clawchef 0.1.6 → 0.1.7

package/README.md

@@ -12,7 +12,8 @@ Recipe-driven OpenClaw environment orchestrator.
 - Requires secrets to be injected via `--var` / `CLAWCHEF_VAR_*` (no inline secrets in recipe).
 - Prepares OpenClaw version (install or reuse).
 - When installed OpenClaw version mismatches recipe version, prompts: ignore / abort / force reinstall (silent mode auto-picks force reinstall).
-- Always runs factory reset first (with confirmation prompt unless `-s/--silent` is used).
+- Supports scoped execution via `--scope full|files|workspace`.
+- `full` scope runs factory reset first (with confirmation prompt unless `-s/--silent` is used).
 - If `openclaw` is missing, auto-installs the recipe version and skips factory reset.
 - Starts OpenClaw gateway service after each recipe execution.
 - Creates workspaces and agents (default workspace path: `~/.openclaw/workspace-<workspace-name>`).
@@ -20,7 +21,6 @@ Recipe-driven OpenClaw environment orchestrator.
 - Materializes files into target workspaces.
 - Installs skills.
 - Supports plugin preinstall via `openclaw.plugins[]` and runtime `--plugin` flags.
-- Supports preserving existing OpenClaw state via `--keep-openclaw-state` (skip factory reset).
 - Configures channels with `openclaw channels add`.
 - Supports interactive channel login at the end of execution (`channels[].login: true`) for channels that expose login.
 - Supports remote HTTP orchestration via runtime flags (`--provider remote`) when OpenClaw is reachable via API.
@@ -96,13 +96,19 @@ Use it only in CI/non-interactive flows where destructive reset behavior is expe
 Keep existing OpenClaw state (skip reset and keep current version on mismatch):
 
 ```bash
-clawchef cook recipes/sample.yaml --keep-openclaw-state
+clawchef cook recipes/sample.yaml --scope files
+```
+
+Update only one workspace:
+
+```bash
+clawchef cook recipes/sample.yaml --scope workspace --workspace workspace-meeting
 ```
 
 From-zero OpenClaw bootstrap (recommended):
 
 ```bash
-CLAWCHEF_VAR_OPENAI_API_KEY=sk-... clawchef cook recipes/openclaw-from-zero.yaml --verbose
+CLAWCHEF_VAR_LLM_API_KEY=sk-... clawchef cook recipes/openclaw-from-zero.yaml --verbose
 ```
 
 Telegram channel setup only:
@@ -183,7 +189,7 @@ await cook("recipes/sample.yaml", {
   provider: "command",
   silent: true,
   vars: {
-    openai_api_key: process.env.OPENAI_API_KEY ?? "",
+    llm_api_key: process.env.OPENAI_API_KEY ?? "",
   },
 });
 
@@ -196,6 +202,8 @@ await scaffold("./my-recipe-project", {
 
 - `vars`: template variables (`Record<string, string>`)
 - `plugins`: plugin npm specs to preinstall for this run (`string[]`)
+- `scope`: `full | files | workspace` (default: `full`)
+- `workspaceName`: required when `scope: "workspace"`
 - `provider`: `command | remote | mock`
 - `remote`: remote provider config (same fields as CLI remote flags)
 - `envFile`: custom env file path/URL; when set, default cwd `.env` loading is skipped
@@ -318,7 +326,7 @@ Supported fields include:
 
 - onboarding: `mode`, `flow`, `non_interactive`, `accept_risk`, `reset`
 - setup toggles: `skip_channels`, `skip_skills`, `skip_health`, `skip_ui`, `skip_daemon`, `install_daemon`
-- auth/provider: `auth_choice`, `openai_api_key`, `anthropic_api_key`, `openrouter_api_key`, `xai_api_key`, `gemini_api_key`, `ai_gateway_api_key`, `cloudflare_ai_gateway_api_key`, `token`, `token_provider`, `token_profile_id`
+- auth/provider: `auth_choice`, `llm_api_key`, `token`, `token_provider`, `token_profile_id`
 
 ### Plugin preinstall
 
@@ -334,7 +342,7 @@ openclaw:
     - "@scope/custom-channel-plugin@1.2.3"
 ```
 
-When `openclaw.bootstrap` contains provider keys, `clawchef` also injects them into runtime env for `openclaw agent --local`.
+When `openclaw.bootstrap` contains `llm_api_key`, clawchef maps it to the provider-specific runtime env by `auth_choice` for `openclaw agent --local`.
 
 For `command` provider, default command templates are:
 
@@ -394,7 +402,7 @@ Supported common fields:
 - `workspaces[].assets` is optional.
 - If `assets` is set, clawchef recursively copies files from that directory into the workspace root.
 - `assets` is resolved relative to the recipe file path (unless absolute path is given).
-- `files[]` runs after assets copy, so `files[]` can override copied asset files.
+- `workspaces[].files[]` runs after assets copy, so explicit file entries can override copied asset files.
 - Direct URL recipes do not support `workspaces[].assets` (assets must resolve to a local directory).
 - If provided, relative paths are resolved from the recipe file directory.
 - For direct URL recipe files, relative workspace paths are resolved from the current working directory.
@@ -410,10 +418,10 @@ workspaces:
 
 ## File content references
 
-In `files[]`, set exactly one of:
+In `workspaces[].files[]`, set exactly one of:
 
 - `content`: inline text in recipe
-- `content_from`: load text from another file/URL
+- `content_from`: load text from another file/URL (loaded content supports `${var}` template rendering)
 - `source`: copy raw file bytes from another file/URL
 
 `content_from` and `source` accept:
@@ -433,8 +441,8 @@ Useful placeholders when overriding commands:
 
 - Do not put plaintext API keys/tokens in recipe files.
 - Use `${var}` placeholders in recipe and pass values via:
-  - `--var openai_api_key=...`
-  - `CLAWCHEF_VAR_OPENAI_API_KEY=...`
+  - `--var llm_api_key=...`
+  - `CLAWCHEF_VAR_LLM_API_KEY=...`
 - Inline secrets in `openclaw.bootstrap.*` are rejected by validation.
 
 ## Conversation message format

package/dist/api.d.ts

@@ -1,4 +1,4 @@
-import type { OpenClawProvider, OpenClawRemoteConfig } from "./types.js";
+import type { OpenClawProvider, OpenClawRemoteConfig, RunScope } from "./types.js";
 import type { ScaffoldOptions, ScaffoldResult } from "./scaffold.js";
 export interface CookOptions {
     vars?: Record<string, string>;
@@ -7,6 +7,8 @@ export interface CookOptions {
     allowMissing?: boolean;
     verbose?: boolean;
     silent?: boolean;
+    scope?: RunScope;
+    workspaceName?: string;
     provider?: OpenClawProvider;
     remote?: Partial<OpenClawRemoteConfig>;
     envFile?: string;

package/dist/api.js

@@ -8,14 +8,23 @@ import { scaffoldProject } from "./scaffold.js";
 import { recipeSchema } from "./schema.js";
 function normalizeCookOptions(options) {
     const plugins = Array.from(new Set((options.plugins ?? []).map((value) => value.trim()).filter((value) => value.length > 0)));
+    const scope = options.scope ?? "full";
+    const workspaceName = options.workspaceName?.trim() || undefined;
+    if (scope === "workspace" && !workspaceName) {
+        throw new ClawChefError("scope=workspace requires workspaceName");
+    }
+    if (scope !== "workspace" && workspaceName) {
+        throw new ClawChefError("workspaceName is only allowed when scope=workspace");
+    }
     return {
         vars: options.vars ?? {},
         plugins,
+        scope,
+        workspaceName,
         dryRun: Boolean(options.dryRun),
         allowMissing: Boolean(options.allowMissing),
         verbose: Boolean(options.verbose),
         silent: options.silent ?? true,
-        keepOpenClawState: false,
         provider: options.provider ?? "command",
         remote: options.remote ?? {},
     };

package/dist/cli.js

@@ -8,8 +8,23 @@ import { recipeSchema } from "./schema.js";
 import { scaffoldProject } from "./scaffold.js";
 import YAML from "js-yaml";
 import path from "node:path";
+import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
+function readPackageVersion() {
+    try {
+        const pkgPath = new URL("../package.json", import.meta.url);
+        const content = readFileSync(pkgPath, "utf8");
+        const parsed = JSON.parse(content);
+        if (parsed.version?.trim()) {
+            return parsed.version;
+        }
+    }
+    catch {
+        // ignore and use fallback
+    }
+    return "0.0.0";
+}
 function parseVarFlags(values) {
     const out = {};
     for (const item of values) {
@@ -40,6 +55,12 @@ function parseProvider(value) {
     }
     throw new ClawChefError(`Invalid --provider value: ${value}. Expected command, remote, or mock`);
 }
+function parseScope(value) {
+    if (value === "full" || value === "files" || value === "workspace") {
+        return value;
+    }
+    throw new ClawChefError(`Invalid --scope value: ${value}. Expected full, files, or workspace`);
+}
 function parseOptionalInt(value, fieldName) {
     if (value === undefined) {
         return undefined;
@@ -69,7 +90,7 @@ export function buildCli() {
     program
         .name("clawchef")
         .description("Run OpenClaw environment recipes")
-        .version("0.1.6");
+        .version(readPackageVersion());
     program
         .command("cook")
         .argument("<recipe>", "Recipe path/URL/dir/archive[:file]")
@@ -78,7 +99,8 @@ export function buildCli() {
         .option("--allow-missing", "Allow unresolved template variables", false)
         .option("--verbose", "Verbose logging", false)
         .option("-s, --silent", "Skip reset confirmation prompt", false)
-        .option("--keep-openclaw-state", "Preserve existing OpenClaw state (skip factory reset)", false)
+        .option("--scope <scope>", "Run scope: full | files | workspace", "full")
+        .option("--workspace <name>", "Workspace name (required when --scope workspace)")
         .option("--dotenv-ref <path-or-url>", "Load env vars from local file or HTTP URL")
         .option("--provider <provider>", "Execution provider: command | remote | mock")
         .option("--plugin <npm-spec>", "Preinstall plugin package (repeatable)", (v, p) => p.concat([v]), [])
@@ -96,14 +118,23 @@ export function buildCli() {
             importDotEnvFromCwd();
         }
         const provider = parseProvider(opts.provider ?? readEnv("CLAWCHEF_PROVIDER") ?? "command");
+        const scope = parseScope(String(opts.scope ?? "full"));
+        const workspaceName = opts.workspace?.trim() ? String(opts.workspace).trim() : undefined;
+        if (scope === "workspace" && !workspaceName) {
+            throw new ClawChefError("--scope workspace requires --workspace <name>");
+        }
+        if (scope !== "workspace" && workspaceName) {
+            throw new ClawChefError("--workspace is only allowed when --scope workspace");
+        }
         const options = {
             vars: parseVarFlags(opts.var),
             plugins: parsePluginFlags(opts.plugin),
+            scope,
+            workspaceName,
             dryRun: Boolean(opts.dryRun),
             allowMissing: Boolean(opts.allowMissing),
             verbose: Boolean(opts.verbose),
             silent: Boolean(opts.silent),
-            keepOpenClawState: Boolean(opts.keepOpenclawState),
             provider,
             remote: {
                 base_url: opts.remoteBaseUrl ?? readEnv("CLAWCHEF_REMOTE_BASE_URL"),

package/dist/openclaw/command-provider.d.ts

@@ -2,7 +2,7 @@ import type { AgentDef, ChannelDef, ConversationDef, OpenClawSection } from "../
 import type { EnsureVersionResult, OpenClawProvider, ResolvedWorkspaceDef } from "./provider.js";
 export declare class CommandOpenClawProvider implements OpenClawProvider {
     private readonly stagedMessages;
-    ensureVersion(config: OpenClawSection, dryRun: boolean, silent: boolean, keepOpenClawState: boolean): Promise<EnsureVersionResult>;
+    ensureVersion(config: OpenClawSection, dryRun: boolean, silent: boolean, preserveExistingState: boolean): Promise<EnsureVersionResult>;
     factoryReset(config: OpenClawSection, dryRun: boolean): Promise<void>;
     installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
     startGateway(config: OpenClawSection, dryRun: boolean): Promise<void>;

package/dist/openclaw/command-provider.js

@@ -21,14 +21,25 @@ const DEFAULT_COMMANDS = {
     run_agent: "${bin} agent --local --agent ${agent} --message ${prompt_q} --json",
 };
 const SECRET_FLAG_RE = /(--[A-Za-z0-9-]*(?:api-key|token|password|secret)[A-Za-z0-9-]*\s+)(?:'[^']*'|"[^"]*"|\S+)/g;
+const AUTH_CHOICE_TO_LLM_FLAG = {
+    "openai-api-key": "--openai-api-key",
+    "anthropic-api-key": "--anthropic-api-key",
+    "openrouter-api-key": "--openrouter-api-key",
+    "xai-api-key": "--xai-api-key",
+    "gemini-api-key": "--gemini-api-key",
+    "ai-gateway-api-key": "--ai-gateway-api-key",
+    "cloudflare-ai-gateway-api-key": "--cloudflare-ai-gateway-api-key",
+};
+const AUTH_CHOICE_TO_LLM_ENV = {
+    "openai-api-key": "OPENAI_API_KEY",
+    "anthropic-api-key": "ANTHROPIC_API_KEY",
+    "openrouter-api-key": "OPENROUTER_API_KEY",
+    "xai-api-key": "XAI_API_KEY",
+    "gemini-api-key": "GEMINI_API_KEY",
+    "ai-gateway-api-key": "AI_GATEWAY_API_KEY",
+    "cloudflare-ai-gateway-api-key": "CLOUDFLARE_AI_GATEWAY_API_KEY",
+};
 const BOOTSTRAP_STRING_FLAGS = [
-    ["openai_api_key", "--openai-api-key"],
-    ["anthropic_api_key", "--anthropic-api-key"],
-    ["openrouter_api_key", "--openrouter-api-key"],
-    ["xai_api_key", "--xai-api-key"],
-    ["gemini_api_key", "--gemini-api-key"],
-    ["ai_gateway_api_key", "--ai-gateway-api-key"],
-    ["cloudflare_ai_gateway_api_key", "--cloudflare-ai-gateway-api-key"],
     ["cloudflare_ai_gateway_account_id", "--cloudflare-ai-gateway-account-id"],
     ["cloudflare_ai_gateway_gateway_id", "--cloudflare-ai-gateway-gateway-id"],
     ["token", "--token"],
@@ -187,6 +198,12 @@ function buildBootstrapCommand(bin, bootstrap, workspacePath) {
     else if (cfg.install_daemon === false) {
         flags.push("--no-install-daemon");
     }
+    if (cfg.llm_api_key?.trim()) {
+        const llmFlag = AUTH_CHOICE_TO_LLM_FLAG[cfg.auth_choice ?? ""];
+        if (llmFlag) {
+            flags.push(`${llmFlag} ${shellQuote(cfg.llm_api_key)}`);
+        }
+    }
     for (const [field, flag] of BOOTSTRAP_STRING_FLAGS) {
         const value = cfg[field];
         if (value && value.trim()) {
@@ -202,26 +219,17 @@ function bootstrapRuntimeEnv(bootstrap) {
         return {};
     }
     const env = {};
-    if (bootstrap.openai_api_key)
-        env.OPENAI_API_KEY = bootstrap.openai_api_key;
-    if (bootstrap.anthropic_api_key)
-        env.ANTHROPIC_API_KEY = bootstrap.anthropic_api_key;
-    if (bootstrap.openrouter_api_key)
-        env.OPENROUTER_API_KEY = bootstrap.openrouter_api_key;
-    if (bootstrap.xai_api_key)
-        env.XAI_API_KEY = bootstrap.xai_api_key;
-    if (bootstrap.gemini_api_key)
-        env.GEMINI_API_KEY = bootstrap.gemini_api_key;
-    if (bootstrap.ai_gateway_api_key)
-        env.AI_GATEWAY_API_KEY = bootstrap.ai_gateway_api_key;
-    if (bootstrap.cloudflare_ai_gateway_api_key) {
-        env.CLOUDFLARE_AI_GATEWAY_API_KEY = bootstrap.cloudflare_ai_gateway_api_key;
+    if (bootstrap.llm_api_key?.trim()) {
+        const envKey = AUTH_CHOICE_TO_LLM_ENV[bootstrap.auth_choice ?? ""];
+        if (envKey) {
+            env[envKey] = bootstrap.llm_api_key;
+        }
     }
     return env;
 }
 export class CommandOpenClawProvider {
     stagedMessages = new Map();
-    async ensureVersion(config, dryRun, silent, keepOpenClawState) {
+    async ensureVersion(config, dryRun, silent, preserveExistingState) {
         const bin = config.bin ?? "openclaw";
         const installPolicy = config.install ?? "auto";
         const useCmd = commandFor(config, "use_version", { bin, version: config.version });
@@ -272,7 +280,7 @@ export class CommandOpenClawProvider {
         if (installedThisRun) {
             throw new ClawChefError(`OpenClaw version mismatch after install: current ${currentVersion}, expected ${config.version}`);
         }
-        if (keepOpenClawState) {
+        if (preserveExistingState) {
             return { installedThisRun: false };
         }
         const choice = await chooseVersionMismatchAction(currentVersion, config.version, silent);

package/dist/openclaw/mock-provider.d.ts

@@ -2,7 +2,7 @@ import type { AgentDef, ChannelDef, ConversationDef, OpenClawSection } from "../
 import type { EnsureVersionResult, OpenClawProvider, ResolvedWorkspaceDef } from "./provider.js";
 export declare class MockOpenClawProvider implements OpenClawProvider {
     private state;
-    ensureVersion(config: OpenClawSection, _dryRun: boolean, _silent: boolean, _keepOpenClawState: boolean): Promise<EnsureVersionResult>;
+    ensureVersion(config: OpenClawSection, _dryRun: boolean, _silent: boolean, _preserveExistingState: boolean): Promise<EnsureVersionResult>;
     installPlugin(_config: OpenClawSection, _pluginSpec: string, _dryRun: boolean): Promise<void>;
     factoryReset(_config: OpenClawSection, _dryRun: boolean): Promise<void>;
     startGateway(_config: OpenClawSection, _dryRun: boolean): Promise<void>;

package/dist/openclaw/mock-provider.js

@@ -7,7 +7,7 @@ export class MockOpenClawProvider {
         skills: new Set(),
         messages: new Map(),
     };
-    async ensureVersion(config, _dryRun, _silent, _keepOpenClawState) {
+    async ensureVersion(config, _dryRun, _silent, _preserveExistingState) {
         const policy = config.install ?? "auto";
         const installed = this.state.installedVersions.has(config.version);
         let installedThisRun = false;

package/dist/openclaw/provider.d.ts

@@ -6,7 +6,7 @@ export interface EnsureVersionResult {
     installedThisRun: boolean;
 }
 export interface OpenClawProvider {
-    ensureVersion(config: OpenClawSection, dryRun: boolean, silent: boolean, keepOpenClawState: boolean): Promise<EnsureVersionResult>;
+    ensureVersion(config: OpenClawSection, dryRun: boolean, silent: boolean, preserveExistingState: boolean): Promise<EnsureVersionResult>;
     installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
     factoryReset(config: OpenClawSection, dryRun: boolean): Promise<void>;
     startGateway(config: OpenClawSection, dryRun: boolean): Promise<void>;

package/dist/openclaw/remote-provider.d.ts

@@ -5,7 +5,7 @@ export declare class RemoteOpenClawProvider implements OpenClawProvider {
     private readonly remoteConfig;
     constructor(remoteConfig: Partial<OpenClawRemoteConfig>);
     private perform;
-    ensureVersion(config: OpenClawSection, dryRun: boolean, _silent: boolean, _keepOpenClawState: boolean): Promise<EnsureVersionResult>;
+    ensureVersion(config: OpenClawSection, dryRun: boolean, _silent: boolean, _preserveExistingState: boolean): Promise<EnsureVersionResult>;
     installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
     factoryReset(config: OpenClawSection, dryRun: boolean): Promise<void>;
     startGateway(config: OpenClawSection, dryRun: boolean): Promise<void>;

package/dist/openclaw/remote-provider.js

@@ -94,7 +94,7 @@ export class RemoteOpenClawProvider {
             clearTimeout(timeout);
         }
     }
-    async ensureVersion(config, dryRun, _silent, _keepOpenClawState) {
+    async ensureVersion(config, dryRun, _silent, _preserveExistingState) {
         const result = await this.perform(config, "ensure_version", {
             install: config.install,
         }, dryRun);

package/dist/orchestrator.js

@@ -22,6 +22,25 @@ function truncateForLog(text, maxLength = 500) {
     }
     return `${text.slice(0, maxLength)}... [truncated ${text.length - maxLength} chars]`;
 }
+function renderTemplateString(input, vars, allowMissing) {
+    return input.replace(/\$\{([^}]+)\}/g, (_match, rawKey) => {
+        const key = String(rawKey).trim();
+        if (!key) {
+            return "";
+        }
+        if (Object.prototype.hasOwnProperty.call(vars, key)) {
+            return vars[key] ?? "";
+        }
+        const lowerKey = key.toLowerCase();
+        if (Object.prototype.hasOwnProperty.call(vars, lowerKey)) {
+            return vars[lowerKey] ?? "";
+        }
+        if (allowMissing) {
+            return `\${${key}}`;
+        }
+        throw new ClawChefError(`Missing template variable in file content: ${key}`);
+    });
+}
 function resolveWorkspacePath(recipeOrigin, name, configuredPath) {
     if (configuredPath?.trim()) {
         if (path.isAbsolute(configuredPath)) {
@@ -121,13 +140,14 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
     const provider = createProvider(options);
     const remoteMode = options.provider === "remote";
     const workspacePaths = new Map();
+    const preserveExistingState = options.scope !== "full";
     logger.info(`Running recipe: ${recipe.name}`);
-    const versionResult = await provider.ensureVersion(recipe.openclaw, options.dryRun, options.silent, options.keepOpenClawState);
+    const versionResult = await provider.ensureVersion(recipe.openclaw, options.dryRun, options.silent, preserveExistingState);
     logger.info(`OpenClaw version ready: ${recipe.openclaw.version}`);
     if (versionResult.installedThisRun) {
         logger.info("OpenClaw was installed in this run; skipping factory reset");
     }
-    else if (options.keepOpenClawState) {
+    else if (preserveExistingState) {
         logger.info("Keeping existing OpenClaw state; skipping factory reset");
     }
     else {
@@ -198,65 +218,69 @@ export async function runRecipe(recipe, recipeOrigin, options, logger) {
         await provider.configureChannel(recipe.openclaw, channel, options.dryRun);
         logger.info(`Channel configured: ${channel.channel}${channel.account ? `/${channel.account}` : ""}`);
     }
-    for (const file of recipe.files ?? []) {
-        const wsPath = workspacePaths.get(file.workspace);
+    for (const workspace of recipe.workspaces ?? []) {
+        const wsPath = workspacePaths.get(workspace.name);
         if (!wsPath) {
-            throw new ClawChefError(`File target workspace does not exist: ${file.workspace}`);
+            throw new ClawChefError(`Workspace does not exist for files: ${workspace.name}`);
         }
-        if (provider.materializeFile) {
-            let content = file.content;
-            if (content === undefined && file.content_from) {
-                if (!options.dryRun) {
-                    content = await readTextFromRef(recipeOrigin, file.content_from);
+        for (const file of workspace.files ?? []) {
+            if (provider.materializeFile) {
+                let content = file.content;
+                if (content === undefined && file.content_from) {
+                    if (!options.dryRun) {
+                        const rawContent = await readTextFromRef(recipeOrigin, file.content_from);
+                        content = renderTemplateString(rawContent, options.vars, options.allowMissing);
+                    }
+                    else {
+                        const resolved = resolveFileRef(recipeOrigin, file.content_from);
+                        content = `__dry_run_content_from__:${resolved.value}`;
+                    }
                 }
-                else {
-                    const resolved = resolveFileRef(recipeOrigin, file.content_from);
-                    content = `__dry_run_content_from__:${resolved.value}`;
+                if (content === undefined && file.source) {
+                    if (!options.dryRun) {
+                        content = await readTextFromRef(recipeOrigin, file.source);
+                    }
+                    else {
+                        const resolved = resolveFileRef(recipeOrigin, file.source);
+                        content = `__dry_run_source__:${resolved.value}`;
+                    }
+                }
+                if (content === undefined) {
+                    throw new ClawChefError(`File ${file.path} requires content, content_from, or source`);
                 }
+                await provider.materializeFile(recipe.openclaw, workspace.name, file.path, content, file.overwrite, options.dryRun);
+                logger.info(`File materialized: ${workspace.name}/${file.path}`);
+                continue;
             }
-            if (content === undefined && file.source) {
-                if (!options.dryRun) {
-                    content = await readTextFromRef(recipeOrigin, file.source);
+            const target = path.resolve(wsPath, file.path);
+            const targetDir = path.dirname(target);
+            if (!options.dryRun) {
+                await mkdir(targetDir, { recursive: true });
+                const alreadyExists = await exists(target);
+                if (alreadyExists && file.overwrite === false) {
+                    logger.warn(`Skipping existing file: ${target}`);
                 }
-                else {
-                    const resolved = resolveFileRef(recipeOrigin, file.source);
-                    content = `__dry_run_source__:${resolved.value}`;
+                else if (file.content !== undefined) {
+                    await writeFile(target, file.content, "utf8");
                 }
-            }
-            if (content === undefined) {
-                throw new ClawChefError(`File ${file.path} requires content, content_from, or source`);
-            }
-            await provider.materializeFile(recipe.openclaw, file.workspace, file.path, content, file.overwrite, options.dryRun);
-            logger.info(`File materialized: ${file.workspace}/${file.path}`);
-            continue;
-        }
-        const target = path.resolve(wsPath, file.path);
-        const targetDir = path.dirname(target);
-        if (!options.dryRun) {
-            await mkdir(targetDir, { recursive: true });
-            const alreadyExists = await exists(target);
-            if (alreadyExists && file.overwrite === false) {
-                logger.warn(`Skipping existing file: ${target}`);
-            }
-            else if (file.content !== undefined) {
-                await writeFile(target, file.content, "utf8");
-            }
-            else if (file.content_from) {
-                const content = await readTextFromRef(recipeOrigin, file.content_from);
-                await writeFile(target, content, "utf8");
-            }
-            else if (file.source) {
-                const resolved = resolveFileRef(recipeOrigin, file.source);
-                if (resolved.kind === "local") {
-                    await copyFile(resolved.value, target);
+                else if (file.content_from) {
+                    const rawContent = await readTextFromRef(recipeOrigin, file.content_from);
+                    const content = renderTemplateString(rawContent, options.vars, options.allowMissing);
+                    await writeFile(target, content, "utf8");
                 }
-                else {
-                    const content = await readBinaryFromRef(recipeOrigin, file.source);
-                    await writeFile(target, content);
+                else if (file.source) {
+                    const resolved = resolveFileRef(recipeOrigin, file.source);
+                    if (resolved.kind === "local") {
+                        await copyFile(resolved.value, target);
+                    }
+                    else {
+                        const content = await readBinaryFromRef(recipeOrigin, file.source);
+                        await writeFile(target, content);
+                    }
                 }
             }
+            logger.info(`File materialized: ${workspace.name}/${file.path}`);
         }
-        logger.info(`File materialized: ${file.workspace}/${file.path}`);
     }
     for (const agent of recipe.agents ?? []) {
         for (const skill of agent.skills ?? []) {