mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
ibhagwanandGitHub
b0b3a50fa3
* feat(channels): add native Signal channel via signal-cli HTTP daemon Implement a native Rust Signal channel that connects to a running signal-cli daemon's HTTP endpoint, enabling Signal messaging without WASM overhead. Architecture: - SSE listener at /api/v1/events for receiving messages with automatic reconnection and exponential backoff - JSON-RPC client at /api/v1/rpc for sending messages and typing indicators - Reply target tracking via Arc<RwLock<HashMap>> to route responses back to the correct DM or group conversation Features: - User allowlisting supporting E.164 phone numbers, bare UUIDs, and uuid:-prefixed identifiers (matching OpenClaw's format) - Group allowlisting with wildcard (*) support - Configurable story and attachment-only message filtering - Health check via signal-cli /api/v1/check - Broadcast support to all tracked reply targets Configuration via environment variables: - SIGNAL_HTTP_URL, SIGNAL_ACCOUNT (required) - SIGNAL_ALLOWED_USERS, SIGNAL_ALLOWED_GROUPS - SIGNAL_IGNORE_ATTACHMENTS (default: false) - SIGNAL_IGNORE_STORIES (default: true) Includes unit tests covering allowlist logic, envelope parsing, recipient targeting, SSE deserialization, and edge cases. * refactor(signal): remove expect|unwrap calls - Change SignalChannel::new to return Result<Self, ChannelError> - Replace .expect() on reqwest client build with proper error handling - Replace .expect() on NonZeroUsize with compile-time const using unsafe new_unchecked - Propagate errors through test helpers to avoid unwraps in tests * fix(signal): prevent OOM from chunked response without Content-Length Use bytes_stream() to check response size during download rather than buffering entire body first. This closes the OOM vector where a malicious signal-cli daemon could send unbounded chunked data. * fix(signal): align is_e164 minimum digits with setup wizard Both now require 7-15 digits after '+', preventing environment variable bypass of the stricter onboarding validation. * refactor(signal): extract from_parts constructor Extract SignalChannel::from_parts() used by both new() and sse_listener() to ensure consistent object construction. * chore: remove redundant unused var * refactor(signal): rename allowed_users to allow_from and add dm_policy/group_policy - Rename allowed_users -> allow_from for consistency with other channels - Rename allowed_groups -> allow_from_groups - Add dm_policy field: 'open', 'allowlist', or 'pairing' (default: 'pairing') - Add group_policy field: 'allowlist', 'open', or 'disabled' (default: 'allowlist') - Add group_allow_from field that inherits from allow_from if empty - Implement dm_policy and group_policy logic in message processing - Add environment variable resolution: SIGNAL_ALLOW_FROM, SIGNAL_ALLOW_FROM_GROUPS, SIGNAL_DM_POLICY, SIGNAL_GROUP_POLICY, SIGNAL_GROUP_ALLOW_FROM - Add setup wizard prompts for new policy options - Note: full pairing flow (PairingStore integration) marked as pending for future PR * feat(signal): implement DM pairing workflow for unapproved senders - Add PairingStore integration to check approved senders - Handle pairing requests for unknown senders with dm_policy=pairing - Send pairing reply message with approval instructions - Update FEATURE_PARITY.md to reflect DM pairing support * chore(ci): fix clippy warnings
120 lines
4.3 KiB
Bash
120 lines
4.3 KiB
Bash
# Database Configuration
|
|
DATABASE_URL=postgres://localhost/ironclaw
|
|
DATABASE_POOL_SIZE=10
|
|
|
|
# LLM Provider
|
|
# LLM_BACKEND=nearai # default
|
|
# Possible values: nearai, ollama, openai_compatible, openai, anthropic, tinfoil
|
|
|
|
# === NEAR AI (Chat Completions API) ===
|
|
# Two auth modes:
|
|
# 1. Session token (default): Uses browser OAuth (GitHub/Google) on first run.
|
|
# Session token stored in ~/.ironclaw/session.json automatically.
|
|
# Base URL defaults to https://private.near.ai
|
|
# 2. API key: Set NEARAI_API_KEY to use API key auth from cloud.near.ai.
|
|
# Base URL defaults to https://cloud-api.near.ai
|
|
NEARAI_MODEL=zai-org/GLM-5-FP8
|
|
NEARAI_BASE_URL=https://private.near.ai
|
|
NEARAI_AUTH_URL=https://private.near.ai
|
|
# NEARAI_SESSION_TOKEN=sess_... # hosting providers: set this
|
|
# NEARAI_SESSION_PATH=~/.ironclaw/session.json # optional, default shown
|
|
# NEARAI_API_KEY=... # API key from cloud.near.ai
|
|
|
|
# Local LLM Providers (Ollama, LM Studio, vLLM, LiteLLM)
|
|
|
|
# === Ollama ===
|
|
# OLLAMA_MODEL=llama3.2
|
|
# LLM_BACKEND=ollama
|
|
# OLLAMA_BASE_URL=http://localhost:11434 # default
|
|
|
|
# === OpenAI-compatible (LM Studio, vLLM, Anything-LLM) ===
|
|
# LLM_MODEL=llama-3.2-3b-instruct-q4_K_M
|
|
# LLM_BACKEND=openai_compatible
|
|
# LLM_BASE_URL=http://localhost:1234/v1
|
|
# LLM_API_KEY=sk-... # optional for local servers
|
|
# Custom HTTP headers for OpenAI-compatible providers
|
|
# Format: comma-separated key:value pairs
|
|
# LLM_EXTRA_HEADERS=HTTP-Referer:https://github.com/nearai/ironclaw,X-Title:ironclaw
|
|
|
|
# === OpenRouter (300+ models via OpenAI-compatible) ===
|
|
# LLM_MODEL=anthropic/claude-sonnet-4 # see openrouter.ai/models for IDs
|
|
# LLM_BACKEND=openai_compatible
|
|
# LLM_BASE_URL=https://openrouter.ai/api/v1
|
|
# LLM_API_KEY=sk-or-...
|
|
|
|
# LLM_EXTRA_HEADERS=HTTP-Referer:https://myapp.com,X-Title:MyApp
|
|
|
|
|
|
# === Together AI (via OpenAI-compatible) ===
|
|
# LLM_MODEL=meta-llama/Llama-3.3-70B-Instruct-Turbo
|
|
# LLM_BACKEND=openai_compatible
|
|
# LLM_BASE_URL=https://api.together.xyz/v1
|
|
# LLM_API_KEY=...
|
|
|
|
# === Fireworks AI (via OpenAI-compatible) ===
|
|
# LLM_MODEL=accounts/fireworks/models/llama4-maverick-instruct-basic
|
|
# LLM_BACKEND=openai_compatible
|
|
# LLM_BASE_URL=https://api.fireworks.ai/inference/v1
|
|
# LLM_API_KEY=fw_...
|
|
|
|
# For full provider setup guide see docs/LLM_PROVIDERS.md
|
|
|
|
# Channel Configuration
|
|
# CLI is always enabled
|
|
|
|
# Slack Bot (optional)
|
|
SLACK_BOT_TOKEN=xoxb-...
|
|
SLACK_APP_TOKEN=xapp-...
|
|
SLACK_SIGNING_SECRET=...
|
|
|
|
# Telegram Bot (optional)
|
|
TELEGRAM_BOT_TOKEN=...
|
|
|
|
# HTTP Webhook Server (optional)
|
|
HTTP_HOST=0.0.0.0
|
|
HTTP_PORT=8080
|
|
HTTP_WEBHOOK_SECRET=your-webhook-secret
|
|
|
|
# Signal Channel (optional, requires signal-cli daemon --http)
|
|
# SIGNAL_HTTP_URL=http://127.0.0.1:8080
|
|
# SIGNAL_ACCOUNT=+1234567890
|
|
# SIGNAL_ALLOW_FROM=+1234567890,uuid:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx # comma-separated, * for all, empty = deny/require pairing
|
|
# SIGNAL_ALLOW_FROM_GROUPS= # comma-separated group IDs, * for all, empty = deny all groups
|
|
# SIGNAL_DM_POLICY=pairing # open | allowlist | pairing
|
|
# SIGNAL_GROUP_POLICY=allowlist # allowlist | open | disabled
|
|
# SIGNAL_GROUP_ALLOW_FROM= # comma-separated, empty = inherit from ALLOW_FROM
|
|
# SIGNAL_IGNORE_ATTACHMENTS=false
|
|
# SIGNAL_IGNORE_STORIES=true
|
|
|
|
# Agent Settings
|
|
AGENT_NAME=ironclaw
|
|
AGENT_MAX_PARALLEL_JOBS=5
|
|
AGENT_JOB_TIMEOUT_SECS=3600
|
|
AGENT_STUCK_THRESHOLD_SECS=300
|
|
# Enable planning phase before tool execution (default: true)
|
|
AGENT_USE_PLANNING=true
|
|
|
|
# Self-repair settings
|
|
SELF_REPAIR_CHECK_INTERVAL_SECS=60
|
|
SELF_REPAIR_MAX_ATTEMPTS=3
|
|
|
|
# Heartbeat settings (proactive periodic execution)
|
|
# When enabled, reads HEARTBEAT.md checklist and reports findings
|
|
HEARTBEAT_ENABLED=false
|
|
HEARTBEAT_INTERVAL_SECS=1800
|
|
HEARTBEAT_NOTIFY_CHANNEL=cli
|
|
HEARTBEAT_NOTIFY_USER=default
|
|
|
|
# Memory hygiene settings (automatic cleanup of stale workspace documents)
|
|
# Runs on each heartbeat tick; identity files (IDENTITY.md, SOUL.md) are never deleted
|
|
# MEMORY_HYGIENE_ENABLED=true
|
|
# MEMORY_HYGIENE_RETENTION_DAYS=30 # delete daily/ docs older than this many days
|
|
# MEMORY_HYGIENE_CADENCE_HOURS=12 # minimum hours between cleanup passes
|
|
|
|
# Safety settings
|
|
SAFETY_MAX_OUTPUT_LENGTH=100000
|
|
SAFETY_INJECTION_CHECK_ENABLED=true
|
|
|
|
# Logging
|
|
RUST_LOG=ironclaw=debug,tower_http=debug
|