alvis
a5c625b9b6
openclaw.json now sends `Authorization: Bearer ${AGAP_MCP_TOKEN}` to the agap
MCP server, which requires it as of kb#180. The token is injected from
openai/.env via docker-compose.yml and only substituted here, never inlined.
It maps to agent id `adolf`, which is also what the kb#147 vault gate reads.
Fixes tools.media.audio, which had been added but never restart-validated:
the per-entry `apiKey: "not-needed"` is rejected by the schema
("tools.media.audio.models.0: Invalid input"), and an invalid config makes the
gateway refuse to start outright -- adolf crash-looped on the first restart
after the block landed. The old comment claimed the schema requires a
non-empty apiKey; it is the opposite, apiKey is not a valid per-entry key at
all. Isolated with `openclaw config validate` against the running image
(2026.6.11): {provider, model} and {provider, model, baseUrl} validate, and
adding apiKey alone reproduces the failure. baseUrl is kept -- that is the
per-entry override pointing the openai-shaped provider at the local
faster-whisper server. Provider auth follows the normal model auth order per
docs/nodes/audio.md, and faster-whisper-server has no auth to satisfy anyway.
Two lessons encoded in the comments: `enabled: false` does NOT exempt an entry
from schema validation, and a config edit is not done until a restart boots
healthy -- this sat invalid but latent because the running gateway still held
an older loaded config. The block stays enabled: false; turning STT on is
still a kb#175/#191 decision (GTX 1070 co-residency).
Also adds the proactive-prioritization and todoist-capture design notes and
the vw-mcp prototype.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
29 lines
1.5 KiB
Plaintext
29 lines
1.5 KiB
Plaintext
# Copy to .env (git-ignored) and fill in real values before `docker compose up`.
|
|
# This server is intentionally narrow: read-only vw_* tools, a dedicated bot
|
|
# vault identity, and its own bearer token. See CLAUDE.md / kb task #64 for
|
|
# the full architecture and the sensitive setup steps (creating the bot user
|
|
# and the "Adolf" collection) that are NOT done by this scaffolding.
|
|
|
|
# Port this server listens on. 3100=agap-mcp, 3101=marketplace-mcp,
|
|
# 3103=kanboard-mcp, 3104=kanboard-mcp-adolf — 3105 verified free at write time.
|
|
PORT=3105
|
|
|
|
# Local Vaultwarden instance (NOT bitwarden.com). Unlike agap-mcp/
|
|
# marketplace-mcp, this service owns a fresh BITWARDENCLI_APPDATA_DIR volume
|
|
# with no pre-existing `bw config server`, so vaultwarden.js sets it on every
|
|
# boot from this var.
|
|
VW_URL=http://localhost:8041
|
|
|
|
# Dedicated bot identity — NEVER the master allogn@gmail.com account.
|
|
# Create this user in Vaultwarden first (sensitive step, reserved for the
|
|
# orchestrator — see report). Password: generate one and store it in
|
|
# Vaultwarden as item "ADOLF_VW_PASSWORD" (also a sensitive step).
|
|
BW_EMAIL=adolf-vault@auth.local
|
|
BW_PASSWORD=
|
|
|
|
# Bearer token gating /mcp, /sse, /messages (same pattern as
|
|
# marketplace-mcp). Generate with e.g. `openssl rand -hex 32`, store it in
|
|
# Vaultwarden as its own item (e.g. "VW_MCP_ADOLF_TOKEN"), and put the real
|
|
# value here — the line below is a PLACEHOLDER, not a usable secret.
|
|
VW_MCP_TOKEN=replace-with-output-of-openssl-rand--hex-32
|