chore: release v3.8.0 deploy doctor

Author: iPythoning

.github/workflows/validate.yml

@@ -0,0 +1,25 @@
+name: Validate Template
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Validate template
+        run: npm test

CHANGELOG.md

@@ -8,6 +8,20 @@ Changes sourced from upstream (openclaw/openclaw) are labeled with the originati
 
 ## [Unreleased]
 
+## 2026-06-07 — Template v3.8.0 CI + deploy doctor
+
+### Added
+
+- **GitHub Actions CI**: Added `.github/workflows/validate.yml` so pushes and pull requests to `main` run `npm test` automatically.
+- **Post-deploy doctor**: Added `deploy/doctor.sh` for SSH-based health checks covering Node/npm, OpenClaw CLI, config permissions, workspace files, local skills, Gateway service, Gateway health endpoint, and Chroma memory.
+- **Remote path configuration**: Added `REMOTE_HOME`, `REMOTE_OPENCLAW_HOME`, `REMOTE_CONFIG_HOME`, and `REMOTE_WORKSPACE_DIR` so non-root or custom-path deployments no longer require editing deploy scripts.
+- **IP isolation path alignment**: `deploy/ip-isolate.sh` now uses the configured OpenClaw and systemd user paths when injecting Gateway proxy settings.
+
+### Fixed
+
+- **Generated workspace path**: `deploy/generate-config.sh` now writes `agents.defaults.workspace` from the configured remote workspace path instead of hardcoding `/root/.openclaw/workspace`.
+- **Validation coverage**: `npm test` now verifies the CI workflow, doctor script, current `b2b_trade` skill count, and non-root workspace path generation.
+
 ## 2026-06-07 — Template v3.7.0 validation + memory deployment alignment
 
 ### Added

CONTRIBUTING.md

@@ -62,8 +62,14 @@ cp deploy/config.sh.example deploy/config.sh
 
 # Template smoke tests
 npm test
+
+# Post-deploy remote health check
+cd deploy
+./doctor.sh
 ```
 
+Pull requests to `main` run the same `npm test` checks in GitHub Actions.
+
 ## License
 
 By contributing, you agree that your contributions will be licensed under the MIT License.

README.md

@@ -12,7 +12,7 @@
 
 > Turn any B2B export business into an AI-powered sales machine in 5 minutes.
 
-> ✅ **New · 2026-06-07** — **Template v3.7.0**: Local `npm test` validation, deploy-time ChromaDB memory alignment, README metadata cleanup, and release smoke tests for product KB, PI generation, Chroma memory, and generated OpenClaw config. [See full changelog →](./CHANGELOG.md)
+> ✅ **New · 2026-06-07** — **Template v3.8.0**: GitHub Actions CI for `npm test`, post-deploy `deploy/doctor.sh` health checks, configurable remote OpenClaw paths for non-root deployments, and expanded validation for skill counts + workspace path generation. [See full changelog →](./CHANGELOG.md)
 
 > 🚀 **New · 2026-06-03** — **OpenClaw v2026.6.1**: Multi-agent workboard orchestration, rebuilt Skill Workshop Control UI (proposal lists, today actions, review states, locale coverage), 8-platform channel delivery hardening, iMessage SQLite state persistence, 6-category hot-path performance gains, and MiniMax M3 + GitHub Copilot agent runtime. [See full changelog →](./CHANGELOG.md)
 
@@ -112,6 +112,7 @@ vim config.sh               # Fill in: server IP, API key, WhatsApp number
 #### 3. Validate Locally
 
 ```bash
+cd ..
 npm test
 ```
 
@@ -120,6 +121,7 @@ This checks the template structure, shell scripts, product KB JSON, proforma inv
 #### 4. Deploy
 
 ```bash
+cd deploy
 ./deploy.sh my-company
 
 # Output:
@@ -130,6 +132,14 @@ This checks the template structure, shell scripts, product KB JSON, proforma inv
 # Skills:   b2b_trade (41 skills)
 ```
 
+#### 5. Verify Remote Health
+
+```bash
+./doctor.sh
+```
+
+Doctor checks SSH, Node/npm, OpenClaw CLI, `openclaw.json` permissions, workspace context files, local skills, Gateway service state, Gateway `/health`, and Chroma memory.
+
 That's it. Your AI SDR is live on WhatsApp and ready to sell.
 
 ## What It Does
@@ -347,6 +357,18 @@ SHEETS_SPREADSHEET_ID="your-google-sheets-id"
 ADMIN_PHONES="+1234567890"
 ```
 
+For non-root servers or custom OpenClaw locations, set the remote paths instead of editing deploy scripts:
+
+```bash
+SERVER_USER="openclaw"
+REMOTE_HOME="/srv/openclaw"
+REMOTE_OPENCLAW_HOME="/srv/openclaw/.openclaw"
+REMOTE_CONFIG_HOME="/srv/openclaw/.config"
+REMOTE_WORKSPACE_DIR="/srv/openclaw/.openclaw/workspace"
+```
+
+CI runs `npm test` on every push and pull request to `main`.
+
 ### WhatsApp IP Isolation (Multi-Tenant)
 
 When running multiple agents on the same server, each should have a unique exit IP so WhatsApp sees independent devices. This prevents cross-account flagging.

README.zh-CN.md

@@ -6,7 +6,7 @@
 
 基于 [OpenClaw](https://openclaw.dev) 构建，已在真实外贸企业验证。
 
-> ✅ **最新 · 2026-06-07** — **Template v3.7.0**：新增本地 `npm test` 验收、部署时 ChromaDB 记忆开关对齐、README 元数据清理，并覆盖产品知识库、PI 生成、Chroma 记忆、OpenClaw 配置生成的 release smoke test。[查看完整更新日志 →](./CHANGELOG.md)
+> ✅ **最新 · 2026-06-07** — **Template v3.8.0**：新增 GitHub Actions 自动跑 `npm test`、部署后 `deploy/doctor.sh` 健康检查、非 root 部署远端路径配置，并扩展技能数量与 workspace 路径生成验收。[查看完整更新日志 →](./CHANGELOG.md)
 
 > 🚀 **平台 · 2026-06-03** — **OpenClaw v2026.6.1**：多 Agent workboard 编排、重构 Skill Workshop 控制台、8 平台渠道投递加固、iMessage SQLite 状态持久化、6 类热路径性能优化，以及 MiniMax M3 + GitHub Copilot agent runtime。[查看完整更新日志 →](./CHANGELOG.md)
 
@@ -88,6 +88,7 @@ vim config.sh               # 填入：服务器 IP、API Key、WhatsApp 号码
 #### 3. 本地验收
 
 ```bash
+cd ..
 npm test
 ```
 
@@ -96,6 +97,7 @@ npm test
 #### 4. 一键部署
 
 ```bash
+cd deploy
 ./deploy.sh my-company
 
 # 输出:
@@ -106,6 +108,14 @@ npm test
 # Skills:   b2b_trade (41 个)
 ```
 
+#### 5. 远端健康检查
+
+```bash
+./doctor.sh
+```
+
+Doctor 会检查 SSH、Node/npm、OpenClaw CLI、`openclaw.json` 权限、workspace 上下文文件、本地 skills、Gateway 服务状态、Gateway `/health`，以及 Chroma 记忆脚本。
+
 完成。你的 AI SDR 已在 WhatsApp 上线，准备好卖货了。
 
 ## 功能概览
@@ -272,6 +282,20 @@ Token 在部署时自动生成并显示在输出中。请妥善保管 — 拥有
 - AI 模型 API Key（OpenAI、Anthropic、Google、Kimi 等）
 - WhatsApp Business 账号（可选但推荐）
 
+### 配置
+
+所有部署配置都在 `deploy/config.sh`。非 root 服务器或自定义 OpenClaw 路径时，不要改部署脚本，直接配置远端路径：
+
+```bash
+SERVER_USER="openclaw"
+REMOTE_HOME="/srv/openclaw"
+REMOTE_OPENCLAW_HOME="/srv/openclaw/.openclaw"
+REMOTE_CONFIG_HOME="/srv/openclaw/.config"
+REMOTE_WORKSPACE_DIR="/srv/openclaw/.openclaw/workspace"
+```
+
+CI 会在每次 push 和 pull request 到 `main` 时自动运行 `npm test`。
+
 ### WhatsApp 配置
 
 默认情况下，AI SDR 接受**所有 WhatsApp 联系人**的消息（`dmPolicy: "open"`）。这是销售代理的推荐设置 — 你希望每个潜在客户都能联系到你。

deploy/config.sh.example

@@ -12,6 +12,16 @@ SERVER_PORT=22              # SSH port
 SSH_KEY=""                  # SSH key path (leave empty for default)
 SSH_PASS=""                 # SSH password (key preferred, password as fallback)
 
+# ─── Remote Paths ────────────────────────────────────────
+# Defaults:
+#   root user     -> /root/.openclaw
+#   non-root user -> /home/<SERVER_USER>/.openclaw
+# Override these when the server uses a custom home directory or OpenClaw path.
+REMOTE_HOME=""
+REMOTE_OPENCLAW_HOME=""
+REMOTE_CONFIG_HOME=""
+REMOTE_WORKSPACE_DIR=""
+
 # ─── OpenClaw Gateway ────────────────────────────────────
 GATEWAY_PORT=18789          # Gateway port
 GATEWAY_TOKEN=""            # Auth token (auto-generated if empty)

deploy/deploy.sh

@@ -43,6 +43,19 @@ fi
 # ─── Load Config ──────────────────────────────────────────
 source "$CONFIG_FILE"
 
+SERVER_USER="${SERVER_USER:-root}"
+SERVER_PORT="${SERVER_PORT:-22}"
+if [ -z "${REMOTE_HOME:-}" ]; then
+  if [ "$SERVER_USER" = "root" ]; then
+    REMOTE_HOME="/root"
+  else
+    REMOTE_HOME="/home/$SERVER_USER"
+  fi
+fi
+REMOTE_OPENCLAW_HOME="${REMOTE_OPENCLAW_HOME:-$REMOTE_HOME/.openclaw}"
+REMOTE_CONFIG_HOME="${REMOTE_CONFIG_HOME:-$REMOTE_HOME/.config}"
+REMOTE_WORKSPACE_DIR="${REMOTE_WORKSPACE_DIR:-$REMOTE_OPENCLAW_HOME/workspace}"
+
 missing=()
 [ -z "$SERVER_HOST" ] && missing+=("SERVER_HOST")
 [ -z "$PRIMARY_API_KEY" ] && [ -z "$FALLBACK_API_KEY" ] && missing+=("At least one model API key")
@@ -58,6 +71,16 @@ fi
 if ! [[ "${SERVER_PORT:-22}" =~ ^[0-9]+$ ]]; then
   err "Invalid SERVER_PORT: ${SERVER_PORT}"; exit 1
 fi
+validate_remote_path() {
+  if ! [[ "$1" =~ ^/[a-zA-Z0-9._/-]+$ ]]; then
+    err "Invalid remote path: $1"
+    exit 1
+  fi
+}
+validate_remote_path "$REMOTE_HOME"
+validate_remote_path "$REMOTE_OPENCLAW_HOME"
+validate_remote_path "$REMOTE_CONFIG_HOME"
+validate_remote_path "$REMOTE_WORKSPACE_DIR"
 
 echo ""
 echo "═══════════════════════════════════════════════════════════"
@@ -67,6 +90,7 @@ echo ""
 info "Server: ${SERVER_USER}@${SERVER_HOST}:${SERVER_PORT:-22}"
 info "Primary Model: ${PRIMARY_PROVIDER}/${PRIMARY_MODEL_ID}"
 info "Gateway Port: ${GATEWAY_PORT}"
+info "OpenClaw Home: ${REMOTE_OPENCLAW_HOME}"
 echo ""
 
 if [ "$DRY_RUN" = true ]; then
@@ -145,7 +169,7 @@ fi
 
 # Ensure exec-approvals are set to full (default since 2026.4.2; explicit for forward-compatibility)
 info "  Setting exec approvals to full..."
-remote "cat > /root/.openclaw/exec-approvals.json << 'EAEOF'
+remote "mkdir -p '$REMOTE_OPENCLAW_HOME' && cat > '$REMOTE_OPENCLAW_HOME/exec-approvals.json' << 'EAEOF'
 {
   \"version\": 1,
   \"defaults\": {
@@ -156,7 +180,7 @@ remote "cat > /root/.openclaw/exec-approvals.json << 'EAEOF'
   \"agents\": {}
 }
 EAEOF
-chmod 600 /root/.openclaw/exec-approvals.json"
+chmod 600 '$REMOTE_OPENCLAW_HOME/exec-approvals.json'"
 log "  Exec approvals configured (security=full)"
 
 # ─── Step 3: Check Node.js ───────────────────────────────
@@ -191,7 +215,7 @@ log "  graphify installed"
 info "Step 4/8: Generating config..."
 
 # Backup existing config before overwriting
-remote "[ -f /root/.openclaw/openclaw.json ] && cp /root/.openclaw/openclaw.json /root/.openclaw/openclaw.json.bak.\$(date +%s) || true" 2>/dev/null
+remote "[ -f '$REMOTE_OPENCLAW_HOME/openclaw.json' ] && cp '$REMOTE_OPENCLAW_HOME/openclaw.json' '$REMOTE_OPENCLAW_HOME/openclaw.json.bak.'\$(date +%s) || true" 2>/dev/null
 
 bash "$SCRIPT_DIR/generate-config.sh" "$SCRIPT_DIR"
 log "openclaw.json generated"
@@ -206,17 +230,17 @@ fi
 # ─── Step 5: Deploy Files ────────────────────────────────
 info "Step 5/8: Deploying files..."
 
-remote "mkdir -p /root/.openclaw/{workspace,memory,skills,delivery-queue}"
+remote "mkdir -p '$REMOTE_WORKSPACE_DIR' '$REMOTE_OPENCLAW_HOME/memory' '$REMOTE_WORKSPACE_DIR/skills' '$REMOTE_OPENCLAW_HOME/delivery-queue'"
 
-remote_upload "$SCRIPT_DIR/openclaw.json" "/root/.openclaw/openclaw.json"
-remote "chmod 600 /root/.openclaw/openclaw.json"
+remote_upload "$SCRIPT_DIR/openclaw.json" "$REMOTE_OPENCLAW_HOME/openclaw.json"
+remote "chmod 600 '$REMOTE_OPENCLAW_HOME/openclaw.json'"
 log "  openclaw.json deployed (permissions: 600)"
 
 # Upload workspace MD files
 WORKSPACE_DIR="$(dirname "$SCRIPT_DIR")/workspace"
 for md in IDENTITY.md SOUL.md USER.md AGENTS.md MEMORY.md HEARTBEAT.md TOOLS.md; do
   if [ -f "$WORKSPACE_DIR/$md" ]; then
-    remote_upload "$WORKSPACE_DIR/$md" "/root/.openclaw/workspace/$md"
+    remote_upload "$WORKSPACE_DIR/$md" "$REMOTE_WORKSPACE_DIR/$md"
     log "  $md deployed"
   fi
 done
@@ -226,11 +250,11 @@ SKILLS_DIR="$(dirname "$SCRIPT_DIR")/skills"
 for skill_dir in "$SKILLS_DIR"/*/; do
   skill_name=$(basename "$skill_dir")
   if [ -f "$skill_dir/SKILL.md" ]; then
-    remote "mkdir -p /root/.openclaw/workspace/skills/$skill_name"
-    remote_upload "$skill_dir/SKILL.md" "/root/.openclaw/workspace/skills/$skill_name/SKILL.md"
+    remote "mkdir -p '$REMOTE_WORKSPACE_DIR/skills/$skill_name'"
+    remote_upload "$skill_dir/SKILL.md" "$REMOTE_WORKSPACE_DIR/skills/$skill_name/SKILL.md"
     # Upload any script files (.mjs, .sh) alongside the SKILL.md
     for script in "$skill_dir"*.mjs "$skill_dir"*.sh; do
-      [ -f "$script" ] && remote_upload "$script" "/root/.openclaw/workspace/skills/$skill_name/$(basename "$script")"
+      [ -f "$script" ] && remote_upload "$script" "$REMOTE_WORKSPACE_DIR/skills/$skill_name/$(basename "$script")"
     done
     log "  skill/$skill_name deployed"
   fi
@@ -239,9 +263,9 @@ done
 # ─── Step 6: Start Gateway ───────────────────────────────
 info "Step 6/8: Starting Gateway..."
 
-remote "mkdir -p /root/.config/systemd/user"
+remote "mkdir -p '$REMOTE_CONFIG_HOME/systemd/user'"
 SAFE_PORT=$(printf '%d' "$GATEWAY_PORT")
-remote "cat > /root/.config/systemd/user/openclaw-gateway.service << SVCEOF
+remote "cat > '$REMOTE_CONFIG_HOME/systemd/user/openclaw-gateway.service' << SVCEOF
 [Unit]
 Description=OpenClaw Gateway
 After=network-online.target
@@ -250,11 +274,11 @@ After=network-online.target
 ExecStart=/usr/bin/openclaw gateway --port $SAFE_PORT
 Restart=always
 RestartSec=5
-Environment=HOME=/root
-Environment=PATH=/root/.local/bin:/usr/local/bin:/usr/bin:/bin
+Environment=HOME=$REMOTE_HOME
+Environment=PATH=$REMOTE_HOME/.local/bin:/usr/local/bin:/usr/bin:/bin
 NoNewPrivileges=yes
 ProtectSystem=strict
-ReadWritePaths=/root/.openclaw /root/.config /tmp
+ReadWritePaths=$REMOTE_OPENCLAW_HOME $REMOTE_CONFIG_HOME /tmp
 PrivateTmp=yes
 
 [Install]
@@ -296,7 +320,7 @@ if [ -n "$SKILL_LIST" ] && [ "$SKILL_COUNT" -gt 0 ]; then
     if [[ ! "$skill" =~ ^[a-zA-Z0-9_-]+$ ]]; then
       warn "  Skipping invalid skill name: $skill"; continue
     fi
-    remote "cd /root/.openclaw/workspace/skills && clawhub install $(printf '%q' "$skill") --force --no-input 2>&1 | tail -1" 2>/dev/null || true
+    remote "cd '$REMOTE_WORKSPACE_DIR/skills' && clawhub install $(printf '%q' "$skill") --force --no-input 2>&1 | tail -1" 2>/dev/null || true
   done
   log "  Skills installed"
 fi
@@ -318,7 +342,8 @@ echo "════════════════════════
 echo ""
 echo "  Server:           ${SERVER_HOST}"
 echo "  Gateway:          ws://${SERVER_HOST}:${GATEWAY_PORT}"
-echo "  Gateway Token:    [hidden — see /root/.openclaw/openclaw.json]"
+echo "  OpenClaw Home:    ${REMOTE_OPENCLAW_HOME}"
+echo "  Gateway Token:    [hidden — see ${REMOTE_OPENCLAW_HOME}/openclaw.json]"
 echo ""
 echo "  WhatsApp:         $( [ "$WHATSAPP_ENABLED" = true ] && echo 'Enabled' || echo 'Disabled' )"
 echo "  Telegram:         $( [ "$TELEGRAM_ENABLED" = true ] && echo 'Enabled' || echo 'Disabled' )"
@@ -330,4 +355,5 @@ echo "  Commands:"
 echo "    Status:  ssh ${SERVER_USER}@${SERVER_HOST} systemctl --user status openclaw-gateway"
 echo "    Logs:    ssh ${SERVER_USER}@${SERVER_HOST} journalctl --user -u openclaw-gateway -f"
 echo "    Restart: ssh ${SERVER_USER}@${SERVER_HOST} systemctl --user restart openclaw-gateway"
+echo "    Doctor:  cd deploy && ./doctor.sh"
 echo ""