velaclaw-dev 0.2.0

package/members/member-template/runtime/docker-compose.yml

@@ -0,0 +1,53 @@
+name: REPLACE_COMPOSE_PROJECT
+
+services:
+  openclaw-member:
+    image: ghcr.io/openclaw/openclaw:latest
+    container_name: REPLACE_CONTAINER_ID
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:18800:18789"
+    environment:
+      OPENCLAW_CONFIG_DIR: /home/node/.openclaw
+      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
+      HTTP_PROXY: http://host.docker.internal:17892
+      HTTPS_PROXY: http://host.docker.internal:17892
+      http_proxy: http://host.docker.internal:17892
+      https_proxy: http://host.docker.internal:17892
+      NO_PROXY: 127.0.0.1,localhost,::1,host.docker.internal
+      no_proxy: 127.0.0.1,localhost,::1,host.docker.internal
+    user: "1000:1000"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    read_only: true
+    tmpfs:
+      - /tmp:size=256m,mode=1777
+    pids_limit: 256
+    mem_limit: 2g
+    cpus: 1.5
+    volumes:
+      - ./config:/home/node/.openclaw:rw
+      - ./workspace:/home/node/.openclaw/workspace:rw
+      - ./secrets:/home/node/.openclaw/secrets:rw
+      - ../../private-memory:/home/node/.openclaw/workspace/private-memory:rw
+      - ../../private-skills:/home/node/.openclaw/workspace/private-skills:rw
+      - ../../private-tools:/home/node/.openclaw/workspace/private-tools:rw
+      - ../../private-docs:/home/node/.openclaw/workspace/private-docs:rw
+      - ../../../../teams/REPLACE_TEAM_SLUG/assets/current:/srv/team-shared:ro
+      - ../../../../teams/REPLACE_TEAM_SLUG/assets/current:/home/node/.openclaw/workspace/team-shared:ro
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://127.0.0.1:18789/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+    networks:
+      - member_isolated
+
+networks:
+  member_isolated:
+    driver: bridge

package/members/member-template/runtime/logs/README.md

@@ -0,0 +1,3 @@
+# Runtime logs directory
+
+Store local runtime logs here if needed.

package/members/member-template/runtime/secrets/.gitkeep

@@ -0,0 +1 @@
+

package/members/member-template/runtime/secrets/README.md

@@ -0,0 +1,3 @@
+# Runtime secrets directory
+
+Place only this member runtime's secrets here.

package/members/member-template/runtime/workspace/.gitkeep

@@ -0,0 +1 @@
+

package/members/member-template/runtime/workspace/README.md

@@ -0,0 +1,3 @@
+# Runtime workspace directory
+
+This is the isolated runtime workspace for the member container.

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "velaclaw-dev",
+  "version": "0.2.0",
+  "description": "Velaclaw control-plane MVP prototype",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "velaclaw": "dist/cli.js",
+    "velaclaw-dev": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "scripts",
+    "members/member-template",
+    "members/README.md",
+    "members/LAUNCH_CHECKLIST.md",
+    "services/litellm/docker-compose.yml",
+    "services/litellm/config.yaml",
+    "services/litellm/litellm.env.example",
+    "team-assets",
+    "shared-snapshots",
+    "ARCHITECTURE.md",
+    "README.md",
+    "README.dev.md",
+    "README.public.md",
+    "TESTING.md",
+    "RELEASING.md",
+    "provision-member.md",
+    "pic",
+    ".gitignore"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "dev": "tsx watch src/server.ts",
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/server.js",
+    "load:test-team": "node scripts/team-load-test.mjs",
+    "smoke:skills": "node scripts/shared-skill-combo-test.mjs",
+    "smoke:assets": "node scripts/shared-asset-stack-test.mjs",
+    "verify:install": "node scripts/verify-install.mjs",
+    "release:check": "npm run build && npm run verify:install && npm pack --dry-run",
+    "publish:npm": "npm publish --access public",
+    "publish:private": "npm publish",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "express": "^4.21.2"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.1",
+    "@types/node": "^22.15.3",
+    "tsx": "^4.19.4",
+    "typescript": "^5.8.3"
+  }
+}

package/provision-member.md

@@ -0,0 +1,87 @@
+# Provision a new Velaclaw member runtime
+
+This guide provisions a new member runtime from `members/member-template/`.
+
+## Overview
+
+Each member gets:
+- private memory
+- private skills
+- private tool bindings
+- private docs
+- isolated OpenClaw runtime config/workspace/secrets/logs
+
+## Steps
+
+### 1. Copy the template
+
+From `velaclaw/members/`:
+
+```bash
+cp -a member-template <member-id>
+```
+
+### 2. Edit runtime config
+
+File:
+- `members/<member-id>/runtime/config/openclaw.json`
+
+Replace:
+- `REPLACE_WITH_RANDOM_GATEWAY_TOKEN`
+- `REPLACE_WITH_USER_ID`
+
+Optional:
+- assistant identity name
+- model defaults
+- disabled tools
+
+### 3. Add member channel secrets
+
+Place secrets in:
+- `members/<member-id>/runtime/secrets/`
+
+Examples:
+- `telegram-bot-token`
+
+### 4. Adjust compose settings
+
+File:
+- `members/<member-id>/runtime/docker-compose.yml`
+
+Replace:
+- `REPLACE_MEMBER_ID`
+- published port `18800` if another member already uses it
+
+### 5. Start runtime
+
+From the member runtime directory:
+
+```bash
+docker compose up -d
+```
+
+### 6. Verify isolation
+
+Check:
+- container is healthy
+- only the member's own workspace is mounted
+- no docker socket is mounted
+- member secrets stay local to that runtime
+- high-risk tools remain disabled or approval-gated
+
+## Naming recommendations
+
+Use stable member IDs such as:
+- `zane`
+- `alice`
+- `research`
+- `ops`
+
+## Safety checklist
+
+- unique bot token per member runtime
+- unique allowlist user ID(s)
+- unique published port if exposing locally
+- no host primary workspace mounts
+- no host docker socket mounts
+- no shared writable team asset mounts

package/scripts/shared-asset-stack-test.mjs

@@ -0,0 +1,369 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+import {
+  acceptInvitationByCode,
+  createInvitationForTeam,
+  createTeam,
+  createTeamAssetProposal,
+  getTeamAssetCapabilityRegistryBySlug,
+  getTeamAssetServerManifestBySlug,
+  getTeamMemberWorkspaceById,
+  runMemberRuntimeActionForTeam
+} from "../dist/data.js";
+
+const execFileAsync = promisify(execFile);
+const ROOT = process.env.VELACLAW_ROOT
+  ? path.resolve(process.env.VELACLAW_ROOT)
+  : path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+async function run(command, args, options = {}) {
+  const result = await execFileAsync(command, args, {
+    cwd: options.cwd || ROOT,
+    maxBuffer: 1024 * 1024 * 24
+  });
+  return {
+    stdout: String(result.stdout || ""),
+    stderr: String(result.stderr || "")
+  };
+}
+
+async function ensureReadTool(configPath) {
+  const raw = JSON.parse(await fs.readFile(configPath, "utf8"));
+  raw.tools ??= {};
+  raw.tools.alsoAllow = Array.from(new Set([...(Array.isArray(raw.tools.alsoAllow) ? raw.tools.alsoAllow : []), "read"]));
+  raw.tools.fs = {
+    ...(typeof raw.tools.fs === "object" && raw.tools.fs ? raw.tools.fs : {}),
+    workspaceOnly: true
+  };
+  await fs.writeFile(configPath, `${JSON.stringify(raw, null, 2)}\n`, "utf8");
+}
+
+async function waitForRuntimeHealthy(teamSlug, memberId, timeoutMs = 120000) {
+  const started = Date.now();
+  while (Date.now() - started < timeoutMs) {
+    const { stdout } = await run("curl", ["-sS", `http://127.0.0.1:4318/api/teams/${teamSlug}/members/${memberId}/runtime`]);
+    const payload = JSON.parse(stdout);
+    if (payload?.runtime?.container?.health === "healthy") {
+      return payload.runtime;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 2000));
+  }
+  throw new Error(`runtime did not become healthy for ${memberId}`);
+}
+
+async function findSessionEntry(sessionsPath, suffix, timeoutMs = 30000) {
+  const started = Date.now();
+  while (Date.now() - started < timeoutMs) {
+    const raw = JSON.parse(await fs.readFile(sessionsPath, "utf8"));
+    const key = Object.keys(raw).find((entry) => entry.includes(suffix));
+    if (key) {
+      return {
+        sessionKey: key,
+        sessionId: raw[key].sessionId,
+        entry: raw[key]
+      };
+    }
+    await new Promise((resolve) => setTimeout(resolve, 1000));
+  }
+  throw new Error(`session not found for ${suffix}`);
+}
+
+function buildSyntheticAssets() {
+  return {
+    skills: [
+      {
+        title: "Thesis Merge Composer",
+        content: `---
+name: thesis-merge-composer
+description: Merge multiple short drafts into one coherent final memo. Use when the user provides two or more fragments and wants one integrated output.
+---
+
+# Thesis Merge Composer
+
+Use this skill when multiple short drafts need to become one coherent memo.
+
+Rules:
+- Preserve all meaningful arguments from each draft.
+- Remove repetition.
+- Produce one integrated final memo, not a bullet outline.
+- Prefer natural Chinese prose over formal report boilerplate.
+`
+      },
+      {
+        title: "Consensus Stress Tester",
+        content: `---
+name: consensus-stress-tester
+description: Challenge consensus views and identify what the market may already be pricing in. Use for investment or strategic analysis.
+---
+
+# Consensus Stress Tester
+
+When a thesis sounds obvious, ask:
+- what is already consensus?
+- what assumptions are embedded in the current narrative?
+- what operational bottlenecks could delay or weaken the expected outcome?
+
+Always add a section that stresses the consensus view before giving a final conclusion.
+`
+      },
+      {
+        title: "CN Final Polish",
+        content: `---
+name: cn-final-polish
+description: Turn a stiff or AI-sounding Chinese draft into more natural, direct prose.
+---
+
+# CN Final Polish
+
+Use this skill for the last pass of Chinese writing.
+
+Rules:
+- Remove empty transition phrases.
+- Prefer direct sentences.
+- Avoid exaggerated slogan-like endings.
+- Keep the tone calm, concrete, and readable.
+`
+      }
+    ],
+    memory: {
+      title: "Team Preference Ledger",
+      content: `# Team Preference Ledger
+
+When this workspace writes a final investment memo, include the exact phrase "风险是按时间定价的" once in the final answer.
+`
+    },
+    workflow: {
+      title: "Investment Memo Flow",
+      content: `# Investment Memo Flow
+
+Follow these three sections in order:
+
+1. Merged View
+2. Second-Layer Risks
+3. Final Memo
+
+Use these section headings exactly in the final answer.
+`
+    }
+  };
+}
+
+async function createPublishedAssets(teamSlug) {
+  const assets = buildSyntheticAssets();
+  const created = [];
+
+  for (const skill of assets.skills) {
+    const result = await createTeamAssetProposal({
+      teamSlug,
+      category: "shared-skills",
+      title: skill.title,
+      content: skill.content,
+      submittedByLabel: "manager",
+      sourceZone: "collab"
+    });
+    created.push({ type: "skill", title: skill.title, assetId: result.asset.id, status: result.asset.status });
+  }
+
+  for (const [type, category, payload] of [
+    ["memory", "shared-memory", assets.memory],
+    ["workflow", "shared-workflows", assets.workflow]
+  ]) {
+    const result = await createTeamAssetProposal({
+      teamSlug,
+      category,
+      title: payload.title,
+      content: payload.content,
+      submittedByLabel: "manager",
+      sourceZone: "collab"
+    });
+    created.push({ type, title: payload.title, assetId: result.asset.id, status: result.asset.status });
+  }
+
+  return created;
+}
+
+async function runMemberScenario(containerName, sessionId, prompt) {
+  const { stdout } = await run("sudo", [
+    "-n",
+    "docker",
+    "exec",
+    containerName,
+    "sh",
+    "-lc",
+    `cd /app && openclaw agent --session-id ${sessionId} --message ${JSON.stringify(prompt)} --json`
+  ]);
+  return JSON.parse(stdout);
+}
+
+async function readSessionArtifacts(memberRoot, suffix) {
+  const sessionsPath = path.join(memberRoot, "config", "agents", "main", "sessions", "sessions.json");
+  const { sessionId, sessionKey, entry } = await findSessionEntry(sessionsPath, suffix);
+  const jsonlPath = path.join(memberRoot, "config", "agents", "main", "sessions", `${sessionId}.jsonl`);
+  const jsonlLines = (await fs.readFile(jsonlPath, "utf8"))
+    .trim()
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => JSON.parse(line));
+
+  const assistantToolCalls = jsonlLines
+    .filter((item) => item.type === "message" && item.message?.role === "assistant")
+    .flatMap((item) => item.message.content || [])
+    .filter((item) => item.type === "toolCall")
+    .map((item) => ({
+      name: item.name,
+      arguments: item.arguments
+    }));
+
+  const finalAssistantText =
+    jsonlLines
+      .filter((item) => item.type === "message" && item.message?.role === "assistant")
+      .flatMap((item) => item.message.content || [])
+      .filter((item) => item.type === "text")
+      .map((item) => item.text)
+      .join("\n\n") || "";
+
+  return {
+    sessionId,
+    sessionKey,
+    entry,
+    assistantToolCalls,
+    finalAssistantText,
+    jsonlPath
+  };
+}
+
+async function main() {
+  await fs.mkdir(path.join(ROOT, "artifacts"), { recursive: true });
+  const teamSuffix = Date.now();
+  const team = await createTeam({
+    name: `Asset Stack Test ${teamSuffix}`,
+    slug: `asset-stack-test-${teamSuffix}`,
+    description: "Synthetic skills/memory/workflow combination regression test",
+    managerLabel: "Test Manager"
+  });
+
+  const createdAssets = await createPublishedAssets(team.slug);
+  const invitation = await createInvitationForTeam(team.slug, {
+    inviteeLabel: "Asset Stack Probe",
+    memberId: "asset-stack-probe@team.local",
+    memberEmail: "asset-stack-probe@team.local",
+    role: "member",
+    createdBy: "shared-asset-stack-test"
+  });
+  const accepted = await acceptInvitationByCode(invitation.code, {
+    identityName: "Asset Stack Probe"
+  });
+
+  const memberId = accepted.policy.memberId;
+  const memberRoot = path.join(ROOT, "members", team.slug, memberId, "runtime");
+  const configPath = path.join(memberRoot, "config", "openclaw.json");
+  await ensureReadTool(configPath);
+  await runMemberRuntimeActionForTeam(team.slug, memberId, "start");
+  const runtime = await waitForRuntimeHealthy(team.slug, memberId);
+
+  const probeWorkspace = await getTeamMemberWorkspaceById(team.slug, memberId);
+  const registry = await getTeamAssetCapabilityRegistryBySlug(team.slug);
+  const workspaceSkillFiles = (await fs.readdir(path.join(memberRoot, "workspace", "skills"))).sort();
+
+  const skillMemoryPrompt = [
+    "请整合下面两段投资草稿，先挑战市场共识，再给我一版自然的中文最终稿。",
+    "",
+    "草稿A：市场普遍认为该公司会因为 AI 数据中心扩张而快速增长。",
+    "草稿B：审批、资本开支和供应链可能让业绩兑现更慢。",
+    "",
+    "如果团队有固定写作偏好，请遵守。"
+  ].join("\n");
+
+  const workflowPrompt = [
+    "请按团队共享流程输出一版投资分析。",
+    "",
+    "输入观点：公司受益于 AI 数据中心电力需求，但兑现节奏可能慢于市场预期。",
+    "",
+    "请严格按共享流程输出最终结果。"
+  ].join("\n");
+
+  const skillMemoryResult = await runMemberScenario(runtime.containerName, "asset-stack-skill-memory", skillMemoryPrompt);
+  const workflowResult = await runMemberScenario(runtime.containerName, "asset-stack-workflow", workflowPrompt);
+
+  const skillMemorySession = await readSessionArtifacts(memberRoot, "asset-stack-skill-memory");
+  const workflowSession = await readSessionArtifacts(memberRoot, "asset-stack-workflow");
+
+  const report = {
+    createdAt: new Date().toISOString(),
+    team,
+    member: {
+      memberId,
+      runtime,
+      workspaceSkillFiles
+    },
+    createdAssets,
+    registryCounts: registry.counts,
+    registryTitles: Object.fromEntries(
+      Object.entries(registry.byKind).map(([kind, items]) => [kind, items.map((item) => item.title)])
+    ),
+    scenarios: {
+      skillMemory: {
+        sessionId: skillMemorySession.sessionId,
+        loadedSkills: (skillMemorySession.entry.skillsSnapshot?.skills || []).map((entry) => entry.name),
+        toolCalls: skillMemorySession.assistantToolCalls,
+        finalAssistantText:
+          skillMemoryResult?.result?.payloads?.map((entry) => entry.text).filter(Boolean).join("\n\n") ||
+          skillMemorySession.finalAssistantText
+      },
+      workflow: {
+        sessionId: workflowSession.sessionId,
+        loadedSkills: (workflowSession.entry.skillsSnapshot?.skills || []).map((entry) => entry.name),
+        toolCalls: workflowSession.assistantToolCalls,
+        finalAssistantText:
+          workflowResult?.result?.payloads?.map((entry) => entry.text).filter(Boolean).join("\n\n") ||
+          workflowSession.finalAssistantText
+      }
+    },
+    checks: {
+      sharedSkillsDiscovered:
+        workspaceSkillFiles.filter((name) => name.startsWith("team-shared-")).length >= 3,
+      gatewayUsedForRuns:
+        skillMemorySession.entry.modelProvider === "team-gateway" &&
+        workflowSession.entry.modelProvider === "team-gateway",
+      skillMemoryReadsSharedSkills:
+        skillMemorySession.assistantToolCalls.some((call) => call.name === "read" && String(call.arguments?.path || "").includes("team-shared-")),
+      skillMemoryReadsSharedMemory:
+        skillMemorySession.assistantToolCalls.some((call) => {
+          const targetPath = String(call.arguments?.path || "");
+          return call.name === "read" && (
+            targetPath.includes("/MEMORY.md") ||
+            targetPath.includes("/docs/team-shared/active/memory/") ||
+            targetPath.includes("team-shared-memory-")
+          );
+        }) ||
+        Array.isArray(skillMemorySession.entry.systemPromptReport?.injectedWorkspaceFiles) &&
+          skillMemorySession.entry.systemPromptReport.injectedWorkspaceFiles.some((file) => file?.name === "MEMORY.md" && file?.missing === false),
+      skillMemoryOutputReflectsMemory:
+        (skillMemoryResult?.result?.payloads?.map((entry) => entry.text).join("\n") || "").includes("风险是按时间定价的"),
+      workflowReadsSharedWorkflow:
+        workflowSession.assistantToolCalls.some((call) => {
+          const targetPath = String(call.arguments?.path || "");
+          return call.name === "read" && (
+            targetPath.includes("/docs/team-shared/active/workflows/") ||
+            targetPath.includes("team-shared-workflow-")
+          );
+        }),
+      workflowOutputUsesExpectedSections:
+        ["Merged View", "Second-Layer Risks", "Final Memo"].every((heading) =>
+          (workflowResult?.result?.payloads?.map((entry) => entry.text).join("\n") || "").includes(heading)
+        )
+    }
+  };
+
+  const artifactPath = path.join(ROOT, "artifacts", `shared-asset-stack-test-${teamSuffix}.json`);
+  await fs.writeFile(artifactPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+  console.log(JSON.stringify({ artifactPath, report }, null, 2));
+}
+
+main().catch((error) => {
+  console.error(error instanceof Error ? error.stack || error.message : String(error));
+  process.exitCode = 1;
+});