AgapHost/adolf/openclaw.json

{
  // Adolf P6 — OpenClaw gateway config for the "adolf" container.
  // Lives in the adolf-state VOLUME (mounted at /home/node/.openclaw), not
  // in the openai/ git repo. Secrets referenced below (${VAR}) are resolved
  // from this container's process env, itself sourced from openai/.env
  // (gitignored) via docker-compose.yml — never inlined here.

  gateway: {
    mode: "local",
    auth: {
      // Compose already binds "lan" (0.0.0.0) and publishes 18789/18790 to
      // the host, so this is a non-loopback bind and auth is mandatory.
      // Shared-secret token auth also gives the openclaw-tools bridge
      // (which calls POST /tools/invoke with the same token) full
      // trusted-operator scope, which is what lets gateway.tools.allow
      // below actually unlock cron/nodes for it.
      mode: "token",
      token: "${OPENCLAW_GATEWAY_TOKEN}",
    },
    tools: {
      // cron and nodes are owner-only and hard-denied on the HTTP
      // /tools/invoke surface by default. The openclaw-tools MCP bridge
      // (P5) calls that surface for cron_create/cron_list/nodes_invoke, so
      // without this allow-list those tools 404 even with a valid token.
      // "browser" added (kb#64 follow-up) so Adolf can drive the OpenClaw
      // browser via the openclaw-tools bridge for authenticated web access
      // (e.g. the family wiki login form).
      allow: ["cron", "nodes", "browser"],
    },
  },

  // Browser tool — bundled plugin, off by default. Enables a dedicated,
  // agent-only headless Chromium profile ("openclaw") driven through the
  // gateway's loopback control service. Chromium is already in the image
  // (playwright chromium-1228). Needs both this browser.enabled=true and the
  // "browser" entry in gateway.tools.allow above.
  browser: {
    enabled: true,
    // Chromium's setuid sandbox can't initialize inside this container (no
    // unprivileged user namespaces), so run with --no-sandbox. Safe here: the
    // browser profile is agent-only and isolated, and the container already
    // drops NET_RAW/NET_ADMIN. Without this, `browser start` fails with
    // "No usable sandbox".
    noSandbox: true,
    // The local *.alogins.net services resolve to the host gateway (private
    // 172.17.0.1 via extra_hosts), so the browser's SSRF guard blocks them by
    // default ("navigation blocked by policy"). Opt in for this trusted,
    // self-owned network — same decision as channels.matrix.network above.
    ssrfPolicy: {
      dangerouslyAllowPrivateNetwork: true,
    },
  },

  // Model provider: adolf-llm (P2/P4), the Kimi-CLI OpenAI-compatible
  // wrapper on :8010. Its HTTP server (openai/adolf-llm/server.js) performs
  // NO api-key/Authorization validation at all -- ADOLF_KEY's value is
  // functionally irrelevant to adolf-llm itself. It's still wired through
  // env (not hardcoded) because OpenClaw's custom-provider schema requires
  // a non-empty apiKey field and ${VAR} substitution fails closed on an
  // empty/missing var.
  models: {
    mode: "merge",
    providers: {
      "adolf-llm": {
        baseUrl: "http://adolf-llm:8010/v1",
        apiKey: "${ADOLF_KEY}",
        api: "openai-completions",
        // Margin above the server.js SSE heartbeat cadence (empty-content
        // keepalive delta every ~25s once idle) so the idle watchdog never
        // fires on long thinking/tool/MCP phases even if a heartbeat tick
        // is delayed (kb #71). Raised to 10min: long agentic turns (Cognee
        // tool-loops / recalls up to 150s each) were producing no *content*
        // progress for >300s, tripping "no response from model" and surfacing
        // an error before the agent finished. The wrapper now also kills the
        // kimi child on disconnect, so an over-timeout turn no longer orphans.
        timeoutSeconds: 600,
        models: [
          { id: "adolf", name: "Adolf", input: ["text", "image"] },
        ],
      },
    },
  },

  agents: {
    defaults: {
      model: "adolf-llm/adolf",
    },
  },

  ui: {
    assistant: { name: "Adolf" },
  },

  // Matrix channel (P6). Deliberately no accessToken/userId/password here:
  // MATRIX_HOMESERVER / MATRIX_USER_ID / MATRIX_PASSWORD / MATRIX_DEVICE_NAME
  // are config-key-backed env vars OpenClaw reads automatically when the
  // matching config key is unset, so real creds never touch this file or
  // git. Password auth (not the raw access token) mints Adolf its own fresh
  // Matrix device instead of reusing the existing matrixbot (Python/nio)
  // device -- see the P6 report for why that separation matters.
  //
  // Conservative defaults on purpose: dm "pairing" (owner must approve
  // unknown senders) and groupPolicy "disabled" (no room handling yet).
  // Revisit once the legacy matrixbot adapter is retired.
  channels: {
    matrix: {
      enabled: true,
      encryption: true,
      dm: { policy: "allowlist", allowFrom: ["@admin:mtx.alogins.net", "@elizaveta:mtx.alogins.net"] },
      groupPolicy: "disabled",
      autoJoin: "always",
      // mtx.alogins.net is deliberately mapped to the host-gateway (private)
      // IP via extra_hosts in docker-compose.yml to dodge a hairpin-NAT dead
      // end on the public route -- not an actual SSRF exposure, so opt out
      // of the private-network block for this trusted, self-owned homeserver.
      network: { dangerouslyAllowPrivateNetwork: true },
    },
  },

  // MCP registry (P6) -- same servers as openai/shared-mcp.json,
  // expressed in OpenClaw's own mcp.servers schema. `type: "http"` is
  // OpenClaw's documented CLI-native alias for transport: "streamable-http".
  mcp: {
    servers: {
      // kb#144 (A2A-12): toolFilter.include is OpenClaw's OWN per-server
      // tool-scoping mechanism (mcp.servers.*.toolFilter, zod-validated;
      // applied in agent-bundle-mcp-materialize.js when THIS container's own
      // tool bundle is built). CORRECTION (kb#144 second pass, 2026-07-22):
      // this does NOT reach the model on Adolf's kimi backbone -- Kimi CLI
      // (inside the separate adolf-llm container) reads its own
      // project-root .mcp.json, seeded from openai/shared-mcp.json, and
      // applies ITS OWN enabledTools/disabledTools (McpServerCommonFields,
      // computeEnabledNames). Live wire.jsonl verification (restart + one
      // real turn) proved OpenClaw's toolFilter alone left Kimi's actual
      // tool counts unchanged. This block is still correct for OpenClaw's
      // own MCP client surface -- see openai/shared-mcp.json for the layer
      // that actually scopes what the model sees.
      //
      // Scoped to Adolf's CORE memory ops: recall/retain/reflect (the
      // hooks below do IMPLICIT recall/retain automatically; these MCP
      // tools cover explicit "remember this" / "what do you recall about
      // X" turns) plus single-memory read/update and directive CRUD
      // (standing instructions). Cuts 20 rarely-used/admin tools: the
      // mental-model CRUD (7), document CRUD (3), operation-tracking (3),
      // tags (1), bank admin (4), sync_retain, invalidate_memory -- none
      // of which Adolf's Matrix persona drives turn-to-turn; reach the
      // hindsight MCP directly (unscoped) for that admin work instead of
      // paying for it on every Adolf turn. 29 tools -> 9.
      hindsight: {
        type: "http",
        url: "http://hindsight:8888/mcp/adolf/",
        toolFilter: {
          include: ["recall", "retain", "reflect", "list_memories", "get_memory", "update_memory", "list_directives", "create_directive", "delete_directive"],
        },
      },
      // Already minimal (5 tools -- message_send/cron_create/cron_list/
      // nodes_invoke/browser_invoke, all core to Adolf's matrix-chat +
      // cron-scheduling + browser capabilities) -- deliberately NO
      // toolFilter here, not an oversight.
      "openclaw-tools": {
        type: "http",
        url: "http://openclaw-tools:8020/mcp",
      },
      // kanboard-mcp-adolf (kb task #58) -- standalone kanboard-mcp image
      // (source /home/alvis/kanboard/mcp), second instance on :3104,
      // authenticated as the Kanboard "adolf" user via its own personal API
      // access token (KANBOARD_AUTH_USER=adolf in that instance's
      // .env.adolf) -- a genuinely distinct credential from the "claude"
      // instance on :3103 (app-wide jsonrpc token). Not part of the openai
      // compose network, so reached via host.docker.internal (already
      // extra_hosts-mapped for this container) rather than a service name.
      // kb#144: scoped to task-triage/proactive-monitoring core --
      // list/read/search/create/update/move/status/assign/comment/
      // activity. Cuts subtask CRUD, task-link CRUD, tag CRUD, and
      // destructive remove_task/remove_comment (9 tools) -- deep
      // task-graph management is claude-coder's job (the actual task
      // worker), not Adolf's lighter triage/reporting role. 23 -> 14.
      kanboard: {
        type: "http",
        url: "http://host.docker.internal:3104/mcp",
        toolFilter: {
          include: ["kanboard_list_projects", "kanboard_get_project", "kanboard_list_tasks", "kanboard_my_tasks", "kanboard_get_task", "kanboard_search_tasks", "kanboard_list_users", "kanboard_project_activity", "kanboard_create_task", "kanboard_update_task", "kanboard_move_task", "kanboard_change_task_status", "kanboard_assign_task", "kanboard_add_comment"],
        },
      },
      // marketplace-mcp (kb task #61) -- the SAME shared marketplace-mcp
      // instance Claude Code and OpenWebUI use (single service, port 3101,
      // network_mode: host on the Agap host), not a second copy. It can
      // place real orders on live marketplace accounts, so it's gated by a
      // shared bearer token (MARKETPLACE_MCP_TOKEN in Vaultwarden / this
      // container's env, injected via openai/.env -> docker-compose.yml).
      // Reached via host.docker.internal, same reasoning as kanboard above.
      // kb#144: scoped to READ-ONLY discovery (find_best/search/product/
      // recommendations/reviews/compare/status). Cuts the checkout
      // surface -- add_to_cart, get_cart, login, open_vnc, save_session,
      // submit_sms (6 tools) -- real-money/session-auth actions Adolf
      // shouldn't take unattended from background Matrix chat. This
      // whole server is also the FIRST candidate to move OUT to Torgash
      // (kb#130's marketplace-analyst persona, not yet built) per
      // design §2/§8; scoping now both cuts tokens and removes purchase
      // risk in the meantime rather than waiting on Torgash to exist.
      // 13 -> 7.
      marketplace: {
        type: "http",
        url: "http://host.docker.internal:3101/mcp",
        headers: {
          Authorization: "Bearer ${MARKETPLACE_MCP_TOKEN}",
        },
        toolFilter: {
          include: ["marketplace_find_best", "marketplace_search", "marketplace_get_product", "marketplace_get_recommendations", "marketplace_get_reviews", "marketplace_compare_prices", "marketplace_status"],
        },
      },
      // agap-mcp (kb#64) -- the SAME shared agap-mcp instance Claude Code uses
      // (network_mode: host, :3100, unauthenticated on localhost). Grants Adolf
      // the same access as Claude: vault (vw_* for credential fetching) plus
      // gitea/ha/zabbix/radicale. Reached via host.docker.internal like
      // kanboard/marketplace above.
      // kb#144: scoped to Adolf's proactive-auditor/personal-assistant
      // core -- vault read/write (trusted, credential help), HA
      // (smart-home monitoring), Zabbix (the literal "proactive
      // auditor" job), calendar read/write (minus admin
      // create/delete_calendar), Todoist. Cuts all 6 gitea_* tools
      // (repo/wiki/issue management is claude-coder's infra-ops domain,
      // not Adolf's Matrix persona) plus radicale_create_calendar/
      // delete_calendar (rare calendar-admin ops) -- 8 tools. 32 -> 24.
      // kb#95: added wiki_search/wiki_read/wiki_edit (family MediaWiki,
      // family.alogins.net / РодоВики -- source of truth for relatives,
      // dates, events) -- squarely Adolf's persona domain. 35 -> 27.
      agap: {
        type: "http",
        url: "http://host.docker.internal:3100/mcp",
        toolFilter: {
          include: ["vw_get_password", "vw_get_item", "vw_list_items", "vw_create_login", "vw_update_password", "ha_get_state", "ha_list_entities", "ha_call_service", "ha_get_history", "zabbix_get_problems", "zabbix_get_hosts", "zabbix_get_items", "zabbix_get_triggers", "radicale_list_calendars", "radicale_list_events", "radicale_get_event", "radicale_put_event", "radicale_delete_event", "radicale_move_event", "todoist_list_tasks", "todoist_list_projects", "todoist_create_task", "todoist_update_task", "todoist_complete_task", "wiki_search", "wiki_read", "wiki_edit"],
        },
      },
    },
  },

  // Memory plugins (P8). Activation entry is required for the gateway to
  // load a plugin at startup (discovery alone is not enough).
  plugins: {
    entries: {
      // Hindsight memory plugin (kb #75, H3) — installed external plugin
      // under .openclaw/extensions/hindsight-memory, bind-mounted read-only
      // from openai/hindsight-openclaw-plugin (see that project's
      // docker-compose.yml adolf.volumes). Structural successor to
      // cognee-memory above: LLM-free recall inject (before_prompt_build) +
      // async retain (agent_end) against the hindsight service, bank
      // "adolf" (same bank the mcp.servers.hindsight tool surface above
      // uses, so hook-based and tool-based memory stay one consistent
      // store). No cognify/sweep config here — Hindsight's retain does
      // extraction/consolidation server-side, so that whole class of
      // config (sweepIntervalMs etc. above) doesn't apply.
      "hindsight-memory": {
        enabled: true,
        // Same opt-in requirement as cognee-memory above: before_prompt_build
        // => allowPromptInjection; agent_end => allowConversationAccess.
        hooks: { allowConversationAccess: true, allowPromptInjection: true },
      },
      // Kimi quota readout (kb #62) — installed external plugin, bind-mounted
      // read-only from openai/quota-command-openclaw-plugin (see that
      // project's docker-compose.yml adolf.volumes) onto
      // .openclaw/extensions/quota-command. Registers a `/quota` native
      // command; no hooks, so no allowConversationAccess/allowPromptInjection
      // opt-in needed.
      "quota-command": {
        enabled: true,
      },
      // Kimi quota footer (kb #85) — installed external plugin, bind-mounted
      // read-only from openai/kimi-quota-footer-plugin (see that project's
      // docker-compose.yml adolf.volumes) onto
      // .openclaw/extensions/kimi-quota-footer. Appends a compact Kimi
      // usage line to every outgoing reply via the reply_payload_sending
      // hook (not a raw conversation hook, so no allowConversationAccess/
      // allowPromptInjection opt-in needed), reusing the same LLM-free
      // adolf-llm:8010/usage route as quota-command above. Verified this
      // hook fires on Adolf's actual send path (sendDurableMessageBatch ->
      // deliverOutboundPayloadsInternal) as long as channels.matrix.streaming
      // stays unset/"off" as it is today — see the plugin's index.js header
      // comment for the streaming caveat if that ever changes.
      "kimi-quota-footer": {
        enabled: true,
      },
    },
  },
}