leedab 0.7.2 → 0.8.0

package/bin/leedab.js

@@ -15,6 +15,7 @@ import { loadConfig, initConfig } from "../dist/config/index.js";
 import { setupChannels } from "../dist/channels/index.js";
 import { runOnboard } from "../dist/onboard/index.js";
 import { ensureFirstRun } from "../dist/first-run/ensure.js";
+import { createBackup, listBackups, restoreBackup, deleteBackup, humanBytes } from "../dist/backup/index.js";
 import { startConsole, stopConsole } from "../dist/console-launcher.js";
 import { execBranded } from "../dist/brand.js";
 import { resolveOpenClawBin, openclawArgs, openclawEnv } from "../dist/openclaw.js";
@@ -140,8 +141,8 @@ function ensureAdminToken() {
 // inline before any operations that depend on a configured workspace or
 // license; the project + license guards would bail too eagerly on a fresh
 // install otherwise.
-const NO_PROJECT_REQUIRED = new Set(["onboard", "init", "help", "start"]);
-const NO_LICENSE_REQUIRED = new Set(["onboard", "init", "help", "stop", "start"]);
+const NO_PROJECT_REQUIRED = new Set(["onboard", "init", "help", "start", "reset", "backup"]);
+const NO_LICENSE_REQUIRED = new Set(["onboard", "init", "help", "stop", "start", "reset", "backup"]);
 
 /**
  * Auto-recover from the "two-state-dirs" footgun. If the current working
@@ -555,6 +556,248 @@ program
     console.log(chalk.green("LeedAB agent stopped."));
   });
 
+program
+  .command("reset")
+  .description("Wipe local state (~/.leedab including the agent workspace, ~/.openclaw, console data, plus any legacy ./workspace) and start fresh. Destructive.")
+  .option("-y, --yes", "Skip both prompts (backup + confirmation). NOT recommended outside CI.", false)
+  .option("--no-backup", "Skip the backup-before-reset prompt and reset directly.")
+  .action(async (opts) => {
+    // Targets. Each is independent — a missing path is a no-op, not a
+    // failure. The set covers everything the gateway, openclaw daemon, and
+    // Next.js console write to during a normal run, so a reset puts the
+    // box into the same state a brand new install would see.
+    //
+    // The console's data directory is critical — it holds runs.json,
+    // usage.json, conversations/, workflows/, retry-queue.json and lives
+    // under apps/console/.next/standalone/data/ (Next.js standalone build
+    // cwd). Earlier resets only wiped ~/.leedab and ~/.openclaw, which left
+    // the previous tenant's chat history and run records visible to the
+    // next licensee on the same machine.
+    const cwdState = resolve(process.cwd(), ".leedab");
+    const cwdWorkspace = resolve(process.cwd(), "workspace");
+    const homeOpenclaw = resolve(homedir(), ".openclaw");
+    const PACKAGE_ROOT = findPackageRoot();
+    // Both prod (next standalone, run via leedab start) and dev (next dev,
+    // run via `npm --prefix apps/console run dev`) end up with a `data/`
+    // directory next to the cwd the console was launched from. Wipe both.
+    const consoleStandaloneData = resolve(PACKAGE_ROOT, "apps", "console", ".next", "standalone", "data");
+    const consoleDevData = resolve(PACKAGE_ROOT, "apps", "console", "data");
+    const targets = [
+      { path: STATE_DIR,             label: "~/.leedab" },
+      { path: homeOpenclaw,          label: "~/.openclaw" },
+      { path: consoleStandaloneData, label: "apps/console/.next/standalone/data (runs, chats, usage)" },
+      { path: consoleDevData,        label: "apps/console/data (dev-mode runs, chats, usage)" },
+      // Legacy: the agent workspace used to be cwd-relative. Newer installs
+      // keep it under ~/.leedab/agent-workspace/ (wiped by the STATE_DIR
+      // target above). Still wipe any stale cwd workspace so an operator
+      // upgrading from the old layout doesn't end up with two copies.
+      { path: cwdWorkspace,          label: `${process.cwd()}/workspace (legacy)` },
+      { path: cwdState,              label: `${process.cwd()}/.leedab` },
+    ];
+
+    const existing = targets.filter((t) => existsSync(t.path));
+    if (existing.length === 0) {
+      console.log(chalk.dim("\n  Nothing to reset. State is already clean.\n"));
+      return;
+    }
+
+    console.log(chalk.bold("\n  This will permanently delete:\n"));
+    for (const t of existing) console.log(chalk.red(`    × ${t.label}`));
+    console.log();
+    console.log(chalk.yellow("  Includes: license, model config, vault, run history,"));
+    console.log(chalk.yellow("            chat transcripts, memory, seeded workspace."));
+    console.log(chalk.dim("  Run ") + chalk.cyan("leedab start") + chalk.dim(" after to re-enter your license and pick a model.\n"));
+
+    // Offer a backup-before-reset by default. The reset itself is the
+    // destructive moment; the backup is a soft-delete safety net that
+    // makes restore possible. Users running with --yes (CI, demo wipes)
+    // skip both prompts; --no-backup skips just the backup ask.
+    if (!opts.yes && opts.backup !== false) {
+      const { default: inquirer } = await import("inquirer");
+      let wantBackup = true;
+      try {
+        const ans = await inquirer.prompt([
+          {
+            type: "confirm",
+            name: "wantBackup",
+            message: "Back this up first so you can restore later?",
+            default: true,
+          },
+        ]);
+        wantBackup = ans.wantBackup;
+      } catch {
+        wantBackup = false;
+      }
+      if (wantBackup) {
+        const spinner = ora("Creating backup...").start();
+        try {
+          const result = await createBackup({ label: "pre-reset" });
+          spinner.succeed(
+            chalk.green(`Backup saved: ${result.archive} (${humanBytes(result.bytes)})`)
+          );
+          console.log(chalk.dim(`  Restore later with: `) + chalk.cyan(`leedab backup restore ${result.archive}`));
+          console.log();
+        } catch (err) {
+          spinner.fail(chalk.red(`Backup failed: ${err.message}`));
+          console.log(chalk.yellow("  Reset aborted because the safety net failed."));
+          console.log(chalk.dim("  Re-run with ") + chalk.cyan("--no-backup") + chalk.dim(" to reset without a backup.\n"));
+          process.exit(1);
+        }
+      }
+    }
+
+    if (!opts.yes) {
+      const { default: inquirer } = await import("inquirer");
+      let confirmed;
+      try {
+        const ans = await inquirer.prompt([
+          { type: "confirm", name: "confirmed", message: "Wipe and reset?", default: false },
+        ]);
+        confirmed = ans.confirmed;
+      } catch {
+        // ctrl-c bails — treat as no
+        confirmed = false;
+      }
+      if (!confirmed) {
+        console.log(chalk.dim("\n  Aborted. Nothing was deleted.\n"));
+        return;
+      }
+    }
+
+    // Best-effort shutdown. If nothing is running these silently no-op.
+    await stopConsole().catch(() => {});
+    await stopGateway().catch(() => {});
+
+    let removed = 0;
+    for (const t of existing) {
+      try {
+        rmSync(t.path, { recursive: true, force: true });
+        console.log(chalk.green(`    ✓ removed ${t.label}`));
+        removed++;
+      } catch (err) {
+        console.error(chalk.red(`    × failed to remove ${t.label}: ${err.message}`));
+      }
+    }
+
+    console.log();
+    console.log(chalk.bold(`  ${removed} path${removed === 1 ? "" : "s"} wiped. Fresh slate.`));
+    console.log(chalk.dim("  Next step: ") + chalk.cyan("leedab start"));
+    console.log();
+  });
+
+const backup = program
+  .command("backup")
+  .description("Snapshot runs, chats, memory, workspace, license + config to a tarball under ~/.leedab/backups/")
+  .option("--label <slug>", "Optional label appended to the archive name (e.g. before-pilot-demo)")
+  .action(async (opts) => {
+    const spinner = ora("Creating backup...").start();
+    try {
+      const result = await createBackup({ label: opts.label });
+      spinner.succeed(chalk.green(`Backup saved: ${result.archive} (${humanBytes(result.bytes)})`));
+      const present = result.manifest.items.filter((i) => i.present);
+      const skipped = result.manifest.items.filter((i) => !i.present);
+      console.log();
+      console.log(chalk.bold("  Included:"));
+      for (const i of present) {
+        console.log(chalk.dim(`    ${i.archiveName.padEnd(18)} ${humanBytes(i.bytes).padStart(8)}  ${i.absPath}`));
+      }
+      if (skipped.length > 0) {
+        console.log();
+        console.log(chalk.dim("  Skipped (absent on this machine):"));
+        for (const i of skipped) console.log(chalk.dim(`    ${i.archiveName}`));
+      }
+      console.log();
+      console.log(chalk.dim("  Restore with: ") + chalk.cyan(`leedab backup restore ${result.archive}`));
+      console.log();
+    } catch (err) {
+      spinner.fail(chalk.red(`Backup failed: ${err.message}`));
+      process.exit(1);
+    }
+  });
+
+backup
+  .command("list")
+  .description("List all local backups under ~/.leedab/backups/")
+  .action(async () => {
+    const backups = await listBackups();
+    if (backups.length === 0) {
+      console.log(chalk.dim("\n  No backups yet. Run ") + chalk.cyan("leedab backup") + chalk.dim(" to create one.\n"));
+      return;
+    }
+    console.log();
+    console.log(chalk.bold(`  ${backups.length} backup${backups.length === 1 ? "" : "s"}:`));
+    console.log();
+    for (const b of backups) {
+      const when = b.createdAt ? new Date(b.createdAt).toLocaleString() : "unknown";
+      console.log(`    ${chalk.cyan(b.archive)}`);
+      console.log(chalk.dim(`      ${when} · ${humanBytes(b.bytes)}` + (b.manifest?.leedabVersion ? ` · v${b.manifest.leedabVersion}` : "")));
+    }
+    console.log();
+  });
+
+backup
+  .command("restore <archive>")
+  .description("Extract a backup tarball back over the current state. Overwrites existing files.")
+  .option("-y, --yes", "Skip the confirmation prompt", false)
+  .action(async (archive, opts) => {
+    const abs = resolve(archive);
+    if (!existsSync(abs)) {
+      console.error(chalk.red(`\n  Backup not found: ${abs}\n`));
+      process.exit(1);
+    }
+    console.log(chalk.bold(`\n  About to restore: ${chalk.cyan(abs)}`));
+    console.log(chalk.yellow("  This OVERWRITES existing runs, chats, memory, workspace, and state."));
+    console.log(chalk.dim("  Stop the agent first if it's running.\n"));
+
+    if (!opts.yes) {
+      const { default: inquirer } = await import("inquirer");
+      let confirmed;
+      try {
+        const ans = await inquirer.prompt([
+          { type: "confirm", name: "confirmed", message: "Continue?", default: false },
+        ]);
+        confirmed = ans.confirmed;
+      } catch {
+        confirmed = false;
+      }
+      if (!confirmed) {
+        console.log(chalk.dim("\n  Aborted. Nothing was restored.\n"));
+        return;
+      }
+    }
+
+    await stopConsole().catch(() => {});
+    await stopGateway().catch(() => {});
+
+    const spinner = ora("Restoring...").start();
+    try {
+      const manifest = await restoreBackup(abs);
+      spinner.succeed(chalk.green("Restore complete."));
+      if (manifest?.createdAt) {
+        console.log(chalk.dim(`  Snapshot from: ${new Date(manifest.createdAt).toLocaleString()}`));
+        if (manifest.leedabVersion) console.log(chalk.dim(`  leedab v${manifest.leedabVersion}`));
+      }
+      console.log(chalk.dim("  Next step: ") + chalk.cyan("leedab start"));
+      console.log();
+    } catch (err) {
+      spinner.fail(chalk.red(`Restore failed: ${err.message}`));
+      process.exit(1);
+    }
+  });
+
+backup
+  .command("delete <archive>")
+  .description("Delete a backup tarball")
+  .action((archive) => {
+    const abs = resolve(archive);
+    if (!existsSync(abs)) {
+      console.error(chalk.red(`\n  Backup not found: ${abs}\n`));
+      process.exit(1);
+    }
+    deleteBackup(abs);
+    console.log(chalk.green(`\n  Removed ${abs}\n`));
+  });
+
 const pairing = program
   .command("pairing")
   .description("Manage channel pairing (approve users to message the agent)");

package/dist/backup/index.d.ts

@@ -0,0 +1,30 @@
+export type BackupManifest = {
+    createdAt: string;
+    leedabVersion: string;
+    hostname: string;
+    items: Array<{
+        archiveName: string;
+        absPath: string;
+        bytes: number;
+        present: boolean;
+    }>;
+};
+export type CreateResult = {
+    archive: string;
+    manifest: BackupManifest;
+    bytes: number;
+};
+export declare function createBackup(opts?: {
+    label?: string;
+}): Promise<CreateResult>;
+export type BackupListing = {
+    archive: string;
+    bytes: number;
+    createdAt: string | null;
+    manifest: BackupManifest | null;
+};
+export declare function listBackups(): Promise<BackupListing[]>;
+export declare function restoreBackup(archive: string): Promise<BackupManifest | null>;
+export declare function deleteBackup(archive: string): void;
+export declare function backupDir(): string;
+export declare function humanBytes(n: number): string;

package/dist/backup/index.js

@@ -0,0 +1,273 @@
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, } from "node:fs";
+import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { hostname, tmpdir } from "node:os";
+import { create as tarCreate, extract as tarExtract } from "tar";
+import { STATE_DIR, AGENT_WORKSPACE_DIR } from "../paths.js";
+// Backup helper used by `leedab backup` and by `leedab reset` (as the
+// soft-delete safety net). Captures the data and configuration a tenant
+// would lose on a reset: runs, usage, chats, workflows, memory, license,
+// and the seeded workspace. Skips logs, the admin token, pid files, and
+// anything regenerable. Produces a single .tar.gz at a predictable path
+// so list + restore can find it without parsing names.
+const BACKUP_DIR = resolve(STATE_DIR, "backups");
+function timestampSlug() {
+    const d = new Date();
+    const pad = (n) => String(n).padStart(2, "0");
+    return (`${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}` +
+        `-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`);
+}
+function dirBytes(path) {
+    if (!existsSync(path))
+        return 0;
+    let total = 0;
+    const walk = (p) => {
+        const st = statSync(p);
+        if (st.isFile()) {
+            total += st.size;
+            return;
+        }
+        if (st.isDirectory()) {
+            for (const child of readdirSync(p))
+                walk(resolve(p, child));
+        }
+    };
+    walk(path);
+    return total;
+}
+function packageRoot() {
+    // Walk up from this module looking for the leedab package.json. Works
+    // for both source (src/backup/index.ts) and dist (dist/backup/index.js).
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 10; i++) {
+        const candidate = resolve(dir, "package.json");
+        if (existsSync(candidate)) {
+            try {
+                const pkg = JSON.parse(readFileSync(candidate, "utf-8"));
+                if (pkg.name === "leedab")
+                    return dir;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        const parent = resolve(dir, "..");
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new Error("Could not locate leedab package root from src/backup");
+}
+function leedabVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(resolve(packageRoot(), "package.json"), "utf-8"));
+        return pkg.version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}
+function captureSet() {
+    const PACKAGE_ROOT = packageRoot();
+    return [
+        {
+            absPath: resolve(PACKAGE_ROOT, "apps", "console", ".next", "standalone", "data"),
+            archiveName: "console-data",
+        },
+        {
+            absPath: resolve(PACKAGE_ROOT, "apps", "console", "data"),
+            archiveName: "console-data-dev",
+        },
+        {
+            absPath: resolve(STATE_DIR, "memory"),
+            archiveName: "memory",
+        },
+        {
+            absPath: AGENT_WORKSPACE_DIR,
+            archiveName: "workspace",
+        },
+        {
+            absPath: STATE_DIR,
+            archiveName: "state",
+            filter: (p) => {
+                const name = basename(p);
+                if (name === "logs")
+                    return false;
+                if (name === "admin-token")
+                    return false;
+                if (name === "console.pid")
+                    return false;
+                if (name === "update-check.json")
+                    return false;
+                if (name === "backups")
+                    return false;
+                // The agent workspace is captured as its own top-level archive
+                // entry above; exclude it here so the state archive doesn't
+                // double-pack it.
+                if (name === "agent-workspace")
+                    return false;
+                return true;
+            },
+        },
+    ];
+}
+export async function createBackup(opts = {}) {
+    await mkdir(BACKUP_DIR, { recursive: true });
+    const slug = timestampSlug() + (opts.label ? `-${opts.label}` : "");
+    const archive = resolve(BACKUP_DIR, `${slug}.tar.gz`);
+    const sidecarManifest = resolve(BACKUP_DIR, `.${slug}.manifest.json`);
+    const items = captureSet();
+    const manifestEntries = [];
+    const toArchive = [];
+    for (const item of items) {
+        const present = existsSync(item.absPath);
+        manifestEntries.push({
+            archiveName: item.archiveName,
+            absPath: item.absPath,
+            bytes: present ? dirBytes(item.absPath) : 0,
+            present,
+        });
+        if (present) {
+            toArchive.push({
+                src: item.absPath,
+                rename: item.archiveName,
+                filter: item.filter,
+            });
+        }
+    }
+    const manifest = {
+        createdAt: new Date().toISOString(),
+        leedabVersion: leedabVersion(),
+        hostname: hostname(),
+        items: manifestEntries,
+    };
+    await writeFile(sidecarManifest, JSON.stringify(manifest, null, 2) + "\n");
+    // Pre-stage with fs.cp so the archive contains clean rewritten top-
+    // level directory names regardless of where the sources live on disk.
+    // Cross-platform (tar's --transform syntax differs between GNU + BSD)
+    // and keeps the implementation small.
+    //
+    // Staging lives in the OS tmpdir, not inside BACKUP_DIR. Earlier versions
+    // staged at `BACKUP_DIR/.<slug>.staging`, which sits *inside* STATE_DIR.
+    // The state capture's source is STATE_DIR itself, so fs.cp refused with
+    // EINVAL ("cannot copy a directory to a subdirectory of itself") — the
+    // backups-folder filter would have skipped the nested copy, but Node's
+    // pre-flight check fires before the filter is consulted.
+    const stagingDir = resolve(tmpdir(), `leedab-backup-${slug}.staging`);
+    await mkdir(stagingDir, { recursive: true });
+    try {
+        const stagedNames = [];
+        for (const a of toArchive) {
+            const dest = resolve(stagingDir, a.rename);
+            await cp(a.src, dest, {
+                recursive: true,
+                filter: a.filter ? (src) => a.filter(src) : undefined,
+            });
+            stagedNames.push(a.rename);
+        }
+        // Include the manifest inside the archive so restore can verify
+        // without needing the sidecar sibling file.
+        await writeFile(resolve(stagingDir, "manifest.json"), JSON.stringify(manifest, null, 2) + "\n");
+        stagedNames.push("manifest.json");
+        await tarCreate({
+            file: archive,
+            cwd: stagingDir,
+            gzip: true,
+            portable: true,
+        }, stagedNames);
+    }
+    finally {
+        await rm(stagingDir, { recursive: true, force: true });
+    }
+    const bytes = statSync(archive).size;
+    return { archive, manifest, bytes };
+}
+export async function listBackups() {
+    if (!existsSync(BACKUP_DIR))
+        return [];
+    const files = readdirSync(BACKUP_DIR).filter((f) => f.endsWith(".tar.gz"));
+    const out = [];
+    for (const f of files) {
+        const archive = resolve(BACKUP_DIR, f);
+        const st = statSync(archive);
+        const slug = f.replace(/\.tar\.gz$/, "");
+        const sidecar = resolve(BACKUP_DIR, `.${slug}.manifest.json`);
+        let manifest = null;
+        if (existsSync(sidecar)) {
+            try {
+                manifest = JSON.parse(await readFile(sidecar, "utf-8"));
+            }
+            catch {
+                manifest = null;
+            }
+        }
+        out.push({
+            archive,
+            bytes: st.size,
+            createdAt: manifest?.createdAt ?? st.mtime.toISOString(),
+            manifest,
+        });
+    }
+    return out.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? 1 : -1);
+}
+export async function restoreBackup(archive) {
+    if (!existsSync(archive)) {
+        throw new Error(`Backup not found at ${archive}`);
+    }
+    const stagingDir = resolve(BACKUP_DIR, `.restore-${timestampSlug()}`);
+    await mkdir(stagingDir, { recursive: true });
+    await tarExtract({ file: archive, cwd: stagingDir });
+    let manifest = null;
+    const manifestPath = resolve(stagingDir, "manifest.json");
+    if (existsSync(manifestPath)) {
+        try {
+            manifest = JSON.parse(await readFile(manifestPath, "utf-8"));
+        }
+        catch {
+            manifest = null;
+        }
+    }
+    const PACKAGE_ROOT = packageRoot();
+    const targetByName = {
+        "console-data": resolve(PACKAGE_ROOT, "apps", "console", ".next", "standalone", "data"),
+        "console-data-dev": resolve(PACKAGE_ROOT, "apps", "console", "data"),
+        memory: resolve(STATE_DIR, "memory"),
+        workspace: AGENT_WORKSPACE_DIR,
+        state: STATE_DIR,
+    };
+    for (const [name, dest] of Object.entries(targetByName)) {
+        if (!dest)
+            continue;
+        const src = resolve(stagingDir, name);
+        if (!existsSync(src))
+            continue;
+        await mkdir(dirname(dest), { recursive: true });
+        await cp(src, dest, { recursive: true, force: true });
+    }
+    await rm(stagingDir, { recursive: true, force: true });
+    return manifest;
+}
+export function deleteBackup(archive) {
+    if (!existsSync(archive))
+        return;
+    unlinkSync(archive);
+    const slug = basename(archive).replace(/\.tar\.gz$/, "");
+    const sidecar = resolve(dirname(archive), `.${slug}.manifest.json`);
+    if (existsSync(sidecar))
+        unlinkSync(sidecar);
+}
+export function backupDir() {
+    if (!existsSync(BACKUP_DIR))
+        mkdirSync(BACKUP_DIR, { recursive: true });
+    return BACKUP_DIR;
+}
+export function humanBytes(n) {
+    if (n < 1024)
+        return `${n}B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)}KB`;
+    if (n < 1024 * 1024 * 1024)
+        return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+    return `${(n / (1024 * 1024 * 1024)).toFixed(2)}GB`;
+}

package/dist/gateway.js

@@ -1,12 +1,12 @@
 import { spawn, execFile } from "node:child_process";
 import { createWriteStream } from "node:fs";
 import { resolve, dirname, join } from "node:path";
-import { readFile, writeFile, readdir, copyFile, mkdir, access } from "node:fs/promises";
+import { readFile, writeFile, readdir, copyFile, mkdir } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { resolveOpenClawBin, openclawArgs, openclawEnv } from "./openclaw.js";
 import { ensureLicense } from "./license.js";
-import { STATE_DIR } from "./paths.js";
+import { STATE_DIR, AGENT_WORKSPACE_DIR } from "./paths.js";
 const execFileAsync = promisify(execFile);
 let gatewayProcess = null;
 /**
@@ -23,6 +23,11 @@ export async function startGateway(config) {
     const env = openclawEnv(stateDir);
     // Seed workspace templates (skip files that already exist)
     await seedWorkspace();
+    // Point openclaw's default agent at our seeded workspace. Without this,
+    // openclaw reads SOUL.md and friends from ~/.openclaw/workspace/ (its
+    // own default install location, with the generic openclaw SOUL) instead
+    // of LeedAB's COO contract in ./workspace/.
+    await pinAgentWorkspace(stateDir);
     // Auto-approve all tool executions (enterprise local deployment)
     await ensureAutoApprove(bin, env);
     // Make sure the OpenAI-compat /v1/chat/completions HTTP endpoint is on.
@@ -153,6 +158,44 @@ async function registerChannels(bin, stateDir, config) {
         }
     }
 }
+/**
+ * Pin openclaw's default agent at the repo-local ./workspace/ instead of
+ * its own ~/.openclaw/workspace/. The "main" agent's workspace path is
+ * resolved from `agents.defaults.workspace` in openclaw.json. Openclaw's
+ * onboard sets that to ~/.openclaw/workspace/, which has the generic
+ * openclaw SOUL — so on Telegram the bot reads a generic-assistant
+ * identity and has no idea about LeedAB's COO routing or the licensed
+ * AB roster. Pointing it at ./workspace/ (where seedWorkspace just
+ * wrote SOUL.md + COO.md + AGENTS.md + BOOTSTRAP.md) makes the
+ * channel-facing agent IS the COO.
+ *
+ * Idempotent: no-op when the path is already correct or when
+ * openclaw.json doesn't exist yet (onboard hasn't run).
+ */
+async function pinAgentWorkspace(stateDir) {
+    const workspacePath = AGENT_WORKSPACE_DIR;
+    const configPath = resolve(stateDir, "openclaw.json");
+    let raw;
+    try {
+        raw = await readFile(configPath, "utf-8");
+    }
+    catch {
+        return; // openclaw.json not created yet — onboard hasn't run
+    }
+    let cfg;
+    try {
+        cfg = JSON.parse(raw);
+    }
+    catch {
+        return;
+    }
+    cfg.agents = cfg.agents ?? {};
+    cfg.agents.defaults = cfg.agents.defaults ?? {};
+    if (cfg.agents.defaults.workspace === workspacePath)
+        return;
+    cfg.agents.defaults.workspace = workspacePath;
+    await writeFile(configPath, JSON.stringify(cfg, null, 2) + "\n");
+}
 /**
  * Idempotently flip `gateway.http.endpoints.chatCompletions.enabled` to true
  * in ~/.leedab/openclaw.json. The console (Next.js, apps/console) proxies
@@ -265,24 +308,26 @@ async function ensureAutoApprove(bin, env, gateway = false) {
     console.warn("[leedab] auto-approve setup failed:", lastErr?.message ?? lastErr);
 }
 /**
- * Copy default workspace files (AGENTS.md, SOUL.md, etc.) into workspace/
- * on first run. Existing files are never overwritten.
+ * Copy the framework workspace files (AGENTS.md, SOUL.md, COO.md,
+ * BOOTSTRAP.md) into AGENT_WORKSPACE_DIR on every start. These four are
+ * framework-level identity files that define how the COO routes work
+ * across channels — they always reflect the templates the build ships
+ * with. Operator-specific content lives in USER.md and per-agent files,
+ * neither of which is templated.
+ *
+ * The destination is anchored under STATE_DIR (~/.leedab/agent-workspace/)
+ * rather than cwd-relative, so the path doesn't drift between directories
+ * across customer installs. pinAgentWorkspace points openclaw at this
+ * same path so the channel-facing agent reads from here.
  */
 async function seedWorkspace() {
     const srcDir = join(dirname(fileURLToPath(import.meta.url)), "templates", "workspace");
-    const destDir = resolve("workspace");
+    const destDir = AGENT_WORKSPACE_DIR;
     await mkdir(destDir, { recursive: true });
     try {
         const files = await readdir(srcDir);
         for (const file of files) {
-            const dest = join(destDir, file);
-            try {
-                await access(dest);
-                // Already exists — don't overwrite
-            }
-            catch {
-                await copyFile(join(srcDir, file), dest);
-            }
+            await copyFile(join(srcDir, file), join(destDir, file));
         }
     }
     catch (err) {