squad-openclaw 2026.2.2002 → 2026.2.2004

package/README.md

@@ -31,7 +31,7 @@ These directories are **completely blocked** from all filesystem operations (rea
 
 | Path | Reason |
 |---|---|
-| `~/.openclaw/squad-ceo-data/squad-relay.json` | Contains ed25519 private key for relay device identity |
+| `~/.openclaw/squad-ceo-data/relay/squad-relay.json` | Contains ed25519 private key for relay device identity |
 | `~/.openclaw/*.bak` | Backup files at the top level contain unredacted config (tokens, keys) that would bypass redaction |
 
 ### Layer 2: Redacted Files (hardcoded, non-configurable)
@@ -60,7 +60,7 @@ Operators can customize via the `fs.allowedRoots` config option.
 These files/directories cannot be written to, even if they fall within `allowedRoots`:
 
 - `~/.openclaw/openclaw.json` — operator configuration (read-only with redaction)
-- `~/.openclaw/squad-ceo-data/squad-relay.json` — relay device private key
+- `~/.openclaw/squad-ceo-data/relay/squad-relay.json` — relay device private key
 - All blocked directories above (credentials, devices, identity)
 - All `.bak` files at `~/.openclaw/` top level
 

package/dist/index.d.ts

@@ -21,11 +21,11 @@
  * │  REDACTED on read (sensitive fields replaced with "[REDACTED]"):       │
  * │    • ~/.openclaw/openclaw.json → channel.*.botToken                    │
  * │    • ~/.openclaw/openclaw.json → gateway.auth.*                        │
- * │    • squad-ceo-data/squad-relay.json → deviceKeys.privateKeyPem        │
+ * │    • squad-ceo-data/relay/squad-relay.json → deviceKeys.privateKeyPem   │
  * │                                                                         │
  * │  WRITE-PROTECTED (no writes, deletes, or renames):                      │
  * │    • ~/.openclaw/openclaw.json                                          │
- * │    • squad-ceo-data/squad-relay.json                                    │
+ * │    • squad-ceo-data/relay/squad-relay.json                               │
  * │    • All blocked directories above                                      │
  * │                                                                         │
  * │  The bundle is NOT minified to allow security auditing of the           │

package/dist/index.js

@@ -1,3 +1,107 @@
+// src/agents.ts
+import { execSync } from "child_process";
+function registerAgentMethods(api) {
+  api.registerGatewayMethod(
+    "squad.agents.add",
+    async ({ params, respond }) => {
+      const name = params?.name;
+      const model = params?.model;
+      if (!name || typeof name !== "string" || !name.trim()) {
+        respond(false, { error: "Missing or empty 'name' parameter" });
+        return;
+      }
+      const safeName = name.trim();
+      if (!/^[a-zA-Z0-9][a-zA-Z0-9 _-]*$/.test(safeName)) {
+        respond(false, { error: "Agent name must start with a letter/number and contain only letters, numbers, spaces, hyphens, or underscores" });
+        return;
+      }
+      try {
+        let cmd = `openclaw agents add ${JSON.stringify(safeName)} --non-interactive`;
+        if (model) {
+          cmd += ` --model ${JSON.stringify(model)}`;
+        }
+        const output = execSync(cmd, {
+          timeout: 3e4,
+          encoding: "utf-8",
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        respond(true, { ok: true, output: output.slice(0, 1e3) });
+      } catch (err2) {
+        const msg = err2 instanceof Error ? err2.message : String(err2);
+        const stderr = err2?.stderr;
+        respond(false, {
+          error: `Failed to add agent: ${stderr || msg}`.slice(0, 500)
+        });
+      }
+    }
+  );
+  api.registerGatewayMethod(
+    "squad.agents.delete",
+    async ({ params, respond }) => {
+      const agentId = params?.agentId;
+      if (!agentId || typeof agentId !== "string" || !agentId.trim()) {
+        respond(false, { error: "Missing or empty 'agentId' parameter" });
+        return;
+      }
+      if (agentId === "main") {
+        respond(false, { error: "Cannot delete the main agent" });
+        return;
+      }
+      if (!/^[a-z0-9][a-z0-9-]*$/.test(agentId)) {
+        respond(false, { error: "Invalid agent ID format" });
+        return;
+      }
+      try {
+        const output = execSync(
+          `openclaw agents delete ${JSON.stringify(agentId)} --non-interactive 2>&1`,
+          { timeout: 3e4, encoding: "utf-8" }
+        );
+        respond(true, { ok: true, output: output.slice(0, 1e3) });
+      } catch (err2) {
+        const msg = err2 instanceof Error ? err2.message : String(err2);
+        const stderr = err2?.stderr;
+        respond(false, {
+          error: `Failed to delete agent: ${stderr || msg}`.slice(0, 500)
+        });
+      }
+    }
+  );
+  api.registerGatewayMethod(
+    "squad.agents.set-identity",
+    async ({ params, respond }) => {
+      const agentId = params?.agentId;
+      const name = params?.name;
+      const emoji = params?.emoji;
+      const theme = params?.theme;
+      if (!agentId || typeof agentId !== "string") {
+        respond(false, { error: "Missing 'agentId' parameter" });
+        return;
+      }
+      const args = [`--agent`, JSON.stringify(agentId)];
+      if (name) args.push(`--name`, JSON.stringify(name));
+      if (emoji) args.push(`--emoji`, JSON.stringify(emoji));
+      if (theme) args.push(`--theme`, JSON.stringify(theme));
+      if (args.length <= 2) {
+        respond(false, { error: "No identity fields provided (name, emoji, or theme)" });
+        return;
+      }
+      try {
+        const output = execSync(
+          `openclaw agents set-identity ${args.join(" ")} 2>&1`,
+          { timeout: 15e3, encoding: "utf-8" }
+        );
+        respond(true, { ok: true, output: output.slice(0, 1e3) });
+      } catch (err2) {
+        const msg = err2 instanceof Error ? err2.message : String(err2);
+        const stderr = err2?.stderr;
+        respond(false, {
+          error: `Failed to set identity: ${stderr || msg}`.slice(0, 500)
+        });
+      }
+    }
+  );
+}
+
 // src/entities.ts
 import { Type as T } from "@sinclair/typebox";
 import path3 from "path";
@@ -266,7 +370,7 @@ var SENSITIVE_BLOCKED_DIRS = [
   path2.join(OPENCLAW_DIR, "identity")
 ];
 var SENSITIVE_BLOCKED_FILES = [
-  path2.join(OPENCLAW_DIR, "squad-ceo-data", "squad-relay.json")
+  path2.join(OPENCLAW_DIR, "squad-ceo-data", "relay", "squad-relay.json")
 ];
 function isSensitivePath(resolvedPath) {
   for (const blocked of SENSITIVE_BLOCKED_DIRS) {
@@ -1111,11 +1215,16 @@ function registerSqlTools(api) {
 }
 
 // src/version.ts
-import { execSync } from "child_process";
+import { execSync as execSync2 } from "child_process";
 import fs5 from "fs";
 import path5 from "path";
 import { fileURLToPath } from "url";
 var PACKAGE_NAME = "squad-openclaw";
+var CONFIG_PATH = path5.join(
+  process.env.HOME ?? "/root",
+  ".openclaw",
+  "openclaw.json"
+);
 function getCurrentVersion() {
   const thisFile = fileURLToPath(import.meta.url);
   const pkgPath = path5.resolve(path5.dirname(thisFile), "..", "package.json");
@@ -1175,18 +1284,36 @@ function registerVersionMethods(api) {
       try {
         const before = getCurrentVersion();
         let updateOutput = "";
+        let configBackup = null;
+        try {
+          configBackup = fs5.readFileSync(CONFIG_PATH, "utf-8");
+        } catch {
+        }
+        try {
+          execSync2("openclaw doctor --fix 2>&1", {
+            timeout: 3e4,
+            encoding: "utf-8"
+          });
+        } catch {
+        }
         try {
-          updateOutput = execSync(
+          updateOutput = execSync2(
             `openclaw plugins update ${PACKAGE_NAME} 2>&1`,
             { timeout: 12e4, encoding: "utf-8" }
           );
         } catch {
           try {
-            updateOutput = execSync(
+            updateOutput = execSync2(
               `npm install -g ${PACKAGE_NAME}@latest 2>&1`,
               { timeout: 12e4, encoding: "utf-8" }
             );
           } catch (npmErr) {
+            if (configBackup) {
+              try {
+                fs5.writeFileSync(CONFIG_PATH, configBackup, "utf-8");
+              } catch {
+              }
+            }
             const msg = npmErr instanceof Error ? npmErr.message : String(npmErr);
             respond(false, {
               error: `Update failed: ${msg}`,
@@ -1208,7 +1335,7 @@ function registerVersionMethods(api) {
         );
         setTimeout(() => {
           try {
-            execSync("openclaw gateway restart 2>&1", {
+            execSync2("openclaw gateway restart 2>&1", {
               timeout: 3e4,
               encoding: "utf-8"
             });
@@ -1319,7 +1446,7 @@ function readOperatorToken() {
     return null;
   }
 }
-var RELAY_DATA_DIR = path6.join(os.homedir(), ".openclaw", "squad-ceo-data");
+var RELAY_DATA_DIR = path6.join(os.homedir(), ".openclaw", "squad-ceo-data", "relay");
 var RELAY_STATE_PATH = path6.join(RELAY_DATA_DIR, "squad-relay.json");
 function readRelayState() {
   try {
@@ -1356,7 +1483,7 @@ function loadOrCreateRelayDeviceKeys() {
 }
 function writeDeviceInfoFile(keys) {
   const stateDir = process.env.OPENCLAW_STATE_DIR || path6.join(os.homedir(), ".openclaw");
-  const infoPath = path6.join(stateDir, "squad-ceo-data", "relay-device-info.json");
+  const infoPath = path6.join(stateDir, "squad-ceo-data", "relay", "relay-device-info.json");
   const info = {
     deviceId: keys.deviceId,
     publicKey: keys.publicKey,
@@ -1895,6 +2022,7 @@ function squadAppPlugin(api) {
   registerFilesystemTools(api);
   registerSqlTools(api);
   registerVersionMethods(api);
+  registerAgentMethods(api);
   api.registerGatewayMethod(
     "tools.invoke",
     async ({ params, respond }) => {

package/openclaw.plugin.json

@@ -10,7 +10,7 @@
         "type": "array",
         "items": { "type": "string" },
         "default": ["~/.openclaw"],
-        "description": "Restrict filesystem operations to these directories. Defaults to [\"~/.openclaw\"]. Hardcoded blocks on credentials/, devices/, identity/, squad-relay.json, and .bak files always apply."
+        "description": "Restrict filesystem operations to these directories. Defaults to [\"~/.openclaw\"]. Hardcoded blocks on credentials/, devices/, identity/, relay/squad-relay.json, and .bak files always apply."
       },
       "relay.enabled": {
         "type": "boolean",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squad-openclaw",
-  "version": "2026.2.2002",
+  "version": "2026.2.2004",
   "description": "Entity registry, filesystem tools, and version management plugin for OpenClaw gateway",
   "type": "module",
   "main": "./dist/index.js",