dryRun);
+            logger.info(`Channel login completed: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
         }
-        await provider.loginChannel(recipe.openclaw, effectiveChannel, options.dryRun);
-        logger.info(`Channel login completed: ${effectiveChannel.channel}${effectiveChannel.account ? `/${effectiveChannel.account}` : ""}`);
     }
     logger.info("Recipe execution completed");
 }

package/dist/recipe.js

@@ -44,6 +44,35 @@ const ALLOWED_CHANNELS = new Set([
 ]);
 const CHANNEL_SECRET_FIELDS = ["token", "bot_token", "access_token", "app_token", "password"];
 const TEMPLATE_TOKEN_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function assertNoInlineSecretsInObject(value, pathLabel) {
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i += 1) {
+            assertNoInlineSecretsInObject(value[i], `${pathLabel}[${i}]`);
+        }
+        return;
+    }
+    if (!value || typeof value !== "object") {
+        return;
+    }
+    for (const [key, nestedValue] of Object.entries(value)) {
+        const nextPath = `${pathLabel}.${key}`;
+        if (typeof nestedValue === "string" &&
+            /(token|password|secret|api[_-]?key|webhook)/i.test(key) &&
+            nestedValue.trim().length > 0 &&
+            !TEMPLATE_TOKEN_RE.test(nestedValue)) {
+            throw new ClawChefError(`Inline secret in ${nextPath} is not allowed. Use \${var} and pass it via --var or CLAWCHEF_VAR_*`);
+        }
+        assertNoInlineSecretsInObject(nestedValue, nextPath);
+    }
+}
+function hasExplicitEmptyTelegramToken(channel) {
+    if (channel.channel !== "telegram") {
+        return false;
+    }
+    const emptyToken = channel.token !== undefined && channel.token.trim().length === 0;
+    const emptyBotToken = channel.bot_token !== undefined && channel.bot_token.trim().length === 0;
+    return emptyToken || emptyBotToken;
+}
 function assertNoInlineSecrets(recipe) {
     const bootstrap = recipe.openclaw.bootstrap;
     if (bootstrap) {
@@ -57,6 +86,9 @@ function assertNoInlineSecrets(recipe) {
             }
         }
     }
+    if (recipe.openclaw.config_patch) {
+        assertNoInlineSecretsInObject(recipe.openclaw.config_patch, "openclaw.config_patch");
+    }
     for (const channel of recipe.channels ?? []) {
         for (const field of CHANNEL_SECRET_FIELDS) {
             const value = channel[field];
@@ -118,6 +150,20 @@ function collectVars(recipe, cliVars, requiredKeys) {
     return vars;
 }
 function projectRecipeForScope(recipe, options) {
+    if (options.scope === "files") {
+        return {
+            ...recipe,
+            openclaw: {
+                ...recipe.openclaw,
+                version: "0.0.0",
+                bootstrap: undefined,
+                plugins: [],
+            },
+            channels: [],
+            agents: [],
+            conversations: [],
+        };
+    }
     if (options.scope !== "workspace") {
         return recipe;
     }
@@ -222,6 +268,9 @@ function semanticValidate(recipe) {
                 }
                 return /(token|password|secret|api[_-]?key|webhook)/i.test(key) && String(value).trim().length > 0;
             });
+        if (hasExplicitEmptyTelegramToken(channel)) {
+            continue;
+        }
         if (!hasAuth) {
             throw new ClawChefError(`channels[] entry for ${channel.channel} requires at least one auth input (for example token/bot_token/access_token/token_file/use_env)`);
         }
@@ -662,7 +711,7 @@ export async function loadRecipe(recipePath, options) {
         }
         const projected = projectRecipeForScope(firstParse.data, options);
         assertNoInlineSecrets(projected);
-        const requiredKeys = options.scope === "workspace" ? new Set() : undefined;
+        const requiredKeys = options.scope === "workspace" || options.scope === "files" ? new Set() : undefined;
         const vars = collectVars(projected, options.vars, requiredKeys);
         const rendered = deepResolveTemplates(projected, vars, options.allowMissing);
         const secondParse = recipeSchema.safeParse(rendered);

package/dist/schema.d.ts

@@ -75,6 +75,7 @@ export declare const recipeSchema: z.ZodObject<{
             }[] | undefined;
             assets?: string | undefined;
         }>>;
+        config_patch: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         bootstrap: z.ZodOptional<z.ZodObject<{
             non_interactive: z.ZodOptional<z.ZodBoolean>;
             accept_risk: z.ZodOptional<z.ZodBoolean>;
@@ -201,6 +202,7 @@ export declare const recipeSchema: z.ZodObject<{
             }[] | undefined;
             assets?: string | undefined;
         } | undefined;
+        config_patch?: Record<string, unknown> | undefined;
         bootstrap?: {
             workspace?: string | undefined;
             cloudflare_ai_gateway_account_id?: string | undefined;
@@ -255,6 +257,7 @@ export declare const recipeSchema: z.ZodObject<{
             }[] | undefined;
             assets?: string | undefined;
         } | undefined;
+        config_patch?: Record<string, unknown> | undefined;
         bootstrap?: {
             workspace?: string | undefined;
             cloudflare_ai_gateway_account_id?: string | undefined;
@@ -512,6 +515,7 @@ export declare const recipeSchema: z.ZodObject<{
             }[] | undefined;
             assets?: string | undefined;
         } | undefined;
+        config_patch?: Record<string, unknown> | undefined;
         bootstrap?: {
             workspace?: string | undefined;
             cloudflare_ai_gateway_account_id?: string | undefined;
@@ -628,6 +632,7 @@ export declare const recipeSchema: z.ZodObject<{
             }[] | undefined;
             assets?: string | undefined;
         } | undefined;
+        config_patch?: Record<string, unknown> | undefined;
         bootstrap?: {
             workspace?: string | undefined;
             cloudflare_ai_gateway_account_id?: string | undefined;

package/dist/schema.js

@@ -72,6 +72,7 @@ const openClawSchema = z
     install: z.enum(["auto", "always", "never"]).optional(),
     plugins: z.array(z.string().min(1)).optional(),
     root: openClawRootSchema.optional(),
+    config_patch: z.record(z.unknown()).optional(),
     bootstrap: openClawBootstrapSchema.optional(),
     commands: openClawCommandsSchema.optional(),
 })
@@ -107,10 +108,10 @@ const channelSchema = z
     login_mode: z.enum(["interactive"]).optional(),
     login_account: z.string().min(1).optional(),
     name: z.string().min(1).optional(),
-    token: z.string().min(1).optional(),
+    token: z.string().optional(),
     token_file: z.string().min(1).optional(),
     use_env: z.boolean().optional(),
-    bot_token: z.string().min(1).optional(),
+    bot_token: z.string().optional(),
     access_token: z.string().min(1).optional(),
     app_token: z.string().min(1).optional(),
     webhook_url: z.string().min(1).optional(),

package/dist/types.d.ts

@@ -1,6 +1,6 @@
 export type InstallPolicy = "auto" | "always" | "never";
 export type OpenClawProvider = "command" | "mock" | "remote";
-export type RunScope = "full" | "files" | "workspace";
+export type RunScope = "full" | "stateful" | "files" | "workspace";
 export type GatewayMode = "service" | "run" | "none";
 export interface OpenClawRemoteConfig {
     base_url: string;
@@ -59,6 +59,7 @@ export interface OpenClawSection {
     install?: InstallPolicy;
     plugins?: string[];
     root?: OpenClawRootDef;
+    config_patch?: Record<string, unknown>;
     bootstrap?: OpenClawBootstrap;
     commands?: OpenClawCommandOverrides;
 }
@@ -136,6 +137,7 @@ export interface Recipe {
 export interface RunOptions {
     vars: Record<string, string>;
     plugins: string[];
+    filePatterns: string[];
     scope: RunScope;
     workspaceName?: string;
     gatewayMode: GatewayMode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawchef",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "Recipe-driven OpenClaw environment orchestrator",
   "homepage": "https://renorzr.github.io/clawchef",
   "repository": {