diff --git a/README.md b/README.md index ba74cf5..e9dd23f 100644 --- a/README.md +++ b/README.md @@ -141,8 +141,8 @@ require_pairing = true # require pairing code on first connect allow_public_bind = false # refuse 0.0.0.0 without tunnel [autonomy] -level = "supervised" # "readonly", "supervised", "full" -workspace_only = true +level = "supervised" # "readonly", "supervised", "full" (default: supervised) +workspace_only = true # default: true — scoped to workspace allowed_commands = ["git", "npm", "cargo", "ls", "cat", "grep"] forbidden_paths = ["/etc", "/root", "/proc", "/sys", "~/.ssh", "~/.gnupg", "~/.aws"] diff --git a/docs/architecture.svg b/docs/architecture.svg index 95d8a92..ec37052 100644 --- a/docs/architecture.svg +++ b/docs/architecture.svg @@ -1,4 +1,4 @@ - + @@ -24,11 +24,11 @@ - + ZeroClaw Architecture - Zero overhead. Zero compromise. 100% Rust. 100% Agnostic. + Zero overhead. Zero compromise. 100% Rust. 100% Agnostic. 8 pluggable traits. @@ -240,8 +240,8 @@ Null byte injection blocked Symlink escape detection 14 system dirs + 4 dotfiles blocked - Autonomy: ReadOnly / Supervised / Full - Workspace-only mode (default) + Default: Supervised + workspace-only + Levels: ReadOnly / Supervised / Full @@ -259,9 +259,9 @@ - + Setup Wizard -- zeroclaw onboard (--quick for instant setup) - 7 steps, under 60 seconds + 7 steps, under 60 seconds | Live connection testing | Secure defaults @@ -274,7 +274,7 @@ 3. Channels - 7 channels + test + 7 channels + live test 4. Tunnel @@ -290,7 +290,7 @@ 7. Scaffold - workspace MD files + 8 workspace MD files @@ -300,10 +300,13 @@ + + Full summary: Provider, Model, Channels, Tunnel, Composio, Secrets, Gateway, Autonomy, Memory + - - Ready -- zeroclaw agent + + Ready -- zeroclaw agent - ~3.4MB binary | <10ms startup | 1,017 tests | 22+ providers | 7 channels | 5 tunnels | Encrypted secrets | Pluggable everything + ~3.4MB binary | <10ms startup | 1,017 tests | 22+ providers | 8 traits | 17,800+ lines of Rust | 0 clippy warnings diff --git a/src/onboard/wizard.rs b/src/onboard/wizard.rs index acf0651..f38a3e4 100644 --- a/src/onboard/wizard.rs +++ b/src/onboard/wizard.rs @@ -3,7 +3,6 @@ use crate::config::{ IMessageConfig, MatrixConfig, MemoryConfig, ObservabilityConfig, RuntimeConfig, SecretsConfig, SlackConfig, TelegramConfig, WebhookConfig, }; -use crate::security::AutonomyLevel; use anyhow::{Context, Result}; use console::style; use dialoguer::{Confirm, Input, Select}; @@ -77,7 +76,7 @@ pub fn run_wizard() -> Result { scaffold_workspace(&workspace_dir, &project_ctx)?; // ── Build config ── - // Defaults: SQLite memory, full autonomy, full computer access, native runtime + // Defaults: SQLite memory, supervised autonomy, workspace-scoped, native runtime let config = Config { workspace_dir: workspace_dir.clone(), config_path: config_path.clone(), @@ -90,11 +89,7 @@ pub fn run_wizard() -> Result { default_model: Some(model), default_temperature: 0.7, observability: ObservabilityConfig::default(), - autonomy: AutonomyConfig { - level: AutonomyLevel::Full, - workspace_only: false, - ..AutonomyConfig::default() - }, + autonomy: AutonomyConfig::default(), runtime: RuntimeConfig::default(), heartbeat: HeartbeatConfig::default(), channels_config, @@ -106,9 +101,9 @@ pub fn run_wizard() -> Result { }; println!( - " {} Security: {} | Full computer access", + " {} Security: {} | workspace-scoped", style("✓").green().bold(), - style("Full Autonomy").green() + style("Supervised").green() ); println!( " {} Memory: {} (auto-save: on)", @@ -188,11 +183,7 @@ pub fn run_quick_setup(api_key: Option<&str>, provider: Option<&str>) -> Result< default_model: Some(model.clone()), default_temperature: 0.7, observability: ObservabilityConfig::default(), - autonomy: AutonomyConfig { - level: AutonomyLevel::Full, - workspace_only: false, - ..AutonomyConfig::default() - }, + autonomy: AutonomyConfig::default(), runtime: RuntimeConfig::default(), heartbeat: HeartbeatConfig::default(), channels_config: ChannelsConfig::default(), @@ -241,7 +232,7 @@ pub fn run_quick_setup(api_key: Option<&str>, provider: Option<&str>) -> Result< println!( " {} Security: {}", style("✓").green().bold(), - style("Full Autonomy").green() + style("Supervised (workspace-scoped)").green() ); println!( " {} Memory: {}", @@ -253,6 +244,21 @@ pub fn run_quick_setup(api_key: Option<&str>, provider: Option<&str>) -> Result< style("✓").green().bold(), style("encrypted").green() ); + println!( + " {} Gateway: {}", + style("✓").green().bold(), + style("pairing required (127.0.0.1:8080)").green() + ); + println!( + " {} Tunnel: {}", + style("✓").green().bold(), + style("none (local only)").dim() + ); + println!( + " {} Composio: {}", + style("✓").green().bold(), + style("disabled (sovereign mode)").dim() + ); println!(); println!( " {} {}", @@ -260,13 +266,16 @@ pub fn run_quick_setup(api_key: Option<&str>, provider: Option<&str>) -> Result< style(config_path.display()).green() ); println!(); - println!(" Next steps:"); + println!(" {}", style("Next steps:").white().bold()); if api_key.is_none() { println!(" 1. Set your API key: export OPENROUTER_API_KEY=\"sk-...\""); println!(" 2. Or edit: ~/.zeroclaw/config.toml"); - println!(" 3. Run: zeroclaw agent -m \"Hello!\""); + println!(" 3. Chat: zeroclaw agent -m \"Hello!\""); + println!(" 4. Gateway: zeroclaw gateway"); } else { - println!(" Run: zeroclaw agent -m \"Hello!\""); + println!(" 1. Chat: zeroclaw agent -m \"Hello!\""); + println!(" 2. Gateway: zeroclaw gateway"); + println!(" 3. Status: zeroclaw status --verbose"); } println!(); @@ -1828,6 +1837,50 @@ fn print_summary(config: &Config) { } ); + // Tunnel + println!( + " {} Tunnel: {}", + style("🌐").cyan(), + if config.tunnel.provider == "none" || config.tunnel.provider.is_empty() { + "none (local only)".to_string() + } else { + config.tunnel.provider.clone() + } + ); + + // Composio + println!( + " {} Composio: {}", + style("🔗").cyan(), + if config.composio.enabled { + style("enabled (1000+ OAuth apps)").green().to_string() + } else { + "disabled (sovereign mode)".to_string() + } + ); + + // Secrets + println!( + " {} Secrets: {}", + style("🔒").cyan(), + if config.secrets.encrypt { + style("encrypted").green().to_string() + } else { + style("plaintext").yellow().to_string() + } + ); + + // Gateway + println!( + " {} Gateway: {}", + style("🚪").cyan(), + if config.gateway.require_pairing { + "pairing required (secure)" + } else { + "pairing disabled" + } + ); + println!(); println!(" {}", style("Next steps:").white().bold()); println!();