openclaw-sc 5.38.0

package/.env.example

@@ -0,0 +1,13 @@
+# Optional provider keys. Leave blank in source control.
+DEEPSEEK_API_KEY=
+TAVILY_API_KEY=
+OLLAMA_BASE_URL=http://127.0.0.1:11434
+
+# Optional path to ripgrep. If empty, sc uses bundled rg when present or the
+# system `rg` command from PATH.
+SC_RG_PATH=
+
+# Optional sidecar settings. Keep runtime state outside published packages.
+SC_SIDECAR_PORT=18792
+SC_INBOX_DELIVERY_MODE=notify-only
+SC_INBOX_CHAT_INJECT=0

package/INSTALL.md

@@ -0,0 +1,13 @@
+# sc install notes
+
+1. Install Node.js 22 or newer.
+2. Run `npm install` and `npm run lint`.
+3. Copy this directory to `%USERPROFILE%\.openclaw\workspace\plugins\sc`.
+4. Enable the `sc` plugin in OpenClaw plugin configuration.
+5. Keep real `.env`, logs, inbox events, task files, and local OpenClaw memory
+   outside the public repository.
+
+Optional tools:
+
+- Install ripgrep as `rg`, or set `SC_RG_PATH`.
+- Set provider keys through environment variables only.

package/LICENSE

@@ -0,0 +1,233 @@
+# Business Source License 1.1
+
+Copyright (c) 2026 Yupeng Zhou (周宇鹏)
+
+This license is designed to protect the intellectual property of independent
+creators while granting free use to individual users, students, researchers,
+and small non-commercial operators.
+
+──────────────────────────────────────────
+
+## 1. Core Parameters
+
+| | |
+|---|---|
+| Licensor | Yupeng Zhou |
+| Software | Universal Brute Workpack — full-capability Agent MCP workpack |
+| Change License | Apache License v2.0 |
+| Change Date | 2030-06-29 |
+
+On and after the Change Date, this software automatically converts to Apache
+License v2.0. Prior to that date, the following terms are in full legal effect.
+
+## 2. Grant — Free Use
+
+The following uses are completely free, no authorization or payment required:
+
+  a) Individual developers for technical research, study, personal projects,
+     or personal Agent/MCP workflows on non-company devices;
+
+  b) Students and academic researchers for non-commercial experiments;
+
+  c) Individual operators with annual revenue under ¥1,000,000 RMB, for
+     internal non-sale tools that do not form a commercial product, commercial
+     service, SaaS, or paid automation offering.
+
+Within the above scope, you may:
+
+  - Download and read source code;
+  - Run locally;
+  - Modify for personal or permitted internal use;
+  - Use in personal projects and non-commercial experiments.
+
+## 3. Commercial Restrictions
+
+Without written authorization from the Licensor, no person or entity may:
+
+  a) Use this software or derivatives in production, commercial products,
+     internal enterprise deployment, intranet deployment, commercial services,
+     paid consulting delivery, managed automation services, or Agent/MCP
+     tool platforms by any enterprise or organization with annual revenue
+     greater than or equal to ¥1,000,000 RMB;
+
+  b) Use this software or derivatives as a component of a product, service,
+     platform, plugin marketplace, AI agent system, automation workbench,
+     developer tool, SaaS, hosted MCP gateway, or internal corporate agent
+     infrastructure that is monetized directly or indirectly;
+
+  c) Replicate, port, or reconstruct functionally equivalent software in
+     any programming language based on understanding of this software's core
+     architecture and design, including but not limited to: full-capability
+     MCP tool orchestration, stdio/SSE dual transport workpack design,
+     profile-based tool exposure and denial, graceful degradation chains,
+     local file/search/code/command tool aggregation, memory recall fallback,
+     and Agent pipeline orchestration, and use it for commercial profit;
+
+  d) Package this software or derivatives as a commercial SaaS service,
+     hosted MCP service, enterprise internal service, OEM product, white-label
+     product, marketplace listing, or paid tool bundle without a commercial
+     license or revenue-sharing agreement with the Licensor;
+
+  e) Remove, obscure, or misrepresent this license, the Licensor, or the
+     Change Date in redistributed copies or derivative works.
+
+## 4. Commercial Licensing
+
+To use this software under the restricted scope above, contact the Licensor
+for written commercial authorization.
+
+Commercial license types include but are not limited to:
+
+  - Enterprise internal deployment license;
+  - OEM / white-label license;
+  - SaaS hosting license;
+  - Agent platform / MCP gateway integration license;
+  - Marketplace redistribution license;
+  - Revenue-sharing partnership model.
+
+## 5. Enforcement
+
+This agreement is a globally applicable commercial contract. Any person or
+entity downloading, installing, copying, modifying, distributing, or using this
+software is deemed to have read and agreed to all terms of this agreement,
+regardless of location.
+
+Jurisdiction:
+
+  a) Disputes within the PRC: governed by the laws of the People's Republic
+     of China and heard by the People's Court of the Licensor's domicile;
+
+  b) Disputes outside the PRC: governed by the UN CISG and international IP
+     conventions where applicable; parties agree to arbitration at HKIAC under
+     its rules, with Hong Kong as the seat of arbitration;
+
+  c) Regardless of jurisdiction, the Licensor may seek injunctive relief,
+     including interim and permanent injunctions, in courts where the
+     infringer's assets, users, infrastructure, or business are located.
+
+Violations of Section 3 constitute breach of contract. The Licensor may:
+
+  a) Require the infringer to immediately cease use and destroy all copies;
+  b) Recover commercial profits obtained during the infringement as damages;
+  c) Seek statutory, contractual, and equitable remedies available under
+     applicable law;
+  d) File litigation or arbitration in a court/forum of competent jurisdiction.
+
+## 6. Disclaimer
+
+This software is provided "AS IS", without warranty of any kind, express or
+implied, including but not limited to warranties of merchantability, fitness
+for a particular purpose, non-infringement, security, availability, correctness,
+or suitability for any production environment. In no event shall the Licensor
+be liable for any damages arising from the use of this software.
+
+---
+
+# 商业源代码许可证 1.1 (中文版)
+
+版权所有 (c) 2026 周宇鹏
+
+本许可证旨在保护独立技术创新者的智力成果，同时为个人用户、学生、
+研究者和小规模非商业使用者提供免费使用权利。
+
+──────────────────────────────────────────
+
+## 1. 核心参数
+
+授权人 (Licensor): 周宇鹏
+
+软件名称 (Software): Universal Brute Workpack — 全能力 Agent MCP 工作包
+
+变更许可证 (Change License): Apache License v2.0
+
+变更日期 (Change Date): 2030-06-29
+
+自变更日期起，本软件将自动转为 Apache License v2.0。在此之前，
+以下条款具备完全法律效力。
+
+## 2. 免费使用范围
+
+以下情况完全免费，无需授权，无需付费：
+
+  a) 个人开发者在非公司设备上用于技术研究、学习、个人项目或个人
+     Agent/MCP 工作流；
+
+  b) 学生及学术研究人员用于非商业目的的实验；
+
+  c) 年营业额低于 ¥100 万元人民币的个体经营者，用于自身非对外售卖
+     的内部工具，且不构成商业产品、商业服务、SaaS 或收费自动化服务。
+
+在上述范围内，允许：
+
+  - 下载、阅读源码；
+  - 本地运行；
+  - 为个人或被允许的内部用途修改；
+  - 在个人项目和非商业实验中使用。
+
+## 3. 商业限制
+
+未经授权人书面授权，任何人或实体不得从事以下行为：
+
+  a) 任何年营业额大于或等于 ¥100 万元人民币的企业或组织，在生产环境、
+     商业产品、企业内部部署、内网部署、商业服务、付费咨询交付、托管
+     自动化服务或 Agent/MCP 工具平台中使用本软件或其衍生品；
+
+  b) 将本软件或其衍生品作为产品、服务、平台、插件市场、AI Agent 系统、
+     自动化工作台、开发者工具、SaaS、托管 MCP 网关或企业内部 Agent 基础
+     设施的组成部分，并直接或间接商业化；
+
+  c) 在理解本软件核心架构与设计思路后，采用任何编程语言进行功能等效
+     的复刻、移植或重构，并用于商业牟利。核心架构与设计思路包括但不
+     限于：全能力 MCP 工具编排、stdio/SSE 双 transport 工作包设计、
+     基于 profile 的工具暴露与 deny、渐进降级链路、本地文件/搜索/代码/
+     命令工具聚合、记忆召回 fallback、Agent pipeline 编排；
+
+  d) 未经商业授权或收入分成协议，将本软件或其衍生品打包为商业 SaaS、
+     托管 MCP 服务、企业内部服务、OEM 产品、白标产品、市场分发项或
+     收费工具包；
+
+  e) 在再分发副本或衍生作品中移除、遮蔽或错误表述本许可证、授权人或
+     变更日期。
+
+## 4. 商业授权获取
+
+如需在上述限制范围内使用本软件，请联系授权人获取书面商业授权。
+
+商业授权类型包括但不限于：
+
+  - 企业内部部署授权；
+  - OEM / 白标授权；
+  - SaaS 托管授权；
+  - Agent 平台 / MCP 网关集成授权；
+  - 市场再分发授权；
+  - 收入分成合作模式。
+
+## 5. 法律效力
+
+本协议为全球适用的商业合同。任何个人或实体下载、安装、复制、修改、
+分发或使用本软件，即视为已阅读并同意本协议全部条款，无论其所在地。
+
+管辖权条款：
+
+  a) 中华人民共和国境内的争议，受中华人民共和国法律管辖，由授权人
+     所在地人民法院审理；
+
+  b) 中华人民共和国境外的争议，在适用范围内适用《联合国国际货物销售
+     合同公约》(CISG) 及国际知识产权相关公约，双方同意提交香港国际
+     仲裁中心 (HKIAC) 按其仲裁规则进行仲裁，仲裁地为香港；
+
+  c) 无论管辖地为何，授权人均有权在侵权方资产、用户、基础设施或营业地
+     的法院寻求禁令救济，包括临时禁令和永久禁令。
+
+违反本协议第 3 条的行为构成违约。授权人有权：
+
+  a) 要求侵权方立即停止使用并销毁所有拷贝；
+  b) 追缴侵权期间的商业获利作为经济赔偿；
+  c) 寻求适用法律下的法定、合同及衡平救济；
+  d) 向有管辖权的法院或仲裁机构提起诉讼/仲裁。
+
+## 6. 免责声明
+
+本软件按"现状"提供，不附带任何明示或默示的担保，包括但不限于适销性、
+特定用途适用性、不侵权、安全性、可用性、正确性或适合任何生产环境的
+担保。在任何情况下，授权人均不对因使用本软件而产生的任何损害承担责任。

package/README.md

@@ -0,0 +1,123 @@
+# OpenClaw sc
+
+sc is an OpenClaw plugin for local agent orchestration. It adds sub-agent task
+dispatch, MCP-style tool routing, local worker jobs, memory search helpers, and
+sidecar delivery plumbing for OpenClaw runtimes.
+
+This repository is the public source package. It excludes private runtime
+state, local logs, task inbox files, backups, service binaries, and credentials.
+
+## What sc Provides
+
+| Area | Capability |
+| --- | --- |
+| Sub-agent orchestration | Dispatches bounded sub-agent tasks and records completion artifacts. |
+| MCP tool bridge | Exposes search, memory, file, code, worker, and pipeline tools through a bridge layer. |
+| Local worker path | Runs deterministic local worker jobs without spending model tokens. |
+| Memory helpers | Provides SQLite, FTS, and optional vector-search helper modules. |
+| Sidecar integration | Receives sub-agent completion events through a sidecar server and inbox flow. |
+| Safety controls | Includes prompt-injection checks, blocked-tool rules, and emergency stop boundaries. |
+
+## Requirements
+
+- OpenClaw with plugin support.
+- Node.js 22 or newer.
+- PowerShell on Windows for the documented install commands.
+- Optional: `rg` / ripgrep installed on PATH, or set `SC_RG_PATH`.
+- Optional: Tavily, DeepSeek, Ollama, or other provider keys depending on which
+  tools you enable.
+
+The npm package does not include private runtime directories or Windows service
+helpers. If your local deployment uses NSSM or bundled binaries, keep those in
+your private runtime install, not in the public package.
+
+## Install From Source
+
+```powershell
+git clone https://github.com/haoyun18881-beep/openclaw-sc.git
+cd openclaw-sc
+npm install
+npm run lint
+```
+
+Copy the plugin into your OpenClaw plugin workspace:
+
+```powershell
+$target = "$env:USERPROFILE\.openclaw\workspace\plugins\sc"
+New-Item -ItemType Directory -Force -Path $target | Out-Null
+Copy-Item -Recurse -Force .\* $target
+```
+
+Then add or enable `sc` in your OpenClaw plugin configuration. The exact
+OpenClaw config shape can vary by runtime version, but the plugin entry should
+point at the copied `sc` directory and load `openclaw.plugin.json`.
+
+## Runtime Configuration
+
+Start from the empty example:
+
+```powershell
+Copy-Item .env.example .env
+```
+
+Keep real secrets out of git. Common settings:
+
+| Variable | Purpose |
+| --- | --- |
+| `DEEPSEEK_API_KEY` | Optional model provider key used by configured tools. |
+| `TAVILY_API_KEY` | Optional web-search key. |
+| `OLLAMA_BASE_URL` | Optional local vision/model endpoint. |
+| `SC_RG_PATH` | Optional explicit path to `rg`; otherwise sc tries bundled rg, then system `rg`. |
+| `SC_SIDECAR_PORT` | Sidecar port when the sidecar server is used. |
+| `SC_INBOX_DELIVERY_MODE` | Inbox completion delivery mode, for example `notify-only`. |
+| `SC_INBOX_CHAT_INJECT` | Whether inbox completion messages are injected into chat. |
+
+## Main Files
+
+| Path | Purpose |
+| --- | --- |
+| `index.js` | OpenClaw plugin entry. |
+| `openclaw.plugin.json` | Plugin metadata and tool contracts. |
+| `lib/` | Core routing, task, memory, security, and orchestration modules. |
+| `tools/bridge.js` | Tool bridge and MCP-style tool handlers. |
+| `tools/sidecar/sidecar-server.cjs` | Sidecar server for completion delivery. |
+| `tools/sidecar/subagent-runner.cjs` | Sub-agent runner process. |
+| `workers/worker.js` | Local worker implementation. |
+| `vector/` | Optional vector-search helper modules. |
+
+## Validation
+
+Run syntax checks:
+
+```powershell
+npm run lint
+```
+
+Preview the npm package contents:
+
+```powershell
+npm run pack:dry
+```
+
+The package preview should not include:
+
+- `node_modules/`
+- `logs/`
+- `tools/sidecar/inbox/`
+- `tools/sidecar/tasks/`
+- `.env`
+- private OpenClaw memory or session files
+- `nssm.exe`
+- backup files such as `*.bak`
+
+## Security
+
+sc can touch local files, memory records, tool outputs, and sub-agent task
+artifacts. Review `SECURITY.md` before publishing forks or sharing task reports.
+Never publish real `.env`, `openclaw.json`, logs, task-state JSON, inbox events,
+credentials, cookies, tokens, private prompts, or full local paths from a
+private deployment.
+
+## License
+
+Business Source License 1.1. See `LICENSE`.

package/SECURITY.md

@@ -0,0 +1,27 @@
+# Security
+
+sc is an OpenClaw plugin that can route local files, web search, memory lookup,
+worker tasks, and sub-agent jobs. Treat prompts, task files, logs, memory
+records, inbox events, screenshots, and API keys as sensitive.
+
+## Do Not Commit
+
+- `.env` or `.env.*`
+- `openclaw.json` or private runtime configuration
+- `logs/`, `tools/logs/`, `tools/sidecar/logs/`
+- `tools/sidecar/inbox/` and `tools/sidecar/tasks/`
+- `memory/`, `state/`, `backups/`, `runtime/`, `workspace/`
+- request/response dumps, full task reports, private prompts, cookies, tokens,
+  API keys, Authorization headers, or private paths
+
+## Runtime Boundaries
+
+The public package excludes local runtime state and bundled service binaries.
+Install external tools such as ripgrep through the operating system package
+manager, or set `SC_RG_PATH` to a reviewed executable.
+
+## Reporting Issues
+
+Report only redacted reproduction details. Do not include real credentials,
+private prompts, raw session logs, task-state JSON, inbox events, or full local
+configuration files.