openclaw-multi-auto 1.0.9 → 1.1.1

package/scripts/run-openclaw-podman.sh

@@ -0,0 +1,213 @@
+#!/usr/bin/env bash
+# Rootless OpenClaw in Podman: run after one-time setup.
+#
+# One-time setup (from repo root): ./setup-podman.sh
+# Then:
+#   ./scripts/run-openclaw-podman.sh launch           # Start gateway
+#   ./scripts/run-openclaw-podman.sh launch setup      # Onboarding wizard
+#
+# As the openclaw user (no repo needed):
+#   sudo -u openclaw /home/openclaw/run-openclaw-podman.sh
+#   sudo -u openclaw /home/openclaw/run-openclaw-podman.sh setup
+#
+# Legacy: "setup-host" delegates to ../setup-podman.sh
+
+set -euo pipefail
+
+OPENCLAW_USER="${OPENCLAW_PODMAN_USER:-openclaw}"
+
+resolve_user_home() {
+  local user="$1"
+  local home=""
+  if command -v getent >/dev/null 2>&1; then
+    home="$(getent passwd "$user" 2>/dev/null | cut -d: -f6 || true)"
+  fi
+  if [[ -z "$home" && -f /etc/passwd ]]; then
+    home="$(awk -F: -v u="$user" '$1==u {print $6}' /etc/passwd 2>/dev/null || true)"
+  fi
+  if [[ -z "$home" ]]; then
+    home="/home/$user"
+  fi
+  printf '%s' "$home"
+}
+
+OPENCLAW_HOME="$(resolve_user_home "$OPENCLAW_USER")"
+OPENCLAW_UID="$(id -u "$OPENCLAW_USER" 2>/dev/null || true)"
+LAUNCH_SCRIPT="$OPENCLAW_HOME/run-openclaw-podman.sh"
+
+# Legacy: setup-host → run setup-podman.sh
+if [[ "${1:-}" == "setup-host" ]]; then
+  shift
+  REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  SETUP_PODMAN="$REPO_ROOT/setup-podman.sh"
+  if [[ -f "$SETUP_PODMAN" ]]; then
+    exec "$SETUP_PODMAN" "$@"
+  fi
+  echo "setup-podman.sh not found at $SETUP_PODMAN. Run from repo root: ./setup-podman.sh" >&2
+  exit 1
+fi
+
+# --- Step 2: launch (from repo: re-exec as openclaw in safe cwd; from openclaw home: run container) ---
+if [[ "${1:-}" == "launch" ]]; then
+  shift
+  if [[ -n "${OPENCLAW_UID:-}" && "$(id -u)" -ne "$OPENCLAW_UID" ]]; then
+    # Exec as openclaw with cwd=/tmp so a nologin user never inherits an invalid cwd.
+    exec sudo -u "$OPENCLAW_USER" env HOME="$OPENCLAW_HOME" PATH="$PATH" TERM="${TERM:-}" \
+      bash -c 'cd /tmp && exec '"$LAUNCH_SCRIPT"' "$@"' _ "$@"
+  fi
+  # Already openclaw; fall through to container run (with remaining args, e.g. "setup")
+fi
+
+# --- Container run (script in openclaw home, run as openclaw) ---
+EFFECTIVE_HOME="${HOME:-}"
+if [[ -n "${OPENCLAW_UID:-}" && "$(id -u)" -eq "$OPENCLAW_UID" ]]; then
+  EFFECTIVE_HOME="$OPENCLAW_HOME"
+  export HOME="$OPENCLAW_HOME"
+fi
+if [[ -z "${EFFECTIVE_HOME:-}" ]]; then
+  EFFECTIVE_HOME="${OPENCLAW_HOME:-/tmp}"
+fi
+CONFIG_DIR="${OPENCLAW_CONFIG_DIR:-$EFFECTIVE_HOME/.openclaw}"
+ENV_FILE="${OPENCLAW_PODMAN_ENV:-$CONFIG_DIR/.env}"
+WORKSPACE_DIR="${OPENCLAW_WORKSPACE_DIR:-$CONFIG_DIR/workspace}"
+CONTAINER_NAME="${OPENCLAW_PODMAN_CONTAINER:-openclaw}"
+OPENCLAW_IMAGE="${OPENCLAW_PODMAN_IMAGE:-openclaw:local}"
+PODMAN_PULL="${OPENCLAW_PODMAN_PULL:-never}"
+HOST_GATEWAY_PORT="${OPENCLAW_PODMAN_GATEWAY_HOST_PORT:-${OPENCLAW_GATEWAY_PORT:-18789}}"
+HOST_BRIDGE_PORT="${OPENCLAW_PODMAN_BRIDGE_HOST_PORT:-${OPENCLAW_BRIDGE_PORT:-18790}}"
+# Keep Podman default local-only unless explicitly overridden.
+# Non-loopback binds require gateway.controlUi.allowedOrigins (security hardening).
+GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-loopback}"
+
+# Safe cwd for podman (openclaw is nologin; avoid inherited cwd from sudo)
+cd "$EFFECTIVE_HOME" 2>/dev/null || cd /tmp 2>/dev/null || true
+
+RUN_SETUP=false
+if [[ "${1:-}" == "setup" || "${1:-}" == "onboard" ]]; then
+  RUN_SETUP=true
+  shift
+fi
+
+mkdir -p "$CONFIG_DIR" "$WORKSPACE_DIR"
+# Subdirs the app may create at runtime (canvas, cron); create here so ownership is correct
+mkdir -p "$CONFIG_DIR/canvas" "$CONFIG_DIR/cron"
+chmod 700 "$CONFIG_DIR" "$WORKSPACE_DIR" 2>/dev/null || true
+
+if [[ -f "$ENV_FILE" ]]; then
+  set -a
+  # shellcheck source=/dev/null
+  source "$ENV_FILE" 2>/dev/null || true
+  set +a
+fi
+
+upsert_env_var() {
+  local file="$1"
+  local key="$2"
+  local value="$3"
+  local tmp
+  tmp="$(mktemp)"
+  if [[ -f "$file" ]]; then
+    awk -v k="$key" -v v="$value" '
+      BEGIN { found = 0 }
+      $0 ~ ("^" k "=") { print k "=" v; found = 1; next }
+      { print }
+      END { if (!found) print k "=" v }
+    ' "$file" >"$tmp"
+  else
+    printf '%s=%s\n' "$key" "$value" >"$tmp"
+  fi
+  mv "$tmp" "$file"
+  chmod 600 "$file" 2>/dev/null || true
+}
+
+generate_token_hex_32() {
+  if command -v openssl >/dev/null 2>&1; then
+    openssl rand -hex 32
+    return 0
+  fi
+  if command -v python3 >/dev/null 2>&1; then
+    python3 - <<'PY'
+import secrets
+print(secrets.token_hex(32))
+PY
+    return 0
+  fi
+  if command -v od >/dev/null 2>&1; then
+    od -An -N32 -tx1 /dev/urandom | tr -d " \n"
+    return 0
+  fi
+  echo "Missing dependency: need openssl or python3 (or od) to generate OPENCLAW_GATEWAY_TOKEN." >&2
+  exit 1
+}
+
+if [[ -z "${OPENCLAW_GATEWAY_TOKEN:-}" ]]; then
+  export OPENCLAW_GATEWAY_TOKEN="$(generate_token_hex_32)"
+  mkdir -p "$(dirname "$ENV_FILE")"
+  upsert_env_var "$ENV_FILE" "OPENCLAW_GATEWAY_TOKEN" "$OPENCLAW_GATEWAY_TOKEN"
+  echo "Generated OPENCLAW_GATEWAY_TOKEN and wrote it to $ENV_FILE." >&2
+fi
+
+# The gateway refuses to start unless gateway.mode=local is set in config.
+# Keep this minimal; users can run the wizard later to configure channels/providers.
+CONFIG_JSON="$CONFIG_DIR/openclaw.json"
+if [[ ! -f "$CONFIG_JSON" ]]; then
+  echo '{ gateway: { mode: "local" } }' >"$CONFIG_JSON"
+  chmod 600 "$CONFIG_JSON" 2>/dev/null || true
+  echo "Created $CONFIG_JSON (minimal gateway.mode=local)." >&2
+fi
+
+PODMAN_USERNS="${OPENCLAW_PODMAN_USERNS:-keep-id}"
+USERNS_ARGS=()
+RUN_USER_ARGS=()
+case "$PODMAN_USERNS" in
+  ""|auto) ;;
+  keep-id) USERNS_ARGS=(--userns=keep-id) ;;
+  host) USERNS_ARGS=(--userns=host) ;;
+  *)
+    echo "Unsupported OPENCLAW_PODMAN_USERNS=$PODMAN_USERNS (expected: keep-id, auto, host)." >&2
+    exit 2
+    ;;
+esac
+
+RUN_UID="$(id -u)"
+RUN_GID="$(id -g)"
+if [[ "$PODMAN_USERNS" == "keep-id" ]]; then
+  RUN_USER_ARGS=(--user "${RUN_UID}:${RUN_GID}")
+  echo "Starting container as uid=${RUN_UID} gid=${RUN_GID} (must match owner of $CONFIG_DIR)" >&2
+else
+  echo "Starting container without --user (OPENCLAW_PODMAN_USERNS=$PODMAN_USERNS), mounts may require ownership fixes." >&2
+fi
+
+ENV_FILE_ARGS=()
+[[ -f "$ENV_FILE" ]] && ENV_FILE_ARGS+=(--env-file "$ENV_FILE")
+
+if [[ "$RUN_SETUP" == true ]]; then
+  exec podman run --pull="$PODMAN_PULL" --rm -it \
+    --init \
+    "${USERNS_ARGS[@]}" "${RUN_USER_ARGS[@]}" \
+    -e HOME=/home/node -e TERM=xterm-256color -e BROWSER=echo \
+    -e OPENCLAW_GATEWAY_TOKEN="$OPENCLAW_GATEWAY_TOKEN" \
+    -v "$CONFIG_DIR:/home/node/.openclaw:rw" \
+    -v "$WORKSPACE_DIR:/home/node/.openclaw/workspace:rw" \
+    "${ENV_FILE_ARGS[@]}" \
+    "$OPENCLAW_IMAGE" \
+    node dist/index.js onboard "$@"
+fi
+
+podman run --pull="$PODMAN_PULL" -d --replace \
+  --name "$CONTAINER_NAME" \
+  --init \
+  "${USERNS_ARGS[@]}" "${RUN_USER_ARGS[@]}" \
+  -e HOME=/home/node -e TERM=xterm-256color \
+  -e OPENCLAW_GATEWAY_TOKEN="$OPENCLAW_GATEWAY_TOKEN" \
+  "${ENV_FILE_ARGS[@]}" \
+  -v "$CONFIG_DIR:/home/node/.openclaw:rw" \
+  -v "$WORKSPACE_DIR:/home/node/.openclaw/workspace:rw" \
+  -p "${HOST_GATEWAY_PORT}:18789" \
+  -p "${HOST_BRIDGE_PORT}:18790" \
+  "$OPENCLAW_IMAGE" \
+  node dist/index.js gateway --bind "$GATEWAY_BIND" --port 18789
+
+echo "Container $CONTAINER_NAME started. Dashboard: http://127.0.0.1:${HOST_GATEWAY_PORT}/"
+echo "Logs: podman logs -f $CONTAINER_NAME"
+echo "For auto-start/restarts, use: ./setup-podman.sh --quadlet (Quadlet + systemd user service)."

package/scripts/sandbox-browser-entrypoint.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+dedupe_chrome_args() {
+  local -A seen_args=()
+  local -a unique_args=()
+
+  for arg in "${CHROME_ARGS[@]}"; do
+    if [[ -n "${seen_args["$arg"]:+x}" ]]; then
+      continue
+    fi
+    seen_args["$arg"]=1
+    unique_args+=("$arg")
+  done
+
+  CHROME_ARGS=("${unique_args[@]}")
+}
+
+export DISPLAY=:1
+export HOME=/tmp/openclaw-home
+export XDG_CONFIG_HOME="${HOME}/.config"
+export XDG_CACHE_HOME="${HOME}/.cache"
+
+CDP_PORT="${OPENCLAW_BROWSER_CDP_PORT:-${CLAWDBOT_BROWSER_CDP_PORT:-9222}}"
+CDP_SOURCE_RANGE="${OPENCLAW_BROWSER_CDP_SOURCE_RANGE:-${CLAWDBOT_BROWSER_CDP_SOURCE_RANGE:-}}"
+VNC_PORT="${OPENCLAW_BROWSER_VNC_PORT:-${CLAWDBOT_BROWSER_VNC_PORT:-5900}}"
+NOVNC_PORT="${OPENCLAW_BROWSER_NOVNC_PORT:-${CLAWDBOT_BROWSER_NOVNC_PORT:-6080}}"
+ENABLE_NOVNC="${OPENCLAW_BROWSER_ENABLE_NOVNC:-${CLAWDBOT_BROWSER_ENABLE_NOVNC:-1}}"
+HEADLESS="${OPENCLAW_BROWSER_HEADLESS:-${CLAWDBOT_BROWSER_HEADLESS:-0}}"
+ALLOW_NO_SANDBOX="${OPENCLAW_BROWSER_NO_SANDBOX:-${CLAWDBOT_BROWSER_NO_SANDBOX:-0}}"
+NOVNC_PASSWORD="${OPENCLAW_BROWSER_NOVNC_PASSWORD:-${CLAWDBOT_BROWSER_NOVNC_PASSWORD:-}}"
+DISABLE_GRAPHICS_FLAGS="${OPENCLAW_BROWSER_DISABLE_GRAPHICS_FLAGS:-1}"
+DISABLE_EXTENSIONS="${OPENCLAW_BROWSER_DISABLE_EXTENSIONS:-1}"
+RENDERER_PROCESS_LIMIT="${OPENCLAW_BROWSER_RENDERER_PROCESS_LIMIT:-2}"
+
+mkdir -p "${HOME}" "${HOME}/.chrome" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}"
+
+Xvfb :1 -screen 0 1280x800x24 -ac -nolisten tcp &
+
+if [[ "${HEADLESS}" == "1" ]]; then
+  CHROME_ARGS=(
+    "--headless=new"
+  )
+else
+  CHROME_ARGS=()
+fi
+
+if [[ "${CDP_PORT}" -ge 65535 ]]; then
+  CHROME_CDP_PORT="$((CDP_PORT - 1))"
+else
+  CHROME_CDP_PORT="$((CDP_PORT + 1))"
+fi
+
+CHROME_ARGS+=(
+  "--remote-debugging-address=127.0.0.1"
+  "--remote-debugging-port=${CHROME_CDP_PORT}"
+  "--user-data-dir=${HOME}/.chrome"
+  "--no-first-run"
+  "--no-default-browser-check"
+  "--disable-dev-shm-usage"
+  "--disable-background-networking"
+  "--disable-features=TranslateUI"
+  "--disable-breakpad"
+  "--disable-crash-reporter"
+  "--no-zygote"
+  "--metrics-recording-only"
+)
+
+DISABLE_GRAPHICS_FLAGS_LOWER="${DISABLE_GRAPHICS_FLAGS,,}"
+if [[ "${DISABLE_GRAPHICS_FLAGS_LOWER}" == "1" || "${DISABLE_GRAPHICS_FLAGS_LOWER}" == "true" || "${DISABLE_GRAPHICS_FLAGS_LOWER}" == "yes" || "${DISABLE_GRAPHICS_FLAGS_LOWER}" == "on" ]]; then
+  CHROME_ARGS+=(
+    "--disable-3d-apis"
+    "--disable-gpu"
+    "--disable-software-rasterizer"
+  )
+fi
+
+DISABLE_EXTENSIONS_LOWER="${DISABLE_EXTENSIONS,,}"
+if [[ "${DISABLE_EXTENSIONS_LOWER}" == "1" || "${DISABLE_EXTENSIONS_LOWER}" == "true" || "${DISABLE_EXTENSIONS_LOWER}" == "yes" || "${DISABLE_EXTENSIONS_LOWER}" == "on" ]]; then
+  CHROME_ARGS+=(
+    "--disable-extensions"
+  )
+fi
+
+if [[ "${RENDERER_PROCESS_LIMIT}" =~ ^[0-9]+$ && "${RENDERER_PROCESS_LIMIT}" -gt 0 ]]; then
+  CHROME_ARGS+=("--renderer-process-limit=${RENDERER_PROCESS_LIMIT}")
+fi
+
+if [[ "${ALLOW_NO_SANDBOX}" == "1" ]]; then
+  CHROME_ARGS+=(
+    "--no-sandbox"
+    "--disable-setuid-sandbox"
+  )
+fi
+
+dedupe_chrome_args
+chromium "${CHROME_ARGS[@]}" about:blank &
+
+for _ in $(seq 1 50); do
+  if curl -sS --max-time 1 "http://127.0.0.1:${CHROME_CDP_PORT}/json/version" >/dev/null; then
+    break
+  fi
+  sleep 0.1
+done
+
+SOCAT_LISTEN_ADDR="TCP-LISTEN:${CDP_PORT},fork,reuseaddr,bind=0.0.0.0"
+if [[ -n "${CDP_SOURCE_RANGE}" ]]; then
+  SOCAT_LISTEN_ADDR="${SOCAT_LISTEN_ADDR},range=${CDP_SOURCE_RANGE}"
+fi
+socat "${SOCAT_LISTEN_ADDR}" "TCP:127.0.0.1:${CHROME_CDP_PORT}" &
+
+if [[ "${ENABLE_NOVNC}" == "1" && "${HEADLESS}" != "1" ]]; then
+  # VNC auth passwords are max 8 chars; use a random default when not provided.
+  if [[ -z "${NOVNC_PASSWORD}" ]]; then
+    NOVNC_PASSWORD="$(< /proc/sys/kernel/random/uuid)"
+    NOVNC_PASSWORD="${NOVNC_PASSWORD//-/}"
+    NOVNC_PASSWORD="${NOVNC_PASSWORD:0:8}"
+  fi
+  NOVNC_PASSWD_FILE="${HOME}/.vnc/passwd"
+  mkdir -p "${HOME}/.vnc"
+  x11vnc -storepasswd "${NOVNC_PASSWORD}" "${NOVNC_PASSWD_FILE}" >/dev/null
+  chmod 600 "${NOVNC_PASSWD_FILE}"
+  x11vnc -display :1 -rfbport "${VNC_PORT}" -shared -forever -rfbauth "${NOVNC_PASSWD_FILE}" -localhost &
+  websockify --web /usr/share/novnc/ "${NOVNC_PORT}" "localhost:${VNC_PORT}" &
+fi
+
+wait -n

package/scripts/sandbox-browser-setup.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME="openclaw-sandbox-browser:bookworm-slim"
+
+docker build -t "${IMAGE_NAME}" -f Dockerfile.sandbox-browser .
+echo "Built ${IMAGE_NAME}"

package/scripts/sandbox-common-setup.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BASE_IMAGE="${BASE_IMAGE:-openclaw-sandbox:bookworm-slim}"
+TARGET_IMAGE="${TARGET_IMAGE:-openclaw-sandbox-common:bookworm-slim}"
+PACKAGES="${PACKAGES:-curl wget jq coreutils grep nodejs npm python3 git ca-certificates golang-go rustc cargo unzip pkg-config libasound2-dev build-essential file}"
+INSTALL_PNPM="${INSTALL_PNPM:-1}"
+INSTALL_BUN="${INSTALL_BUN:-1}"
+BUN_INSTALL_DIR="${BUN_INSTALL_DIR:-/opt/bun}"
+INSTALL_BREW="${INSTALL_BREW:-1}"
+BREW_INSTALL_DIR="${BREW_INSTALL_DIR:-/home/linuxbrew/.linuxbrew}"
+FINAL_USER="${FINAL_USER:-sandbox}"
+
+if ! docker image inspect "${BASE_IMAGE}" >/dev/null 2>&1; then
+  echo "Base image missing: ${BASE_IMAGE}"
+  echo "Building base image via scripts/sandbox-setup.sh..."
+  scripts/sandbox-setup.sh
+fi
+
+echo "Building ${TARGET_IMAGE} with: ${PACKAGES}"
+
+docker build \
+  -t "${TARGET_IMAGE}" \
+  -f Dockerfile.sandbox-common \
+  --build-arg BASE_IMAGE="${BASE_IMAGE}" \
+  --build-arg PACKAGES="${PACKAGES}" \
+  --build-arg INSTALL_PNPM="${INSTALL_PNPM}" \
+  --build-arg INSTALL_BUN="${INSTALL_BUN}" \
+  --build-arg BUN_INSTALL_DIR="${BUN_INSTALL_DIR}" \
+  --build-arg INSTALL_BREW="${INSTALL_BREW}" \
+  --build-arg BREW_INSTALL_DIR="${BREW_INSTALL_DIR}" \
+  --build-arg FINAL_USER="${FINAL_USER}" \
+  .
+
+cat <<NOTE
+Built ${TARGET_IMAGE}.
+To use it, set agents.defaults.sandbox.docker.image to "${TARGET_IMAGE}" and restart.
+If you want a clean re-create, remove old sandbox containers:
+  docker rm -f \$(docker ps -aq --filter label=openclaw.sandbox=1)
+NOTE

package/scripts/sandbox-setup.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME="openclaw-sandbox:bookworm-slim"
+
+docker build -t "${IMAGE_NAME}" -f Dockerfile.sandbox .
+echo "Built ${IMAGE_NAME}"

package/scripts/setup-auth-system.sh

@@ -0,0 +1,119 @@
+#!/bin/bash
+# Setup OpenClaw Auth Management System
+# Run this once to set up:
+# 1. Long-lived Claude Code token
+# 2. Auth monitoring with notifications
+# 3. Instructions for Termux widgets
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+echo "=== OpenClaw Auth System Setup ==="
+echo ""
+
+# Step 1: Check current auth status
+echo "Step 1: Checking current auth status..."
+"$SCRIPT_DIR/claude-auth-status.sh" full || true
+echo ""
+
+# Step 2: Set up long-lived token
+echo "Step 2: Long-lived token setup"
+echo ""
+echo "Option A: Use 'claude setup-token' (recommended)"
+echo "  - Creates a long-lived API token"
+echo "  - No daily re-auth needed"
+echo "  - Run: claude setup-token"
+echo ""
+echo "Would you like to set up a long-lived token now? [y/N]"
+read -r SETUP_TOKEN
+
+if [[ "$SETUP_TOKEN" =~ ^[Yy] ]]; then
+    echo ""
+    echo "Opening https://console.anthropic.com/settings/api-keys"
+    echo "Create a new key or copy existing one, then paste below."
+    echo ""
+    claude setup-token
+fi
+
+echo ""
+
+# Step 3: Set up auth monitoring
+echo "Step 3: Auth monitoring setup"
+echo ""
+echo "The auth monitor checks expiry every 30 minutes and notifies you."
+echo ""
+echo "Configure notification channels:"
+echo ""
+
+# Check for ntfy
+echo "  ntfy.sh: Free push notifications to your phone"
+echo "  1. Install ntfy app on your phone"
+echo "  2. Subscribe to a topic (e.g., 'openclaw-alerts')"
+echo ""
+echo "Enter ntfy.sh topic (or leave blank to skip):"
+read -r NTFY_TOPIC
+
+# Phone notification
+echo ""
+echo "  OpenClaw message: Send warning via OpenClaw itself"
+echo "Enter your phone number for alerts (or leave blank to skip):"
+read -r PHONE_NUMBER
+
+# Update service file
+SERVICE_FILE="$SCRIPT_DIR/systemd/openclaw-auth-monitor.service"
+if [ -n "$NTFY_TOPIC" ]; then
+    sed -i "s|# Environment=NOTIFY_NTFY=.*|Environment=NOTIFY_NTFY=$NTFY_TOPIC|" "$SERVICE_FILE"
+fi
+if [ -n "$PHONE_NUMBER" ]; then
+    sed -i "s|# Environment=NOTIFY_PHONE=.*|Environment=NOTIFY_PHONE=$PHONE_NUMBER|" "$SERVICE_FILE"
+fi
+
+# Install systemd units
+echo ""
+echo "Installing systemd timer..."
+mkdir -p ~/.config/systemd/user
+cp "$SCRIPT_DIR/systemd/openclaw-auth-monitor.service" ~/.config/systemd/user/
+cp "$SCRIPT_DIR/systemd/openclaw-auth-monitor.timer" ~/.config/systemd/user/
+systemctl --user daemon-reload
+systemctl --user enable --now openclaw-auth-monitor.timer
+
+echo "Auth monitor installed and running."
+echo ""
+
+# Step 4: Termux widget setup
+echo "Step 4: Termux widget setup (for phone)"
+echo ""
+echo "To set up quick auth from your phone:"
+echo ""
+echo "1. Install Termux and Termux:Widget from F-Droid"
+echo "2. Create ~/.shortcuts/ directory in Termux:"
+echo "   mkdir -p ~/.shortcuts"
+echo ""
+echo "3. Copy the widget scripts:"
+echo "   scp $SCRIPT_DIR/termux-quick-auth.sh phone:~/.shortcuts/ClawdAuth"
+echo "   scp $SCRIPT_DIR/termux-auth-widget.sh phone:~/.shortcuts/ClawdAuth-Full"
+echo ""
+echo "4. Make them executable on phone:"
+echo "   ssh phone 'chmod +x ~/.shortcuts/Clawd*'"
+echo ""
+echo "5. Add Termux:Widget to your home screen"
+echo "6. Tap the widget to see your auth scripts"
+echo ""
+echo "The quick widget (ClawdAuth) shows status and opens auth URL if needed."
+echo "The full widget (ClawdAuth-Full) provides guided re-auth flow."
+echo ""
+
+# Summary
+echo "=== Setup Complete ==="
+echo ""
+echo "What's configured:"
+echo "  - Auth status: $SCRIPT_DIR/claude-auth-status.sh"
+echo "  - Mobile re-auth: $SCRIPT_DIR/mobile-reauth.sh"
+echo "  - Auth monitor: systemctl --user status openclaw-auth-monitor.timer"
+echo ""
+echo "Quick commands:"
+echo "  Check auth:  $SCRIPT_DIR/claude-auth-status.sh"
+echo "  Re-auth:     $SCRIPT_DIR/mobile-reauth.sh"
+echo "  Test monitor: $SCRIPT_DIR/auth-monitor.sh"
+echo ""