clawmacdo 0.16.0 → 0.18.0

package/README.md

@@ -5,12 +5,22 @@
 
 Rust CLI tool for deploying [OpenClaw](https://openclaw.ai) to **DigitalOcean**, **AWS Lightsail**, **Tencent Cloud**, **Microsoft Azure**, or **BytePlus Cloud** — with Claude Code, Codex, and Gemini CLI pre-installed.
 
-## ✨ What's New in v0.16.0
+## ✨ What's New in v0.18.0
 
-- **BytePlus destroy cleanup** — Automatically release EIP and delete VPC/subnet/security-group when destroying BytePlus instances
-- **BytePlus deploy form improvements** — Auto-default primary AI model to "byteplus" when BytePlus provider selected; "Generate" button for ARK API key with endpoint selection
-- **ARK API endpoints** — `POST /api/ark/endpoints` and `POST /api/ark/api-key` for ARK key generation from the web UI
-- **Playwright E2E test suite** — 30 CSV-driven test scenarios covering all 5 cloud providers with all model/failover/messaging permutations
+- **Tailscale Funnel** — `tailscale-funnel` subcommand: install Tailscale, enable Funnel, configure `openclaw.json`, auto-approve devices, and print public webchat URL
+- **Funnel toggle** — `funnel-on` / `funnel-off` CLI commands and web UI Deployments tab toggle button
+- **Device approval** — `device-approve` subcommand to auto-approve all pending webchat pairing requests
+- **Customer skill management** — `skill-upload`, `skill-download`, `skill-push` subcommands for per-deployment SKILL.md via Railway skills API + SCP to instances
+- **User-skills API** — REST endpoints for per-deployment SKILL.md with API key protection and auto-backup
+- **Web UI fixes** — Deployments tab works after PIN login; logout button; PIN error message displays correctly
+
+### Previous highlights (v0.17.x)
+- **Web UI security hardening (CRIT-01)** — API key auth, 6-digit PIN login, CORS, rate limiting, localhost-only binding
+- **All 4 CRITICAL security findings resolved**
+
+### Previous highlights (v0.16.x)
+- **BytePlus destroy cleanup** — Auto-release EIP and delete VPC/subnet/security-group
+- **Playwright E2E test suite** — 30 CSV-driven test scenarios covering all 5 cloud providers
 
 ### Previous highlights (v0.14.x – v0.15.x)
 - **Windows builds fixed** — Dependencies correctly scoped, native MSVC builds
@@ -355,6 +365,11 @@ new-crate = { workspace = true }
 | `OPENAI_API_KEY` | OpenAI API key | Optional |
 | `TELEGRAM_TOKEN` | Telegram bot token | Optional |
 | `TAILSCALE_AUTH_KEY` | Tailscale auth key | Optional |
+| `CLAWMACDO_API_KEY` | API key protecting `/api/*` endpoints | Optional (Web UI) |
+| `CLAWMACDO_PIN` | 6-digit PIN for web UI login page | Optional (Web UI) |
+| `CLAWMACDO_BIND` | Server bind address (default: `127.0.0.1`) | Optional (Web UI) |
+| `SKILLS_API_URL` | Railway skills API base URL | For skill commands |
+| `USER_SKILLS_API_KEY` | API key for user-skills endpoints | For skill commands |
 
 ## Architecture Notes
 
@@ -397,5 +412,5 @@ See [CHANGELOG.md](CHANGELOG.md) for version history and breaking changes.
 ---
 
 **Last updated:** March 16, 2026
-**Current version:** 0.16.0
+**Current version:** 0.18.0
 **Architecture version:** 2.0 (modular workspace)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawmacdo",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "CLI tool for deploying OpenClaw to multiple cloud providers with pre-installed AI dev tools",
   "keywords": [
     "openclaw",
@@ -30,8 +30,8 @@
     "node": ">=16"
   },
   "optionalDependencies": {
-    "@clawmacdo/darwin-arm64": "0.16.0",
-    "@clawmacdo/linux-x64": "0.16.0",
-    "@clawmacdo/win32-x64": "0.16.0"
+    "@clawmacdo/darwin-arm64": "0.18.0",
+    "@clawmacdo/linux-x64": "0.18.0",
+    "@clawmacdo/win32-x64": "0.18.0"
   }
 }