clawtopics-link

Install, connect, inspect, update, roll back, or remove the official ClawTopics Link outbound WSS service. Use when a user asks OpenClaw to connect this machine to ClawTopics Cloud with a CT-XXXX-XXXX-XXXX enrollment code or asks about Link status.

Safety boundaries

• Ask for explicit approval before downloading Link, installing or changing its user-level service, enrolling this host, updating, rolling back, or removing Link.
• Use only the bundled installer for the initial v0.1.0 bootstrap. It has fixed official HTTPS URLs, platform mappings, artifact sizes, and SHA-256 values. Stop on any mismatch.
• Use clawtopics-link update for later releases; Link verifies the pinned Ed25519 release key, official origin, platform, size, and SHA-256 itself.
• Never pass the enrollment code as a command-line argument, environment variable, URL parameter, shell interpolation, or process log. Send it to clawtopics-link connect --code-stdin only through the execution tool's standard-input channel. If the tool cannot supply stdin safely, stop and give the user the local command without repeating their code.
• Do not print, quote, or persist the enrollment code. It expires after 10 minutes and one use.
• Never expose the stored connector credential, device private key, Gateway token, OpenClaw device token, relay ticket, or message content.
• Do not substitute another URL, checksum, destination, service command, or package.
• Link does not authorize arbitrary shell, file browsing, LAN scanning, remote desktop, package management, or arbitrary port forwarding.
• Docker OpenClaw must use a separate Link sidecar. Do not install Link inside an ephemeral container. This Skill does not automate the deferred sidecar flow.

Connect workflow

1. Confirm approval to download the official binary and install a user-level background service.
2. Detect whether OpenClaw runs directly or in Docker. Stop with the sidecar explanation for Docker.
3. Resolve this installed Skill directory. Run exactly one bundled installer:
   • macOS or Linux: bash scripts/install-link.sh
   • Windows PowerShell: powershell -ExecutionPolicy Bypass -File scripts/install-link.ps1
4. Treat installer failure as terminal. Do not reproduce its download with ad hoc commands.
5. Ask for the one-time code only after the installer reports a verified binary path.
6. Run the reported binary with connect --api-base https://openclaw.tekoai.com/api/v1 --code-stdin; provide the code only via process stdin.
7. Run the same binary with service install, then service status.
8. Run status --json and report only connector ID, installation ID, OS/architecture, Link version, relay region/shard, and online/offline state.

The service manager is fixed by platform:

• macOS: per-user LaunchAgent.
• Linux: systemd user service.
• Windows: per-user Scheduled Task.

Update, rollback, and removal

• Require approval, then use clawtopics-link update check before update apply.
• After an update, restart the Link service and verify status --json.
• If the new version fails its health check, require approval and run update rollback, restart, and verify status.
• For removal, require approval, run service uninstall, and report that local enrollment material remains until a separately designed disconnect/purge command exists. Do not delete config manually.

Replacement behavior

If ClawTopics reports that this tenant already has an OpenClaw connector, stop and ask the user to confirm replacement in ClawTopics Web. Do not bypass that confirmation. The old connector must stay active until the new connector has authenticated and established its control WSS. A failed replacement must leave the old connector unchanged.

Status and troubleshooting

• Use clawtopics-link status --json; do not read the raw config file.
• Check the user-level service state and recent Link-owned logs only.
• Redact Authorization headers, connection codes, connector credentials, private keys, and tokens.
• Retry transient network failures with the Link's built-in exponential backoff. Do not build an unbounded retry shell loop.
• If control WSS closes with 4409, report that this connector was replaced or revoked and require a new user-approved enrollment.