Merge branch 'main' into dev-20260407-v2.0.13

Author: endxxxx

.github/workflows/hermes-plugin-publish.yml

@@ -0,0 +1,113 @@
+name: Hermes Plugin — Build Prebuilds & Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to publish (e.g. 1.0.0 or 1.0.0-beta.1)"
+        required: true
+      tag:
+        description: "npm dist-tag (latest for production, beta/next/alpha for testing)"
+        required: true
+        default: "latest"
+
+defaults:
+  run:
+    working-directory: apps/memos-local-plugin
+
+permissions:
+  contents: write
+
+jobs:
+  build-prebuilds:
+    strategy:
+      matrix:
+        include:
+          - os: macos-14
+            platform: darwin-arm64
+          - os: macos-15
+            platform: darwin-x64
+          - os: ubuntu-latest
+            platform: linux-x64
+          - os: windows-latest
+            platform: win32-x64
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Rebuild for x64 under Rosetta (darwin-x64 only)
+        if: matrix.platform == 'darwin-x64'
+        run: |
+          arch -x86_64 npm rebuild better-sqlite3
+
+      - name: Collect prebuild
+        shell: bash
+        run: |
+          mkdir -p prebuilds/${{ matrix.platform }}
+          cp node_modules/better-sqlite3/build/Release/better_sqlite3.node prebuilds/${{ matrix.platform }}/
+
+      - name: Upload prebuild artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: prebuild-hermes-${{ matrix.platform }}
+          path: apps/memos-local-plugin/prebuilds/${{ matrix.platform }}/better_sqlite3.node
+
+  publish:
+    needs: build-prebuilds
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
+      - name: Download all prebuilds
+        uses: actions/download-artifact@v4
+        with:
+          path: apps/memos-local-plugin/prebuilds
+          pattern: prebuild-hermes-*
+          merge-multiple: false
+
+      - name: Organize prebuilds
+        run: |
+          cd prebuilds
+          for dir in prebuild-hermes-*; do
+            platform="${dir#prebuild-hermes-}"
+            mkdir -p "$platform"
+            mv "$dir/better_sqlite3.node" "$platform/"
+            rmdir "$dir"
+          done
+          echo "Prebuilds collected:"
+          find . -name "*.node" -exec ls -lh {} \;
+
+      - name: Install dependencies (skip native build)
+        run: npm install --ignore-scripts
+
+      - name: Bump version
+        run: npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
+
+      - name: Publish to npm
+        run: npm publish --access public --tag ${{ inputs.tag }}
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Create git tag and push
+        working-directory: .
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add apps/memos-local-plugin/package.json
+          if ! git diff --staged --quiet; then
+            git commit -m "release: hermes-plugin v${{ inputs.version }}"
+          fi
+          git tag "hermes-plugin-v${{ inputs.version }}"
+          git push origin HEAD --tags

.github/workflows/openclaw-plugin-publish.yml

@@ -100,7 +100,8 @@ jobs:
           MEMOS_ARMS_ENV: ${{ secrets.MEMOS_ARMS_ENV }}
 
       - name: Bump version
-        run: npm version ${{ inputs.version }} --no-git-tag-version
+        # Branch may already have this version in package.json (e.g. after a prior merge); npm errors without this flag.
+        run: npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
 
       - name: Publish to npm
         run: npm publish --access public --tag ${{ inputs.tag }}
@@ -113,6 +114,8 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add apps/memos-local-openclaw/package.json
-          git commit -m "release: openclaw-plugin v${{ inputs.version }}"
+          if ! git diff --staged --quiet; then
+            git commit -m "release: openclaw-plugin v${{ inputs.version }}"
+          fi
           git tag "openclaw-plugin-v${{ inputs.version }}"
           git push origin HEAD --tags

apps/MemOS-Cloud-OpenClaw-Plugin/.gitignore

@@ -4,6 +4,7 @@ node_modules
 # Environment variables
 .env
 .env.*
+.memos_arms_uid
 
 # NPM
 .npmrc

apps/MemOS-Cloud-OpenClaw-Plugin/HOOK.md

@@ -0,0 +1,22 @@
+---
+name: memos-cloud-openclaw-plugin
+description: "OpenClaw lifecycle plugin for MemOS Cloud (add + recall memory)"
+homepage: https://github.com/MemTensor/MemOS-Cloud-OpenClaw-Plugin
+metadata: {
+  "openclaw": {
+    "emoji": "🧠",
+    "events": ["before_agent_start", "agent_end", "command:new"],
+    "requires": {
+      "bins": ["node"]
+    }
+  }
+}
+---
+
+# MemOS Cloud OpenClaw Plugin Hooks
+
+This plugin registers the following OpenClaw lifecycle hooks to interact with MemOS Cloud:
+
+- `before_agent_start`: Intercepts the agent startup sequence to recall relevant memories from MemOS Cloud and injects them into the agent's context.
+- `agent_end`: Intercepts the agent termination sequence to capture the completed conversation turn and saves it to MemOS Cloud.
+- `command:new`: Increments a numeric conversation suffix when the `/new` command is issued to keep MemOS contexts distinct.

apps/MemOS-Cloud-OpenClaw-Plugin/README.md

@@ -7,8 +7,18 @@ A minimal OpenClaw lifecycle plugin that **recalls** memories from MemOS Cloud b
 ## Features
 - **Recall**: `before_agent_start` → `/search/memory`
 - **Add**: `agent_end` → `/add/message`
+- **Config UI**: starting the gateway also starts a local plugin config page for editing `plugins.entries.memos-cloud-openclaw-plugin.config`
 - Uses **Token** auth (`Authorization: Token <MEMOS_API_KEY>`)
 
+## Config UI
+- On gateway start, the plugin launches a local config page and prints the URL in the terminal (default: `http://127.0.0.1:38463`).
+- The page reads and writes the host config file directly:
+  - OpenClaw: `~/.openclaw/openclaw.json`
+  - Moltbot: `~/.moltbot/moltbot.json`
+  - ClawDBot: `~/.clawdbot/clawdbot.json`
+- If the preferred UI port is already in use, the plugin automatically picks the next free port.
+- Saving changes writes `plugins.entries.memos-cloud-openclaw-plugin.config`. (Note: you may need to manually restart the gateway after saving for settings to take effect).
+
 ## Install
 
 ### Option A — NPM (Recommended)
@@ -55,9 +65,8 @@ Make sure it’s enabled in `~/.openclaw/openclaw.json`:
 Restart the gateway after config changes.
 
 ## Environment Variables
-The plugin resolves runtime config in this order: **plugin config → env files → process environment**.
-Among env files, it tries them in order (**openclaw → moltbot → clawdbot**). For each key, the first file with a value wins.
-If none of these files exist (or the key is missing), it falls back to the process environment.
+The plugin resolves runtime config in this order: **plugin config → env files**. Due to strict security sandboxing, it **does not** read credentials from process environment variables.
+For env files, it tries them in order (**openclaw → moltbot → clawdbot**). For each key, the first file with a value wins.
 
 **Where to configure**
 - Files (priority order):
@@ -66,19 +75,9 @@ If none of these files exist (or the key is missing), it falls back to the proce
   - `~/.clawdbot/.env`
 - Each line is `KEY=value`
 
-**Quick setup (shell)**
+**Quick setup (shell / Windows)**
 ```bash
-echo 'export MEMOS_API_KEY="mpg-..."' >> ~/.zshrc
-source ~/.zshrc
-# or
-
-echo 'export MEMOS_API_KEY="mpg-..."' >> ~/.bashrc
-source ~/.bashrc
-```
-
-**Quick setup (Windows PowerShell)**
-```powershell
-[System.Environment]::SetEnvironmentVariable("MEMOS_API_KEY", "mpg-...", "User")
+echo 'MEMOS_API_KEY="mpg-..."' >> ~/.openclaw/.env
 ```
 
 If `MEMOS_API_KEY` is missing, the plugin will warn with setup instructions and the API key URL.
@@ -306,7 +305,7 @@ MEMOS_AGENT_OVERRIDES='{"research-agent": {"memoryLimitNumber": 12, "relativity"
 - **What it does**: when enabled, session keys like `agent:main:<provider>:direct:<peer-id>` reuse `<peer-id>` as MemOS `user_id`.
 - **What it does not do**: non-direct session keys such as `agent:main:<provider>:channel:<channel-id>` keep using the configured fallback `userId`.
 - **Request paths affected**: the same resolver is used by both `buildSearchPayload()` and `buildAddMessagePayload()`, so recall and add stay consistent.
-- **Config precedence**: runtime config still follows the same rule as the rest of the plugin - plugin config first, then `.env` files (`~/.openclaw/.env` -> `~/.moltbot/.env` -> `~/.clawdbot/.env`), then process env.
+- **Config precedence**: runtime config still follows the same rule as the rest of the plugin - plugin config first, then `.env` files (`~/.openclaw/.env` -> `~/.moltbot/.env` -> `~/.clawdbot/.env`).
 
 
 ## Notes

apps/MemOS-Cloud-OpenClaw-Plugin/README_ZH.md

@@ -9,8 +9,18 @@
 ## 功能
 - **Recall**：`before_agent_start` → `/search/memory`
 - **Add**：`agent_end` → `/add/message`
+- **Config UI**：启动 gateway 时同时启动本地插件配置页面，用来编辑 `plugins.entries.memos-cloud-openclaw-plugin.config`
 - 使用 **Token** 认证（`Authorization: Token <MEMOS_API_KEY>`）
 
+## 配置页面
+- Gateway 启动后，插件会同时拉起一个本地配置页面，并在终端输出访问地址（默认：`http://127.0.0.1:38463`）。
+- 页面会直接读取并写回当前宿主的配置文件：
+  - OpenClaw：`~/.openclaw/openclaw.json`
+  - Moltbot：`~/.moltbot/moltbot.json`
+  - ClawDBot：`~/.clawdbot/clawdbot.json`
+- 如果默认端口被占用，插件会自动顺延到下一个可用端口。
+- 页面保存后会写回 `plugins.entries.memos-cloud-openclaw-plugin.config`。（注意：保存后可能需要手动重启 Gateway 以使配置生效）
+
 ## 安装
 
 ### 方式 A — NPM（推荐）
@@ -57,9 +67,8 @@ openclaw gateway restart
 修改配置后需要重启 gateway。
 
 ## 环境变量
-插件运行时配置的优先级是：**插件 config → env 文件 → 进程环境变量**。
+插件运行时配置的优先级是：**插件 config → env 文件**。为符合纯粹的安全沙箱规范，插件不再支持回退到进程环境变量去读取敏感凭证。
 在 env 文件层，按顺序读取（**openclaw → moltbot → clawdbot**），每个键优先使用最先匹配到的值。
-若三个文件都不存在（或该键未找到），才会回退到进程环境变量。
 
 **配置位置**
 - 文件（优先级顺序）：
@@ -68,19 +77,9 @@ openclaw gateway restart
   - `~/.clawdbot/.env`
 - 每行格式：`KEY=value`
 
-**快速配置（Shell）**
+**快速配置（Shell / Windows）**
 ```bash
-echo 'export MEMOS_API_KEY="mpg-..."' >> ~/.zshrc
-source ~/.zshrc
-# 或者
-
-echo 'export MEMOS_API_KEY="mpg-..."' >> ~/.bashrc
-source ~/.bashrc
-```
-
-**快速配置（Windows PowerShell）**
-```powershell
-[System.Environment]::SetEnvironmentVariable("MEMOS_API_KEY", "mpg-...", "User")
+echo 'MEMOS_API_KEY="mpg-..."' >> ~/.openclaw/.env
 ```
 
 若未读取到 `MEMOS_API_KEY`，插件会提示配置方式并附 API Key 获取地址。
@@ -311,7 +310,7 @@ MEMOS_AGENT_OVERRIDES='{"research-agent": {"memoryLimitNumber": 12, "relativity"
 - **行为说明**：开启后，像 `agent:main:<provider>:direct:<peer-id>` 这样的私聊 sessionKey，会把 `<peer-id>` 当作 MemOS `user_id`。
 - **不会影响的场景**：像 `agent:main:<provider>:channel:<channel-id>` 这类非私聊 sessionKey，仍继续使用配置好的 fallback `userId`。
 - **作用范围**：同一套解析逻辑同时作用于 `buildSearchPayload()` 和 `buildAddMessagePayload()`，保证 recall 与 add 一致。
-- **配置优先级**：仍遵循插件现有规则——插件 config 优先，其次是 `.env` 文件（`~/.openclaw/.env` -> `~/.moltbot/.env` -> `~/.clawdbot/.env`），最后才回退到进程环境变量。
+- **配置优先级**：仍遵循插件现有规则——插件 config 优先，其次是 `.env` 文件（`~/.openclaw/.env` -> `~/.moltbot/.env` -> `~/.clawdbot/.env`）。
 
 
 ## 说明