clawchef 0.1.6 → 0.1.7

package/recipes/sample.yaml

@@ -15,6 +15,12 @@ openclaw:
 
 workspaces:
   - name: "${project_name}"
+    files:
+      - path: "README.md"
+        overwrite: true
+        content: |
+          # ${project_name}
+          Generated by clawchef.
 
 channels:
   - channel: "telegram"
@@ -27,14 +33,6 @@ agents:
     model: "gpt-5.3-codex"
     skills: ["repo-explore", "code-review"]
 
-files:
-  - workspace: "${project_name}"
-    path: "README.md"
-    overwrite: true
-    content: |
-      # ${project_name}
-      Generated by clawchef.
-
 conversations:
   - workspace: "${project_name}"
     agent: "planner"

package/recipes/snippets/readme-template.md

@@ -1,3 +1,5 @@
-# content-from-demo
+# ${project_name}
 
 This content is loaded from a referenced file.
+
+Assigned agent: ${agent_name}

package/src/api.ts

@@ -6,7 +6,7 @@ import { runRecipe } from "./orchestrator.js";
 import { loadRecipe, loadRecipeText } from "./recipe.js";
 import { scaffoldProject } from "./scaffold.js";
 import { recipeSchema } from "./schema.js";
-import type { OpenClawProvider, OpenClawRemoteConfig, RunOptions } from "./types.js";
+import type { OpenClawProvider, OpenClawRemoteConfig, RunOptions, RunScope } from "./types.js";
 import type { ScaffoldOptions, ScaffoldResult } from "./scaffold.js";
 
 export interface CookOptions {
@@ -16,6 +16,8 @@ export interface CookOptions {
   allowMissing?: boolean;
   verbose?: boolean;
   silent?: boolean;
+  scope?: RunScope;
+  workspaceName?: string;
   provider?: OpenClawProvider;
   remote?: Partial<OpenClawRemoteConfig>;
   envFile?: string;
@@ -24,14 +26,23 @@ export interface CookOptions {
 
 function normalizeCookOptions(options: CookOptions): RunOptions {
   const plugins = Array.from(new Set((options.plugins ?? []).map((value) => value.trim()).filter((value) => value.length > 0)));
+  const scope = options.scope ?? "full";
+  const workspaceName = options.workspaceName?.trim() || undefined;
+  if (scope === "workspace" && !workspaceName) {
+    throw new ClawChefError("scope=workspace requires workspaceName");
+  }
+  if (scope !== "workspace" && workspaceName) {
+    throw new ClawChefError("workspaceName is only allowed when scope=workspace");
+  }
   return {
     vars: options.vars ?? {},
     plugins,
+    scope,
+    workspaceName,
     dryRun: Boolean(options.dryRun),
     allowMissing: Boolean(options.allowMissing),
     verbose: Boolean(options.verbose),
     silent: options.silent ?? true,
-    keepOpenClawState: false,
     provider: options.provider ?? "command",
     remote: options.remote ?? {},
   };

package/src/cli.ts

@@ -6,12 +6,27 @@ import { runRecipe } from "./orchestrator.js";
 import { loadRecipe, loadRecipeText } from "./recipe.js";
 import { recipeSchema } from "./schema.js";
 import { scaffoldProject } from "./scaffold.js";
-import type { RunOptions } from "./types.js";
+import type { RunOptions, RunScope } from "./types.js";
 import YAML from "js-yaml";
 import path from "node:path";
+import { readFileSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 
+function readPackageVersion(): string {
+  try {
+    const pkgPath = new URL("../package.json", import.meta.url);
+    const content = readFileSync(pkgPath, "utf8");
+    const parsed = JSON.parse(content) as { version?: string };
+    if (parsed.version?.trim()) {
+      return parsed.version;
+    }
+  } catch {
+    // ignore and use fallback
+  }
+  return "0.0.0";
+}
+
 function parseVarFlags(values: string[]): Record<string, string> {
   const out: Record<string, string> = {};
   for (const item of values) {
@@ -46,6 +61,13 @@ function parseProvider(value: string): "command" | "mock" | "remote" {
   throw new ClawChefError(`Invalid --provider value: ${value}. Expected command, remote, or mock`);
 }
 
+function parseScope(value: string): RunScope {
+  if (value === "full" || value === "files" || value === "workspace") {
+    return value;
+  }
+  throw new ClawChefError(`Invalid --scope value: ${value}. Expected full, files, or workspace`);
+}
+
 function parseOptionalInt(value: string | undefined, fieldName: string): number | undefined {
   if (value === undefined) {
     return undefined;
@@ -78,7 +100,7 @@ export function buildCli(): Command {
   program
     .name("clawchef")
     .description("Run OpenClaw environment recipes")
-    .version("0.1.6");
+    .version(readPackageVersion());
 
   program
     .command("cook")
@@ -88,7 +110,8 @@ export function buildCli(): Command {
     .option("--allow-missing", "Allow unresolved template variables", false)
     .option("--verbose", "Verbose logging", false)
     .option("-s, --silent", "Skip reset confirmation prompt", false)
-    .option("--keep-openclaw-state", "Preserve existing OpenClaw state (skip factory reset)", false)
+    .option("--scope <scope>", "Run scope: full | files | workspace", "full")
+    .option("--workspace <name>", "Workspace name (required when --scope workspace)")
     .option("--dotenv-ref <path-or-url>", "Load env vars from local file or HTTP URL")
     .option("--provider <provider>", "Execution provider: command | remote | mock")
     .option("--plugin <npm-spec>", "Preinstall plugin package (repeatable)", (v, p: string[]) => p.concat([v]), [])
@@ -106,14 +129,23 @@ export function buildCli(): Command {
       }
 
       const provider = parseProvider(opts.provider ?? readEnv("CLAWCHEF_PROVIDER") ?? "command");
+      const scope = parseScope(String(opts.scope ?? "full"));
+      const workspaceName = opts.workspace?.trim() ? String(opts.workspace).trim() : undefined;
+      if (scope === "workspace" && !workspaceName) {
+        throw new ClawChefError("--scope workspace requires --workspace <name>");
+      }
+      if (scope !== "workspace" && workspaceName) {
+        throw new ClawChefError("--workspace is only allowed when --scope workspace");
+      }
       const options: RunOptions = {
         vars: parseVarFlags(opts.var),
         plugins: parsePluginFlags(opts.plugin),
+        scope,
+        workspaceName,
         dryRun: Boolean(opts.dryRun),
         allowMissing: Boolean(opts.allowMissing),
         verbose: Boolean(opts.verbose),
         silent: Boolean(opts.silent),
-        keepOpenClawState: Boolean(opts.keepOpenclawState),
         provider,
         remote: {
           base_url: opts.remoteBaseUrl ?? readEnv("CLAWCHEF_REMOTE_BASE_URL"),

package/src/openclaw/command-provider.ts

@@ -35,27 +35,33 @@ const SECRET_FLAG_RE =
   /(--[A-Za-z0-9-]*(?:api-key|token|password|secret)[A-Za-z0-9-]*\s+)(?:'[^']*'|"[^"]*"|\S+)/g;
 
 type BootstrapStringField =
-  | "openai_api_key"
-  | "anthropic_api_key"
-  | "openrouter_api_key"
-  | "xai_api_key"
-  | "gemini_api_key"
-  | "ai_gateway_api_key"
-  | "cloudflare_ai_gateway_api_key"
   | "cloudflare_ai_gateway_account_id"
   | "cloudflare_ai_gateway_gateway_id"
   | "token"
   | "token_provider"
   | "token_profile_id";
 
+const AUTH_CHOICE_TO_LLM_FLAG: Record<string, string> = {
+  "openai-api-key": "--openai-api-key",
+  "anthropic-api-key": "--anthropic-api-key",
+  "openrouter-api-key": "--openrouter-api-key",
+  "xai-api-key": "--xai-api-key",
+  "gemini-api-key": "--gemini-api-key",
+  "ai-gateway-api-key": "--ai-gateway-api-key",
+  "cloudflare-ai-gateway-api-key": "--cloudflare-ai-gateway-api-key",
+};
+
+const AUTH_CHOICE_TO_LLM_ENV: Record<string, string> = {
+  "openai-api-key": "OPENAI_API_KEY",
+  "anthropic-api-key": "ANTHROPIC_API_KEY",
+  "openrouter-api-key": "OPENROUTER_API_KEY",
+  "xai-api-key": "XAI_API_KEY",
+  "gemini-api-key": "GEMINI_API_KEY",
+  "ai-gateway-api-key": "AI_GATEWAY_API_KEY",
+  "cloudflare-ai-gateway-api-key": "CLOUDFLARE_AI_GATEWAY_API_KEY",
+};
+
 const BOOTSTRAP_STRING_FLAGS: Array<[BootstrapStringField, string]> = [
-  ["openai_api_key", "--openai-api-key"],
-  ["anthropic_api_key", "--anthropic-api-key"],
-  ["openrouter_api_key", "--openrouter-api-key"],
-  ["xai_api_key", "--xai-api-key"],
-  ["gemini_api_key", "--gemini-api-key"],
-  ["ai_gateway_api_key", "--ai-gateway-api-key"],
-  ["cloudflare_ai_gateway_api_key", "--cloudflare-ai-gateway-api-key"],
   ["cloudflare_ai_gateway_account_id", "--cloudflare-ai-gateway-account-id"],
   ["cloudflare_ai_gateway_gateway_id", "--cloudflare-ai-gateway-gateway-id"],
   ["token", "--token"],
@@ -239,6 +245,13 @@ function buildBootstrapCommand(bin: string, bootstrap: OpenClawBootstrap | undef
     flags.push("--no-install-daemon");
   }
 
+  if (cfg.llm_api_key?.trim()) {
+    const llmFlag = AUTH_CHOICE_TO_LLM_FLAG[cfg.auth_choice ?? ""];
+    if (llmFlag) {
+      flags.push(`${llmFlag} ${shellQuote(cfg.llm_api_key)}`);
+    }
+  }
+
   for (const [field, flag] of BOOTSTRAP_STRING_FLAGS) {
     const value = cfg[field];
     if (value && value.trim()) {
@@ -257,14 +270,11 @@ function bootstrapRuntimeEnv(bootstrap: OpenClawBootstrap | undefined): Record<s
   }
   const env: Record<string, string> = {};
 
-  if (bootstrap.openai_api_key) env.OPENAI_API_KEY = bootstrap.openai_api_key;
-  if (bootstrap.anthropic_api_key) env.ANTHROPIC_API_KEY = bootstrap.anthropic_api_key;
-  if (bootstrap.openrouter_api_key) env.OPENROUTER_API_KEY = bootstrap.openrouter_api_key;
-  if (bootstrap.xai_api_key) env.XAI_API_KEY = bootstrap.xai_api_key;
-  if (bootstrap.gemini_api_key) env.GEMINI_API_KEY = bootstrap.gemini_api_key;
-  if (bootstrap.ai_gateway_api_key) env.AI_GATEWAY_API_KEY = bootstrap.ai_gateway_api_key;
-  if (bootstrap.cloudflare_ai_gateway_api_key) {
-    env.CLOUDFLARE_AI_GATEWAY_API_KEY = bootstrap.cloudflare_ai_gateway_api_key;
+  if (bootstrap.llm_api_key?.trim()) {
+    const envKey = AUTH_CHOICE_TO_LLM_ENV[bootstrap.auth_choice ?? ""];
+    if (envKey) {
+      env[envKey] = bootstrap.llm_api_key;
+    }
   }
 
   return env;
@@ -277,7 +287,7 @@ export class CommandOpenClawProvider implements OpenClawProvider {
     config: OpenClawSection,
     dryRun: boolean,
     silent: boolean,
-    keepOpenClawState: boolean,
+    preserveExistingState: boolean,
   ): Promise<EnsureVersionResult> {
     const bin = config.bin ?? "openclaw";
     const installPolicy = config.install ?? "auto";
@@ -343,7 +353,7 @@ export class CommandOpenClawProvider implements OpenClawProvider {
       );
     }
 
-    if (keepOpenClawState) {
+    if (preserveExistingState) {
       return { installedThisRun: false };
     }
 

package/src/openclaw/mock-provider.ts

@@ -25,7 +25,7 @@ export class MockOpenClawProvider implements OpenClawProvider {
     config: OpenClawSection,
     _dryRun: boolean,
     _silent: boolean,
-    _keepOpenClawState: boolean,
+    _preserveExistingState: boolean,
   ): Promise<EnsureVersionResult> {
     const policy = config.install ?? "auto";
     const installed = this.state.installedVersions.has(config.version);

package/src/openclaw/provider.ts

@@ -11,7 +11,7 @@ export interface OpenClawProvider {
     config: OpenClawSection,
     dryRun: boolean,
     silent: boolean,
-    keepOpenClawState: boolean,
+    preserveExistingState: boolean,
   ): Promise<EnsureVersionResult>;
   installPlugin(config: OpenClawSection, pluginSpec: string, dryRun: boolean): Promise<void>;
   factoryReset(config: OpenClawSection, dryRun: boolean): Promise<void>;

package/src/openclaw/remote-provider.ts

@@ -145,7 +145,7 @@ export class RemoteOpenClawProvider implements OpenClawProvider {
     config: OpenClawSection,
     dryRun: boolean,
     _silent: boolean,
-    _keepOpenClawState: boolean,
+    _preserveExistingState: boolean,
   ): Promise<EnsureVersionResult> {
     const result = await this.perform(
       config,

package/src/orchestrator.ts

@@ -27,6 +27,26 @@ function truncateForLog(text: string, maxLength = 500): string {
   return `${text.slice(0, maxLength)}... [truncated ${text.length - maxLength} chars]`;
 }
 
+function renderTemplateString(input: string, vars: Record<string, string>, allowMissing: boolean): string {
+  return input.replace(/\$\{([^}]+)\}/g, (_match, rawKey: string) => {
+    const key = String(rawKey).trim();
+    if (!key) {
+      return "";
+    }
+    if (Object.prototype.hasOwnProperty.call(vars, key)) {
+      return vars[key] ?? "";
+    }
+    const lowerKey = key.toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(vars, lowerKey)) {
+      return vars[lowerKey] ?? "";
+    }
+    if (allowMissing) {
+      return `\${${key}}`;
+    }
+    throw new ClawChefError(`Missing template variable in file content: ${key}`);
+  });
+}
+
 function resolveWorkspacePath(recipeOrigin: RecipeOrigin, name: string, configuredPath?: string): string {
   if (configuredPath?.trim()) {
     if (path.isAbsolute(configuredPath)) {
@@ -146,19 +166,20 @@ export async function runRecipe(
   const provider = createProvider(options);
   const remoteMode = options.provider === "remote";
   const workspacePaths = new Map<string, string>();
+  const preserveExistingState = options.scope !== "full";
 
   logger.info(`Running recipe: ${recipe.name}`);
   const versionResult = await provider.ensureVersion(
     recipe.openclaw,
     options.dryRun,
     options.silent,
-    options.keepOpenClawState,
+    preserveExistingState,
   );
   logger.info(`OpenClaw version ready: ${recipe.openclaw.version}`);
 
   if (versionResult.installedThisRun) {
     logger.info("OpenClaw was installed in this run; skipping factory reset");
-  } else if (options.keepOpenClawState) {
+  } else if (preserveExistingState) {
     logger.info("Keeping existing OpenClaw state; skipping factory reset");
   } else {
     const confirmed = await confirmFactoryReset(options);
@@ -244,63 +265,67 @@ export async function runRecipe(
     logger.info(`Channel configured: ${channel.channel}${channel.account ? `/${channel.account}` : ""}`);
   }
 
-  for (const file of recipe.files ?? []) {
-    const wsPath = workspacePaths.get(file.workspace);
+  for (const workspace of recipe.workspaces ?? []) {
+    const wsPath = workspacePaths.get(workspace.name);
     if (!wsPath) {
-      throw new ClawChefError(`File target workspace does not exist: ${file.workspace}`);
+      throw new ClawChefError(`Workspace does not exist for files: ${workspace.name}`);
     }
 
-    if (provider.materializeFile) {
-      let content = file.content;
-      if (content === undefined && file.content_from) {
-        if (!options.dryRun) {
-          content = await readTextFromRef(recipeOrigin, file.content_from);
-        } else {
-          const resolved = resolveFileRef(recipeOrigin, file.content_from);
-          content = `__dry_run_content_from__:${resolved.value}`;
+    for (const file of workspace.files ?? []) {
+      if (provider.materializeFile) {
+        let content = file.content;
+        if (content === undefined && file.content_from) {
+          if (!options.dryRun) {
+            const rawContent = await readTextFromRef(recipeOrigin, file.content_from);
+            content = renderTemplateString(rawContent, options.vars, options.allowMissing);
+          } else {
+            const resolved = resolveFileRef(recipeOrigin, file.content_from);
+            content = `__dry_run_content_from__:${resolved.value}`;
+          }
         }
-      }
-      if (content === undefined && file.source) {
-        if (!options.dryRun) {
-          content = await readTextFromRef(recipeOrigin, file.source);
-        } else {
-          const resolved = resolveFileRef(recipeOrigin, file.source);
-          content = `__dry_run_source__:${resolved.value}`;
+        if (content === undefined && file.source) {
+          if (!options.dryRun) {
+            content = await readTextFromRef(recipeOrigin, file.source);
+          } else {
+            const resolved = resolveFileRef(recipeOrigin, file.source);
+            content = `__dry_run_source__:${resolved.value}`;
+          }
+        }
+        if (content === undefined) {
+          throw new ClawChefError(`File ${file.path} requires content, content_from, or source`);
         }
-      }
-      if (content === undefined) {
-        throw new ClawChefError(`File ${file.path} requires content, content_from, or source`);
-      }
 
-      await provider.materializeFile(recipe.openclaw, file.workspace, file.path, content, file.overwrite, options.dryRun);
-      logger.info(`File materialized: ${file.workspace}/${file.path}`);
-      continue;
-    }
+        await provider.materializeFile(recipe.openclaw, workspace.name, file.path, content, file.overwrite, options.dryRun);
+        logger.info(`File materialized: ${workspace.name}/${file.path}`);
+        continue;
+      }
 
-    const target = path.resolve(wsPath, file.path);
-    const targetDir = path.dirname(target);
-
-    if (!options.dryRun) {
-      await mkdir(targetDir, { recursive: true });
-      const alreadyExists = await exists(target);
-      if (alreadyExists && file.overwrite === false) {
-        logger.warn(`Skipping existing file: ${target}`);
-      } else if (file.content !== undefined) {
-        await writeFile(target, file.content, "utf8");
-      } else if (file.content_from) {
-        const content = await readTextFromRef(recipeOrigin, file.content_from);
-        await writeFile(target, content, "utf8");
-      } else if (file.source) {
-        const resolved = resolveFileRef(recipeOrigin, file.source);
-        if (resolved.kind === "local") {
-          await copyFile(resolved.value, target);
-        } else {
-          const content = await readBinaryFromRef(recipeOrigin, file.source);
-          await writeFile(target, content);
+      const target = path.resolve(wsPath, file.path);
+      const targetDir = path.dirname(target);
+
+      if (!options.dryRun) {
+        await mkdir(targetDir, { recursive: true });
+        const alreadyExists = await exists(target);
+        if (alreadyExists && file.overwrite === false) {
+          logger.warn(`Skipping existing file: ${target}`);
+        } else if (file.content !== undefined) {
+          await writeFile(target, file.content, "utf8");
+        } else if (file.content_from) {
+          const rawContent = await readTextFromRef(recipeOrigin, file.content_from);
+          const content = renderTemplateString(rawContent, options.vars, options.allowMissing);
+          await writeFile(target, content, "utf8");
+        } else if (file.source) {
+          const resolved = resolveFileRef(recipeOrigin, file.source);
+          if (resolved.kind === "local") {
+            await copyFile(resolved.value, target);
+          } else {
+            const content = await readBinaryFromRef(recipeOrigin, file.source);
+            await writeFile(target, content);
+          }
         }
       }
+      logger.info(`File materialized: ${workspace.name}/${file.path}`);
     }
-    logger.info(`File materialized: ${file.workspace}/${file.path}`);
   }
 
   for (const agent of recipe.agents ?? []) {

package/src/recipe.ts

@@ -32,24 +32,18 @@ export interface LoadedRecipeText {
 }
 
 const AUTH_CHOICE_TO_FIELD: Record<string, string> = {
-  "openai-api-key": "openai_api_key",
-  "anthropic-api-key": "anthropic_api_key",
-  "openrouter-api-key": "openrouter_api_key",
-  "xai-api-key": "xai_api_key",
-  "gemini-api-key": "gemini_api_key",
-  "ai-gateway-api-key": "ai_gateway_api_key",
-  "cloudflare-ai-gateway-api-key": "cloudflare_ai_gateway_api_key",
+  "openai-api-key": "llm_api_key",
+  "anthropic-api-key": "llm_api_key",
+  "openrouter-api-key": "llm_api_key",
+  "xai-api-key": "llm_api_key",
+  "gemini-api-key": "llm_api_key",
+  "ai-gateway-api-key": "llm_api_key",
+  "cloudflare-ai-gateway-api-key": "llm_api_key",
   token: "token",
 };
 
 const SECRET_BOOTSTRAP_FIELDS = [
-  "openai_api_key",
-  "anthropic_api_key",
-  "openrouter_api_key",
-  "xai_api_key",
-  "gemini_api_key",
-  "ai_gateway_api_key",
-  "cloudflare_ai_gateway_api_key",
+  "llm_api_key",
   "token",
 ] as const;
 
@@ -124,7 +118,7 @@ function assertNoInlineSecrets(recipe: Recipe): void {
   }
 }
 
-function collectVars(recipe: Recipe, cliVars: Record<string, string>): Record<string, string> {
+function collectVars(recipe: Recipe, cliVars: Record<string, string>, requiredKeys?: Set<string>): Record<string, string> {
   const vars: Record<string, string> = {};
   const params = recipe.params ?? {};
 
@@ -155,7 +149,7 @@ function collectVars(recipe: Recipe, cliVars: Record<string, string>): Record<st
       vars[key] = def.default;
       continue;
     }
-    if (def.required) {
+    if (def.required && (requiredKeys === undefined || requiredKeys.has(key))) {
       throw new ClawChefError(`Parameter ${key} is required but was not provided via --var or environment`);
     }
   }
@@ -167,6 +161,36 @@ function collectVars(recipe: Recipe, cliVars: Record<string, string>): Record<st
   return vars;
 }
 
+function projectRecipeForScope(recipe: Recipe, options: RunOptions): Recipe {
+  if (options.scope !== "workspace") {
+    return recipe;
+  }
+
+  return {
+    ...recipe,
+    openclaw: {
+      ...recipe.openclaw,
+      bootstrap: undefined,
+    },
+    channels: [],
+    conversations: [],
+  };
+}
+
+function filterRecipeByWorkspaceName(recipe: Recipe, workspaceName: string): Recipe {
+  const workspace = (recipe.workspaces ?? []).find((ws) => ws.name === workspaceName);
+  if (!workspace) {
+    throw new ClawChefError(`Workspace not found in recipe: ${workspaceName}`);
+  }
+
+  return {
+    ...recipe,
+    workspaces: [workspace],
+    agents: (recipe.agents ?? []).filter((agent) => agent.workspace === workspaceName),
+    conversations: (recipe.conversations ?? []).filter((conv) => conv.workspace === workspaceName),
+  };
+}
+
 function semanticValidate(recipe: Recipe): void {
   const ws = new Set((recipe.workspaces ?? []).map((w) => w.name));
   for (const workspace of recipe.workspaces ?? []) {
@@ -179,9 +203,11 @@ function semanticValidate(recipe: Recipe): void {
       throw new ClawChefError(`Agent ${agent.name} references missing workspace: ${agent.workspace}`);
     }
   }
-  for (const file of recipe.files ?? []) {
-    if (!ws.has(file.workspace)) {
-      throw new ClawChefError(`File ${file.path} references missing workspace: ${file.workspace}`);
+  for (const workspace of recipe.workspaces ?? []) {
+    for (const file of workspace.files ?? []) {
+      if (!file.path.trim()) {
+        throw new ClawChefError(`Workspace ${workspace.name} has file with empty path`);
+      }
     }
   }
   const agents = new Set((recipe.agents ?? []).map((a) => `${a.workspace}::${a.name}`));
@@ -752,18 +778,31 @@ export async function loadRecipe(recipePath: string, options: RunOptions): Promi
       throw new ClawChefError(`Recipe format is invalid: ${firstParse.error.message}`);
     }
 
-    assertNoInlineSecrets(firstParse.data);
+    const projected = projectRecipeForScope(firstParse.data, options);
 
-    const vars = collectVars(firstParse.data, options.vars);
-    const rendered = deepResolveTemplates(firstParse.data, vars, options.allowMissing);
+    assertNoInlineSecrets(projected);
+
+    const requiredKeys = options.scope === "workspace" ? new Set<string>() : undefined;
+    const vars = collectVars(projected, options.vars, requiredKeys);
+    const rendered = deepResolveTemplates(projected, vars, options.allowMissing);
     const secondParse = recipeSchema.safeParse(rendered);
     if (!secondParse.success) {
       throw new ClawChefError(`Recipe is invalid after parameter resolution: ${secondParse.error.message}`);
     }
 
-    semanticValidate(secondParse.data);
+    const scopedRecipe = (() => {
+      if (options.scope !== "workspace") {
+        return secondParse.data;
+      }
+      if (!options.workspaceName) {
+        throw new ClawChefError("scope=workspace requires a workspace name");
+      }
+      return filterRecipeByWorkspaceName(secondParse.data, options.workspaceName);
+    })();
+
+    semanticValidate(scopedRecipe);
     return {
-      recipe: secondParse.data,
+      recipe: scopedRecipe,
       origin: recipeRef.origin,
     };
   });

package/src/schema.ts

@@ -39,13 +39,7 @@ const openClawBootstrapSchema = z
     skip_ui: z.boolean().optional(),
     skip_daemon: z.boolean().optional(),
     install_daemon: z.boolean().optional(),
-    openai_api_key: z.string().optional(),
-    anthropic_api_key: z.string().optional(),
-    openrouter_api_key: z.string().optional(),
-    xai_api_key: z.string().optional(),
-    gemini_api_key: z.string().optional(),
-    ai_gateway_api_key: z.string().optional(),
-    cloudflare_ai_gateway_api_key: z.string().optional(),
+    llm_api_key: z.string().optional(),
     cloudflare_ai_gateway_account_id: z.string().optional(),
     cloudflare_ai_gateway_gateway_id: z.string().optional(),
     token: z.string().optional(),
@@ -70,6 +64,22 @@ const workspaceSchema = z
     name: z.string().min(1),
     path: z.string().min(1).optional(),
     assets: z.string().min(1).optional(),
+    files: z
+      .array(
+        z
+          .object({
+            path: z.string().min(1),
+            content: z.string().optional(),
+            content_from: z.string().min(1).optional(),
+            source: z.string().optional(),
+            overwrite: z.boolean().optional(),
+          })
+          .strict()
+          .refine((v) => [v.content, v.content_from, v.source].filter((item) => item !== undefined).length === 1, {
+            message: "workspaces[].files[] requires exactly one of content, content_from, or source",
+          }),
+      )
+      .optional(),
   })
   .strict();
 
@@ -104,20 +114,6 @@ const agentSchema = z
   })
   .strict();
 
-const fileSchema = z
-  .object({
-    workspace: z.string().min(1),
-    path: z.string().min(1),
-    content: z.string().optional(),
-    content_from: z.string().min(1).optional(),
-    source: z.string().optional(),
-    overwrite: z.boolean().optional(),
-  })
-  .strict()
-  .refine((v) => [v.content, v.content_from, v.source].filter((item) => item !== undefined).length === 1, {
-    message: "files[] requires exactly one of content, content_from, or source",
-  });
-
 const conversationExpectSchema = z
   .object({
     contains: z.array(z.string()).optional(),
@@ -152,7 +148,6 @@ export const recipeSchema = z
     workspaces: z.array(workspaceSchema).optional(),
     channels: z.array(channelSchema).optional(),
     agents: z.array(agentSchema).optional(),
-    files: z.array(fileSchema).optional(),
     conversations: z.array(conversationSchema).optional(),
   })
   .strict();