feat: provision config, wizard reorder, AGENTS.md managed section#20
Merged
feat: provision config, wizard reorder, AGENTS.md managed section#20
Conversation
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
OpenClaw's onboard creates a nested .git inside data/workspace/, which causes git add data/ to fail. Remove it after onboard on the host side. Also adds a checkpoint SKILL.md so agents know how and when to use claw checkpoint, updates .gitignore for secrets and ephemeral files, and hardens the watch handler with a defensive nested-git check and commit stat logging. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… workspace All VM-side setup now goes through `claw` provisioning stages. New `claw provision workspace` stage installs checkpoint skill (unconditional), secret-management skill, op wrapper, and exec-approvals (conditional on op being installed). Removed generateSecretManagementSkill, generateOpWrapperScript, and generateExecApprovals from @clawctl/templates. Added provision-workspace lifecycle phase. Documents the "delegate to claw" architectural principle. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add ProvisionConfig type and PROVISION_CONFIG_FILE constant. The host writes data/provision.json with onePassword/tailscale feature flags before claw stages run. VM-side stages read the config and skip op-cli or tailscale installation when disabled. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Split the credentials step into two: collection (before VM) and setup (after provision). Credentials now asks about 1Password/Tailscale and collects tokens without needing the VM. The new credential-setup step validates tokens and connects Tailscale after the VM exists. Wizard flow is now 9 steps: welcome → configure → credentials → host-setup → create-vm → provision → credential-setup → onboard → finish. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Improve checkpoint skill description with concrete file triggers and the write→checkpoint→done habit pattern. Add a clawctl-managed section to AGENTS.md (delimited by HTML comment markers) with operational rules the agent should follow. Currently contains the checkpoint-after-writes rule. Runs after onboard and bootstrap so OpenClaw populates AGENTS.md first; appends if it exists, creates as fallback if not. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
If the user exits the first conversation with Ctrl-C, execInteractive throws and patchAgentsMd was skipped. Catch the tui error so the managed section is always written. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
data/provision.jsonwith feature flags (onePassword,tailscale) before claw stages run. VM-side stages read the config and skip op-cli/tailscale installation when disabled. Previously every VM got both unconditionally.provision.jsoncan be written with the right flags. Wizard is now 9 steps.<!-- clawctl:managed:start/end -->) appended to AGENTS.md with operational rules (currently: checkpoint after writes). Runs after onboard + bootstrap/first conversation so OpenClaw populates AGENTS.md first. Idempotent — replaces in-place on re-run.openclaw tui(first conversation) so a user exit doesn't skip the AGENTS.md patch.Test plan
bun test— 234 pass, 0 failbun run lint— cleanbun run format:check— cleanservices.onePassword→ no op-cli installedservices.onePassword→ op-cli + skill + wrapper present🤖 Generated with Claude Code