clawpowers 1.1.4 → 2.0.0

package/hooks/session-start

@@ -1,205 +0,0 @@
-#!/usr/bin/env bash
-# hooks/session-start — ClawPowers session injection hook (bash runtime)
-#
-# Detects the active AI coding platform and outputs platform-appropriate JSON
-# to inject the using-clawpowers skill into the agent's context window.
-#
-# Supported platforms:
-#   - Claude Code  (CLAUDE_PLUGIN_ROOT env var)
-#   - Cursor       (CURSOR_PLUGIN_ROOT env var)
-#   - Codex        (CODEX env var or codex in PATH)
-#   - OpenCode     (OPENCODE env var)
-#   - Gemini CLI   (GEMINI_CLI env var or gemini in PATH)
-#
-# Output: JSON object suitable for platform context injection
-# Exit 0: success with JSON on stdout
-# Exit 1: skill file not found
-set -euo pipefail
-
-## === Path Setup ===
-
-# hooks/ is one level inside the repo; climb to get the repo root
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-# Path to the primary skill file that gets embedded in the injection JSON
-SKILL_FILE="$REPO_ROOT/skills/using-clawpowers/SKILL.md"
-
-# Path to the bash init script for silent first-run initialization
-RUNTIME_INIT="$REPO_ROOT/runtime/init.sh"
-
-## === First-Run Initialization ===
-
-# Silently initialize the runtime directory if it doesn't exist yet.
-# This handles the case where a platform hook runs before the user has
-# manually executed `clawpowers init`. Output is suppressed so it doesn't
-# pollute the JSON emitted below.
-if [[ ! -d "${HOME}/.clawpowers" ]] && [[ -f "$RUNTIME_INIT" ]]; then
-  bash "$RUNTIME_INIT" >/dev/null 2>&1 || true
-fi
-
-## === Prerequisite Check ===
-
-# If the skill file is missing, emit a machine-readable JSON error to stderr
-# so the consuming platform can surface a helpful message to the user.
-if [[ ! -f "$SKILL_FILE" ]]; then
-  echo '{"error":"ClawPowers: using-clawpowers/SKILL.md not found","action":"run npx clawpowers init"}' >&2
-  exit 1
-fi
-
-# Read the skill file content once — it's embedded in every platform's JSON output
-SKILL_CONTENT="$(cat "$SKILL_FILE")"
-TIMESTAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-VERSION="1.0.0"
-
-## === Platform Detection ===
-
-# Detect the active AI coding platform by checking environment variables first,
-# then falling back to PATH binary checks. Priority order reflects likelihood.
-detect_platform() {
-  if [[ -n "${CLAUDE_PLUGIN_ROOT:-}" ]]; then
-    echo "claude-code"
-  elif [[ -n "${CURSOR_PLUGIN_ROOT:-}" ]]; then
-    echo "cursor"
-  elif [[ -n "${CODEX:-}" ]] || command -v codex >/dev/null 2>&1; then
-    # Codex sets the CODEX env var when active; also detectable via binary
-    echo "codex"
-  elif [[ -n "${OPENCODE:-}" ]]; then
-    echo "opencode"
-  elif [[ -n "${GEMINI_CLI:-}" ]] || command -v gemini >/dev/null 2>&1; then
-    # Gemini CLI sets GEMINI_CLI env var when active; also detectable via binary
-    echo "gemini"
-  else
-    # No recognized platform — emit generic JSON any agent can consume
-    echo "generic"
-  fi
-}
-
-PLATFORM="$(detect_platform)"
-
-## === JSON Escaping ===
-
-# Escape a string for safe embedding in a JSON double-quoted string value.
-# Order matters: backslashes must be escaped first, then quotes, then control chars.
-json_escape() {
-  local content="$1"
-  content="${content//\\/\\\\}"   # Escape backslashes (must be first)
-  content="${content//\"/\\\"}"   # Escape double quotes
-  content="${content//$'\n'/\\n}" # Escape newlines (skill content is multi-line)
-  content="${content//$'\r'/\\r}" # Escape carriage returns (Windows line endings)
-  content="${content//$'\t'/\\t}" # Escape tabs
-  echo "$content"
-}
-
-# Escape the skill file content once; reused in all platform branches below
-ESCAPED_CONTENT="$(json_escape "$SKILL_CONTENT")"
-
-## === Platform-Specific JSON Output ===
-
-# Each platform receives the same JSON structure but with a tailored instruction
-# string that matches how that platform surfaces skill content to its agent.
-case "$PLATFORM" in
-  claude-code)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "claude-code",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "You have ClawPowers skills loaded. Read the content above to understand available skills and how to trigger them. Skills activate automatically when you recognize a matching task pattern."
-}
-EOF
-    ;;
-
-  cursor)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "cursor",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "ClawPowers skills are available in this Cursor session. Trigger skills by recognizing task patterns described in the using-clawpowers skill above."
-}
-EOF
-    ;;
-
-  codex)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "codex",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "ClawPowers loaded for Codex session. Apply skills based on task pattern recognition."
-}
-EOF
-    ;;
-
-  opencode)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "opencode",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "ClawPowers loaded for OpenCode session. Skills activate on pattern recognition."
-}
-EOF
-    ;;
-
-  gemini)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "gemini",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "ClawPowers loaded for Gemini CLI session. Recognize task patterns to activate skills."
-}
-EOF
-    ;;
-
-  generic)
-    cat <<EOF
-{
-  "type": "skill_injection",
-  "platform": "generic",
-  "version": "$VERSION",
-  "timestamp": "$TIMESTAMP",
-  "skill": {
-    "name": "using-clawpowers",
-    "source": "$SKILL_FILE",
-    "content": "$ESCAPED_CONTENT"
-  },
-  "instruction": "ClawPowers skills loaded. Use the using-clawpowers skill content to understand available capabilities."
-}
-EOF
-    ;;
-esac
-
-exit 0

package/hooks/session-start.cmd

@@ -1,43 +0,0 @@
-@echo off
-:: hooks/session-start.cmd — Windows batch file for ClawPowers session injection
-::
-:: Delegates to hooks/session-start.js via Node.js for Windows-native hook invocation.
-:: This wrapper exists because Windows CMD and PowerShell cannot directly execute
-:: Unix bash scripts. The JS hook produces identical JSON output on all platforms.
-::
-:: Usage:
-::   hooks\session-start.cmd
-::
-:: Output: JSON object suitable for platform context injection (same as session-start.js)
-:: Exit 0: success — JSON on stdout
-:: Exit 1: Node.js not found, or skill file not found
-
-setlocal
-
-:: ============================================================
-:: Step 1: Verify Node.js is installed and on the PATH
-:: ============================================================
-:: 'where' exits non-zero if node.exe is not found.
-:: Without Node.js the JS hook cannot run — surface a machine-readable error.
-where node >nul 2>&1
-if %ERRORLEVEL% neq 0 (
-    echo {"error":"Node.js not found. Install from https://nodejs.org","action":"install Node.js >= 16"} >&2
-    exit /b 1
-)
-
-:: ============================================================
-:: Step 2: Resolve the directory containing this script
-:: ============================================================
-:: %~dp0 expands to the drive+path of the current script including a trailing backslash.
-:: We strip the trailing backslash so path concatenation below works correctly.
-set "SCRIPT_DIR=%~dp0"
-if "%SCRIPT_DIR:~-1%"=="\" set "SCRIPT_DIR=%SCRIPT_DIR:~0,-1%"
-
-:: ============================================================
-:: Step 3: Run the JS hook
-:: ============================================================
-:: session-start.js lives in the same directory as this CMD file.
-:: Node.js inherits the current environment, including CLAWPOWERS_DIR if set.
-:: The exit code from node is forwarded verbatim so callers can detect errors.
-node "%SCRIPT_DIR%\session-start.js"
-exit /b %ERRORLEVEL%

package/hooks/session-start.js

@@ -1,163 +0,0 @@
-#!/usr/bin/env node
-// hooks/session-start.js — ClawPowers session injection hook
-//
-// Detects the active AI coding platform and outputs platform-appropriate JSON
-// to inject the using-clawpowers skill into the agent's context window.
-//
-// Supported platforms:
-//   - Claude Code  (CLAUDE_PLUGIN_ROOT env var)
-//   - Cursor       (CURSOR_PLUGIN_ROOT env var)
-//   - Codex        (CODEX env var or codex in PATH)
-//   - OpenCode     (OPENCODE env var)
-//   - Gemini CLI   (GEMINI_CLI env var or gemini in PATH)
-//
-// Output: JSON object suitable for platform context injection
-// Exit 0: success with JSON on stdout
-// Exit 1: skill file not found
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const { execSync } = require('child_process');
-
-// hooks/ is inside the repo; climb one level to get the repo root
-const SCRIPT_DIR = __dirname;
-const REPO_ROOT = path.resolve(SCRIPT_DIR, '..');
-
-// Primary skill file that gets injected into every session
-const SKILL_FILE = path.join(REPO_ROOT, 'skills', 'using-clawpowers', 'SKILL.md');
-
-// Path to the JS init module used for silent first-run initialization
-const INIT_JS = path.join(REPO_ROOT, 'runtime', 'init.js');
-
-const VERSION = '1.0.0';
-
-/**
- * Returns an ISO 8601 timestamp without milliseconds (e.g. "2025-01-15T12:00:00Z").
- * Milliseconds are stripped for readability in the JSON output.
- *
- * @returns {string} ISO 8601 UTC timestamp.
- */
-function isoTimestamp() {
-  return new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
-}
-
-/**
- * Checks whether a command-line binary exists in the system PATH.
- * Uses platform-appropriate existence check: `where` on Windows, `command -v` on Unix.
- *
- * @param {string} cmd - Binary name to search for (e.g. 'codex', 'gemini').
- * @returns {boolean} True if the binary is found and executable.
- */
-function commandExists(cmd) {
-  try {
-    const check = os.platform() === 'win32'
-      ? `where ${cmd}`        // Windows: where.exe searches PATH
-      : `command -v ${cmd}`;  // Unix: shell built-in, no subprocess needed
-    execSync(check, { stdio: 'ignore' });
-    return true;
-  } catch (_) {
-    return false;
-  }
-}
-
-/**
- * Detects which AI coding platform is currently active by inspecting
- * environment variables first, then falling back to PATH binary checks.
- * Priority order matches likelihood of each platform being in use.
- *
- * @returns {string} Platform identifier: 'claude-code' | 'cursor' | 'codex' |
- *                   'opencode' | 'gemini' | 'generic'.
- */
-function detectPlatform() {
-  if (process.env.CLAUDE_PLUGIN_ROOT) return 'claude-code';
-  if (process.env.CURSOR_PLUGIN_ROOT) return 'cursor';
-  // Codex sets CODEX env var when active; also detectable via binary
-  if (process.env.CODEX || commandExists('codex')) return 'codex';
-  if (process.env.OPENCODE) return 'opencode';
-  // Gemini CLI sets GEMINI_CLI env var; also detectable via binary
-  if (process.env.GEMINI_CLI || commandExists('gemini')) return 'gemini';
-  // No recognized platform detected — emit generic JSON that any agent can parse
-  return 'generic';
-}
-
-/**
- * Platform-specific instructions embedded in the injection JSON.
- * Each instruction tells the agent how to activate skills in that environment.
- * The 'generic' fallback works for any agent that receives the JSON.
- */
-const INSTRUCTIONS = {
-  'claude-code': 'You have ClawPowers skills loaded. Read the content above to understand available skills and how to trigger them. Skills activate automatically when you recognize a matching task pattern.',
-  'cursor':      'ClawPowers skills are available in this Cursor session. Trigger skills by recognizing task patterns described in the using-clawpowers skill above.',
-  'codex':       'ClawPowers loaded for Codex session. Apply skills based on task pattern recognition.',
-  'opencode':    'ClawPowers loaded for OpenCode session. Skills activate on pattern recognition.',
-  'gemini':      'ClawPowers loaded for Gemini CLI session. Recognize task patterns to activate skills.',
-  'generic':     'ClawPowers skills loaded. Use the using-clawpowers skill content to understand available capabilities.',
-};
-
-/**
- * Main entry point.
- *
- * 1. Silently initializes the runtime directory if it doesn't exist yet
- *    (first-run scenario when called directly from a platform hook).
- * 2. Reads the using-clawpowers SKILL.md file.
- * 3. Detects the active platform.
- * 4. Emits a structured JSON object to stdout for the platform to consume.
- */
-function main() {
-  // Auto-initialize runtime on first run so the hook works without a manual `init` step.
-  // CLAWPOWERS_QUIET=1 suppresses all init output to avoid polluting the JSON stream.
-  const clawpowersDir = process.env.CLAWPOWERS_DIR || path.join(os.homedir(), '.clawpowers');
-  if (!fs.existsSync(clawpowersDir) && fs.existsSync(INIT_JS)) {
-    try {
-      const init = require(INIT_JS);
-      // Save and restore CLAWPOWERS_QUIET so we don't clobber an existing value
-      const orig = process.env.CLAWPOWERS_QUIET;
-      process.env.CLAWPOWERS_QUIET = '1';
-      init.main();
-      if (orig === undefined) delete process.env.CLAWPOWERS_QUIET;
-      else process.env.CLAWPOWERS_QUIET = orig;
-    } catch (_) { /* non-fatal: proceed even if init fails */ }
-  }
-
-  // Skill file is required — output a machine-readable error JSON if missing
-  if (!fs.existsSync(SKILL_FILE)) {
-    process.stderr.write(
-      JSON.stringify({
-        error: 'ClawPowers: using-clawpowers/SKILL.md not found',
-        action: 'run npx clawpowers init',
-      }) + '\n'
-    );
-    process.exit(1);
-  }
-
-  const skillContent = fs.readFileSync(SKILL_FILE, 'utf8');
-  const platform = detectPlatform();
-  const instruction = INSTRUCTIONS[platform] || INSTRUCTIONS.generic;
-
-  // Structured injection payload — platforms parse this to load skills into context
-  const output = {
-    type: 'skill_injection',
-    platform,
-    version: VERSION,
-    timestamp: isoTimestamp(),
-    skill: {
-      name: 'using-clawpowers',
-      source: SKILL_FILE,
-      content: skillContent,
-    },
-    instruction,
-  };
-
-  // JSON.stringify handles all escaping correctly — no manual escaping needed
-  console.log(JSON.stringify(output, null, 2));
-}
-
-try {
-  main();
-  process.exit(0);
-} catch (err) {
-  process.stderr.write(`Error: ${err.message}\n`);
-  process.exit(1);
-}

package/runtime/demo/README.md

@@ -1,78 +0,0 @@
-# x402 Demo — Agent Payments in 60 Seconds
-
-HTTP has a 402 status code that basically nobody used — until agents needed to pay.
-
-This demo runs a local mock x402 merchant so you can see the full payment flow without any real money.
-
-## Quick Start
-
-```bash
-# Terminal 1: Start the mock merchant
-npx clawpowers demo x402
-
-# Terminal 2: Hit the paid endpoint
-curl http://localhost:PORT/api/premium-data
-# → Returns 402 with payment requirements
-
-# Simulate payment
-curl -H "x-payment: mock-proof" http://localhost:PORT/api/premium-data
-# → Returns 200 with data
-```
-
-## What's Happening
-
-1. Your agent calls a premium API
-2. The server returns **HTTP 402 Payment Required** with x402 payment requirements (amount, asset, recipient, network)
-3. ClawPowers evaluates the payment against your spending policy (limits, allowlist, mode)
-4. In **dry-run mode**: logs what would happen, no funds move
-5. In **live mode**: signs a payment proof via `agentwallet-sdk`, sends payment, retries the request
-6. Server validates payment proof and returns the data
-
-## The x402 Flow
-
-```
-Agent                    Mock Merchant
-  |                           |
-  |-- GET /api/premium-data ->|
-  |<- 402 + requirements -----|
-  |                           |
-  | [evaluate policy]         |
-  | [sign payment proof]      |
-  |                           |
-  |-- GET + x-payment ------->|
-  |<- 200 + data -------------|
-```
-
-## Payment Requirements Format
-
-The 402 response includes a JSON body:
-
-```json
-{
-  "x402Version": 1,
-  "accepts": [{
-    "scheme": "exact",
-    "network": "base-sepolia",
-    "maxAmountRequired": "100000",
-    "resource": "https://localhost:PORT/api/premium-data",
-    "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
-    "payTo": "0xff86829393C6C26A4EC122bE0Cc3E466Ef876AdD"
-  }],
-  "error": "Payment Required"
-}
-```
-
-## Check Payment Logs
-
-After running the demo, inspect the payment decisions:
-
-```bash
-npx clawpowers payments log
-npx clawpowers payments summary
-```
-
-## Next Steps
-
-- Read the [agent-payments skill](../../skills/agent-payments/SKILL.md) for full methodology
-- Run `npx clawpowers payments setup` to configure spending limits
-- See the [Security Model](../../README.md#security-model) for guardrails