velaclaw-dev 0.2.0

package/members/LAUNCH_CHECKLIST.md

@@ -0,0 +1,13 @@
+# Member runtime launch checklist
+
+Before launching a member runtime, verify:
+
+- [ ] member directory copied from template
+- [ ] `runtime/config/openclaw.json` placeholders replaced
+- [ ] `runtime/secrets/` contains only this member's secrets
+- [ ] `runtime/docker-compose.yml` has unique member ID and port
+- [ ] no Docker socket mount present
+- [ ] no primary workspace mount present
+- [ ] team assets are not mounted writable
+- [ ] high-risk actions remain approval-gated
+- [ ] Telegram allowlist points to the intended member only

package/members/README.md

@@ -0,0 +1,17 @@
+# Member runtimes
+
+Each member should get a separate directory under this path.
+
+Recommended layout per member:
+
+- `private-memory/`
+- `private-skills/`
+- `private-tools/`
+- `private-docs/`
+- `runtime/`
+  - `config/`
+  - `workspace/`
+  - `secrets/`
+  - `logs/`
+
+Duplicate the `member-template/` directory to create a new member runtime.

package/members/member-template/README.md

@@ -0,0 +1,9 @@
+# Member template
+
+Copy this directory to `../<member-id>/` when provisioning a new member runtime.
+
+After copying:
+- set the member ID in config
+- add the member's channel token(s)
+- set allowlist user IDs
+- keep all secrets private to that member

package/members/member-template/private-docs/README.md

@@ -0,0 +1,3 @@
+# Private member docs
+
+Keep drafts, notes, and member-private references here.

package/members/member-template/private-memory/README.md

@@ -0,0 +1,3 @@
+# Private member memory
+
+Store only this member's private memory here.

package/members/member-template/private-skills/README.md

@@ -0,0 +1,4 @@
+# Private member skills
+
+Member-specific skills live here.
+If a skill becomes broadly useful, publish a reviewed copy into team shared skills.

package/members/member-template/private-tools/README.md

@@ -0,0 +1,4 @@
+# Private member tools
+
+Keep only member-private tool bindings or metadata here.
+Do not place team-wide shared credentials here.

package/members/member-template/runtime/config/README.md

@@ -0,0 +1,3 @@
+# Runtime config directory
+
+Put the member runtime's OpenClaw config here.

package/members/member-template/runtime/config/local-plugins/member-quota-guard/index.js

@@ -0,0 +1,123 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+
+const DEFAULT_POLICY_PATH = "/home/node/.openclaw/team-policy.json";
+const DEFAULT_USAGE_PATH = "/home/node/.openclaw/team-usage.json";
+
+async function safeReadJson(filePath) {
+  try {
+    return JSON.parse(await fs.readFile(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+async function safeWriteJson(filePath, value) {
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  await fs.writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function currentPeriods() {
+  const now = new Date();
+  const day = now.toISOString().slice(0, 10);
+  const month = day.slice(0, 7);
+  return { day, month };
+}
+
+function defaultUsage(periods) {
+  return {
+    day: periods.day,
+    month: periods.month,
+    dailyCount: 0,
+    monthlyCount: 0,
+    lastSeenAt: null
+  };
+}
+
+async function loadPolicyAndUsage(config) {
+  const policyPath = config?.policyPath || DEFAULT_POLICY_PATH;
+  const usagePath = config?.usagePath || DEFAULT_USAGE_PATH;
+  const policy = await safeReadJson(policyPath);
+  const periods = currentPeriods();
+  const existingUsage = (await safeReadJson(usagePath)) || defaultUsage(periods);
+  const usage = {
+    ...defaultUsage(periods),
+    ...existingUsage
+  };
+
+  if (usage.day !== periods.day) {
+    usage.day = periods.day;
+    usage.dailyCount = 0;
+  }
+  if (usage.month !== periods.month) {
+    usage.month = periods.month;
+    usage.monthlyCount = 0;
+  }
+
+  return { policyPath, usagePath, policy, usage };
+}
+
+function isCommandOnly(text) {
+  const value = String(text || "").trim();
+  return value.startsWith("/");
+}
+
+export default definePluginEntry({
+  id: "member-quota-guard",
+  name: "Member Quota Guard",
+  description: "Enforce manager-owned runtime quota and pause policy for member claws",
+  register(api) {
+    api.registerHook("before_dispatch", async (event) => {
+      const body = String(event.body || event.content || "").trim();
+      if (!body) return;
+      if (isCommandOnly(body)) return;
+
+      const config = api.pluginConfig || {};
+      const { usagePath, policy, usage } = await loadPolicyAndUsage(config);
+      const quota = policy?.quota;
+      if (!quota) return;
+
+      if (quota.status === "paused") {
+        return {
+          handled: true,
+          text: "当前这个成员小虾已被 team manager 暂停使用。请联系团队管理员恢复配额。"
+        };
+      }
+
+      if (usage.dailyCount >= quota.dailyMessages) {
+        return {
+          handled: true,
+          text: `今天的消息配额已用完（${quota.dailyMessages}/day）。请联系 team manager 提额或明天再试。`
+        };
+      }
+
+      if (usage.monthlyCount >= quota.monthlyMessages) {
+        return {
+          handled: true,
+          text: `本月的消息配额已用完（${quota.monthlyMessages}/month）。请联系 team manager 提额。`
+        };
+      }
+
+      usage.dailyCount += 1;
+      usage.monthlyCount += 1;
+      usage.lastSeenAt = new Date().toISOString();
+      await safeWriteJson(usagePath, usage);
+    });
+
+    api.registerHook("before_tool_call", async (event) => {
+      if (event.toolName !== "subagents") return;
+
+      const config = api.pluginConfig || {};
+      const { policy } = await loadPolicyAndUsage(config);
+      const quota = policy?.quota;
+      if (!quota) return;
+      if (quota.maxSubagents > 0) return;
+
+      return {
+        block: true,
+        blockReason: "Subagents are disabled for this member by team manager quota."
+      };
+    });
+  }
+});

package/members/member-template/runtime/config/local-plugins/member-quota-guard/openclaw.plugin.json

@@ -0,0 +1,19 @@
+{
+  "id": "member-quota-guard",
+  "name": "Member Quota Guard",
+  "description": "Enforces manager-owned member runtime policy for pause state and message quotas.",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "policyPath": {
+        "type": "string",
+        "default": "/home/node/.openclaw/team-policy.json"
+      },
+      "usagePath": {
+        "type": "string",
+        "default": "/home/node/.openclaw/team-usage.json"
+      }
+    }
+  }
+}

package/members/member-template/runtime/config/local-plugins/member-quota-guard/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@local/member-quota-guard",
+  "version": "0.1.0",
+  "type": "module",
+  "openclaw": {
+    "extensions": [
+      "./index.js"
+    ]
+  }
+}

package/members/member-template/runtime/config/local-plugins/member-runtime-upgrader/index.js

@@ -0,0 +1,97 @@
+import { createRequire } from "node:module";
+
+let definePluginEntry = (entry) => entry;
+try {
+  const runtimeRequire = createRequire("/app/package.json");
+  ({ definePluginEntry } = runtimeRequire("openclaw/plugin-sdk/plugin-entry"));
+} catch {}
+
+const DEFAULT_API_BASE_URL = "http://host.docker.internal:4318";
+
+async function fetchJson(url, init = {}) {
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/json",
+      ...(init.body ? { "Content-Type": "application/json" } : {}),
+      ...(init.headers || {})
+    },
+    ...init
+  });
+
+  const text = await response.text();
+  let payload;
+  try {
+    payload = text ? JSON.parse(text) : null;
+  } catch {
+    payload = text;
+  }
+
+  if (!response.ok) {
+    const message =
+      payload && typeof payload === "object" && typeof payload.error === "string"
+        ? payload.error
+        : typeof payload === "string"
+          ? payload
+          : `${response.status} ${response.statusText}`;
+    throw new Error(message);
+  }
+
+  return payload;
+}
+
+async function scheduleUpgrade(config) {
+  const apiBaseUrl = config?.apiBaseUrl || DEFAULT_API_BASE_URL;
+  const teamSlug = String(config?.teamSlug || "").trim();
+  const memberId = String(config?.memberId || "").trim();
+  if (!teamSlug || !memberId) {
+    throw new Error("upgrade plugin config is incomplete");
+  }
+
+  return fetchJson(`${apiBaseUrl}/api/teams/${encodeURIComponent(teamSlug)}/members/${encodeURIComponent(memberId)}/upgrade`, {
+    method: "POST",
+    body: JSON.stringify({
+      notifyChannel: config?.notifyChannel || undefined,
+      notifyTo: config?.notifyTo ? `${config.notifyChannel}:${config.notifyTo}` : undefined
+    })
+  });
+}
+
+function resultText(result) {
+  if (result?.status === "already_in_progress") {
+    return "当前已有升级任务在进行中，稍等几十秒再试。";
+  }
+
+  return [
+    "已开始升级当前成员 runtime。",
+    "我会同步主模板、拉取最新镜像并自动重建容器。",
+    "通常 20 到 60 秒恢复，恢复后我会再发一条完成通知。"
+  ].join("\n");
+}
+
+export default definePluginEntry({
+  id: "member-runtime-upgrader",
+  name: "Member Runtime Upgrader",
+  description: "Schedule a self-upgrade for the current member runtime.",
+  register(api) {
+    api.registerCommand({
+      name: "upgrade",
+      description: "Upgrade this member runtime from the latest team template and image.",
+      acceptsArgs: false,
+      nativeNames: { default: "upgrade" },
+      handler: async (ctx) => {
+        try {
+          const result = await scheduleUpgrade({
+            ...(api.pluginConfig || {}),
+            notifyChannel: String(ctx?.channel || "").trim(),
+            notifyTo: String(ctx?.senderId || "").trim()
+          });
+          return { text: resultText(result) };
+        } catch (error) {
+          return {
+            text: `升级失败: ${error instanceof Error ? error.message : String(error)}`
+          };
+        }
+      }
+    });
+  }
+});

package/members/member-template/runtime/config/local-plugins/member-runtime-upgrader/openclaw.plugin.json

@@ -0,0 +1,21 @@
+{
+  "id": "member-runtime-upgrader",
+  "name": "Member Runtime Upgrader",
+  "description": "Lets a member runtime schedule its own template/image upgrade via /upgrade.",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "apiBaseUrl": {
+        "type": "string",
+        "default": "http://host.docker.internal:4318"
+      },
+      "teamSlug": {
+        "type": "string"
+      },
+      "memberId": {
+        "type": "string"
+      }
+    }
+  }
+}

package/members/member-template/runtime/config/local-plugins/member-runtime-upgrader/package.json

@@ -0,0 +1,10 @@
+{
+  "name": "@local/member-runtime-upgrader",
+  "version": "0.1.0",
+  "type": "module",
+  "openclaw": {
+    "extensions": [
+      "./index.js"
+    ]
+  }
+}