Dev

.env.example

@@ -3,6 +3,9 @@
 # OPENCLAW_BASE_URL=http://127.0.0.1:18789
 # OPENCLAW_API_KEY=
 
+# OpenRouter (voice messages, Ask mode, smart titles) is configured in the app
+# under Settings → "Voice & Ask", not here — the key is stored in the local DB.
+
 PORT=3000
 # Default (when unset): ~/.iclaw/data/iclaw.db
 # DB_PATH=./data/iclaw.db

AGENTS.md

@@ -19,7 +19,7 @@ These are intentional non-goals. Don't add them. If a request lands here that ne
 - **Not a generic OpenAI-compat client.** We migrated off `/v1/chat/completions` in commit `a92c10e`. Do not re-introduce an HTTP chat completion path or SSE-based streaming — everything chat-related is native WS.
 - **Not a multi-provider chat tool.** No fallback to Ollama, vLLM, Claude API, OpenAI direct, etc. OpenClaw is the only backend; switch model providers in `openclaw.json`.
 - **Not a remote/hosted product.** Loopback-only. No multi-user, no auth layer, no team features. Threat model is "this user on this machine".
-- **Not a re-implementation of OpenClaw's agent runtime.** We don't compact transcripts, run tools, manage `MEMORY.md`, or wrap the LLM. We display what the gateway produces and (separately) maintain a project-scoped fact layer that's *additional* to OpenClaw memory, not a replacement.
+- **For the default Full Power chat, not a re-implementation of OpenClaw's agent runtime.** On that path we don't compact transcripts, run tools, or wrap the LLM — we display what the gateway produces and (separately) maintain a project-scoped fact layer *additional* to OpenClaw memory. (The Work / Safe work / Incognito modes are the deliberate exception — a small, self-contained agent loop in `packages/iclaw-runtime`; see below. Don't grow it into a general OpenClaw replacement.)
 - **Not heavyweight on the frontend.** No build step beyond `tsc`. Plain CSS, vanilla JS on the client, EJS for views. If you want to add React/Vue/Svelte, open an issue first — the answer is probably no for the current scope.
 
 ## Architecture you need to know
@@ -62,6 +62,26 @@ These are intentional non-goals. Don't add them. If a request lands here that ne
 
 Browser ↔ server is **one persistent WebSocket** at `/ws`. Chat traffic (send, abort, exec approval, streaming turn events, cross-tab sync) flows through it. HTTP routes exist for page rendering (EJS), form actions, the `/media/*` proxy, and JSON endpoints under `/api/gateway/*`. Every HTTP mutation that touches a chat also emits the matching `chat-updated` / `chat-deleted` over WS so other tabs catch up instantly.
 
+### Runtime modes (Work / Safe work / Incognito)
+
+The default **Full Power** mode goes to the gateway (above). The other three modes
+are served by the bundled **iClaw runtime** (`packages/iclaw-runtime`), a small
+agent runtime kept deliberately minimal:
+
+- The host calls it over HTTP on `127.0.0.1:7430` (`src/services/workRuntime.ts` →
+  runtime `index.ts`). The model loop runs **on the host** via OpenRouter.
+- Tool/shell execution is isolated in a **Docker sandbox**, one model per file:
+  `secure-runner.ts` (Safe work / Incognito — everything runs in a per-turn
+  container) and `work-container.ts` (Work — agent loop + file tools on the host,
+  only `run_command` containerized with per-folder `:ro`/`:rw` mounts). Both share
+  ONE image, `container/secure-sandbox.Dockerfile` (tag `iclaw-secure:latest`,
+  built via `npm run build:secure-image`); `node:22` is only an emergency fallback.
+- The live runtime is just 9 files (`index.ts`, `sessions.ts`, `secure-runner.ts`,
+  `work-container.ts`, `agent/{loop,tools,security,prompt-dump}.ts`, `log.ts`).
+  Path/secret enforcement lives in `agent/security.ts`. Needs Docker + an
+  OpenRouter key; without either, these modes are unavailable and fall back to
+  Full Power. This is NOT the OpenClaw path — keep the two cleanly separate.
+
 ### The canonical client paths
 
 | What you want | Use |

CHANGELOG.md

@@ -12,6 +12,15 @@ All notable changes to iClaw are documented here. The format follows [Keep a Cha
 - **Hover-intent auto-close (3.5 s)** for both menus. Mouse leaves the menu → 3.5 s timer; returns → timer resets. Replaces the schedule menu's old 10 s blanket timeout.
 - **Dynamic favicon.** The browser tab icon is now canvas-rendered with Apple-style rounded corners, and carries up to two status dots aggregated across all chats/tasks: 🟠 needs-human, 🔵 chat ready / task-review, 🟢 working (priority orange → blue → green). It's a derived view of the sidebar status dots — repainted only when the verdict actually changes (debounced), never animated, so steady-state cost is zero.
 
+#### Remote Access (E2E alpha)
+- Open the local iClaw UI from another device through an **iclaw-relay** tunnel — no inbound port, no SSH forwarding (**Settings → Remote Access**). Two setups: *local mode* (iClaw + OpenClaw on one laptop) and *host mode* (always-on machine, browse from phone/laptop). Enabled by `ICLAW_RELAY_URL` + `OPAQUE_SERVER_SETUP` on the iClaw host.
+- **OPAQUE login** (`@serenity-kit/opaque`): the tunnel passphrase is never sent in plaintext over the wire; a tunneled `POST /__ra/login` is rejected (426) in favour of the OPAQUE `start`/`finish` handshake.
+- **End-to-end encrypted transport**: HTTP and WebSocket payloads are encrypted between the browser and the *local* iClaw (`/__ra/e2e/http`, `/__ra/e2e/ws`); the relay forwards opaque envelopes (`ct`, `sid`) and sees only metadata (subdomain, timing, sizes).
+- **Trusted device sessions**: Ed25519 challenge-response lets a browser reconnect without retyping the passphrase; devices are listed and individually revocable in Settings.
+- **Relay access-token gate** (`?access=` → HttpOnly cookie) blocks visitors who only guess the subdomain. **New access link** rotates the token and forbids old links; **Disable** revokes the tunnel and its relay registration.
+- Adversarial smoke bundle (`npm run test:ra-smoke`) plus a relay frame-capture scanner (`npm run scan:relay-capture`) assert no plaintext passphrase, cookie, HTML, or chat JSON ever crosses the relay.
+- **Alpha** — not externally audited; the relay still sees routing metadata. Security model and setup in [docs/REMOTE_ACCESS.md](../docs/REMOTE_ACCESS.md).
+
 ### Removed
 
 - Native browser tooltip on sidebar chat items (`title="<chat.title>"`). The full title is already visible inline; the tooltip just got in the way of the new hover-hold gesture.

README.md

@@ -5,55 +5,46 @@
 <h1 align="center">iClaw</h1>
 
 <p align="center">
-  Chat UI for <a href="https://openclaw.ai">OpenClaw Gateway</a> — runs on your machine, stores history locally.
+  Minimalist agent UI - give it a project, it works only within it. Isolated memory, isolated folders
 </p>
 
 <p align="center">
-  <a href="https://github.com/iClawApp/iClaw/actions/workflows/ci.yml?branch=main"><img src="https://img.shields.io/github/actions/workflow/status/iClawApp/iClaw/ci.yml?branch=main&style=for-the-badge" alt="CI"></a>
-  <a href="https://www.npmjs.com/package/@iclawapp/iclaw"><img src="https://img.shields.io/npm/v/@iclawapp/iclaw?style=for-the-badge" alt="npm"></a>
   <a href="https://www.npmjs.com/package/@iclawapp/iclaw"><img src="https://img.shields.io/npm/dm/@iclawapp/iclaw?style=for-the-badge" alt="npm downloads"></a>
+  <a href="https://www.reddit.com/r/iClaw_ai_agent/"><img src="https://img.shields.io/badge/Reddit-r%2FiClaw__ai__agent-FF4500?style=for-the-badge&logo=reddit&logoColor=white" alt="Reddit"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue.svg?style=for-the-badge" alt="MIT"></a>
 </p>
 
 ![iClaw screenshot](./docs/readme-screenshot.png)
 
 ## Install
 
-Requires [Node.js 20+](https://nodejs.org) and a running [OpenClaw Gateway](https://docs.openclaw.ai).
+Requires [Node.js 20+](https://nodejs.org)
 
 ```bash
 npx @iclawapp/iclaw
 ```
 
-The terminal shows a short status line and **press `g`** to open the UI in your browser. It picks the next free port if `3000` is busy, and exits without starting a second copy if iClaw is already running.
+Press **`g`** in the terminal to open the UI in your browser
 
-Your chat history is saved to `~/.iclaw/data/iclaw.db`.
-
-Optional env vars: `PORT` (preferred port, default `3000`), `ICLAW_OPEN_BROWSER=1` (also open the browser tab on start).
-
-## Encrypted chat sharing (optional)
-
-Hit **Share** in any chat to get an encrypted link. The chat is encrypted in your browser (AES-256-GCM); the server stores ciphertext only. Supports password protection, burn-after-read, and TTL.
-
-Powered by [iClaw-cloud](https://github.com/iClawApp/iClaw-cloud) — defaults to `https://app.iclaw.digital`.
-
-## Remote Access (alpha)
+## Star history
 
-Open the iClaw UI from another device through an **iclaw-relay** tunnel (Settings → Remote Access).
+[![Star History Chart](https://api.star-history.com/svg?repos=iClawApp/iClaw&type=Date)](https://www.star-history.com/#iClawApp/iClaw&Date)
 
-**Security model (summary):**
+## Chat modes
 
-- **Relay access token** — blocks visitors who only guess the subdomain.
-- **OPAQUE login** — passphrase is not sent in plaintext over the tunnel.
-- **Encrypted HTTP/WebSocket** (E2E alpha) — payloads are encrypted between the browser and **local** iClaw; the relay forwards encrypted frames only.
-- **Device sessions** — trusted browsers can reconnect without retyping the passphrase.
-- **Alpha** — not externally audited. The relay still sees metadata (subdomain, timing, sizes, E2E endpoint paths).
+| Mode | What it does | Backend |
+| --- | --- | --- |
+| **Work** | AI edits files in folders you pick; you approve every change. | iClaw runtime |
+| **Safe work & Internet research** | Locked Docker sandbox — run untrusted code and research the web. | iClaw runtime |
+| **Full Power** (default) | The full OpenClaw agent — files, tools, shell, browser. | OpenClaw Gateway |
+| **Incognito** | Private, read-only research — reads files & the web, never writes, nothing saved. | iClaw runtime |
 
-Two setups: **local mode** (iClaw + OpenClaw on the same laptop) and **host mode** (always-on machine, browse from phone/laptop). See [docs/REMOTE_ACCESS.md](../docs/REMOTE_ACCESS.md).
+The three runtime modes need **Docker** running and an **OpenRouter key** (Settings); without either the composer falls back to Full Power. Architecture: [AGENTS.md](AGENTS.md).
 
-Env on the iClaw host: `ICLAW_RELAY_URL` and `OPAQUE_SERVER_SETUP` (required when Remote Access is enabled).
+## More
 
----
+- **Encrypted chat sharing** — hit **Share** in any chat for an end-to-end encrypted link (AES-256-GCM; password, burn-after-read, TTL). Powered by [iClaw-cloud](https://github.com/iClawApp/iClaw-cloud).
+- **Remote Access** (alpha) — reach the UI from another device over an iclaw-relay tunnel (Settings → Remote Access). Not externally audited yet — see [docs/REMOTE_ACCESS.md](docs/REMOTE_ACCESS.md).
 
 ## For developers
 
@@ -62,28 +53,9 @@ git clone https://github.com/iClawApp/iClaw.git
 cd iClaw && npm install && npm run dev
 ```
 
-| | Default |
-| --- | --- |
-| Web UI | http://localhost:3000 |
-| Gateway | http://127.0.0.1:18789 (`OPENCLAW_BASE_URL`) |
-
-Optional env vars: [.env.example](.env.example).  
-Architecture + coding rules: [AGENTS.md](AGENTS.md).  
-Remote Access alpha: [docs/REMOTE_ACCESS.md](../docs/REMOTE_ACCESS.md), smoke [docs/REMOTE_ACCESS_SMOKE.md](../docs/REMOTE_ACCESS_SMOKE.md).
-
-```bash
-npm run test:ra-smoke          # E2E adversarial smoke (vitest)
-npm run scan:relay-capture -- frames.ndjson   # scan relay frame capture
-```
-
-## Star history
-
-[![Star History Chart](https://api.star-history.com/svg?repos=iClawApp/iClaw&type=Date)](https://www.star-history.com/#iClawApp/iClaw&Date)
-
-## Contributing
-
-See [CONTRIBUTING.md](CONTRIBUTING.md), [ROADMAP.md](ROADMAP.md), [CHANGELOG.md](CHANGELOG.md). Bug reports and small PRs welcome — for bigger changes open an issue first.
+Web UI on http://localhost:3000, Gateway on http://127.0.0.1:18789 (`OPENCLAW_BASE_URL`). Env vars: [.env.example](.env.example) · Architecture & coding rules: [AGENTS.md](AGENTS.md).
 
-## License
+## License and contributing
+[CONTRIBUTING.md](CONTRIBUTING.md) · [ROADMAP.md](ROADMAP.md) · [CHANGELOG.md](CHANGELOG.md)
 
 MIT — see [LICENSE](LICENSE).