cli-jaw 0.1.7 → 0.1.9

package/public/index.html

@@ -171,13 +171,13 @@
             <div>
                 <label data-i18n="label.permissions">권한</label>
                 <div class="perm-toggle">
-                    <span class="perm-btn active" style="cursor:default;flex:none;padding:6px 14px">⚡ Auto</span>
+                    <span class="perm-btn active" style="cursor:default;width:100%;padding:6px 14px">⚡ Auto</span>
                 </div>
             </div>
 
             <div>
                 <label data-i18n="label.workingDir">작업 디렉토리</label>
-                <input type="text" id="inpCwd" value="" placeholder="~/.cli-jaw">
+                <span id="inpCwd" class="cwd-display">~/.cli-jaw</span>
             </div>
 
             <hr style="border:none;border-top:1px solid var(--border);margin:4px 0">

package/public/js/features/settings.js

@@ -130,7 +130,7 @@ export async function loadSettings() {
     if (Array.from(selCli.options).some(o => o.value === s.cli)) {
         selCli.value = s.cli;
     }
-    document.getElementById('inpCwd').value = s.workingDir;
+    document.getElementById('inpCwd').textContent = s.workingDir;
     document.getElementById('headerCli').textContent = s.cli;
     setPerm(s.permissions, false);
 
@@ -204,7 +204,6 @@ export async function installMcpGlobal() {
 export async function updateSettings() {
     const s = {
         cli: document.getElementById('selCli').value,
-        workingDir: document.getElementById('inpCwd').value,
     };
     document.getElementById('headerCli').textContent = s.cli;
     await apiJson('/api/settings', 'PUT', s);

package/public/js/main.js

@@ -106,7 +106,6 @@ document.querySelector('.sidebar-save-bar .btn-save').addEventListener('click',
 document.getElementById('selCli').addEventListener('change', () => onCliChange());
 document.getElementById('selModel').addEventListener('change', () => saveActiveCliSettings());
 document.getElementById('selEffort').addEventListener('change', () => saveActiveCliSettings());
-document.getElementById('inpCwd').addEventListener('change', updateSettings);
 document.querySelector('[data-action="addEmployee"]').addEventListener('click', addEmployee);
 
 // ── Employees (Event Delegation) ──

package/scripts/check-copilot-gap.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const ROOT = path.resolve(__dirname, '..');
+
+const checks = [
+    {
+        name: 'CLI registry has copilot',
+        file: 'src/cli-registry.js',
+        needle: 'copilot:',
+    },
+    {
+        name: 'Server exposes /api/cli-registry',
+        file: 'server.js',
+        needle: "app.get('/api/cli-registry'",
+    },
+    {
+        name: 'Settings page includes copilot model select',
+        file: 'public/index.html',
+        needle: 'id="modelCopilot"',
+    },
+    {
+        name: 'Frontend loads registry from API',
+        file: 'public/js/constants.js',
+        needle: "fetch('/api/cli-registry')",
+    },
+    {
+        name: 'Employees UI uses dynamic CLI keys',
+        file: 'public/js/features/employees.js',
+        needle: 'getCliKeys()',
+    },
+];
+
+const rows = checks.map((item) => {
+    const fullPath = path.join(ROOT, item.file);
+    const content = fs.existsSync(fullPath) ? fs.readFileSync(fullPath, 'utf8') : '';
+    const ok = content.includes(item.needle);
+    return { ...item, ok };
+});
+
+console.log('\nCopilot gap check\n');
+for (const row of rows) {
+    const icon = row.ok ? 'OK' : 'MISSING';
+    console.log(`- ${icon}: ${row.name} (${row.file})`);
+}
+
+const failed = rows.filter(r => !r.ok);
+if (failed.length) {
+    console.error(`\nMissing ${failed.length} required item(s).`);
+    process.exit(1);
+}
+
+console.log('\nAll checks passed.');

package/scripts/check-deps-offline.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+// ─── Offline Dependency Check ────────────────────────
+// Phase 9.7 — package-lock.json 기반 오프라인 취약 버전 검증
+// 네트워크 없이도 알려진 advisory 범위와 비교 가능
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const lockPath = path.resolve('package-lock.json');
+if (!fs.existsSync(lockPath)) {
+    console.error('[deps] package-lock.json not found');
+    process.exit(2);
+}
+
+const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+const pkgs = lock.packages || {};
+
+function ver(p) { return pkgs[p]?.version || null; }
+
+function semver(v) {
+    const m = String(v || '').match(/^(\d+)\.(\d+)\.(\d+)/);
+    return m ? [+m[1], +m[2], +m[3]] : null;
+}
+
+function lt(a, b) {
+    for (let i = 0; i < 3; i++) { if (a[i] !== b[i]) return a[i] < b[i]; }
+    return false;
+}
+
+function gte(a, b) { return !lt(a, b); }
+
+function inRange(v, lo, hi) {
+    const sv = semver(v);
+    return sv && gte(sv, semver(lo)) && lt(sv, semver(hi));
+}
+
+// ─── Advisory Rules ──────────────────────────────────
+const rules = [
+    {
+        pkg: 'node_modules/ws',
+        test: v => inRange(v, '8.0.0', '8.17.1'),
+        adv: 'GHSA-3h5v-q93c-6h6q',
+        why: 'DoS via infinite loop',
+    },
+    {
+        pkg: 'node_modules/node-fetch',
+        test: v => inRange(v, '3.0.0', '3.1.1') || lt(semver(v), semver('2.6.7')),
+        adv: 'GHSA-r683-j2x4-v87g',
+        why: 'header forwarding to third-party',
+    },
+    {
+        pkg: 'node_modules/grammy/node_modules/node-fetch',
+        test: v => lt(semver(v), semver('2.6.7')),
+        adv: 'GHSA-r683-j2x4-v87g',
+        why: 'transitive dependency',
+    },
+];
+
+// ─── Check ───────────────────────────────────────────
+let fail = 0;
+for (const r of rules) {
+    const v = ver(r.pkg);
+    if (!v) {
+        console.log(`SKIP ${r.pkg} (not installed)`);
+        continue;
+    }
+    if (r.test(v)) {
+        fail++;
+        console.error(`FAIL ${r.pkg}@${v} → ${r.adv} (${r.why})`);
+    } else {
+        console.log(`PASS ${r.pkg}@${v}`);
+    }
+}
+
+process.exit(fail > 0 ? 1 : 0);

package/scripts/check-deps-online.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# ─── Online Dependency Check ─────────────────────────
+# Phase 9.7 — npm audit + outdated + semgrep (네트워크 필요)
+set -euo pipefail
+
+mkdir -p .artifacts
+
+echo '[online] npm audit'
+npm audit --json > .artifacts/npm-audit.json 2>&1 || {
+    echo '[online] audit failed (network or registry issue)'
+    cat .artifacts/npm-audit.json
+    # non-fatal — offline gate에서 이미 검증됨
+}
+
+echo '[online] npm outdated'
+npm outdated --json > .artifacts/npm-outdated.json 2>&1 || true
+
+if command -v semgrep >/dev/null; then
+    echo '[online] semgrep scan'
+    semgrep ci --json --json-output .artifacts/semgrep.json 2>/dev/null || true
+    semgrep ci --sarif --sarif-output .artifacts/semgrep.sarif 2>/dev/null || true
+else
+    echo '[online] semgrep not installed — skipping'
+fi
+
+echo '[online] done — check .artifacts/'

package/scripts/i18n-registry.py

@@ -0,0 +1,208 @@
+#!/usr/bin/env python3
+"""Add dual-key i18n fields to skills registry.
+
+For each skill:
+  - name_ko = current name
+  - name_en = English name
+  - desc_ko = current description
+  - desc_en = English description
+  - Preserves original name/description for backward compat
+"""
+import json
+from pathlib import Path
+
+REGISTRY = Path(__file__).resolve().parent.parent / 'skills_ref' / 'registry.json'
+
+# Manual name translations (19 skills with Korean names)
+NAME_EN = {
+    'himalaya': 'Email (Himalaya)',
+    'github': 'GitHub',
+    'skill-creator': 'Skill Creator',
+    'weather': 'Weather',
+    'video-frames': 'Video Frames',
+    'summarize': 'URL Summarizer',
+    'goplaces': 'Places Search',
+    'nano-banana-pro': 'Image Gen (Gemini)',
+    'browser': 'Browser Control',
+    'develop-web-game': 'Web Game Dev',
+    'figma-implement-design': 'Figma → Code',
+    'notion-knowledge-capture': 'Notion Knowledge Capture',
+    'notion-meeting-intelligence': 'Notion Meeting Intelligence',
+    'notion-research-documentation': 'Notion Research Documentation',
+    'notion-spec-to-implementation': 'Notion Spec → Tasks',
+    'sora': 'Sora Video',
+    'transcribe': 'Speech → Text',
+    'imagegen': 'Image Gen (OpenAI)',
+    'pdf': 'PDF Reader/Writer',
+}
+
+# Full description translations for all 107 skills
+DESC_EN = {
+    'notion': 'Notion page/DB CRUD via curl API calls. Complements Codex notion-* skills.',
+    'trello': 'Trello board/list/card management via curl REST API.',
+    'obsidian': 'Obsidian vault note creation, search, and tag management.',
+    'things-mac': 'Things 3 todo add/complete/search. AppleScript + URL scheme.',
+    'apple-notes': 'Apple Notes create/search. AppleScript-based.',
+    'apple-reminders': 'Apple Reminders add/complete/list management. AppleScript-based.',
+    'apple-messages': 'Send iMessage/SMS via AppleScript.',
+    'linear': 'Linear issue/project/cycle management via GraphQL API.',
+    'bear': 'Bear note markdown editing/archiving. x-callback-url scheme.',
+    'google-calendar': 'gcalcli-based Google Calendar event CRUD.',
+    'himalaya': 'Terminal email read/write/reply/search. Gmail/Outlook supported.',
+    'gog': 'Gmail, Calendar, Drive, Sheets, Docs integrated management.',
+    'xurl': 'Tweet post/search/reply/DM/media upload.',
+    'telegram-send': 'Send voice/photo/document directly via Telegram local API.',
+    'github': 'GitHub gh CLI integration: issues, PRs, CI, code review, API + PR comments, CI debugging, auto-fix.',
+    'tmux': 'tmux session remote control. Send keystrokes + read output.',
+    'skill-creator': 'Auto-generate new SKILL.md. Template + guidelines provided.',
+    'weather': 'wttr.in weather/forecast lookup. No API key needed.',
+    'video-frames': 'Extract video frames/segments with ffmpeg.',
+    'summarize': 'Summarize URLs, YouTube videos, and files to text.',
+    'goplaces': 'Google Places API for location, reviews, and business hours search.',
+    '1password': '1Password CLI for password/document/OTP lookup.',
+    'nano-banana-pro': 'Generate/edit images with Gemini 3 Pro. Different model from Codex imagegen.',
+    'spotify-player': 'Spotify play/pause/search/playlist management.',
+    'openhue': 'Hue light/scene control. "Dim living room to 50%"',
+    'browser': 'Chrome browser automation. Identify elements via ref snapshots → click/type.',
+    'vision-click': 'Vision-based coordinate clicking. Codex CLI only. Screenshot → AI coordinate → pixel click.',
+    'tts': 'macOS say command text-to-speech. Multi-language, file output.',
+    'screen-capture': 'macOS screenshot/webcam/recording. Full/region/window/multi-monitor. Default fallback when tool-specific capture unavailable.',
+    'atlas': 'Control ChatGPT Atlas app. macOS only.',
+    'cloudflare-deploy': 'Deploy to Cloudflare Workers/Pages. wrangler CLI.',
+    'develop-web-game': 'Web game development + Playwright test loop.',
+    'figma-implement-design': 'Convert Figma designs to 1:1 code. Requires Figma MCP.',
+    'jupyter-notebook': '.ipynb create/edit. Bundled Python script.',
+    'netlify-deploy': 'Deploy Netlify sites. netlify CLI.',
+    'notion-knowledge-capture': 'Conversation → Notion wiki/FAQ/HOW-TO capture. Notion MCP.',
+    'notion-meeting-intelligence': 'Meeting prep (per-attendee context, agenda). Notion MCP.',
+    'notion-research-documentation': 'Notion multi-source → report/comparison synthesis. Notion MCP.',
+    'notion-spec-to-implementation': 'PRD/spec → implementation plan + auto task creation. Notion MCP.',
+    'render-deploy': 'Deploy Render services. Blueprint YAML.',
+    'sentry': 'Sentry issue/event lookup. Bundled Python script.',
+    'sora': 'Sora video generation/management. OpenAI API.',
+    'speech': 'OpenAI TTS voice synthesis. Bundled Python script.',
+    'transcribe': 'OpenAI Whisper speech-to-text + speaker diarization.',
+    'vercel-deploy': 'Vercel project deployment.',
+    'memory': 'Long-term memory across sessions. Stored in markdown files, grep search.',
+    'imagegen': 'Generate/edit images via OpenAI Images API.',
+    'openai-docs': 'OpenAI product/API official documentation reference. Build guides.',
+    'pdf': 'PDF read/create/edit/review. reportlab/pdfplumber/pypdf + nano-pdf natural language editing.',
+    'frontend-design': 'Unique, production-grade frontend UI/page design and implementation.',
+    'docx': '.docx document create/edit/read. Visual verification (soffice→PDF→PNG), tracked changes, python-docx.',
+    'xlsx': '.xlsx/.xlsm/.csv/.tsv file create/edit/analyze/format. Includes pandas data analysis.',
+    'webapp-testing': 'Playwright-based web app interaction/verification/debugging test skill.',
+    'mcp-builder': 'Design/implement MCP servers for external API integration.',
+    'pptx': 'Presentation (.pptx) create/edit/analyze skill.',
+    'doc-coauthoring': 'Structured planning/spec/document co-authoring workflow skill.',
+    'web-artifacts-builder': 'React/Tailwind complex web artifact creation skill.',
+    'theme-factory': 'Apply reusable themes to document/slide/HTML outputs.',
+    'web-routing': 'Guide skill for routing browser requests to browser/webapp-testing.',
+    'algorithmic-art': 'p5.js generative art. Algorithm-based visual artwork creation.',
+    'canvas-design': 'Create PNG/PDF visual designs via Canvas API.',
+    'react-best-practices': 'React code patterns, performance optimization, component design best practices.',
+    'web-perf': 'Core Web Vitals audit. Lighthouse/CrUX-based performance analysis.',
+    'agents-sdk': 'Cloudflare Workers AI Agents SDK usage guide.',
+    'durable-objects': 'Cloudflare Durable Objects (RPC+SQLite+WebSocket) stateful workers.',
+    'static-analysis': 'CodeQL+Semgrep+SARIF static security analysis.',
+    'insecure-defaults': 'Detect hardcoded secrets, weak crypto, and insecure defaults.',
+    'modern-python': 'uv+ruff+ty+pytest Python best practices.',
+    'differential-review': 'Security-focused diff review. Analyze security impact of code changes.',
+    'property-based-testing': 'Multi-language property-based testing (Hypothesis/fast-check etc.).',
+    'security-best-practices': 'Language-specific security vulnerability pattern review.',
+    'security-ownership-map': 'Codebase owner/bus-factor mapping.',
+    'security-threat-model': 'Per-repo threat model generation (STRIDE/DREAD).',
+    'hugging-face-cli': 'HF Hub CLI for model/dataset/space management.',
+    'hugging-face-model-trainer': 'TRL: SFT/DPO/GRPO model training.',
+    'hugging-face-evaluation': 'vLLM/lighteval model evaluation and benchmarks.',
+    'fal-image-edit': 'fal.ai AI image editing (style transfer, object removal).',
+    'brainstorming': 'Pre-coding idea refinement → design document creation (obra/superpowers).',
+    'writing-plans': '2-5 minute task decomposition. File paths/code/verification included.',
+    'tdd': 'RED-GREEN-REFACTOR TDD cycle enforcement.',
+    'requesting-code-review': 'Internal agent code review. Severity-based blocking.',
+    'receiving-code-review': 'Code review feedback reception and response patterns.',
+    'dispatching-parallel-agents': 'Parallel sub-agent dispatch patterns.',
+    'debugging-helpers': 'Systematic debugging helpers.',
+    'git-worktrees': 'git worktree-based isolated branch workflow.',
+    'codebase-orientation': 'Project entrypoint/module/build mapping. Onboarding guide.',
+    'debugging-checklist': 'Reproduce → isolate → log → hypothesis verification debugging checklist.',
+    'error-message-explainer': 'Compiler/runtime error → cause + fix suggestions.',
+    'config-file-explainer': 'Config file structure/keys/defaults explanation.',
+    'data-structure-chooser': 'Data structure time/space tradeoff recommendations.',
+    'log-summarizer': 'Log grouping + first failure identification + action suggestions.',
+    'linter-fix-guide': 'Lint rule explanation + pattern examples + minimal fix suggestions.',
+    'dependency-install-helper': 'Platform-specific dependency installation steps + verification commands.',
+    'changelog-generator': 'git commit → changelog/release notes generation.',
+    'video-downloader': 'yt-dlp wrapper. YouTube/media download.',
+    'email-draft-polish': 'Email draft tone adjustment/formatting.',
+    'postgres': 'PostgreSQL read-only queries. Schema exploration.',
+    'deep-research': 'Multi-step research agent. Search → analyze → summarize.',
+    'context-compression': 'Context compression strategies. Long session optimization.',
+    'ios-simulator': 'iOS Simulator control. App build/run/test.',
+    'apple-hig-skills': 'Apple HIG 14 guides (foundations/platforms/components/patterns).',
+    'whatsapp': 'WhatsApp message automation (automate-whatsapp).',
+    'aws-skills': 'AWS infrastructure automation (CDK/CloudFormation/Lambda).',
+    'terraform': 'HashiCorp Terraform HCL/modules/providers IaC.',
+    'kreuzberg': '62+ format text extraction (PDF/DOCX/PPTX/images etc.).',
+    'dev': 'Common development guide. Modular dev, self-reference patterns, skills_ref exploration, changelog.',
+    'dev-frontend': 'Frontend role guide. Unique UI/UX implementation, component design, aesthetic standards.',
+    'dev-backend': 'Backend role guide. Express.js patterns, SQLite, error handling, security basics.',
+    'dev-data': 'Data role guide. ETL pipelines, CSV/JSON processing, SQL queries, analysis.',
+    'dev-testing': 'Debugging phase only. Playwright web app testing, recon-action pattern.',
+}
+
+def main():
+    with open(REGISTRY) as f:
+        data = json.load(f)
+
+    skills = data['skills']
+    updated = 0
+
+    for skill_id, skill in skills.items():
+        name = skill.get('name', skill_id)
+        desc = skill.get('description', '')
+
+        # Set ko fields
+        skill['name_ko'] = name
+        skill['desc_ko'] = desc
+
+        # Set en fields
+        has_ko_name = any('\uac00' <= c <= '\ud7af' for c in name)
+        if has_ko_name:
+            skill['name_en'] = NAME_EN.get(skill_id, name)
+        else:
+            skill['name_en'] = name
+
+        skill['desc_en'] = DESC_EN.get(skill_id, desc)
+        updated += 1
+
+    # Reorder keys: keep original order, insert i18n fields after description
+    new_skills = {}
+    for skill_id, skill in skills.items():
+        ordered = {}
+        for k, v in skill.items():
+            ordered[k] = v
+            if k == 'name':
+                ordered['name_ko'] = skill['name_ko']
+                ordered['name_en'] = skill['name_en']
+            elif k == 'description':
+                ordered['desc_ko'] = skill['desc_ko']
+                ordered['desc_en'] = skill['desc_en']
+        # Remove duplicates from natural ordering
+        new_skills[skill_id] = ordered
+
+    data['skills'] = new_skills
+
+    with open(REGISTRY, 'w') as f:
+        json.dump(data, f, indent=4, ensure_ascii=False)
+
+    print(f'Updated {updated} skills with i18n fields')
+
+    # Verify
+    missing_en = [k for k, v in new_skills.items() if not v.get('desc_en')]
+    if missing_en:
+        print(f'WARNING: {len(missing_en)} skills missing desc_en: {missing_en}')
+    else:
+        print('All skills have desc_en ✓')
+
+if __name__ == '__main__':
+    main()

package/scripts/postinstall-guard.cjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+/**
+ * postinstall-guard.cjs — Cross-platform guard for postinstall.
+ *
+ * 1. Node version check (fail-fast before any build attempt)
+ * 2. dist/bin/postinstall.js exists? → exit 0
+ * 3. Dev clone fallback: local tsc → build → exit 0
+ *    - No local tsc → exit 1 with clear instruction
+ *    - tsc fails → exit 1
+ *
+ * Intentionally CommonJS (.cjs) — runs without compilation,
+ * cross-platform (Windows cmd.exe compatible).
+ */
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+const path = require('path');
+
+// ─── 1. Node version fail-fast ──────────────────────
+const major = parseInt(process.versions.node.split('.')[0], 10);
+if (major < 22) {
+    console.error(`[jaw:init] ❌ Node.js >= 22 required (current: ${process.version})`);
+    console.error(`[jaw:init]    Install: https://nodejs.org or nvm install 22`);
+    process.exit(1);
+}
+
+// ─── 2. dist/ exists? ───────────────────────────────
+const root = path.join(__dirname, '..');
+const target = path.join(root, 'dist', 'bin', 'postinstall.js');
+
+if (fs.existsSync(target)) {
+    // Registry install or already built — proceed directly
+    process.exit(0);
+}
+
+// ─── 3. Dev clone: build with local tsc ─────────────
+// Check both unix and Windows (.cmd) shim paths
+const binDir = path.join(root, 'node_modules', '.bin');
+const localTsc = [
+    path.join(binDir, 'tsc'),
+    path.join(binDir, 'tsc.cmd'),
+    path.join(binDir, 'tsc.ps1'),
+].find(p => fs.existsSync(p));
+
+if (!localTsc) {
+    console.error('[jaw:init] ❌ dist/ not found and typescript not installed locally');
+    console.error('           Run: npm install --ignore-scripts && npm run build && node dist/bin/postinstall.js');
+    process.exit(1);
+}
+
+console.log('[jaw:init] dist/ not found, building...');
+try {
+    // execFileSync avoids shell parsing issues with spaces in paths
+    execFileSync(localTsc, [], { stdio: 'inherit', cwd: root, timeout: 60000 });
+} catch {
+    console.error('[jaw:init] ❌ build failed — run manually:');
+    console.error('           npm run build && node dist/bin/postinstall.js');
+    process.exit(1);
+}
+
+if (!fs.existsSync(target)) {
+    console.error('[jaw:init] ❌ tsc completed but dist/bin/postinstall.js not found');
+    process.exit(1);
+}

package/scripts/release.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# release.sh — 빌드 + 버전업 + npm publish를 한 번에 처리
+set -e
+
+echo "🦈 cli-jaw release script"
+echo "========================="
+
+# 1. TypeScript 빌드
+echo "📦 Building backend (tsc)..."
+./node_modules/.bin/tsc
+
+# 2. Frontend 번들링
+echo "📦 Building frontend (esbuild)..."
+node esbuild.config.mjs
+
+# 3. 버전 bump (patch)
+BUMP=${1:-patch}  # 기본 patch, 인자로 minor/major 가능
+echo "⬆️  Version bump: $BUMP"
+npm version "$BUMP" --no-git-tag-version
+
+VERSION=$(node -p "require('./package.json').version")
+echo "📌 New version: $VERSION"
+
+# 4. npm publish
+echo "🚀 Publishing to npm..."
+npm publish --access public
+
+echo ""
+echo "✅ cli-jaw@$VERSION published!"
+echo "   Install: npm install -g cli-jaw"

package/skills_ref/1password/SKILL.md

@@ -1,70 +0,0 @@
----
-name: 1password
-description: Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
-homepage: https://developer.1password.com/docs/cli/get-started/
-metadata:
-  {
-    "openclaw":
-      {
-        "emoji": "🔐",
-        "requires": { "bins": ["op"] },
-        "install":
-          [
-            {
-              "id": "brew",
-              "kind": "brew",
-              "formula": "1password-cli",
-              "bins": ["op"],
-              "label": "Install 1Password CLI (brew)",
-            },
-          ],
-      },
-  }
----
-
-# 1Password CLI
-
-Follow the official CLI get-started steps. Don't guess install commands.
-
-## References
-
-- `references/get-started.md` (install + app integration + sign-in flow)
-- `references/cli-examples.md` (real `op` examples)
-
-## Workflow
-
-1. Check OS + shell.
-2. Verify CLI present: `op --version`.
-3. Confirm desktop app integration is enabled (per get-started) and the app is unlocked.
-4. REQUIRED: create a fresh tmux session for all `op` commands (no direct `op` calls outside tmux).
-5. Sign in / authorize inside tmux: `op signin` (expect app prompt).
-6. Verify access inside tmux: `op whoami` (must succeed before any secret read).
-7. If multiple accounts: use `--account` or `OP_ACCOUNT`.
-
-## REQUIRED tmux session (T-Max)
-
-The shell tool uses a fresh TTY per command. To avoid re-prompts and failures, always run `op` inside a dedicated tmux session with a fresh socket/session name.
-
-Example (see `tmux` skill for socket conventions, do not reuse old session names):
-
-```bash
-SOCKET_DIR="${OPENCLAW_TMUX_SOCKET_DIR:-${CLAWDBOT_TMUX_SOCKET_DIR:-${TMPDIR:-/tmp}/openclaw-tmux-sockets}}"
-mkdir -p "$SOCKET_DIR"
-SOCKET="$SOCKET_DIR/openclaw-op.sock"
-SESSION="op-auth-$(date +%Y%m%d-%H%M%S)"
-
-tmux -S "$SOCKET" new -d -s "$SESSION" -n shell
-tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op signin --account my.1password.com" Enter
-tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op whoami" Enter
-tmux -S "$SOCKET" send-keys -t "$SESSION":0.0 -- "op vault list" Enter
-tmux -S "$SOCKET" capture-pane -p -J -t "$SESSION":0.0 -S -200
-tmux -S "$SOCKET" kill-session -t "$SESSION"
-```
-
-## Guardrails
-
-- Never paste secrets into logs, chat, or code.
-- Prefer `op run` / `op inject` over writing secrets to disk.
-- If sign-in without app integration is needed, use `op account add`.
-- If a command returns "account is not signed in", re-run `op signin` inside tmux and authorize in the app.
-- Do not run `op` outside tmux; stop and ask if tmux is unavailable.