limbo-ai 1.12.0 → 1.14.0

package/README.md

@@ -25,6 +25,30 @@ This will:
 
 Limbo binds to `127.0.0.1:18789`.
 
+### Agent Installation
+
+AI agents can install Limbo non-interactively using CLI flags:
+
+```bash
+npx limbo-ai start --provider openrouter --api-key sk-or-v1-xxx --model auto
+```
+
+**Required flags:**
+| Flag | Description |
+|------|-------------|
+| `--provider` | `openai`, `anthropic`, or `openrouter` |
+| `--api-key` | Your provider API key |
+
+**Optional flags:**
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--model` | Provider default | Model name (e.g. `anthropic/claude-sonnet-4-6`) |
+| `--language` | `en` | CLI language (`en` or `es`) |
+
+Headless mode skips Telegram setup. To add Telegram later, run `npx limbo-ai start --reconfigure`.
+
+> **Note:** Subscription-based auth (ChatGPT/Codex, Claude Code) requires interactive setup because it involves browser-based OAuth or token pasting. Use `npx limbo-ai start` without flags for subscription auth.
+
 ### Available commands
 
 ```sh

package/cli.js

@@ -18,8 +18,75 @@ const SECRETS_DIR = path.join(LIMBO_DIR, 'secrets');
 const ENV_FILE = path.join(LIMBO_DIR, '.env');
 const COMPOSE_FILE = path.join(LIMBO_DIR, 'docker-compose.yml');
 const GHCR_IMAGE = 'ghcr.io/tomasward1/limbo';
-const DEFAULT_TAG = require('./package.json').version;
-const PORT = 18789;
+const DEFAULT_TAG = 'latest';
+const DEFAULT_PORT = 18789;
+const COEXIST_PORT = 18900;
+let PORT = DEFAULT_PORT;
+
+// ─── OpenClaw Detection ─────────────────────────────────────────────────────
+
+function isPortInUse(port) {
+  try {
+    execSync(
+      `node -e "const s=require('net').connect(${port},'127.0.0.1');s.on('connect',()=>{s.destroy();process.exit(0)});s.on('error',()=>process.exit(1));setTimeout(()=>process.exit(1),1500);"`,
+      { stdio: 'pipe', timeout: 3000 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function detectExistingOpenClaw() {
+  if (!isPortInUse(DEFAULT_PORT)) return null;
+
+  let processInfo = 'unknown process';
+  try {
+    const lsof = execSync(`lsof -i :${DEFAULT_PORT} -t 2>/dev/null`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+    if (lsof) {
+      const pid = lsof.split('\n')[0];
+      const cmdline = execSync(`ps -p ${pid} -o command= 2>/dev/null`, { encoding: 'utf8', stdio: 'pipe' }).trim();
+      if (cmdline.includes('openclaw')) processInfo = 'OpenClaw';
+      else if (cmdline.includes('docker')) processInfo = 'Docker container';
+      else processInfo = cmdline.slice(0, 60);
+    }
+  } catch { /* lsof not available or no match */ }
+
+  return { port: DEFAULT_PORT, processInfo };
+}
+
+function findExistingApiKeys() {
+  const searchPaths = [
+    '/opt/openclaw/.env',
+    '/opt/openclaw/secrets/llm_api_key',
+    path.join(os.homedir(), '.openclaw', '.env'),
+  ];
+
+  for (const envPath of searchPaths) {
+    try {
+      if (!fs.existsSync(envPath)) continue;
+
+      // If it's a secrets file (single value), read directly
+      if (envPath.endsWith('llm_api_key')) {
+        const key = fs.readFileSync(envPath, 'utf8').trim();
+        if (key) return { source: path.dirname(envPath), keys: { LLM_API_KEY: key } };
+        continue;
+      }
+
+      // Parse .env file
+      const content = fs.readFileSync(envPath, 'utf8');
+      const keys = {};
+      for (const line of content.split('\n')) {
+        const match = line.match(/^(LLM_API_KEY|ANTHROPIC_API_KEY|OPENAI_API_KEY|OPENROUTER_API_KEY|MODEL_PROVIDER|MODEL_NAME)=(.+)$/);
+        if (match) keys[match[1]] = match[2].replace(/^["']|["']$/g, '').trim();
+      }
+      const hasKey = keys.LLM_API_KEY || keys.ANTHROPIC_API_KEY || keys.OPENAI_API_KEY || keys.OPENROUTER_API_KEY;
+      if (hasKey) return { source: path.dirname(envPath), keys };
+    } catch { /* permission denied etc — skip */ }
+  }
+
+  return null;
+}
 
 // OpenClaw compatibility snapshots from official docs:
 // - https://docs.openclaw.ai/providers/openai
@@ -67,7 +134,8 @@ const ASCII_ART = String.raw`
 `;
 
 // docker-compose.yml written to ~/.limbo on install
-const COMPOSE_CONTENT = `services:
+function composeContent() {
+  return `services:
   limbo:
     image: ${GHCR_IMAGE}:${DEFAULT_TAG}
     restart: unless-stopped
@@ -98,6 +166,7 @@ const COMPOSE_CONTENT = `services:
     environment:
       OPENCLAW_CONFIG_PATH: /home/limbo/.openclaw/openclaw.json
       OPENCLAW_STATE_DIR: /home/limbo/.openclaw
+      LIMBO_PORT: "${PORT}"
     healthcheck:
       test:
         - CMD-SHELL
@@ -121,9 +190,11 @@ volumes:
   limbo-data:
   limbo-openclaw-state:
 `;
+}
 
 // Hardened variant: adds Squid egress proxy sidecar with domain allowlist
-const COMPOSE_CONTENT_HARDENED = `services:
+function composeContentHardened() {
+  return `services:
   limbo:
     image: ${GHCR_IMAGE}:${DEFAULT_TAG}
     restart: unless-stopped
@@ -154,6 +225,7 @@ const COMPOSE_CONTENT_HARDENED = `services:
     environment:
       OPENCLAW_CONFIG_PATH: /home/limbo/.openclaw/openclaw.json
       OPENCLAW_STATE_DIR: /home/limbo/.openclaw
+      LIMBO_PORT: "${PORT}"
       HTTP_PROXY: http://squid:3128
       HTTPS_PROXY: http://squid:3128
       NO_PROXY: "127.0.0.1,localhost"
@@ -208,6 +280,7 @@ volumes:
   limbo-data:
   limbo-openclaw-state:
 `;
+}
 
 const TEXT = {
   en: {
@@ -316,6 +389,13 @@ const TEXT = {
     helpReconfigure: 'Reconfigure auth and onboarding settings (use with start)',
     securityNotice: 'Security notice: Limbo runs AI agents inside a Docker container with access to your API keys and vault data. The container can make network requests to AI provider APIs. Do not store sensitive secrets (passwords, private keys) in your vault notes.',
     unknownCommand: (cmd) => `Unknown command: ${cmd}`,
+    headlessMissingApiKey: '--provider requires --api-key. Subscription auth needs interactive setup: npx limbo-ai start',
+    headlessInvalidProvider: 'Invalid --provider. Use: openai, anthropic, or openrouter',
+    headlessStarting: 'Headless mode: configuring...',
+    helpProvider: 'Set provider for headless install (openai, anthropic, openrouter)',
+    helpApiKey: 'API key for headless install',
+    helpModel: 'Model name (optional, uses provider default)',
+    helpLanguage: 'Language: en, es (default: en)',
   },
   es: {
     languageName: 'Espanol',
@@ -423,6 +503,13 @@ const TEXT = {
     helpReconfigure: 'Reconfigura auth y onboarding (usar con start)',
     securityNotice: 'Aviso de seguridad: Limbo corre agentes de IA dentro de un container Docker con acceso a tus API keys y datos del vault. El container puede hacer requests a las APIs de los proveedores de IA. No guardes secretos sensibles (passwords, claves privadas) en las notas del vault.',
     unknownCommand: (cmd) => `Comando desconocido: ${cmd}`,
+    headlessMissingApiKey: '--provider requiere --api-key. La autenticacion por suscripcion necesita setup interactivo: npx limbo-ai start',
+    headlessInvalidProvider: '--provider invalido. Usa: openai, anthropic, o openrouter',
+    headlessStarting: 'Modo headless: configurando...',
+    helpProvider: 'Setea el provider para instalacion headless (openai, anthropic, openrouter)',
+    helpApiKey: 'API key para instalacion headless',
+    helpModel: 'Nombre del modelo (opcional, usa el default del provider)',
+    helpLanguage: 'Idioma: en, es (default: en)',
   },
 };
 
@@ -451,6 +538,11 @@ function t(lang, key, ...args) {
   return typeof value === 'function' ? value(...args) : value;
 }
 
+function parseFlag(flag) {
+  const idx = process.argv.indexOf(flag);
+  return idx !== -1 && idx + 1 < process.argv.length ? process.argv[idx + 1] : undefined;
+}
+
 function sleep(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -582,6 +674,7 @@ function normalizeConfig(cfg, existingEnv = {}) {
     AUTH_MODE: cfg.authMode || existingEnv.AUTH_MODE || 'api-key',
     MODEL_PROVIDER: cfg.provider || existingEnv.MODEL_PROVIDER || 'anthropic',
     MODEL_NAME: cfg.modelName || existingEnv.MODEL_NAME || 'claude-opus-4-6',
+    LIMBO_PORT: String(PORT),
     OPENAI_API_KEY: cfg.provider === 'openai' && cfg.apiKey ? cfg.apiKey : (cfg.keepExisting ? existingEnv.OPENAI_API_KEY || '' : ''),
     ANTHROPIC_API_KEY: cfg.provider === 'anthropic' && cfg.apiKey ? cfg.apiKey : (cfg.keepExisting ? existingEnv.ANTHROPIC_API_KEY || '' : ''),
     LLM_API_KEY: cfg.apiKey || (cfg.keepExisting ? existingEnv.LLM_API_KEY || '' : ''),
@@ -681,6 +774,32 @@ async function chooseModel(lang, providerFamily, authMode) {
 async function collectConfig(existingEnv = {}) {
   console.log(`${c.cyan}${ASCII_ART}${c.reset}`);
 
+  // Check for existing API keys from another OpenClaw installation
+  const existingKeys = findExistingApiKeys();
+  if (existingKeys && !existingEnv.LLM_API_KEY && !existingEnv.ANTHROPIC_API_KEY && !existingEnv.OPENAI_API_KEY) {
+    const keyValue = existingKeys.keys.LLM_API_KEY || existingKeys.keys.ANTHROPIC_API_KEY || existingKeys.keys.OPENAI_API_KEY || existingKeys.keys.OPENROUTER_API_KEY || '';
+    const maskedKey = keyValue ? keyValue.slice(0, 10) + '...' : 'found';
+
+    console.log(`
+  ${c.cyan}Found existing API keys${c.reset} from ${existingKeys.source}
+  ${c.dim}Key: ${maskedKey}${c.reset}
+`);
+
+    const { select } = await getClack();
+    const reuseChoice = await select({
+      message: 'Reuse existing API configuration?',
+      options: [
+        { value: 'yes', label: 'Yes, use existing keys' },
+        { value: 'no', label: 'No, configure new keys' },
+      ],
+    });
+    await maybeHandleClackCancel(reuseChoice);
+
+    if (reuseChoice === 'yes') {
+      Object.assign(existingEnv, existingKeys.keys);
+    }
+  }
+
   const language = (await selectMenu(t('en', 'chooseLanguage'), [
     { label: TEXT.en.languageName, value: 'en' },
     { label: TEXT.es.languageName, value: 'es' },
@@ -712,7 +831,15 @@ async function collectConfig(existingEnv = {}) {
   let apiKey = '';
 
   if (accessMethod === 'api-key') {
-    if (providerFamily === 'openai') {
+    const reusedKey = existingEnv.LLM_API_KEY
+      || (providerFamily === 'openai' && existingEnv.OPENAI_API_KEY)
+      || (providerFamily === 'anthropic' && existingEnv.ANTHROPIC_API_KEY)
+      || (providerFamily === 'openrouter' && existingEnv.OPENROUTER_API_KEY)
+      || '';
+
+    if (reusedKey) {
+      apiKey = reusedKey;
+    } else if (providerFamily === 'openai') {
       apiKey = await promptValidated(
         t(language, 'openAiApiKeyPrompt'),
         (value) => {
@@ -801,7 +928,7 @@ function ensureComposeFile(hardened = false) {
       if (fs.existsSync(src)) fs.copyFileSync(src, dest);
     }
   }
-  fs.writeFileSync(COMPOSE_FILE, hardened ? COMPOSE_CONTENT_HARDENED : COMPOSE_CONTENT);
+  fs.writeFileSync(COMPOSE_FILE, hardened ? composeContentHardened() : composeContent());
 }
 
 function readSecretFile(name) {
@@ -1172,14 +1299,72 @@ async function cmdStart() {
   if (!hasDocker()) die(t('en', 'dockerMissing'));
 
   const hardened = process.argv.includes('--hardened');
-  ensureComposeFile(hardened);
 
+  // ── Detect existing OpenClaw ──────────────────────────────────────────────
   const existingEnv = parseEnvFile();
   const alreadyHasEnv = fs.existsSync(ENV_FILE);
+
+  if (existingEnv.LIMBO_PORT) {
+    const parsed = parseInt(existingEnv.LIMBO_PORT, 10);
+    if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535) {
+      warn(`Invalid LIMBO_PORT="${existingEnv.LIMBO_PORT}" in .env, using default ${DEFAULT_PORT}`);
+    } else {
+      PORT = parsed;
+    }
+  } else {
+    const existing = detectExistingOpenClaw();
+    if (existing) {
+      console.log(`
+  ${c.yellow}${c.bold}Existing OpenClaw detected${c.reset}
+  ${c.dim}Port ${existing.port} is in use (${existing.processInfo})${c.reset}
+
+  Limbo will run its own OpenClaw instance on port ${c.bold}${COEXIST_PORT}${c.reset}.
+  Both can coexist safely — separate containers, separate data.
+`);
+      PORT = COEXIST_PORT;
+    }
+  }
+
+  ensureComposeFile(hardened);
   let cfg;
   let lang = existingEnv.CLI_LANGUAGE || 'en';
 
-  if (alreadyHasEnv) {
+  // ── Headless mode ──────────────────────────────────────────────────────────
+  const flagProvider = parseFlag('--provider');
+  const flagApiKey = parseFlag('--api-key');
+  const flagModel = parseFlag('--model');
+  const flagLang = parseFlag('--language') || 'en';
+
+  if (flagProvider) {
+    const validProviders = ['openai', 'anthropic', 'openrouter'];
+    if (!validProviders.includes(flagProvider)) {
+      die(t(flagLang, 'headlessInvalidProvider'));
+    }
+    if (!flagApiKey) {
+      die(t(flagLang, 'headlessMissingApiKey'));
+    }
+
+    lang = flagLang;
+    const providerFamily = deriveProviderFamily(flagProvider);
+    const catalog = getModelCatalog(providerFamily, 'api-key');
+    const modelName = flagModel || catalog.defaultModel;
+
+    log(t(lang, 'headlessStarting'));
+    cfg = {
+      language: lang,
+      authMode: 'api-key',
+      provider: catalog.provider,
+      providerFamily,
+      modelName,
+      apiKey: flagApiKey,
+      telegramEnabled: 'false',
+      telegramToken: '',
+      telegramAutoPair: 'false',
+      gatewayToken: ensureGatewayToken(existingEnv),
+    };
+    writeEnv({ ...cfg, CLI_LANGUAGE: cfg.language }, existingEnv);
+    ok(t(cfg.language, 'envWritten'));
+  } else if (alreadyHasEnv) {
     log(existingEnv.MODEL_PROVIDER ? t(lang, 'foundExistingConfig') : `Found existing config at ${ENV_FILE}`);
     const reconfig = process.argv.includes('--reconfigure');
     if (!reconfig) {
@@ -1265,10 +1450,22 @@ function cmdLogs() {
 
 function cmdUpdate() {
   if (!fs.existsSync(COMPOSE_FILE)) die(t('en', 'installMissing'));
+
+  // Patch image tag to :latest in existing compose files (handles upgrades from pinned tags)
+  const compose = fs.readFileSync(COMPOSE_FILE, 'utf8');
+  const patched = compose.replace(
+    /image:\s*ghcr\.io\/tomasward1\/limbo:\S+/g,
+    `image: ${GHCR_IMAGE}:${DEFAULT_TAG}`
+  );
+  if (patched !== compose) {
+    fs.writeFileSync(COMPOSE_FILE, patched);
+    log('Patched compose image tag to :latest');
+  }
+
   log('Pulling latest image...');
-  run('docker compose pull -q');
+  run(`docker compose -f "${COMPOSE_FILE}" pull -q`);
   log('Restarting...');
-  run('docker compose up -d --remove-orphans');
+  run(`docker compose -f "${COMPOSE_FILE}" up -d --remove-orphans`);
   ok('Updated and restarted.');
 }
 
@@ -1296,8 +1493,12 @@ ${c.bold}Commands:${c.reset}
   help          Show this help
 
 ${c.bold}Flags:${c.reset}
-  --reconfigure  Reconfigure auth and onboarding settings (use with start)
-  --hardened     Enable egress proxy (restricts outbound to AI provider APIs only)
+  --reconfigure        Reconfigure auth and onboarding settings (use with start)
+  --hardened           Enable egress proxy (restricts outbound to AI provider APIs only)
+  --provider <name>    Set provider for headless install (openai, anthropic, openrouter)
+  --api-key <key>      API key for headless install
+  --model <name>       Model name (optional, uses provider default)
+  --language <code>    Language: en, es (default: en)
 
 ${c.bold}Data directory:${c.reset} ${LIMBO_DIR}
 `);

package/mcp-server/index.js

@@ -65,7 +65,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         properties: {
           id: { type: "string", description: "Unique note identifier (alphanumeric, dashes, underscores)" },
           title: { type: "string", description: "Human-readable note title" },
-          type: { type: "string", description: "Note type: gotcha, decision, config-fact, pattern, tool-knowledge, research-finding, personal-fact" },
+          type: {
+            type: "string",
+            enum: ["fact", "preference", "person", "event", "project", "decision", "idea", "question", "source", "insight"],
+            description: "Note type: fact, preference, person, event, project, decision, idea, question, source, insight",
+          },
           description: { type: "string", description: "One-sentence falsifiable description of the note's claim" },
           content: { type: "string", description: "Full markdown body of the note" },
           subdirectory: { type: "string", description: "Optional subdirectory under notes/ (e.g. 'openclaw', 'research', 'aios/infrastructure'). Created if it doesn't exist." },

package/mcp-server/tools/write.js

@@ -5,6 +5,7 @@ const VAULT_PATH = process.env.VAULT_PATH || "/data/vault";
 const NOTES_DIR = join(VAULT_PATH, "notes");
 
 const REQUIRED_FIELDS = ["id", "title", "type", "description", "content"];
+const VALID_TYPES = ['fact', 'preference', 'person', 'event', 'project', 'decision', 'idea', 'question', 'source', 'insight'];
 
 function escapeYaml(str) {
   return str.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
@@ -21,6 +22,7 @@ function buildFrontmatter(note) {
   lines.push(`title: "${escapeYaml(note.title)}"`);
   lines.push(`description: "${escapeYaml(note.description)}"`);
   lines.push(`type: ${note.type}`);
+  lines.push(`schema_version: 1`);
   if (note.status) {
     lines.push(`status: ${note.status}`);
   }
@@ -54,6 +56,10 @@ export async function vaultWriteNote(note) {
     }
   }
 
+  if (!VALID_TYPES.includes(note.type)) {
+    throw new Error(`Invalid note type: "${note.type}". Valid types: ${VALID_TYPES.join(', ')}`);
+  }
+
   // Sanitize id
   const safe = note.id.replace(/[^a-zA-Z0-9_\-]/g, "");
   if (safe !== note.id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "limbo-ai",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "Your personal AI memory agent — install and manage Limbo via npx",
   "type": "commonjs",
   "bin": {