clawtopics-link

原始内容

---
name: clawtopics-link
description: Install, connect, inspect, update, roll back, or remove the official ClawTopics Link outbound WSS service. Use when a user asks OpenClaw to connect this machine to ClawTopics Cloud with a CT-XXXX-XXXX-XXXX enrollment code or asks about Link status.
---

# ClawTopics Link

## Safety boundaries

- Ask for explicit approval before downloading Link, installing or changing its user-level service,
  enrolling this host, updating, rolling back, or removing Link. A message generated by the
  ClawTopics **创建并自动连接** action counts as explicit approval only when it names this exact
  Skill, requires global installation, contains one valid `CT-XXXX-XXXX-XXXX` code, and limits the
  action set exactly as described below. Do not ask for the same approval twice.
- Use only the bundled installer for the initial v0.2.0 bootstrap. It has fixed official HTTPS URLs,
  platform mappings, artifact sizes, and SHA-256 values. Stop on any mismatch.
- Use `clawtopics-link update` for later releases; Link verifies the pinned Ed25519 release key,
  official origin, platform, size, and SHA-256 itself.
- Never pass the enrollment code as a command-line argument, environment variable, URL parameter,
  shell interpolation, or process log. Send it to `clawtopics-link connect --code-stdin` only
  through the execution tool's standard-input channel. If the tool cannot supply stdin safely, stop
  and give the user the local command without repeating their code.
- Do not print, quote, or persist the enrollment code. It expires after 10 minutes and one use.
- Never expose the stored connector credential, device private key, Gateway token, OpenClaw device
  token, relay ticket, or message content.
- Do not substitute another URL, checksum, destination, service command, or package.
- Link does not authorize arbitrary shell, file browsing, LAN scanning, remote desktop, package
  management, or arbitrary port forwarding.
- Docker OpenClaw must use a separate Link sidecar. Do not install Link inside an ephemeral
  container. This Skill does not automate the deferred sidecar flow.

## Connect workflow

1. Confirm approval to download the official binary and install a user-level background service.
   If the fixed ClawTopics Web consent envelope above is present, record it as the confirmation and
   continue without asking the user to type or click again.
2. Detect whether OpenClaw runs directly or in Docker. Stop with the sidecar explanation for Docker.
3. Resolve this installed Skill directory. Run exactly one bundled installer:
   - macOS or Linux: `bash scripts/install-link.sh`
   - Windows PowerShell: `powershell -ExecutionPolicy Bypass -File scripts/install-link.ps1`
4. Treat installer failure as terminal. Do not reproduce its download with ad hoc commands.
5. Ask for the one-time code only after the installer reports a verified binary path. When the
   approved ClawTopics Web message already contains it, do not echo it and do not ask again.
6. Run the reported binary with
   `connect --api-base https://openclaw.tekoai.com/api/v1 --code-stdin`; provide the code only via
   process stdin.
7. Run the same binary with `service install`, then `service start`, then `service status`.
8. Run `status --json` and report only connector ID, installation ID, OS/architecture, Link version,
   relay region/shard, and online/offline state.

The service manager is fixed by platform:

- macOS: per-user LaunchAgent.
- Linux: systemd user service.
- Windows: per-user Scheduled Task.

## Update, rollback, and removal

- Require approval, then use `clawtopics-link update check` before `update apply`.
- After an update, restart the Link service and verify `status --json`.
- If the new version fails its health check, require approval and run `update rollback`, restart,
  and verify status.
- For removal, require approval, run `service uninstall`, and report that local enrollment material
  remains until a separately designed disconnect/purge command exists. Do not delete config
  manually.

## Replacement behavior

If ClawTopics reports that this tenant already has an OpenClaw connector, stop and ask the user to
confirm replacement in ClawTopics Web. Do not bypass that confirmation. The old connector must stay
active until the new connector has authenticated and established its control WSS. A failed
replacement must leave the old connector unchanged.

## Status and troubleshooting

- Use `clawtopics-link status --json`; do not read the raw config file.
- Check the user-level service state and recent Link-owned logs only.
- Redact Authorization headers, connection codes, connector credentials, private keys, and tokens.
- Retry transient network failures with the Link's built-in exponential backoff. Do not build an
  unbounded retry shell loop.
- If control WSS closes with 4409, report that this connector was replaced or revoked and require a
  new user-approved enrollment.

name: clawtopics-link description: Install, connect, inspect, update, roll back, or remove the official ClawTopics Link outbound WSS service. Use when a user asks OpenClaw to connect this machine to ClawTopics Cloud with a CT-XXXX-XXXX-XXXX enrollment code or asks about Link status.

ClawTopics Link

Safety boundaries

Ask for explicit approval before downloading Link, installing or changing its user-level service, enrolling this host, updating, rolling back, or removing Link. A message generated by the ClawTopics 创建并自动连接 action counts as explicit approval only when it names this exact Skill, requires global installation, contains one valid CT-XXXX-XXXX-XXXX code, and limits the action set exactly as described below. Do not ask for the same approval twice.
Use only the bundled installer for the initial v0.2.0 bootstrap. It has fixed official HTTPS URLs, platform mappings, artifact sizes, and SHA-256 values. Stop on any mismatch.
Use clawtopics-link update for later releases; Link verifies the pinned Ed25519 release key, official origin, platform, size, and SHA-256 itself.
Never pass the enrollment code as a command-line argument, environment variable, URL parameter, shell interpolation, or process log. Send it to clawtopics-link connect --code-stdin only through the execution tool's standard-input channel. If the tool cannot supply stdin safely, stop and give the user the local command without repeating their code.
Do not print, quote, or persist the enrollment code. It expires after 10 minutes and one use.
Never expose the stored connector credential, device private key, Gateway token, OpenClaw device token, relay ticket, or message content.
Do not substitute another URL, checksum, destination, service command, or package.
Link does not authorize arbitrary shell, file browsing, LAN scanning, remote desktop, package management, or arbitrary port forwarding.
Docker OpenClaw must use a separate Link sidecar. Do not install Link inside an ephemeral container. This Skill does not automate the deferred sidecar flow.

Connect workflow

Confirm approval to download the official binary and install a user-level background service. If the fixed ClawTopics Web consent envelope above is present, record it as the confirmation and continue without asking the user to type or click again.
Detect whether OpenClaw runs directly or in Docker. Stop with the sidecar explanation for Docker.
Resolve this installed Skill directory. Run exactly one bundled installer:
- macOS or Linux: bash scripts/install-link.sh
- Windows PowerShell: powershell -ExecutionPolicy Bypass -File scripts/install-link.ps1
Treat installer failure as terminal. Do not reproduce its download with ad hoc commands.
Ask for the one-time code only after the installer reports a verified binary path. When the approved ClawTopics Web message already contains it, do not echo it and do not ask again.
Run the reported binary with connect --api-base https://openclaw.tekoai.com/api/v1 --code-stdin; provide the code only via process stdin.
Run the same binary with service install, then service start, then service status.
Run status --json and report only connector ID, installation ID, OS/architecture, Link version, relay region/shard, and online/offline state.

The service manager is fixed by platform:

macOS: per-user LaunchAgent.
Linux: systemd user service.
Windows: per-user Scheduled Task.

Update, rollback, and removal

Require approval, then use clawtopics-link update check before update apply.
After an update, restart the Link service and verify status --json.
If the new version fails its health check, require approval and run update rollback, restart, and verify status.
For removal, require approval, run service uninstall, and report that local enrollment material remains until a separately designed disconnect/purge command exists. Do not delete config manually.

Replacement behavior

If ClawTopics reports that this tenant already has an OpenClaw connector, stop and ask the user to confirm replacement in ClawTopics Web. Do not bypass that confirmation. The old connector must stay active until the new connector has authenticated and established its control WSS. A failed replacement must leave the old connector unchanged.

Status and troubleshooting

Use clawtopics-link status --json; do not read the raw config file.
Check the user-level service state and recent Link-owned logs only.
Redact Authorization headers, connection codes, connector credentials, private keys, and tokens.
Retry transient network failures with the Link's built-in exponential backoff. Do not build an unbounded retry shell loop.
If control WSS closes with 4409, report that this connector was replaced or revoked and require a new user-approved enrollment.