> ## Documentation Index
> Fetch the complete documentation index at: https://cofounder.appeeky.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenClaw (coding agent)

> Trigger isolated coding runs on your OpenClaw gateway when the Co-founder finds a feature gap.

Like [Hermes](./hermes), OpenClaw lets the Co-founder **delegate well-scoped build tasks** to a coding agent you host. When a competitor ships a feature you lack, Appeeky packages the strategic brief and triggers an isolated agent run on your **[OpenClaw](https://openclaws.io/) gateway** via its webhook ingress. OpenClaw owns the sandbox, repo access, and delivery. Appeeky never runs code.

This is the `engineering_delegate` action with `provider: "openclaw"`.

## How it works

```
Co-founder run
  → feature gap + evidence detected
  → reasoner emits `engineering_delegate` (provider: openclaw)
  → you approve it (delegations always require explicit approval)
  → Appeeky POSTs to your gateway: POST /hooks/agent
  → OpenClaw runs an isolated agent turn (own session, sandbox, model)
  → OpenClaw delivers the result to your channel (optional)
```

Appeeky stores the returned `runId` as the action's `external_id`.

## Prerequisites

Enable the hooks ingress on your OpenClaw gateway and expose it to Appeeky (public URL or tunnel):

```js theme={"theme":{"light":"github-light","dark":"github-dark"}}
// ~/.openclaw/config (or your gateway config)
hooks: {
  enabled: true,
  token: "<a-strong-secret>",          // Appeeky "Hook token"
  path: "/hooks",
  allowRequestSessionKey: true,        // required — Appeeky sends hook:appeeky:… keys
  allowedSessionKeyPrefixes: ["hook:"],
  allowedAgentIds: ["engineering", "main"],
}
```

See the [OpenClaw webhook docs](https://openclaws.io/docs/automation/webhook/).

Before saving, Appeeky calls `GET /healthz` (JSON probe) and verifies your hook token via `POST /hooks/agent` (empty body → `400` when auth passes).

## Reachability & security (you host the gateway)

Appeeky is the strategist; **you host the coding agent**. Appeeky's servers call the `baseUrl` you provide, so the gateway must be publicly reachable and locked down:

* **Public HTTPS required in production.** In production, `baseUrl` must be an `https://` URL — plain `http://` is rejected.
* **Private addresses are blocked.** For SSRF safety, Appeeky refuses gateway URLs that resolve to loopback (`127.0.0.1`, `localhost`), private ranges (`10.x`, `172.16–31.x`, `192.168.x`), link-local / cloud-metadata (`169.254.169.254`), or other reserved addresses.
* **Two ways to expose it:**
  * **Cloud VM + durable hostname (recommended):** named Cloudflare Tunnel or TLS reverse proxy — see [Hosting a coding agent](./hosting-coding-agents).
  * **Tunnel (quick start only):** `cloudflared tunnel --url http://localhost:18789` — hostname changes on restart; not for production.
* **Keep `hooks.token` strong & rotate it.** Restrict targets with `allowedAgentIds`. Appeeky stores the token encrypted and never returns it to the client.

> Local development only: in dev (`NODE_ENV != production`) a `http://127.0.0.1:18789` gateway is allowed for testing. This never applies to the hosted product.

## Setup

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
curl -X PUT https://api.appeeky.com/v1/cofounder/integrations/openclaw \
  -H "X-API-Key: $APPEEKY_KEY" \
  -d '{
    "credentials": { "token": "<hooks.token>" },
    "integrationConfig": {
      "baseUrl": "https://your-host:18789",
      "agentId": "engineering",
      "deliver": "slack",
      "to": "#dev"
    }
  }'
```

Before saving, Appeeky calls `GET /healthz` on your gateway (JSON `ok: true`) and verifies the hook token (auth probe on `/hooks/agent`).

| Field       | Where       | Required | Notes                                                    |
| ----------- | ----------- | -------- | -------------------------------------------------------- |
| `token`     | credentials | ✅        | Your gateway's `hooks.token`                             |
| `baseUrl`   | config      | ✅        | Full URL incl. port, e.g. `https://host:18789`           |
| `hooksPath` | config      | —        | Custom `hooks.path` if not `/hooks`                      |
| `agentId`   | config      | —        | Route to a specific agent (must be in `allowedAgentIds`) |
| `deliver`   | config      | —        | Delivery channel (e.g. `slack`, `telegram`)              |
| `to`        | config      | —        | Delivery target (e.g. `#dev`, a chat id)                 |

## Enable

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
PUT /v1/cofounder/preferences
{ "enabledIntegrations": ["openclaw"] }
```

## What Appeeky sends

```json theme={"theme":{"light":"github-light","dark":"github-dark"}}
POST https://your-host:18789/hooks/agent
Authorization: Bearer <hooks.token>

{
  "message": "# Engineering task from App Co-founder …",
  "sessionKey": "hook:appeeky:<appId>:<task-slug>",
  "name": "Appeeky Co-founder",
  "agentId": "engineering",
  "deliver": true,
  "channel": "slack",
  "to": "#dev",
  "wakeMode": "now"
}
```

The brief always ends with **draft-PR-by-default guardrails**.

## Safety model

* **No Appeeky secrets leave Appeeky.** Your repo access lives on the OpenClaw side.
* **Always approval-gated.** Delegations never auto-run by autopilot level — each waits for your explicit approval.
* **Read mode blocks it.** In `agentMode: read`, no delegations are proposed.
* **Scoped routing.** Use `allowedAgentIds` on your gateway to restrict which agents Appeeky may target.

## Disable

```bash theme={"theme":{"light":"github-light","dark":"github-dark"}}
DELETE /v1/cofounder/integrations/openclaw
```