- Add script -e flag so codex exit code propagates through PTY wrapper
- Use subshell for git repo check to avoid changing caller's cwd
(fixes broken relative --workdir paths)
- Replace ((ERRORS++)) with ERRORS=$((ERRORS + 1)) to avoid set -e
terminating on first verification failure
- Add script binary to installer dependency check
- Install entire skill dir (SKILL.md + scripts/ + references/) into
~/.openclaw/skills/ (shared skill location per OpenClaw docs)
- Scripts live inside the skill folder, not a separate global dir
- Node.js 22 check is now a hard error, not a warning
- timeout check is a hard error (required for delegate.sh)
- Add --force flag to reinstall npm packages on rerun
- Pin npm packages to @latest explicitly
- Drop darwin from os metadata (requires GNU coreutils)
- Fix set -e killing exit code capture in delegate.sh
Installs Claude Code + Codex via npm, copies delegation scripts
into ~/.openclaw/scripts, installs skill definition, and verifies
the setup. Supports --skip-npm, --scripts-dir, and --dry-run.
Checks Node.js 22+, OpenClaw, and subscription auth requirements.
- Codex delegation via delegate.sh now errors on macOS where BSD
script does not support -c (points user to tmux-session.sh instead)
- Wrap script -c command through bash -c so printf '%q' output is
interpreted by bash, not /bin/sh (which may be dash)
Paths containing single quotes would break the generated bash -c
script. Use printf '%q' to safely escape both variables, matching
the existing PROMPT escaping approach.
Adds a skill for delegating code-writing, document generation, and
analysis tasks to Claude Code and OpenAI Codex as sub-processes.
Includes:
- SKILL.md with delegation routing, prompt composition, and security docs
- scripts/delegate.sh — unified delegation launcher with API key stripping
- scripts/tmux-session.sh — tmux session manager for long-running tasks
- references/delegation-policy.md — example policy (adoptable, not prescriptive)
Security: strips 23 known AI provider API keys from sub-process
environment, forcing subscription-based auth and preventing key leakage.
