From 9a1744dbdc39eb9950f694c51e88e4c3999786d0 Mon Sep 17 00:00:00 2001 From: Paul Grey Date: Sat, 16 May 2026 10:34:47 +1200 Subject: [PATCH] =?UTF-8?q?fix(openclaw):=200.4.2=20=E2=80=94=20verified?= =?UTF-8?q?=20Pinata=20install=20flow=20+=20security=20warnings=20preamble?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A live Pinata Agents install of 0.4.1 surfaced one code bug, two doc lies, and one missing operator preamble. This bundle ships all four fixes as 0.4.2. ## Code: `Plugin loaded:` now reports the actual tool count The README told operators to grep for `[xpr-agents] Plugin loaded: 72 tools (35 read, 37 write)` — a string the code never emitted. The code emitted `Plugin loaded: ()`, no count. Rather than backing out the README claim, instrument the registration. `xprAgentsPlugin()` now wraps `api.registerTool` with a counter and logs: [xpr-agents] Plugin loaded: 72 tools, mainnet (https://proton.eosusa.io) The count is computed from real registrations, so it auto-tracks any future tool additions and the README claim stays true. ## Doc lie 1: harness install path was unverified README and PINATA.md hand-waved "register with your harness" because we'd never actually traced what an OpenClaw harness does with the package. Now verified empirically: - Plain `npm install @xpr-agents/openclaw` is NOT sufficient — the harness does not auto-scan workspace `node_modules`. - The supported install is `openclaw plugins install @xpr-agents/openclaw` which downloads from npm, copies to `~/.openclaw/extensions/openclaw/`, and auto-writes both `plugins.entries.openclaw.enabled` and `plugins.installs.openclaw.*` metadata (sha256, integrity, install path, ISO timestamp) to `~/.openclaw/openclaw.json`. Docs now show the verified command, the exact JSON diff the installer writes, and explicitly call out the `npm-install-is-not-enough` trap. ## Doc lie 2: `XPR_ACCOUNT` placement was ambiguous PINATA.md (and implicit in the README's env block) suggested `XPR_ACCOUNT` could go in the plugin's config tree. It can't — the plugin reads `process.env.XPR_ACCOUNT`, which is populated from the gateway env layer (`env.vars` in `openclaw.json`), NOT from `plugins.entries.openclaw.config`. Operators putting it in the config tree end up in silent read-only mode. Docs now show the correct `env.vars.XPR_ACCOUNT` surface with a contrastive note pointing at the wrong location. ## Missing preamble: 19 install-time security warnings OpenClaw's installer scans tarballs and flags risky patterns. It finds 19 in `@xpr-agents/openclaw` — every one intentional and named in the new "Security notes" section: - 16 × env-var-plus-network-send: each skill reads its own service API key (REPLICATE_API_TOKEN, GITHUB_TOKEN, PINATA_JWT, SHELLBOOK_API_KEY, COINGECKO_API_KEY, A2A_SIGNING_KEY) and calls that service. No blockchain key is read from env. - 2 × dynamic-code-execution: that is literally what the `code-sandbox` skill does. - 1 × child_process exec: the proton CLI shell-out. The post- charliebot security feature itself, ironically flagged. The whole point of v0.4.x is that the blockchain key never enters the agent process — it stays in the proton CLI's encrypted keychain and we cross that trust boundary via this exec call. Operators evaluating the package see 19 lines of red text at install time and bail. The new section pre-empts that. ## Pinata-specific restart mechanism The imperative `openclaw gateway restart` doesn't work on Pinata's container — they don't expose systemctl, the command errors with "Gateway service disabled." The actual mechanism is config-driven: patching `openclaw.json` makes the harness emit SIGUSR1 to the gateway process. PINATA.md now documents this with the expected restart event shape. ## Harness-vs-standalone registration gap The standalone `create-xpr-agent` scaffold auto-registers via the runner's `ensureRegistered()`. The harness path loads only the plugin, so the account stays absent from `agentcore::agents` until the operator explicitly calls `xpr_register_agent`. Every `xpr_update_*` / `xpr_set_agent_status` call fails with `Agent not found` until then. Docs now name this explicitly and use `xpr_register_agent` as the canonical "first signed test" — replacing the previous "send 0.0001 XPR" recipe that didn't work anyway (the plugin has no transfer tool; it's domain-scoped to the registry/escrow/feedback/validation/ A2A surface). ## Verification - 80 openclaw tests pass - Smoke-test confirms `Plugin loaded: 72 tools, mainnet (...)` line emitted by `dist/index.js` - All harness-flow specifics verified against a live OpenClaw 2026.3.x install (Pinata Agents container) --- docs/PINATA.md | 128 ++++++++++++++++++++++++++------- openclaw/README.md | 133 +++++++++++++++++++++++++++-------- openclaw/dist/index.d.ts.map | 2 +- openclaw/dist/index.js | 29 +++++--- openclaw/dist/index.js.map | 2 +- openclaw/package.json | 2 +- openclaw/src/index.ts | 29 +++++--- 7 files changed, 247 insertions(+), 78 deletions(-) diff --git a/docs/PINATA.md b/docs/PINATA.md index 4684039..8c5c8ab 100644 --- a/docs/PINATA.md +++ b/docs/PINATA.md @@ -80,55 +80,131 @@ You should NOT need to repeat this step on subsequent sessions — the keychain ## Step 2 — Install the OpenClaw plugin -A single npm install gives your Pinata agent **all 72 XPR MCP tools plus all 13 bundled skills** — `xpr-agent-operator` (system prompt) + 12 domain skills (DeFi, NFT, lending, governance, XMD, smart contracts, creative, web-scraping, code-sandbox, structured-data, tax, shellbook). Skills ship pre-built in the tarball; the plugin manifest lists them so harnesses that honor the `skills` field auto-load them. +The supported install on Pinata Agents (verified on OpenClaw 2026.3.x) is the OpenClaw plugin CLI, **not** plain `npm install`. Pinata's harness doesn't auto-scan workspace `node_modules` for plugins; it scans `~/.openclaw/extensions//`. ```bash # In the Pinata agent's Console -npm i @xpr-agents/openclaw +openclaw plugins install @xpr-agents/openclaw ``` -### 2a. Set the required env var +This downloads from npm, copies the plugin to `~/.openclaw/extensions/openclaw/`, and **auto-writes** the install metadata + enables it in `~/.openclaw/openclaw.json`: -**Without `XPR_ACCOUNT` set, the plugin loads in read-only mode and every signed tool silently fails.** Set these in Pinata's per-agent env / secrets panel: +```jsonc +{ + "plugins": { + "entries": { + "openclaw": { "enabled": true } + }, + "installs": { + "openclaw": { + "source": "npm", + "spec": "@xpr-agents/openclaw", + "version": "0.4.2", + "installPath": "/home//.openclaw/extensions/openclaw", + "integrity": "sha512-<...>", + "installedAt": "" + } + } + } +} +``` -| Var | Value | Why | -|---|---|---| -| `XPR_ACCOUNT` | your XPR account name (e.g. `myagent`) | Required for signing | -| `XPR_NETWORK` | `mainnet` or `testnet` | Defaults to mainnet | -| `INDEXER_URL` | `https://indexer.xpragents.com` (mainnet) or `https://testnet-indexer.xpragents.com` (testnet) | Required by 4 read tools (`xpr_search_agents`, `xpr_get_events`, `xpr_get_stats`, `xpr_indexer_health`) | -| `MAX_TRANSFER_AMOUNT` | `10000000` (= 1000 XPR) — adjust as needed | Caps every signed XPR transfer/stake/fee | +A backup of the previous `openclaw.json` is written to `~/.openclaw/openclaw.json.bak`. -If you skip `XPR_ACCOUNT`, watch the Pinata Logs tab for the diagnostic line `[xpr-agents] Read-only mode: XPR_ACCOUNT not set` — that's the symptom. +> **Heads up — the installer prints a list of "dangerous code patterns" warnings** (currently 19 of them). Every one is intentional and explained in the npm README's "Security notes" section. The biggest one — `Shell command execution detected (child_process)` in `dist/proton-cli.js` — is literally the post-charliebot signing model (proton CLI shells out so the blockchain key never enters the process). Don't bail on the install. -### 2b. Register the plugin +### 2a. Set `XPR_ACCOUNT` at the gateway env layer -The exact mechanism depends on your harness. **On Pinata Agents this is unverified** as of this writing — confirm with Pinata docs / support what format their plugin registration takes. The pattern below is what generic OpenClaw runtimes expect; adapt to Pinata's actual config surface (likely a dashboard form or `~/.openclaw/config.json`): +**Without `XPR_ACCOUNT`, the plugin loads in read-only mode and every write tool fails with a confusing error.** The env var goes in `env.vars`, NOT in `plugins.entries.openclaw.config` — verified empirically: ```jsonc { - "plugins": [ - { - "name": "@xpr-agents/openclaw", - "config": { - "network": "mainnet", - "indexerUrl": "https://indexer.xpragents.com", - "confirmHighRisk": true, - "maxTransferAmount": 10000000 + "env": { + "vars": { + "XPR_ACCOUNT": "", + "XPR_NETWORK": "mainnet" + } + }, + "plugins": { + "entries": { + "openclaw": { + "enabled": true, + "config": { "network": "mainnet" } } } - ] + } +} +``` + +On Pinata Agents this surface is the Control UI's Config editor (Raw JSON tab) at the gateway URL printed by `openclaw status`. The plugin reads `process.env.XPR_ACCOUNT` — populated from `env.vars`, not from per-plugin `config`. + +Diagnostic: if `XPR_ACCOUNT` is missing, the gateway log shows `[xpr-agents] Read-only mode: XPR_ACCOUNT not set. Write tools will fail.` once on plugin init. If wired correctly, that line **doesn't appear**. + +### 2b. Restart the gateway + +On Pinata Agents specifically, **the imperative `openclaw gateway restart` command does not work** ("Gateway service disabled" — they don't expose systemctl in the container). The restart fires automatically when `openclaw.json` is patched — the harness emits a `SIGUSR1` to the gateway process. Saving the config edit through the Control UI is enough. + +Expected restart event shape (visible in the API response or logs): + +```json +{ + "restart": { + "ok": true, + "signal": "SIGUSR1", + "reason": "config.patch" + } } ``` -Restart the agent. Watch the Pinata Logs tab for: +### 2c. Confirm the plugin loaded + +Tail the gateway log (in Pinata's Console or via the Control UI Logs tab): + +```bash +ls -lt /tmp/openclaw/*.log | head -1 # find the current log file +grep "xpr-agents" /tmp/openclaw/openclaw-*.log | tail -10 +``` + +The success signature: + +``` +[xpr-agents] Plugin loaded: 72 tools, mainnet (https://proton.eosusa.io) +``` + +A2A receive-only mode (expected unless you set `A2A_SIGNING_KEY`): + +``` +[xpr-agents] A2A_SIGNING_KEY not set — A2A outbound calls disabled. See docs/A2A.md to enable. +``` + +If signing is wired (you set `XPR_ACCOUNT`), the `Read-only mode:` line **does NOT appear**. + +You can also confirm via the CLI: + +```bash +openclaw plugins list # row should show: openclaw loaded 0.4.2 +openclaw plugins info openclaw # detailed status +``` + +### 2d. First signed write — required on the harness path + +Unlike the standalone `create-xpr-agent` scaffold (which auto-registers via the runner's `ensureRegistered()`), the harness path doesn't run that code. **Your account is not yet in `agentcore::agents`**, and every `xpr_update_*` / `xpr_set_agent_status` call will fail with `Agent not found` until you explicitly register. + +In the agent chat surface: ``` -[xpr-agents] Plugin loaded: 72 tools (35 read, 37 write) +> Register as an agent with name 'My Agent', + description 'Autonomous worker', endpoint 'https://my-agent.example', + protocol 'https', capabilities ['general', 'jobs', 'bidding']. ``` -That's the success line. If you don't see it, the harness never invoked the plugin's default export — your registration step didn't take effect. If you see `[xpr-agents] Read-only mode: XPR_ACCOUNT not set`, the plugin loaded but signing is disabled (back to 2a). +Expected: +- Tool call: `xpr_register_agent` +- Response contains `"transaction_id": "<64-hex-chars>"` +- Gateway log emits `[proton-cli] action agentcore::register auth=@active` then `[proton-cli] tx ok in ms` +- Follow-up `xpr_get_agent` against your account name now returns the registered record -After restart, the plugin's tools (`xpr_get_agent`, `xpr_submit_bid`, `xpr_deliver_job`, etc.) appear in the agent's tool list. +That confirms: harness load + env wiring + proton CLI shell-out + on-chain signing all working. ## Step 3 — (Optional) Install foundational reference skill via ClawHub diff --git a/openclaw/README.md b/openclaw/README.md index 66dd32d..d234869 100644 --- a/openclaw/README.md +++ b/openclaw/README.md @@ -27,44 +27,92 @@ cd my-agent ### Inside an OpenClaw harness +The supported install path on OpenClaw runtimes (OpenClaw 2026.3.x verified, Pinata Agents verified): + +```bash +# 1. Install via OpenClaw's plugin CLI (NOT `npm install` — see "Why not +# plain npm install" below) +openclaw plugins install @xpr-agents/openclaw +``` + +This downloads the package from npm, copies it to `~/.openclaw/extensions/openclaw/`, and **auto-writes** the following to your `~/.openclaw/openclaw.json`: + +```jsonc +{ + "plugins": { + "entries": { + "openclaw": { "enabled": true } + }, + "installs": { + "openclaw": { + "source": "npm", + "spec": "@xpr-agents/openclaw", + "version": "0.4.2", + "installPath": "/home//.openclaw/extensions/openclaw", + "integrity": "sha512-<...>", + "shasum": "<...>", + "installedAt": "" + } + } + } +} +``` + ```bash -# 1. Install -npm install @xpr-agents/openclaw - -# 2. Register with the harness. The mechanism depends on the runtime: -# - Pinata Agents: see docs/PINATA.md for the per-agent config flow -# - Generic OpenClaw: add to your plugins config: -# { -# "plugins": [ -# { -# "name": "@xpr-agents/openclaw", -# "config": { -# "network": "mainnet", -# "indexerUrl": "https://indexer.xpragents.com" -# } -# } -# ] -# } -# -# 3. Restart the agent. You should see in logs: -# [xpr-agents] Plugin loaded: 72 tools (35 read, 37 write) -# If you see `[xpr-agents] Read-only mode: XPR_ACCOUNT not set`, -# the plugin loaded but signing is disabled — set XPR_ACCOUNT -# (see Configuration below) and restart. -# -# 4. Verify: ask the agent to list open jobs: -# > List the latest 5 open jobs on the XPR Agents job board. -# Expect a real list. If you get "tool not found" the registration -# step (#2) didn't fire — check your harness's plugin list. +# 2. Set XPR_ACCOUNT at the gateway env layer (see "Configuration" below +# for which surface — it is NOT inside plugins.entries.openclaw.config). + +# 3. Restart the gateway. Most OpenClaw harnesses restart automatically +# when openclaw.json is patched (a SIGUSR1 fires). If yours doesn't, +# use whichever restart command your harness supports. + +# 4. Verify the load by tailing the gateway log. Look for: +# [xpr-agents] Plugin loaded: 72 tools, mainnet (https://proton.eosusa.io) +# If you also see `[xpr-agents] Read-only mode: XPR_ACCOUNT not set.`, +# the plugin loaded but signing is disabled — re-check step 2. + +# 5. Run your first signed write (the plugin auto-registration in the +# standalone scaffold does NOT fire on the harness path): +# > Register as an agent with name '...', description +# '...', endpoint '...', protocol 'https', capabilities ['general', +# 'jobs', 'bidding']. +# Expect `xpr_register_agent` → real `transaction_id` in the response → +# `[proton-cli] action agentcore::register auth=@active` +# in the gateway log. ``` -The harness provides the LLM — **do not** set `ANTHROPIC_API_KEY` and **do not** run `start.sh` on this path. Plugin path is install + register only. Full walkthrough for Pinata Agents specifically: [`docs/PINATA.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/PINATA.md). +The harness provides the LLM — **do not** set `ANTHROPIC_API_KEY` and **do not** run `start.sh` on this path. Plugin install + gateway env + first `xpr_register_agent` call is the whole flow. Full walkthrough for Pinata Agents specifically: [`docs/PINATA.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/PINATA.md). + +#### Why not plain `npm install`? + +OpenClaw harnesses do **not** auto-scan workspace `node_modules` for plugins. They scan: +- `plugins.load.paths` (explicit) +- `~/.openclaw/extensions//` +- bundled `/app/extensions//` + +So `npm install @xpr-agents/openclaw` puts the package on disk but doesn't make it discoverable. Use `openclaw plugins install` (above) or, for monorepo development, add the workspace path to `plugins.load.paths` manually. + +#### Why the harness path doesn't auto-register + +The standalone `create-xpr-agent` scaffold auto-registers the agent in `agentcore::agents` on first boot via the runner's `ensureRegistered()`. The harness path loads only the plugin — not the runner — so the account is **not** in the registry until you explicitly call `xpr_register_agent`. Until then, every `xpr_update_*` / `xpr_set_agent_status` call returns `Agent not found`. Tracked for v0.5 to optionally self-register on first signed call when `XPR_ACCOUNT` is set. + +## Security notes (read this if your OpenClaw install scanner flags us) + +OpenClaw's plugin installer statically scans every package before install and reports patterns it considers risky. As of 0.4.2 it flags **19 patterns** in `@xpr-agents/openclaw`. Every one of them is intentional and named below — do not bail on the install when you see them. + +| Count | Pattern | Where | Why it's intentional | +|---|---|---|---| +| 16× | "Environment variable access combined with network send — possible credential harvesting" | `skills/{creative,defi,governance,lending,nft,smart-contracts,tax,xmd}/{src,dist}/index.ts:`, `dist/tools/a2a.js`, `dist/tools/shellbook.js` | Each skill reads its own service API key (`REPLICATE_API_TOKEN`, `GITHUB_TOKEN`, `PINATA_JWT`, `SHELLBOOK_API_KEY`, `COINGECKO_API_KEY`, `A2A_SIGNING_KEY`, etc.) and calls that service's HTTPS API. The "credential" the scanner sees is the service-specific key the skill *needs* to function. No blockchain private key is read — that lives in the proton CLI keychain, not in env vars. | +| 1× | "Shell command execution (child_process)" | `dist/proton-cli.js:` | **This is the post-charliebot security feature itself.** All on-chain signing shells out to `proton transaction:push`. The whole reason for v0.4.x is that the blockchain private key never enters the agent process — it stays in the proton CLI's encrypted keychain and we cross the trust boundary via this `child_process` call. If you'd rather hold the key in process, use a different package. | +| 2× | "Dynamic code execution detected" | `skills/code-sandbox/{src,dist}/index.ts:` | The whole point of the `code-sandbox` skill is sandboxed JS execution inside a `node:vm` context. If you don't want sandboxed code execution available to your agent, disable the skill — the rest of the plugin doesn't depend on it. | + +If your harness lets you set `plugins.allow` to an explicit allowlist, set it to `["openclaw"]` (plus any other plugins you trust) — that suppresses the auto-discovery warning and makes the trust decision explicit. ## Bundled Skills (13 total — since v0.4.0) -The plugin ships pre-built skills in its tarball; the `openclaw.plugin.json` manifest lists them so OpenClaw harnesses that honor the `skills` field auto-load them after the agent restarts. Verify by asking the agent `list your skills` — you should see 13. +The plugin ships pre-built skills in its tarball; the `openclaw.plugin.json` manifest lists them so OpenClaw harnesses that honor the `skills` field auto-load them after the agent restarts. -If your harness doesn't honor the manifest's `skills` field, the skill folders are still on disk at `node_modules/@xpr-agents/openclaw/skills//` and can be registered manually. +When you install via `openclaw plugins install @xpr-agents/openclaw`, the skill folders land at `~/.openclaw/extensions/openclaw/skills//` and the harness picks them up on the next gateway restart. If your harness ignores the manifest's `skills` array, the skill folders are still on disk and can be registered through whatever per-skill mechanism your runtime exposes. | Skill | Purpose | |-------|---------| @@ -155,6 +203,29 @@ XPR_ACCOUNT=myagent # REQUIRED — without this, the plugi XPR_NETWORK=mainnet # mainnet | testnet (default: mainnet) ``` +> **Where to put `XPR_ACCOUNT` matters.** On OpenClaw harnesses it goes in the gateway environment layer, NOT in the plugin's config: +> +> ```jsonc +> // ~/.openclaw/openclaw.json — CORRECT +> { +> "env": { +> "vars": { +> "XPR_ACCOUNT": "myagent" +> } +> }, +> "plugins": { +> "entries": { +> "openclaw": { +> "enabled": true, +> "config": { "network": "mainnet" } +> } +> } +> } +> } +> ``` +> +> Putting `XPR_ACCOUNT` inside `plugins.entries.openclaw.config` does NOT work — the plugin reads it from `process.env`, which is populated from `env.vars`, not from per-plugin config. We verified this empirically on OpenClaw 2026.3.x. + ### Optional environment variables ```env diff --git a/openclaw/dist/index.d.ts.map b/openclaw/dist/index.d.ts.map index ef79d80..62d5307 100644 --- a/openclaw/dist/index.d.ts.map +++ b/openclaw/dist/index.d.ts.map @@ -1 +1 @@ -{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,SAAS,CAAC;AAGvE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAElG;;;GAGG;AACH,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,IAAI,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;YAChE,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA0BD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI,CA8DpF"} \ No newline at end of file +{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAUH,OAAO,KAAK,EAAE,SAAS,EAAgC,MAAM,SAAS,CAAC;AAGvE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC1E,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIzD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAElG;;;GAGG;AACH,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,YAAY,CAAC,IAAI,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,OAAO,CAAC;QACpB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC;YAChE,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AA0BD,MAAM,CAAC,OAAO,UAAU,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI,CAyEpF"} \ No newline at end of file diff --git a/openclaw/dist/index.js b/openclaw/dist/index.js index 297ba38..0dafd62 100644 --- a/openclaw/dist/index.js +++ b/openclaw/dist/index.js @@ -98,17 +98,28 @@ function xprAgentsPlugin(realApi) { confirmHighRisk: rawConfig.confirmHighRisk !== false, maxTransferAmount: rawConfig.maxTransferAmount || 10000000, }; - // Register all tool groups - (0, agent_1.registerAgentTools)(api, config); - (0, feedback_1.registerFeedbackTools)(api, config); - (0, validation_1.registerValidationTools)(api, config); - (0, escrow_1.registerEscrowTools)(api, config); - (0, indexer_1.registerIndexerTools)(api, config); - (0, a2a_1.registerA2ATools)(api, config); - (0, shellbook_1.registerShellbookTools)(api); + // Register all tool groups. Wrap registerTool with a counter so the boot + // log can report the actual count — operators grep for this line to + // confirm the plugin loaded fully, and a count that drifts from the docs + // makes that signal worthless. + let toolCount = 0; + const countingApi = { + ...api, + registerTool: (tool) => { + toolCount++; + return api.registerTool(tool); + }, + }; + (0, agent_1.registerAgentTools)(countingApi, config); + (0, feedback_1.registerFeedbackTools)(countingApi, config); + (0, validation_1.registerValidationTools)(countingApi, config); + (0, escrow_1.registerEscrowTools)(countingApi, config); + (0, indexer_1.registerIndexerTools)(countingApi, config); + (0, a2a_1.registerA2ATools)(countingApi, config); + (0, shellbook_1.registerShellbookTools)(countingApi); if (!hasCredentials) { console.log('[xpr-agents] Read-only mode: XPR_ACCOUNT not set. Write tools will fail.'); } - console.log(`[xpr-agents] Plugin loaded: ${config.network} (${rpcEndpoint})`); + console.log(`[xpr-agents] Plugin loaded: ${toolCount} tools, ${config.network} (${rpcEndpoint})`); } //# sourceMappingURL=index.js.map \ No newline at end of file diff --git a/openclaw/dist/index.js.map b/openclaw/dist/index.js.map index 07c811d..77f2d74 100644 --- a/openclaw/dist/index.js.map +++ b/openclaw/dist/index.js.map @@ -1 +1 @@ -{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AA0EH,kCA8DC;AAtID,uCAA6D;AAC7D,yCAAmD;AACnD,+CAAyD;AACzD,mDAA6D;AAC7D,2CAAqD;AACrD,6CAAuD;AACvD,qCAA+C;AAC/C,iDAA2D;AAO3D,sEAAsE;AACtE,wEAAwE;AACxE,6CAA+D;AAAtD,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAEvC,2CAOsB;AANpB,wGAAA,UAAU,OAAA;AACV,iHAAA,mBAAmB,OAAA;AACnB,0GAAA,YAAY,OAAA;AACZ,4GAAA,cAAc,OAAA;AACd,oHAAA,sBAAsB,OAAA;AACtB,4GAAA,cAAc,OAAA;AAwBhB;;;GAGG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO;QACL,YAAY,CAAC,IAAoB;YAC/B,OAAO,CAAC,YAAY,CAAC;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAA+B;oBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACnF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,SAAS;YACP,OAAO,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAwB,eAAe,CAAC,OAAsC;IAC5E,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,GAAG,GAAc,OAAQ,OAAe,CAAC,SAAS,KAAK,UAAU;QACrE,CAAC,CAAC,OAAoB;QACtB,CAAC,CAAC,aAAa,CAAC,OAA4B,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAElC,MAAM,OAAO,GAAI,SAAS,CAAC,OAAkB,IAAI,SAAS,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACnG,MAAM,WAAW,GAAI,SAAS,CAAC,WAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC;IAEpG,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAEjD,6CAA6C;IAC7C,IAAI,GAAG,CAAC;IACR,IAAI,OAAO,CAAC;IAEZ,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAA,2BAAiB,EAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAE3E,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,GAAU;QACf,OAAO;QACP,OAAO,EAAG,SAAS,CAAC,OAAiC,IAAI,SAAS;QAClE,WAAW;QACX,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,+BAA+B;QAC1G,SAAS,EAAE;YACT,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,YAAY;YACnD,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,aAAa;SACvD;QACD,eAAe,EAAE,SAAS,CAAC,eAAe,KAAK,KAAK;QACpD,iBAAiB,EAAG,SAAS,CAAC,iBAA4B,IAAI,QAAQ;KACvE,CAAC;IAEF,2BAA2B;IAC3B,IAAA,0BAAkB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,IAAA,gCAAqB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,IAAA,oCAAuB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrC,IAAA,4BAAmB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,IAAA,8BAAoB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAA,sBAAgB,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAA,kCAAsB,EAAC,GAAG,CAAC,CAAC;IAE5B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;AAChF,CAAC"} \ No newline at end of file +{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AA0EH,kCAyEC;AAjJD,uCAA6D;AAC7D,yCAAmD;AACnD,+CAAyD;AACzD,mDAA6D;AAC7D,2CAAqD;AACrD,6CAAuD;AACvD,qCAA+C;AAC/C,iDAA2D;AAO3D,sEAAsE;AACtE,wEAAwE;AACxE,6CAA+D;AAAtD,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAEvC,2CAOsB;AANpB,wGAAA,UAAU,OAAA;AACV,iHAAA,mBAAmB,OAAA;AACnB,0GAAA,YAAY,OAAA;AACZ,4GAAA,cAAc,OAAA;AACd,oHAAA,sBAAsB,OAAA;AACtB,4GAAA,cAAc,OAAA;AAwBhB;;;GAGG;AACH,SAAS,aAAa,CAAC,OAA0B;IAC/C,OAAO;QACL,YAAY,CAAC,IAAoB;YAC/B,OAAO,CAAC,YAAY,CAAC;gBACnB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,MAA+B;oBACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAC1C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBACnF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC/C,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QACD,SAAS;YACP,OAAO,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAwB,eAAe,CAAC,OAAsC;IAC5E,6EAA6E;IAC7E,mFAAmF;IACnF,MAAM,GAAG,GAAc,OAAQ,OAAe,CAAC,SAAS,KAAK,UAAU;QACrE,CAAC,CAAC,OAAoB;QACtB,CAAC,CAAC,aAAa,CAAC,OAA4B,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAElC,MAAM,OAAO,GAAI,SAAS,CAAC,OAAkB,IAAI,SAAS,CAAC;IAC3D,MAAM,UAAU,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACnG,MAAM,WAAW,GAAI,SAAS,CAAC,WAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU,CAAC;IAEpG,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAEjD,6CAA6C;IAC7C,IAAI,GAAG,CAAC;IACR,IAAI,OAAO,CAAC;IAEZ,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAC9C,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACjB,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;SAAM,CAAC;QACN,GAAG,GAAG,IAAA,2BAAiB,EAAC,WAAW,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAE3E,MAAM,MAAM,GAAiB;QAC3B,GAAG,EAAE,GAAU;QACf,OAAO;QACP,OAAO,EAAG,SAAS,CAAC,OAAiC,IAAI,SAAS;QAClE,WAAW;QACX,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,+BAA+B;QAC1G,SAAS,EAAE;YACT,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,WAAW;YAChD,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,YAAY;YACnD,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,aAAa;SACvD;QACD,eAAe,EAAE,SAAS,CAAC,eAAe,KAAK,KAAK;QACpD,iBAAiB,EAAG,SAAS,CAAC,iBAA4B,IAAI,QAAQ;KACvE,CAAC;IAEF,yEAAyE;IACzE,oEAAoE;IACpE,yEAAyE;IACzE,+BAA+B;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,WAAW,GAAc;QAC7B,GAAG,GAAG;QACN,YAAY,EAAE,CAAC,IAAS,EAAE,EAAE;YAC1B,SAAS,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;KACF,CAAC;IACF,IAAA,0BAAkB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACxC,IAAA,gCAAqB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAA,oCAAuB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAA,4BAAmB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACzC,IAAA,8BAAoB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAA,sBAAgB,EAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACtC,IAAA,kCAAsB,EAAC,WAAW,CAAC,CAAC;IAEpC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,+BAA+B,SAAS,WAAW,MAAM,CAAC,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;AACpG,CAAC"} \ No newline at end of file diff --git a/openclaw/package.json b/openclaw/package.json index 7bbc0bc..e0bc716 100644 --- a/openclaw/package.json +++ b/openclaw/package.json @@ -1,6 +1,6 @@ { "name": "@xpr-agents/openclaw", - "version": "0.4.1", + "version": "0.4.2", "description": "OpenClaw plugin for XPR Network Trustless Agent Registry - autonomous agent operation, escrow jobs, feedback, and validation", "author": "XPR Network", "repository": { diff --git a/openclaw/src/index.ts b/openclaw/src/index.ts index 35a5d99..123aa16 100644 --- a/openclaw/src/index.ts +++ b/openclaw/src/index.ts @@ -131,18 +131,29 @@ export default function xprAgentsPlugin(realApi: OpenClawPluginApi | PluginApi): maxTransferAmount: (rawConfig.maxTransferAmount as number) || 10000000, }; - // Register all tool groups - registerAgentTools(api, config); - registerFeedbackTools(api, config); - registerValidationTools(api, config); - registerEscrowTools(api, config); - registerIndexerTools(api, config); - registerA2ATools(api, config); - registerShellbookTools(api); + // Register all tool groups. Wrap registerTool with a counter so the boot + // log can report the actual count — operators grep for this line to + // confirm the plugin loaded fully, and a count that drifts from the docs + // makes that signal worthless. + let toolCount = 0; + const countingApi: PluginApi = { + ...api, + registerTool: (tool: any) => { + toolCount++; + return api.registerTool(tool); + }, + }; + registerAgentTools(countingApi, config); + registerFeedbackTools(countingApi, config); + registerValidationTools(countingApi, config); + registerEscrowTools(countingApi, config); + registerIndexerTools(countingApi, config); + registerA2ATools(countingApi, config); + registerShellbookTools(countingApi); if (!hasCredentials) { console.log('[xpr-agents] Read-only mode: XPR_ACCOUNT not set. Write tools will fail.'); } - console.log(`[xpr-agents] Plugin loaded: ${config.network} (${rpcEndpoint})`); + console.log(`[xpr-agents] Plugin loaded: ${toolCount} tools, ${config.network} (${rpcEndpoint})`); }