limbo-ai 1.11.0 → 1.13.0

package/README.md

@@ -25,6 +25,30 @@ This will:
 
 Limbo binds to `127.0.0.1:18789`.
 
+### Agent Installation
+
+AI agents can install Limbo non-interactively using CLI flags:
+
+```bash
+npx limbo-ai start --provider openrouter --api-key sk-or-v1-xxx --model auto
+```
+
+**Required flags:**
+| Flag | Description |
+|------|-------------|
+| `--provider` | `openai`, `anthropic`, or `openrouter` |
+| `--api-key` | Your provider API key |
+
+**Optional flags:**
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--model` | Provider default | Model name (e.g. `anthropic/claude-sonnet-4-6`) |
+| `--language` | `en` | CLI language (`en` or `es`) |
+
+Headless mode skips Telegram setup. To add Telegram later, run `npx limbo-ai start --reconfigure`.
+
+> **Note:** Subscription-based auth (ChatGPT/Codex, Claude Code) requires interactive setup because it involves browser-based OAuth or token pasting. Use `npx limbo-ai start` without flags for subscription auth.
+
 ### Available commands
 
 ```sh

package/cli.js

@@ -19,7 +19,74 @@ const ENV_FILE = path.join(LIMBO_DIR, '.env');
 const COMPOSE_FILE = path.join(LIMBO_DIR, 'docker-compose.yml');
 const GHCR_IMAGE = 'ghcr.io/tomasward1/limbo';
 const DEFAULT_TAG = require('./package.json').version;
-const PORT = 18789;
+const DEFAULT_PORT = 18789;
+const COEXIST_PORT = 18900;
+let PORT = DEFAULT_PORT;
+
+// ─── OpenClaw Detection ─────────────────────────────────────────────────────
+
+function isPortInUse(port) {
+  try {
+    execSync(
+      `node -e "const s=require('net').connect(${port},'127.0.0.1');s.on('connect',()=>{s.destroy();process.exit(0)});s.on('error',()=>process.exit(1));setTimeout(()=>process.exit(1),1500);"`,
+      { stdio: 'pipe', timeout: 3000 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function detectExistingOpenClaw() {
+  if (!isPortInUse(DEFAULT_PORT)) return null;
+
+  let processInfo = 'unknown process';
+  try {
+    const lsof = execSync(`lsof -i :${DEFAULT_PORT} -t 2>/dev/null`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+    if (lsof) {
+      const pid = lsof.split('\n')[0];
+      const cmdline = execSync(`ps -p ${pid} -o command= 2>/dev/null`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+      if (cmdline.includes('openclaw')) processInfo = 'OpenClaw';
+      else if (cmdline.includes('docker')) processInfo = 'Docker container';
+      else processInfo = cmdline.slice(0, 60);
+    }
+  } catch { /* lsof not available or no match */ }
+
+  return { port: DEFAULT_PORT, processInfo };
+}
+
+function findExistingApiKeys() {
+  const searchPaths = [
+    '/opt/openclaw/.env',
+    '/opt/openclaw/secrets/llm_api_key',
+    path.join(os.homedir(), '.openclaw', '.env'),
+  ];
+
+  for (const envPath of searchPaths) {
+    try {
+      if (!fs.existsSync(envPath)) continue;
+
+      // If it's a secrets file (single value), read directly
+      if (envPath.endsWith('llm_api_key')) {
+        const key = fs.readFileSync(envPath, 'utf8').trim();
+        if (key) return { source: path.dirname(envPath), keys: { LLM_API_KEY: key } };
+        continue;
+      }
+
+      // Parse .env file
+      const content = fs.readFileSync(envPath, 'utf8');
+      const keys = {};
+      for (const line of content.split('\n')) {
+        const match = line.match(/^(LLM_API_KEY|ANTHROPIC_API_KEY|OPENAI_API_KEY|OPENROUTER_API_KEY|MODEL_PROVIDER|MODEL_NAME)=(.+)$/);
+        if (match) keys[match[1]] = match[2].replace(/^["']|["']$/g, '').trim();
+      }
+      const hasKey = keys.LLM_API_KEY || keys.ANTHROPIC_API_KEY || keys.OPENAI_API_KEY || keys.OPENROUTER_API_KEY;
+      if (hasKey) return { source: path.dirname(envPath), keys };
+    } catch { /* permission denied etc — skip */ }
+  }
+
+  return null;
+}
 
 // OpenClaw compatibility snapshots from official docs:
 // - https://docs.openclaw.ai/providers/openai
@@ -50,6 +117,12 @@ const MODEL_CATALOG = {
     menuModels: ['claude-opus-4-6', 'claude-sonnet-4-6'],
     supportedModels: ['claude-opus-4-6', 'claude-sonnet-4-6', 'claude-opus-4-1', 'claude-sonnet-4'],
   },
+  'openrouter:api-key': {
+    provider: 'openrouter',
+    defaultModel: 'auto',
+    menuModels: [],
+    supportedModels: [],
+  },
 };
 
 const ASCII_ART = String.raw`
@@ -61,7 +134,8 @@ const ASCII_ART = String.raw`
 `;
 
 // docker-compose.yml written to ~/.limbo on install
-const COMPOSE_CONTENT = `services:
+function composeContent() {
+  return `services:
   limbo:
     image: ${GHCR_IMAGE}:${DEFAULT_TAG}
     restart: unless-stopped
@@ -92,6 +166,7 @@ const COMPOSE_CONTENT = `services:
     environment:
       OPENCLAW_CONFIG_PATH: /home/limbo/.openclaw/openclaw.json
       OPENCLAW_STATE_DIR: /home/limbo/.openclaw
+      LIMBO_PORT: "${PORT}"
     healthcheck:
       test:
         - CMD-SHELL
@@ -115,9 +190,11 @@ volumes:
   limbo-data:
   limbo-openclaw-state:
 `;
+}
 
 // Hardened variant: adds Squid egress proxy sidecar with domain allowlist
-const COMPOSE_CONTENT_HARDENED = `services:
+function composeContentHardened() {
+  return `services:
   limbo:
     image: ${GHCR_IMAGE}:${DEFAULT_TAG}
     restart: unless-stopped
@@ -148,6 +225,7 @@ const COMPOSE_CONTENT_HARDENED = `services:
     environment:
       OPENCLAW_CONFIG_PATH: /home/limbo/.openclaw/openclaw.json
       OPENCLAW_STATE_DIR: /home/limbo/.openclaw
+      LIMBO_PORT: "${PORT}"
       HTTP_PROXY: http://squid:3128
       HTTPS_PROXY: http://squid:3128
       NO_PROXY: "127.0.0.1,localhost"
@@ -202,6 +280,7 @@ volumes:
   limbo-data:
   limbo-openclaw-state:
 `;
+}
 
 const TEXT = {
   en: {
@@ -211,6 +290,7 @@ const TEXT = {
     providerQuestion: 'AI Provider',
     providerOpenAI: 'Codex (OpenAI)',
     providerAnthropic: 'Claude (Anthropic)',
+    providerOpenRouter: 'OpenRouter (100+ models)',
     accessMethodQuestion: 'Access method',
     accessSubscriptionOpenAI: 'ChatGPT / Codex subscription',
     accessSubscriptionAnthropic: 'Claude Code subscription',
@@ -225,6 +305,11 @@ const TEXT = {
     requiredField: 'This field is required.',
     invalidOpenAIKey: 'OpenAI API keys usually start with "sk-".',
     invalidAnthropicKey: 'Anthropic API keys usually start with "sk-ant-".',
+    openRouterApiKeyPrompt: '  OpenRouter API key (sk-or-...): ',
+    openRouterKeyWarn: 'OpenRouter API keys usually start with "sk-or-". Proceeding anyway.',
+    openRouterKeyHint: 'Get your key at: https://openrouter.ai/keys',
+    openRouterModelPrompt: '  Model name (blank = auto-routing): ',
+    openRouterModelHint: 'Examples: anthropic/claude-sonnet-4-6, openai/gpt-4o, google/gemini-2.5-pro',
     telegramQuestion: 'Want to speak to Limbo through Telegram?',
     telegramBotFatherSteps: [
       'To create a Telegram bot:',
@@ -304,6 +389,13 @@ const TEXT = {
     helpReconfigure: 'Reconfigure auth and onboarding settings (use with start)',
     securityNotice: 'Security notice: Limbo runs AI agents inside a Docker container with access to your API keys and vault data. The container can make network requests to AI provider APIs. Do not store sensitive secrets (passwords, private keys) in your vault notes.',
     unknownCommand: (cmd) => `Unknown command: ${cmd}`,
+    headlessMissingApiKey: '--provider requires --api-key. Subscription auth needs interactive setup: npx limbo-ai start',
+    headlessInvalidProvider: 'Invalid --provider. Use: openai, anthropic, or openrouter',
+    headlessStarting: 'Headless mode: configuring...',
+    helpProvider: 'Set provider for headless install (openai, anthropic, openrouter)',
+    helpApiKey: 'API key for headless install',
+    helpModel: 'Model name (optional, uses provider default)',
+    helpLanguage: 'Language: en, es (default: en)',
   },
   es: {
     languageName: 'Espanol',
@@ -312,6 +404,7 @@ const TEXT = {
     providerQuestion: 'AI Provider',
     providerOpenAI: 'Codex (OpenAI)',
     providerAnthropic: 'Claude (Anthropic)',
+    providerOpenRouter: 'OpenRouter (100+ modelos)',
     accessMethodQuestion: 'Metodo de acceso',
     accessSubscriptionOpenAI: 'Suscripcion ChatGPT / Codex',
     accessSubscriptionAnthropic: 'Suscripcion Claude Code',
@@ -326,6 +419,11 @@ const TEXT = {
     requiredField: 'Este campo es obligatorio.',
     invalidOpenAIKey: 'Las API keys de OpenAI normalmente empiezan con "sk-".',
     invalidAnthropicKey: 'Las API keys de Anthropic normalmente empiezan con "sk-ant-".',
+    openRouterApiKeyPrompt: '  OpenRouter API key (sk-or-...): ',
+    openRouterKeyWarn: 'Las API keys de OpenRouter normalmente empiezan con "sk-or-". Continuando igual.',
+    openRouterKeyHint: 'Consegui tu key en: https://openrouter.ai/keys',
+    openRouterModelPrompt: '  Nombre del modelo (vacio = auto-routing): ',
+    openRouterModelHint: 'Ejemplos: anthropic/claude-sonnet-4-6, openai/gpt-4o, google/gemini-2.5-pro',
     telegramQuestion: 'Quieres hablar con Limbo por Telegram?',
     telegramBotFatherSteps: [
       'Para crear un bot de Telegram:',
@@ -405,6 +503,13 @@ const TEXT = {
     helpReconfigure: 'Reconfigura auth y onboarding (usar con start)',
     securityNotice: 'Aviso de seguridad: Limbo corre agentes de IA dentro de un container Docker con acceso a tus API keys y datos del vault. El container puede hacer requests a las APIs de los proveedores de IA. No guardes secretos sensibles (passwords, claves privadas) en las notas del vault.',
     unknownCommand: (cmd) => `Comando desconocido: ${cmd}`,
+    headlessMissingApiKey: '--provider requiere --api-key. La autenticacion por suscripcion necesita setup interactivo: npx limbo-ai start',
+    headlessInvalidProvider: '--provider invalido. Usa: openai, anthropic, o openrouter',
+    headlessStarting: 'Modo headless: configurando...',
+    helpProvider: 'Setea el provider para instalacion headless (openai, anthropic, openrouter)',
+    helpApiKey: 'API key para instalacion headless',
+    helpModel: 'Nombre del modelo (opcional, usa el default del provider)',
+    helpLanguage: 'Idioma: en, es (default: en)',
   },
 };
 
@@ -433,6 +538,11 @@ function t(lang, key, ...args) {
   return typeof value === 'function' ? value(...args) : value;
 }
 
+function parseFlag(flag) {
+  const idx = process.argv.indexOf(flag);
+  return idx !== -1 && idx + 1 < process.argv.length ? process.argv[idx + 1] : undefined;
+}
+
 function sleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -564,6 +674,7 @@ function normalizeConfig(cfg, existingEnv = {}) {
     AUTH_MODE: cfg.authMode || existingEnv.AUTH_MODE || 'api-key',
     MODEL_PROVIDER: cfg.provider || existingEnv.MODEL_PROVIDER || 'anthropic',
     MODEL_NAME: cfg.modelName || existingEnv.MODEL_NAME || 'claude-opus-4-6',
+    LIMBO_PORT: String(PORT),
     OPENAI_API_KEY: cfg.provider === 'openai' && cfg.apiKey ? cfg.apiKey : (cfg.keepExisting ? existingEnv.OPENAI_API_KEY || '' : ''),
     ANTHROPIC_API_KEY: cfg.provider === 'anthropic' && cfg.apiKey ? cfg.apiKey : (cfg.keepExisting ? existingEnv.ANTHROPIC_API_KEY || '' : ''),
     LLM_API_KEY: cfg.apiKey || (cfg.keepExisting ? existingEnv.LLM_API_KEY || '' : ''),
@@ -590,7 +701,7 @@ function writeSecrets(cfg, existingEnv = {}) {
 }
 
 const SECRET_KEYS = new Set([
-  'LLM_API_KEY', 'OPENAI_API_KEY', 'ANTHROPIC_API_KEY',
+  'LLM_API_KEY', 'OPENAI_API_KEY', 'ANTHROPIC_API_KEY', 'OPENROUTER_API_KEY',
   'TELEGRAM_BOT_TOKEN', 'OPENCLAW_GATEWAY_TOKEN',
 ]);
 
@@ -615,12 +726,29 @@ function waitForHealthy(lang, maxAttempts = 12) {
   return false;
 }
 
+function deriveProviderFamily(provider) {
+  if (!provider) return 'anthropic';
+  if (provider.startsWith('openai')) return 'openai';
+  if (provider === 'openrouter') return 'openrouter';
+  return 'anthropic';
+}
+
 function getModelCatalog(providerFamily, authMode) {
   return MODEL_CATALOG[`${providerFamily}:${authMode}`];
 }
 
 async function chooseModel(lang, providerFamily, authMode) {
   const catalog = getModelCatalog(providerFamily, authMode);
+
+  if (!catalog.menuModels.length) {
+    console.log(`  ${c.dim}${t(lang, 'openRouterModelHint')}${c.reset}`);
+    const modelName = await promptValidated(
+      t(lang, 'openRouterModelPrompt'),
+      (value) => ({ ok: true, value: value || catalog.defaultModel }),
+    );
+    return modelName;
+  }
+
   const options = catalog.menuModels.map((model) => ({ label: model, value: model }));
   options.push({ label: t(lang, 'customModel'), value: '__custom__' });
 
@@ -646,6 +774,32 @@ async function chooseModel(lang, providerFamily, authMode) {
 async function collectConfig(existingEnv = {}) {
   console.log(`${c.cyan}${ASCII_ART}${c.reset}`);
 
+  // Check for existing API keys from another OpenClaw installation
+  const existingKeys = findExistingApiKeys();
+  if (existingKeys && !existingEnv.LLM_API_KEY && !existingEnv.ANTHROPIC_API_KEY && !existingEnv.OPENAI_API_KEY) {
+    const keyValue = existingKeys.keys.LLM_API_KEY || existingKeys.keys.ANTHROPIC_API_KEY || existingKeys.keys.OPENAI_API_KEY || existingKeys.keys.OPENROUTER_API_KEY || '';
+    const maskedKey = keyValue ? keyValue.slice(0, 10) + '...' : 'found';
+
+    console.log(`
+  ${c.cyan}Found existing API keys${c.reset} from ${existingKeys.source}
+  ${c.dim}Key: ${maskedKey}${c.reset}
+`);
+
+    const { select } = await getClack();
+    const reuseChoice = await select({
+      message: 'Reuse existing API configuration?',
+      options: [
+        { value: 'yes', label: 'Yes, use existing keys' },
+        { value: 'no', label: 'No, configure new keys' },
+      ],
+    });
+    await maybeHandleClackCancel(reuseChoice);
+
+    if (reuseChoice === 'yes') {
+      Object.assign(existingEnv, existingKeys.keys);
+    }
+  }
+
   const language = (await selectMenu(t('en', 'chooseLanguage'), [
     { label: TEXT.en.languageName, value: 'en' },
     { label: TEXT.es.languageName, value: 'es' },
@@ -654,24 +808,38 @@ async function collectConfig(existingEnv = {}) {
   const providerFamily = (await selectMenu(t(language, 'providerQuestion'), [
     { label: t(language, 'providerOpenAI'), value: 'openai' },
     { label: t(language, 'providerAnthropic'), value: 'anthropic' },
+    { label: t(language, 'providerOpenRouter'), value: 'openrouter' },
   ], language)).value;
 
-  const accessMethod = (await selectMenu(t(language, 'accessMethodQuestion'), [
-    {
-      label: providerFamily === 'openai'
-        ? t(language, 'accessSubscriptionOpenAI')
-        : t(language, 'accessSubscriptionAnthropic'),
-      value: 'subscription',
-    },
-    { label: t(language, 'accessApiKey'), value: 'api-key' },
-  ], language)).value;
+  let accessMethod;
+  if (providerFamily === 'openrouter') {
+    accessMethod = 'api-key';
+  } else {
+    accessMethod = (await selectMenu(t(language, 'accessMethodQuestion'), [
+      {
+        label: providerFamily === 'openai'
+          ? t(language, 'accessSubscriptionOpenAI')
+          : t(language, 'accessSubscriptionAnthropic'),
+        value: 'subscription',
+      },
+      { label: t(language, 'accessApiKey'), value: 'api-key' },
+    ], language)).value;
+  }
 
   const modelName = await chooseModel(language, providerFamily, accessMethod);
   const provider = getModelCatalog(providerFamily, accessMethod).provider;
   let apiKey = '';
 
   if (accessMethod === 'api-key') {
-    if (providerFamily === 'openai') {
+    const reusedKey = existingEnv.LLM_API_KEY
+      || (providerFamily === 'openai' && existingEnv.OPENAI_API_KEY)
+      || (providerFamily === 'anthropic' && existingEnv.ANTHROPIC_API_KEY)
+      || (providerFamily === 'openrouter' && existingEnv.OPENROUTER_API_KEY)
+      || '';
+
+    if (reusedKey) {
+      apiKey = reusedKey;
+    } else if (providerFamily === 'openai') {
       apiKey = await promptValidated(
         t(language, 'openAiApiKeyPrompt'),
         (value) => {
@@ -680,6 +848,16 @@ async function collectConfig(existingEnv = {}) {
           return { ok: true, value };
         },
       );
+    } else if (providerFamily === 'openrouter') {
+      console.log(`  ${c.dim}${t(language, 'openRouterKeyHint')}${c.reset}`);
+      apiKey = await promptValidated(
+        t(language, 'openRouterApiKeyPrompt'),
+        (value) => {
+          if (!value) return { ok: false, message: t(language, 'requiredField') };
+          if (!value.startsWith('sk-or-')) warn(t(language, 'openRouterKeyWarn'));
+          return { ok: true, value };
+        },
+      );
     } else {
       apiKey = await promptValidated(
         t(language, 'anthropicApiKeyPrompt'),
@@ -750,7 +928,7 @@ function ensureComposeFile(hardened = false) {
       if (fs.existsSync(src)) fs.copyFileSync(src, dest);
     }
   }
-  fs.writeFileSync(COMPOSE_FILE, hardened ? COMPOSE_CONTENT_HARDENED : COMPOSE_CONTENT);
+  fs.writeFileSync(COMPOSE_FILE, hardened ? composeContentHardened() : composeContent());
 }
 
 function readSecretFile(name) {
@@ -1121,14 +1299,72 @@ async function cmdStart() {
   if (!hasDocker()) die(t('en', 'dockerMissing'));
 
   const hardened = process.argv.includes('--hardened');
-  ensureComposeFile(hardened);
 
+  // ── Detect existing OpenClaw ──────────────────────────────────────────────
   const existingEnv = parseEnvFile();
   const alreadyHasEnv = fs.existsSync(ENV_FILE);
+
+  if (existingEnv.LIMBO_PORT) {
+    const parsed = parseInt(existingEnv.LIMBO_PORT, 10);
+    if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535) {
+      warn(`Invalid LIMBO_PORT="${existingEnv.LIMBO_PORT}" in .env, using default ${DEFAULT_PORT}`);
+    } else {
+      PORT = parsed;
+    }
+  } else {
+    const existing = detectExistingOpenClaw();
+    if (existing) {
+      console.log(`
+  ${c.yellow}${c.bold}Existing OpenClaw detected${c.reset}
+  ${c.dim}Port ${existing.port} is in use (${existing.processInfo})${c.reset}
+
+  Limbo will run its own OpenClaw instance on port ${c.bold}${COEXIST_PORT}${c.reset}.
+  Both can coexist safely — separate containers, separate data.
+`);
+      PORT = COEXIST_PORT;
+    }
+  }
+
+  ensureComposeFile(hardened);
   let cfg;
   let lang = existingEnv.CLI_LANGUAGE || 'en';
 
-  if (alreadyHasEnv) {
+  // ── Headless mode ──────────────────────────────────────────────────────────
+  const flagProvider = parseFlag('--provider');
+  const flagApiKey = parseFlag('--api-key');
+  const flagModel = parseFlag('--model');
+  const flagLang = parseFlag('--language') || 'en';
+
+  if (flagProvider) {
+    const validProviders = ['openai', 'anthropic', 'openrouter'];
+    if (!validProviders.includes(flagProvider)) {
+      die(t(flagLang, 'headlessInvalidProvider'));
+    }
+    if (!flagApiKey) {
+      die(t(flagLang, 'headlessMissingApiKey'));
+    }
+
+    lang = flagLang;
+    const providerFamily = deriveProviderFamily(flagProvider);
+    const catalog = getModelCatalog(providerFamily, 'api-key');
+    const modelName = flagModel || catalog.defaultModel;
+
+    log(t(lang, 'headlessStarting'));
+    cfg = {
+      language: lang,
+      authMode: 'api-key',
+      provider: catalog.provider,
+      providerFamily,
+      modelName,
+      apiKey: flagApiKey,
+      telegramEnabled: 'false',
+      telegramToken: '',
+      telegramAutoPair: 'false',
+      gatewayToken: ensureGatewayToken(existingEnv),
+    };
+    writeEnv({ ...cfg, CLI_LANGUAGE: cfg.language }, existingEnv);
+    ok(t(cfg.language, 'envWritten'));
+  } else if (alreadyHasEnv) {
     log(existingEnv.MODEL_PROVIDER ? t(lang, 'foundExistingConfig') : `Found existing config at ${ENV_FILE}`);
     const reconfig = process.argv.includes('--reconfigure');
     if (!reconfig) {
@@ -1138,7 +1374,7 @@ async function cmdStart() {
       cfg = {
         language: lang,
         provider: existingEnv.MODEL_PROVIDER || 'anthropic',
-        providerFamily: (existingEnv.MODEL_PROVIDER || 'anthropic').startsWith('openai') ? 'openai' : 'anthropic',
+        providerFamily: deriveProviderFamily(existingEnv.MODEL_PROVIDER),
         authMode: existingEnv.AUTH_MODE || 'api-key',
         modelName: existingEnv.MODEL_NAME || 'claude-opus-4-6',
         telegramEnabled: existingEnv.TELEGRAM_ENABLED || 'false',
@@ -1245,8 +1481,12 @@ ${c.bold}Commands:${c.reset}
   help          Show this help
 
 ${c.bold}Flags:${c.reset}
-  --reconfigure  Reconfigure auth and onboarding settings (use with start)
-  --hardened     Enable egress proxy (restricts outbound to AI provider APIs only)
+  --reconfigure        Reconfigure auth and onboarding settings (use with start)
+  --hardened           Enable egress proxy (restricts outbound to AI provider APIs only)
+  --provider <name>    Set provider for headless install (openai, anthropic, openrouter)
+  --api-key <key>      API key for headless install
+  --model <name>       Model name (optional, uses provider default)
+  --language <code>    Language: en, es (default: en)
 
 ${c.bold}Data directory:${c.reset} ${LIMBO_DIR}
 `);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limbo-ai",
-  "version": "1.11.0",
+  "version": "1.13.0",
   "description": "Your personal AI memory agent — install and manage Limbo via npx",
   "type": "commonjs",
   "bin": {