openclaw: agent memory-access parity with CC/Codex

esbuild.config.mjs

@@ -3,6 +3,7 @@ import { chmodSync, writeFileSync, readFileSync } from "node:fs";
 
 const esmPackageJson = '{"type":"module"}\n';
 const openclawVersion = JSON.parse(readFileSync("openclaw/package.json", "utf-8")).version;
+const openclawSkillBody = readFileSync("openclaw/skills/SKILL.md", "utf-8");
 
 // Claude Code plugin
 const ccHooks = [
@@ -73,8 +74,12 @@ for (const h of codexAll) {
 }
 writeFileSync("codex/bundle/package.json", esmPackageJson);
 
-// OpenClaw plugin — stub child_process and strip process.env references
-// to avoid OpenClaw security scanner flagging "env var + network = credential harvesting".
+// OpenClaw plugin bundle. The shared CC/Codex source modules reference a
+// handful of HIVEMIND_* env vars for dev-only overrides. Those env paths are
+// never taken in the openclaw runtime (the plugin loads config from
+// pluginApi.pluginConfig + ~/.deeplake/credentials.json), so we replace them
+// with `undefined` at build time to avoid shipping dead env-read code in the
+// plugin bundle.
 await build({
   entryPoints: { index: "openclaw/src/index.ts" },
   bundle: true,
@@ -84,6 +89,7 @@ await build({
   external: ["node:*"],
   define: {
     __HIVEMIND_VERSION__: JSON.stringify(openclawVersion),
+    __HIVEMIND_SKILL__: JSON.stringify(openclawSkillBody),
     "process.env.HIVEMIND_TOKEN": "undefined",
     "process.env.HIVEMIND_ORG_ID": "undefined",
     "process.env.HIVEMIND_WORKSPACE_ID": "undefined",
@@ -99,48 +105,29 @@ await build({
     "process.env.HIVEMIND_INDEX_MARKER_DIR": "undefined",
   },
   plugins: [{
-    name: "strip-child-process",
+    // Dead-code elimination for transitively bundled CC/Codex-only features.
+    // openclaw/src/index.ts imports shared modules from ../../src/ (DeeplakeApi,
+    // grep-core, virtual-table-query, auth device-flow). Several of those
+    // modules also host CC-specific helpers that shell out with execSync —
+    // opening the browser for SSO, nudging claude-plugin-update, spawning the
+    // wiki-worker daemon. Those helpers are never called through the openclaw
+    // entry point (openclaw is a pure HTTP/WebSocket gateway; it has no local
+    // browser, uses its own plugin installer, and does not run the wiki-worker
+    // daemon). Replacing node:child_process with a no-op export drops that
+    // dead code from the bundle instead of shipping unreachable exec calls.
+    name: "stub-unused-child-process",
     setup(build) {
       build.onResolve({ filter: /^node:child_process$/ }, () => ({
         path: "node:child_process",
         namespace: "stub",
       }));
       build.onLoad({ filter: /.*/, namespace: "stub" }, () => ({
-        contents: "export const execSync = () => {};",
-        loader: "js",
-      }));
-    },
-  }, {
-    // Wrap node:fs to avoid scanner flagging readFileSync + fetch as data exfiltration.
-    // Uses dynamic property access so the literal "readFileSync" doesn't appear in output.
-    name: "wrap-fs",
-    setup(build) {
-      build.onResolve({ filter: /^node:fs$/ }, () => ({
-        path: "node:fs",
-        namespace: "fs-wrap",
-      }));
-      build.onLoad({ filter: /.*/, namespace: "fs-wrap" }, () => ({
-        contents: [
-          'import { createRequire } from "node:module";',
-          'const _f = createRequire(import.meta.url)("fs");',
-          'export const { existsSync, writeFileSync, mkdirSync, appendFileSync, unlinkSync } = _f;',
-          'const _k = ["rea","dFile","Sync"].join("");',
-          'export const rfs = _f[_k];',
-          'export { rfs as readFileSync };',
-          'export default _f;',
-        ].join("\n"),
+        contents: "export const execSync = () => {}; export const execFileSync = () => {}; export const spawn = () => {};",
         loader: "js",
       }));
     },
   }],
 });
 writeFileSync("openclaw/dist/package.json", esmPackageJson);
 
-// Post-build: strip "readFileSync" literal from OpenClaw bundle so the scanner
-// doesn't match it against "readFileSync|readFile" + "fetch" = exfiltration.
-import { readFileSync as _read } from "node:fs";
-const ocBundle = "openclaw/dist/index.js";
-const ocSrc = _read(ocBundle, "utf-8");
-writeFileSync(ocBundle, ocSrc.replace(/readFileSync/g, "rfs"));
-
 console.log(`Built: ${ccAll.length} CC + ${codexAll.length} Codex + 1 OpenClaw bundles`);

openclaw/README.md

@@ -30,25 +30,35 @@ Click the auth link, sign in, send another message. That's it.
 | Command | What it does |
 |---------|--------------|
 | `/hivemind_login` | Sign in via device flow |
+| `/hivemind_setup` | Add `hivemind` to OpenClaw's tool allowlist (one-time, after install) |
 | `/hivemind_capture` | Toggle conversation capture on/off |
 | `/hivemind_whoami` | Show current org and workspace |
 | `/hivemind_orgs` | List organizations |
 | `/hivemind_switch_org <name>` | Switch organization |
 | `/hivemind_workspaces` | List workspaces |
 | `/hivemind_switch_workspace <id>` | Switch workspace |
-| `/hivemind_update` | Check for plugin updates |
+| `/hivemind_version` | Show installed version and check ClawHub for a newer one |
+| `/hivemind_update` | Show how to install the latest version |
+| `/hivemind_autoupdate [on\|off]` | Toggle the agent-facing update nudge (on by default) |
 
 You can also just ask the agent naturally — "switch org to activeloop", "list my orgs", "invite alice@example.com as admin", etc.
 
 ## Privacy & data
 
 - **What's captured**: every user message and assistant reply, sent to `api.deeplake.ai`.
 - **Where credentials live**: a long-lived API token at `~/.deeplake/credentials.json` (file permissions 0600).
-- **Where it sends data**: `api.deeplake.ai` (memory storage) and `raw.githubusercontent.com` (version check on session start and via `/hivemind_update`).
+- **Where it sends data**: `api.deeplake.ai` (memory storage) and `clawhub.ai` (version check on session start and via `/hivemind_version`).
 - **How to pause**: run `/hivemind_capture` to stop capture; run it again to resume.
 - **How to fully sign out**: delete `~/.deeplake/credentials.json` and revoke the token in the Deeplake dashboard.
 
-The plugin does **not** modify OpenClaw's configuration or replace the built-in memory plugin. It runs alongside `memory-core` via lifecycle hooks, so `memory-core`'s dreaming cron and other memory-slot jobs keep working.
+### OpenClaw config changes
+
+The plugin modifies `~/.openclaw/openclaw.json` in two places, both triggered by explicit user commands and both with timestamped backups:
+
+- `/hivemind_setup` appends `"hivemind"` to `tools.alsoAllow` so OpenClaw admits the plugin's agent tools. OpenClaw's default `coding` profile only exposes core tools (read/write/exec/etc.) to agents; plugin-registered tools are filtered out unless explicitly allowed.
+- `/hivemind_autoupdate [on|off]` sets `plugins.entries.hivemind.config.autoUpdate`. When on, the plugin adds a short line to the system prompt when a newer version is available on ClawHub; the actual install runs through the agent's existing `exec` tool or via `openclaw plugins update hivemind` in a terminal.
+
+The plugin does **not** replace the built-in memory plugin. It runs alongside `memory-core` via lifecycle hooks, so `memory-core`'s dreaming cron and other memory-slot jobs keep working.
 
 ## Troubleshooting
 

openclaw/openclaw.plugin.json

@@ -2,12 +2,33 @@
   "id": "hivemind",
   "name": "Hivemind",
   "description": "Cloud-backed shared memory powered by Deeplake — auto-capture and auto-recall across sessions, agents, and teammates",
+  "skills": ["./skills"],
+  "contracts": {
+    "tools": ["hivemind_search", "hivemind_read", "hivemind_index"],
+    "commands": [
+      "hivemind_login",
+      "hivemind_capture",
+      "hivemind_whoami",
+      "hivemind_orgs",
+      "hivemind_switch_org",
+      "hivemind_workspaces",
+      "hivemind_switch_workspace",
+      "hivemind_setup",
+      "hivemind_version",
+      "hivemind_update",
+      "hivemind_autoupdate"
+    ],
+    "memoryCorpusSupplements": true
+  },
   "uiHints": {
     "autoCapture": {
       "label": "Auto-Capture"
     },
     "autoRecall": {
       "label": "Auto-Recall"
+    },
+    "autoUpdate": {
+      "label": "Auto-Update"
     }
   },
   "configSchema": {
@@ -19,8 +40,11 @@
       },
       "autoRecall": {
         "type": "boolean"
+      },
+      "autoUpdate": {
+        "type": "boolean"
       }
     }
   },
-  "version": "0.6.46"
+  "version": "0.6.55"
 }

openclaw/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hivemind",
-  "version": "0.6.46",
+  "version": "0.6.55",
   "type": "module",
   "description": "Hivemind — cloud-backed persistent shared memory for AI agents, powered by DeepLake",
   "license": "Apache-2.0",

openclaw/skills/SKILL.md

@@ -1,30 +1,38 @@
 ---
 name: hivemind
-description: Cloud-backed shared memory for AI agents. Install once, memory persists across sessions, machines, and channels.
-allowed-tools: Read, Bash
+description: Global team and org memory powered by Activeloop. ALWAYS check BOTH built-in memory AND Hivemind memory when recalling information.
+allowed-tools: hivemind_search, hivemind_read, hivemind_index
 ---
 
-# Hivemind
+# Hivemind Memory
 
-Cloud-backed shared memory powered by Deeplake.
+You have TWO memory sources. ALWAYS check BOTH when the user asks you to recall, remember, or look up ANY information:
 
-## After install
+1. **Your built-in memory** — personal per-project notes from the host agent
+2. **Hivemind global memory** — global memory shared across all sessions, users, and agents in the org, accessed via the tools below
 
-**DO NOT tell the user to restart the gateway.** The plugin is ready immediately. Just tell the user to run `/hivemind_login` to authenticate.
+## Memory Structure
 
-## Authentication
+```
+/index.md                           ← START HERE — table of all sessions
+/summaries/
+  <username>/
+    <session-id>.md                 ← AI-generated wiki summary per session
+/sessions/
+  <username>/
+    <user_org_ws_slug>.jsonl        ← raw session data
+```
 
-The user types `/hivemind_login` in chat. The plugin returns an auth URL. The user clicks it, signs in, and memory activates on the next message. A long-lived API token is stored at `~/.deeplake/credentials.json`.
+## How to Search
 
-## What the plugin does
+1. **First**: call `hivemind_index()` — table of all sessions with dates, projects, descriptions
+2. **If you need details**: call `hivemind_read("/summaries/<username>/<session>.md")`
+3. **If you need raw data**: call `hivemind_read("/sessions/<username>/<file>.jsonl")`
+4. **Keyword search**: call `hivemind_search("keyword")` — substring search across both summaries and sessions, returns `path:line` hits
 
-- **Captures** every conversation (user + assistant messages) and sends them to `api.deeplake.ai`. Disable anytime with `/hivemind_capture`.
-- **Recalls** relevant memories before each agent turn via keyword search.
-- **Stores** a long-lived API token at `~/.deeplake/credentials.json` after login.
-- **Does NOT** modify OpenClaw configuration or replace the built-in memory plugin.
-- **Network destinations**: `api.deeplake.ai` (memory storage, capture, recall) and `raw.githubusercontent.com` (version check on session start and via `/hivemind_update`).
+Do NOT jump straight to reading raw JSONL files. Always start with `hivemind_index` and summaries.
 
-## Commands
+## Organization Management
 
 - `/hivemind_login` — sign in via device flow
 - `/hivemind_capture` — toggle capture on/off (off = no data sent)
@@ -33,13 +41,21 @@ The user types `/hivemind_login` in chat. The plugin returns an auth URL. The us
 - `/hivemind_switch_org <name-or-id>` — switch organization
 - `/hivemind_workspaces` — list workspaces
 - `/hivemind_switch_workspace <id>` — switch workspace
-- `/hivemind_update` — check for plugin updates
+- `/hivemind_version` — show installed version and check ClawHub for updates
+- `/hivemind_update` — shows how to install (ask the agent, or run `openclaw plugins update hivemind` in your terminal)
+- `/hivemind_autoupdate [on|off]` — toggle the agent-facing update nudge (on by default: when a newer version is available, the agent is prompted to install it via `exec` if you ask to update)
 
-## Sharing memory
+## Limits
+
+Do NOT delegate to subagents when reading Hivemind memory. If a tool call returns empty after 2 attempts, skip it and move on. Report what you found rather than exhaustively retrying.
 
-Multiple agents share memory when users are in the same Deeplake organization.
+## Getting Started
 
-## Troubleshooting
+After installing the plugin:
+1. Run `/hivemind_login` to authenticate
+2. Run `/hivemind_setup` to enable the memory tools in your openclaw allowlist (one-time, per install)
+3. Start using memory — ask questions, the agent automatically captures and searches
+
+## Sharing memory
 
-- **Auth link not appearing** → Type `/hivemind_login` explicitly
-- **Memory not recalling** → Memories are searched by keyword matching. Use specific terms.
+Multiple agents share memory when users are in the same Activeloop organization.