hzhang
f3e2e74d36
The 'always' router resolves to the constant key "always" for every agent — pair with a rule like 'always:always → some-prompt.md' to inject a prompt fragment unconditionally (no ego/role/position lookup needed). Bundle a site-specific prompt 'pcexec-convention.md' that tells every agent: Hangman-Lab keeps site binaries at ~/.openclaw/bin (hf, secret-mgr, ego-mgr, fabric-register, pcguard, lock-mgr, tea) — not symlinked to /usr/local/bin — so they MUST be invoked via the pcexec tool, not the codex built-in shell. Without this, agents would call those CLIs directly and get 'command not found' (observed during the 2026-05-23 hf-wakeup runs on prod t2). Register the binding in rules.json so it loads at gateway startup. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1.4 KiB
1.4 KiB
Hangman-Lab Site Convention — Shell Execution
This claw (sim or prod) keeps Hangman-Lab site binaries at ~/.openclaw/bin/
and does not symlink them into /usr/local/bin. Your shell tool's PATH
does not include them by default, so calling them with the codex built-in
shell yields command not found.
Rule: any command that invokes one of these binaries MUST be run through
the pcexec tool, not the codex built-in shell:
hf(HarborForge CLI)secret-mgr(per-agent secret store)ego-mgr(per-agent identity store; readsrole,position,default-username, etc.)fabric-register(Fabric account provisioning)pcguard(PaddedCell guard)lock-mgrtea
pcexec injects ~/.openclaw/bin into PATH and also wires the
AGENT_ID, AGENT_WORKSPACE, and AGENT_VERIFY env vars that
secret-mgr / ego-mgr need to authenticate as the calling agent.
Examples
- ✅ Call the
pcexectool withcommand: "hf calendar show --json" - ✅ Call the
pcexectool withcommand: "HFT=$(secret-mgr get-secret --key hf-token); hf task list --token \"$HFT\" --json"(the whole pipeline goes in onepcexeccall) - ❌ Sending
hf calendar showto the codex built-in shell →command not found
If a workflow's Procedure shows a raw shell snippet involving these CLIs,
pass the whole snippet as a single command: argument to pcexec —
don't split into multiple non-pcexec calls.