INNIES.COMPUTER

innies onboarding

innies:~$message @shirtlessfounder in @innies_hq if you have questions
LOADINGLAST -- AUTH: [CLICK TO LOG IN WITH GITHUB]
ONBOARDING WORKSPACE5 GUIDES LOADED · COPY AND SEND TO AGENT TO SET UP
1 / 2
INNIES_BETA_DECISIONS.md
61 lines
1# Innies Beta Decisions
2
3Use this page as the short version of how Innies works right now.
4
5## Accounts And Orgs
6
7- You can create multiple orgs.
8- You can join multiple orgs.
9- Every org lives at its own route.
10- The org URL slug is auto-generated from the org name and is not editable in beta.
11- Accept invites from the org route you were invited to by navigating to the org's Innies link.
12- To accept an invite, you need to be signed into the same GitHub account that was invited.
13- You can switch orgs by clicking the org links in the header.
14- Each org has one owner in this beta.
15- The owner cannot leave the org in beta.
16
17## Buyer Keys
18
19- Each org membership gets its own buyer key.
20- Buyer keys are org-specific. One key does not unlock every org you belong to.
21- After you create an org or accept an invite, the new buyer key is shown once.
22- On the one-time buyer key reveal, you choose an `OpenClaw Pref` for that buyer key: Claude or Codex.
23- The buyer key reveal defaults `OpenClaw Pref` to Codex in beta.
24- Clicking `LOCKED IN` stores that OpenClaw preference on the buyer key and exits the one-time reveal.
25- If you lose that key, contact Innies support or the admin for now.
26
27## Roles And Permissions
28
29- Owners can manage invites and members.
30- Owners can probe, change reserve caps, and remove any OAuth token in the org.
31- Owners can refresh any OAuth token in the org.
32- Members can manage only the OAuth tokens they personally added.
33- Members can refresh only the OAuth tokens they personally added.
34- Users can remove the OAuth tokens they personally added to an org at any time.
35
36## OAuth Tokens
37
38- OAuth tokens are added to a specific org.
39- These are Claude/Codex OAuth tokens, not raw provider API keys.
40- Adding an OAuth token requires both the OAuth token and the refresh token.
41- One OAuth token can belong to only one org at a time.
42- That org can route through the OAuth tokens that belong to it.
43
44## Reserves
45
46- Reserves are the 5h and 1w percentages that keep some token capacity buffered instead of fully routing it.
47- Reserve inputs are percentages from 0 to 100.
48- You can set reserves when adding an OAuth token to an org.
49- Leaving reserve inputs blank means no reserve buffer.
50
51## Leaving Or Removal
52
53- If you leave an org or are removed, your buyer key for that org is revoked.
54- If you leave an org or are removed, the OAuth tokens you added to that org are removed too.
55
56## Beta Limits
57
58- Some recovery flows are still manual.
59- Ownership transfer is not part of this beta.
60- The product is intentionally simple while the org model hardens.
61
CLAUDE_CODEX_OAUTH_TOKENS.md
81 lines
1# Claude + Codex OAuth Tokens
2
3Use this to get your own Claude or Codex/OpenAI login into a form an Innies admin can add.
4
5## Claude
6
71. Make sure you're using the real Claude binary, not the Innies wrapper.
8
9 Run `which -a claude` to see all paths. If the only result is the Innies wrapper, find the real binary (usually at `~/.local/share/claude/versions/<version>`) and run it directly:
10
11 ```bash
12 ~/.local/share/claude/versions/<version> /login
13 ```
14
15 If `claude` already points to the real binary, just run:
16
17 ```bash
18 claude /login
19 ```
20
213. Confirm Claude stays logged in when you reopen it.
22
234. On macOS, Claude OAuth credentials are stored in **Keychain Access**, not in a plain-text file.
24
25 To find them:
26 - Open **Keychain Access** (search for it in Spotlight)
27 - Search for **"claude"** in the search bar
28 - Double-click **"Claude Code-credentials"**
29 - Check **"Show password"** at the bottom — enter your macOS password when prompted
30 - The revealed value is a JSON blob containing your `access_token` (starts with `sk-ant-oat...`) and `refresh_token`
31
325. Innies needs both:
33
34 ```text
35 access token: sk-ant-oat...
36 refresh token: <your Claude OAuth refresh token>
37 ```
38
39## Codex
40
411. Log in:
42
43 ```bash
44 codex login
45 ```
46
472. Confirm Codex stays logged in when you reopen it. A quick sanity check is:
48
49 ```bash
50 codex login status
51 ```
52
533. Current Codex CLI builds store the login session in:
54
55 ```text
56 ~/.codex/auth.json
57 ```
58
594. Innies needs:
60- provider: `openai`
61- auth scheme: `bearer`
62- `tokens.access_token`
63- `tokens.refresh_token`
64
65## Send To Admin
66
67Claude:
68- provider: `anthropic`
69- token: `sk-ant-oat...`
70- refresh token: required for the org dashboard add-token flow
71
72Codex:
73- provider: `openai`
74- access token: `tokens.access_token`
75- refresh token: `tokens.refresh_token` (required for the org dashboard add-token flow; Innies probes the OAuth token before saving it)
76
77## Quick Fixes
78- `claude` opens Innies instead of Claude Code: run `which -a claude` and use the non-wrapper path.
79- You cannot find the Claude token on macOS: check Keychain Access.
80- `~/.codex/auth.json` is missing: re-run `codex login`. If `codex login status` still shows a logged-in session but the file is absent, your Codex build may be storing auth elsewhere, so confirm the current storage path before extracting tokens manually.
81
CLI_ONBOARDING.md
60 lines
1# Innies CLI Onboarding
2
3## What It Does
4- `innies claude` — starts Claude Code routed through Innies (Anthropic lane)
5- `innies codex` — starts Codex CLI routed through Innies (OpenAI lane)
6- One login, two wrappers, deterministic provider routing
7
8## Prerequisites
9- Innies buyer key: `in_live_...`
10- Upstream CLIs installed: `claude` and/or `codex`
11
12## Quickstart
13
14**Option A: Inline token (fastest, no config)**
15```bash
16npm install -g innies
17innies claude --token in_live_REPLACE_ME
18innies codex --token in_live_REPLACE_ME
19```
20
21**Option B: Login once, run without token**
22```bash
23npm install -g innies
24innies login --token in_live_REPLACE_ME
25innies doctor # verify setup
26innies claude # start Claude
27innies codex # start Codex
28```
29
30On connect, the wrapper prints:
31```
32Innies connected | model <model> | proxy <url> | request <id>
33```
34Then hands off to the upstream CLI with full TTY.
35
36## Model Injection
37Both wrappers inject a default `--model`:
38- Claude: `claude-opus-4-6`
39- Codex: `gpt-5.4`
40
41## Troubleshooting
42
43| Symptom | Fix |
44|---------|-----|
45| `Missing --token` | `innies login --token in_live_...` or pass `--token` inline |
46| `Token must start with in_` | Use Innies buyer key, not provider token |
47| Missing `claude`/`codex` binary | Install upstream CLI, rerun `innies doctor` |
48| `No active compatibility rule` | Model not in DB — add to `in_model_compatibility_rules` |
49| Codex "high demand" / reconnecting | Make sure you launched with `innies codex`, not raw `codex`; the wrapper injects Innies config and disables websockets automatically |
50| `Your access token could not be refreshed because your refresh token was already used` | Launch through `innies codex`. The wrapper now isolates Codex from stale local ChatGPT auth state in `~/.codex/auth.json` for wrapped sessions. |
51| Claude has active claude.ai login | Supported — `innies claude` uses a local bridge that injects buyer auth before forwarding to Innies |
52| `Stream disconnected` | Check server logs for `synthetic_output_item_count: 0` |
53
54## Daily Flow
55```bash
56innies doctor
57innies claude -- "<task>"
58innies codex -- "<task>"
59```
60
OPENCLAW_ONBOARDING.md
105 lines
1# OpenClaw → Innies Onboarding
2
3Connect OpenClaw to Innies. Innies handles provider routing and model selection server-side — your OpenClaw config stays the same regardless of which provider (Anthropic, OpenAI) serves the request.
4
5Need a provider credential first? See [Claude + Codex OAuth Token Guide](./CLAUDE_CODEX_OAUTH_TOKENS.md).
6
7## Setup
8
9### 1. Configure provider
10
11Edit `~/.openclaw/agents/main/agent/models.json`:
12
13```json
14{
15 "providers": {
16 "innies": {
17 "baseUrl": "https://api.innies.computer",
18 "apiKey": "in_live_REPLACE_ME",
19 "api": "anthropic-messages",
20 "models": [
21 {
22 "id": "claude-opus-4-6",
23 "api": "anthropic-messages"
24 }
25 ]
26 }
27 }
28}
29```
30
31Replace `in_live_REPLACE_ME` with your buyer key.
32
33### 2. Add UA patch
34
35Cloudflare blocks OpenClaw's default user-agent. This patch overrides it for requests to Innies.
36
37```bash
38mkdir -p ~/.openclaw/patches
39
40cat > ~/.openclaw/patches/ua_patch.js <<'JS'
41const orig = global.fetch;
42global.fetch = async (url, init = {}) => {
43 const u = String(url || '');
44 if (u.includes('api.innies.computer/v1/messages')) {
45 const h = new Headers(init.headers || {});
46 h.set('user-agent', 'OpenClawGateway/1.0');
47 init = { ...init, headers: h };
48 }
49 return orig(url, init);
50};
51JS
52```
53
54Then load it via systemd override:
55
56```bash
57mkdir -p ~/.config/systemd/user/openclaw-gateway.service.d
58
59cat > ~/.config/systemd/user/openclaw-gateway.service.d/ua-patch.conf <<EOF
60[Service]
61Environment=NODE_OPTIONS=--require=$HOME/.openclaw/patches/ua_patch.js
62EOF
63
64systemctl --user daemon-reload
65```
66
67### 3. Restart gateway
68
69```bash
70openclaw gateway restart
71```
72
73### 4. Verify
74
75Send a test prompt from OpenClaw (e.g. `ping`), then check logs:
76
77```bash
78journalctl --user -u openclaw-gateway.service --since "3 min ago" --no-pager \
79 | grep -Ei "403|401|unauthorized|timed out"
80```
81
82No output = working. Optional direct probe:
83
84```bash
85curl -sS -X POST "https://api.innies.computer/v1/messages" \
86 -H "x-api-key: in_live_REPLACE_ME" \
87 -H "content-type: application/json" \
88 -H "anthropic-version: 2023-06-01" \
89 -d '{"model":"claude-opus-4-6","stream":true,"max_tokens":64,"messages":[{"role":"user","content":"ping"}]}'
90```
91
92Expected: streaming SSE response starting with `event: message_start`.
93
94## Provider Routing
95
96OpenClaw always sends requests in Anthropic Messages format. Innies auto routes them based on your buyer key's provider preference (contact admin to set or change it):
97
98- **Anthropic pref** → request goes directly to an Anthropic credential (Claude).
99- **OpenAI pref** → Innies translates the request to OpenAI Responses format, routes to an OpenAI credential (Codex/GPT), and translates the response back. The default translated model is `gpt-5.4`.
100
101Important: keep OpenClaw unpinned. Do not send `x-innies-provider-pin: true` and do not add `metadata.innies_provider_pin=true`.
102
103- Unpinned OpenClaw traffic uses your buyer key's provider preference and automatic fallback to the other provider.
104- Pinned Anthropic traffic stays on Anthropic only, even if the buyer key preference is set to OpenAI/Codex.
105
CONDUCTOR_ONBOARDING.md
131 lines
1# Conductor Onboarding
2
3## What It Does
4- Conductor manages isolated repo workspaces for parallel tasks.
5- For `innies`, each workspace is a separate copy under `~/conductor/workspaces/innies/<name>`.
6- Each workspace gets its own branch, terminal, and agent session.
7
8## Prerequisites
9- Local repo at `~/innies`
10- Conductor installed at `/Applications/Conductor.app`
11- `OPENAI_API_KEY` already working in your normal shell for Codex via Innies
12
13## First-Time Setup
14
151. Import the repo:
16
17 ```text
18 Open Project -> select ~/innies
19 ```
20
212. Open repo settings and set:
22- `Branch new workspaces from` -> `origin/main`
23- `Remote` -> `origin`
24- `Setup script` -> `bash scripts/conductor-bootstrap.sh`
25
263. Do not leave the imported repo rooted on a local-only branch.
27
28If Conductor imports `~/innies` while that checkout is on a local branch like `codex/...`, it can incorrectly try to create new workspaces from `origin/codex/...`, which fails if that remote ref does not exist.
29
30## Automatic Workspace Bootstrap
31
32Conductor can run a repo-local setup command every time it creates a new workspace. For `innies`, use:
33
34```bash
35bash scripts/conductor-bootstrap.sh
36```
37
38This bootstrap script:
39- symlinks `api/.env` from `~/innies/api/.env`
40- symlinks `scripts/.env.local` from `~/innies/scripts/.env.local`
41- symlinks `ui/.env.local` from `~/innies/ui/.env.local`
42- installs missing local dependencies for `api` and `ui`
43
44This gives each fresh Conductor workspace the same local env-backed setup as the canonical `~/innies` checkout, without copying secrets into git-tracked files.
45
46`Run script` is separate from `Setup script`. Leave `Run script` blank unless you want the play button to start something specific like `cd api && npm run dev`.
47
48## Launching Conductor For Codex
49
50Conductor strips `OPENAI_API_KEY` from the shell environment it loads. Since local Codex here is configured to use Innies through `OPENAI_API_KEY`, launch Conductor through the helper instead of Dock or Finder:
51
52```bash
53conductor-open
54```
55
56This helper:
57- reads `OPENAI_API_KEY` from the current shell or Keychain
58- launches `/Applications/Conductor.app` with that env var set
59- avoids changing the existing `~/.codex/config.toml` provider setup
60
61The helper scripts live at:
62- `~/.local/bin/conductor-open`
63- `~/.local/bin/conductor-openai-key-sync`
64- `~/.local/bin/conductor-claude-install`
65- `~/.local/bin/conductor-claude-ensure`
66
67These are local machine helpers installed during onboarding. They are not tracked in the `innies` repo.
68
69If the key changes, refresh the saved Keychain copy from a shell that already has the new key:
70
71```bash
72conductor-openai-key-sync
73```
74
75## Launching Conductor For Opus
76
77Conductor's Claude/Opus path is separate from its Codex path. To keep normal terminal `claude` unchanged while routing Conductor's Opus sessions through Innies, install the Conductor-only Claude shim:
78
79```bash
80conductor-claude-install
81```
82
83This installer:
84- preserves Conductor's private Claude binary as `~/Library/Application Support/com.conductor.app/bin/claude-real`
85- replaces Conductor's private `bin/claude` entrypoint with a wrapper
86- routes only Conductor's Claude/Opus lane through `innies claude`
87- leaves normal terminal `claude` untouched
88
89The installer script lives at:
90- `~/.local/bin/conductor-claude-install`
91
92After installing or changing either helper, fully quit Conductor and relaunch it:
93
94```bash
95conductor-open
96```
97
98`conductor-open` now also checks Conductor's private Claude entrypoint before launch and automatically reruns the local Claude wrapper installer if a Conductor update has overwritten it.
99
100## Daily Flow
101
1021. Start Conductor:
103
104 ```bash
105 conductor-open
106 ```
107
1082. Create a workspace with the `+` button in the sidebar.
109
1103. Confirm the workspace is based on `origin/main`.
111
1124. Work inside the Conductor workspace, not in `~/innies`.
113
114## Troubleshooting
115
116| Symptom | Fix |
117|---------|-----|
118| `Couldn't find origin/codex/...` during workspace creation | Repo base branch is wrong. Set `Branch new workspaces from` to `origin/main`, remove the failed workspace, and recreate it. |
119| `Missing environment variable: OPENAI_API_KEY` in Codex | Quit Conductor and relaunch with `conductor-open`. |
120| Opus/Claude says authentication is required | Install the Conductor-only Claude shim with `conductor-claude-install`, then fully relaunch with `conductor-open`. |
121| Conductor still behaves like the old config | Fully quit Conductor before relaunching; the app must start fresh with the new environment. |
122| Failed workspace stuck in sidebar | Archive/delete it in Conductor, then recreate after fixing the base branch. |
123| Opus routing breaks again after a Conductor update | Prefer relaunching with `conductor-open`; it now self-heals the private Claude wrapper before launch. If needed, run `conductor-claude-install` manually. |
124
125## Notes
126- Keep `~/innies` itself on `main` unless you intentionally need otherwise.
127- New workspaces should generally branch from pushed remote branches like `origin/main`, not unpublished local branches.
128- Codex and Opus are wired separately inside Conductor:
129 - Codex works through `conductor-open`
130 - Opus works through Conductor's private Claude wrapper installed by `conductor-claude-install`
131