flowstate-openclaw-client Package Skill

Package: @epicdm/flowstate-openclaw-client Repository: epic-flowstate-community Path: packages/flowstate-openclaw-client Version: 1.0.7

Use this published Dojo skill as the package-level entrypoint. For detailed workflows, use the package-local skills listed below.

Primary Package Workflow

OpenClaw Client Auth And Device Identity

Purpose

Use this skill to preserve OpenClaw authentication semantics and Ed25519 device identity compatibility with the gateway.

Read First

• packages/flowstate-openclaw-client/src/client.ts
• packages/flowstate-openclaw-client/src/ed25519.ts
• packages/flowstate-openclaw-client/src/types.ts
• packages/flowstate-openclaw-client/src/__tests__/ed25519.test.ts
• packages/flowstate-cli/src/cli-commands/agent/provision-device-key.ts
• packages/flowstate-cli/src/cli-commands/auth/provision-device-key.ts

Auth Channels

There are two separate auth channels:

• kongJwt: appended to the WebSocket URL as ?token=... for Kong JWT validation during upgrade.
• authToken: sent inside the OpenClaw v3 connect request as params.auth.token.

Do not collapse these into one token. Tests assert they stay separate.

Device Fallback

When authToken is empty and deviceIdentity exists, the client signs a v3 device payload and sends params.device in the connect frame.

When neither authToken nor deviceIdentity exists, throw:

new OpenClawClientError('No authToken and no deviceIdentity configured', 'AUTH_MISSING')

Device Id Rule

deriveDeviceIdFromPublicKey(publicKeyPem) must return:

sha256(raw 32-byte Ed25519 public key) as 64-character lowercase hex

The OpenClaw gateway computes the same value and rejects mismatched device ids.

Signed Payload Rule

buildDeviceAuthPayloadV3 uses pipe-separated fields in a fixed order:

v3|deviceId|clientId|clientMode|role|scopes|signedAtMs|token|nonce|platform|deviceFamily

Field order and empty slots are wire format. Do not reorder or remove empty placeholders.

Key Encoding

• Public keys are PEM SPKI.
• Private keys are PEM PKCS8.
• derivePublicKeyRaw extracts the raw 32-byte Ed25519 public key from SPKI DER.
• publicKeyRawBase64Url is used for device.publicKey.
• signPayload returns a base64url Ed25519 signature with no padding.

Verification

yarn workspace @epicdm/flowstate-openclaw-client test --runInBand src/__tests__/ed25519.test.ts src/__tests__/client.test.ts

Package Skill Inventory

@epicdm/flowstate-openclaw-client Skill Inventory

Skill Set

Design Notes

The feature inventory lists individual helpers, but agents need to learn protocol workflows. Cryptographic helpers are covered as part of the device identity workflow because their correctness matters only in the connect handshake and provisioning path.

Not Included

• No generated helper-by-helper skilllets.
• No instructions to deep-import private helpers.
• No Dojo publication steps until reviewed package-local skills are used to rebuild course/skill artifacts.

Review Gate

@epicdm/flowstate-openclaw-client Skills Review

Verdict

Pass with tracked follow-ups.

The authored skills are source-backed and workflow-oriented. They cover WebSocket chat protocol behavior, auth/device identity, streaming recovery, URL rewriting, downstream CLI/MCP integration, and maintenance drift.

Coverage

• Chat protocol: covered from src/client.ts and src/__tests__/client.test.ts.
• Auth/device identity: covered from src/client.ts, src/ed25519.ts, Ed25519 tests, and CLI provision-device-key callers.
• Streaming/recovery: covered from stream(), sendAndAwaitFinal(), and regression tests for runId mismatch, cumulative text, heartbeat/recovery behavior.
• URL routing: covered from src/url-rewrite.ts and tests.
• Maintenance: covered for missing README, stale changelog, generated Dojo weakness, and downstream flowstate-mcp/flowstate-cli callers.

Verification Results

LC_ALL=C rg -n "[^\\x00-\\x7F]" packages/flowstate-openclaw-client/.flowstate/skills
rg -n "^name:|^description:" packages/flowstate-openclaw-client/.flowstate/skills
yarn workspace @epicdm/flowstate-openclaw-client test
yarn workspace @epicdm/flowstate-openclaw-client typecheck
yarn workspace @epicdm/flowstate-openclaw-client build
yarn workspace @epicdm/flowstate-openclaw-client lint
yarn nx build @epicdm/flowstate-openclaw-client

Results:

• ASCII scan passed with no non-ASCII matches.
• Frontmatter scan found name and description on all six skills.
• typecheck passed.
• build passed and emitted CJS, ESM, sourcemaps, and DTS outputs.
• test passed: 3 suites, 39 tests. The runId mismatch regression test emitted the expected console.error diagnostic.
• lint passed with 15 existing non-null assertion warnings.
• yarn nx build @epicdm/flowstate-openclaw-client passed. Nx Cloud reported the existing unconnected-workspace 401 warning.

Follow-Ups

• Add or rebuild a package README from these protocol skills.
• Update changelog beyond 1.0.3 to match package version 1.0.7.
• Rebuild package-local Dojo content from reviewed workflow skills before publishing.

Start with this skill to understand the package purpose, then use the package-local focused skills for specific workflows. Keep this Dojo version aligned with packages/flowstate-openclaw-client/package.json. Do not treat generated feature lists as lessons; use workflow evidence from CODE-REVIEW.md, SKILL-INVENTORY.md, and REVIEW.md.