OpenClaw Build and Operations (4/5) — OpenClaw to Claude Code Bridge

coding-agent SKILL + --permission-mode bypassPermissions --print + process monitoring, verbatim

ํ•ต์‹ฌ ์š”์•ฝ

  • Audience: OpenClaw basics are in place (#9, #10) and you also use Claude Code. You want messenger → Claude Code execution as a real pipeline.
  • What you'll get: The official coding-agent SKILL pattern, Claude Code's --permission-mode bypassPermissions --print verbatim usage, background + sessionId monitoring via the 8 process actions (list/poll/log/write/submit/send-keys/paste/kill), a channel response loop, and the official 8 critical rules.
  • Prerequisite: OpenClaw gateway running, Claude Code installed, coding-agent skill enabled.
  • Important: The "bridge" isn't a separate product — it's a pattern via the coding-agent skill. The source is openclaw/openclaw/skills/coding-agent/ in the official repo.

1. Architecture

Discord / Slack / Telegram user
       ↓ (message received)
OpenClaw Gateway (~/.openclaw/workspace/)
       ↓ (bindings resolve the agent)
Agent session (main or sub)
       ↓ (coding-agent SKILL fires)
bash tool invokes Claude Code
  └─ `claude --permission-mode bypassPermissions --print "task"`
       ↓ (returns sessionId for background)
process tool monitors progress
       ↓ (collect results)
Agent sends a reply back to the channel

Key idea: Claude Code is called directly via OpenClaw's bash tool. No separate IPC or MCP server — just standard CLI flags.

2. Claude Code invocation rules

The official coding-agent SKILL states Claude Code's special requirement:

"For Claude Code (claude CLI), use --print --permission-mode bypassPermissions instead" of PTY mode.

Agent Invocation
Codex / Pi / OpenCode pty: true (allocate an interactive terminal)
Claude Code --permission-mode bypassPermissions --print (no PTY)

Using PTY with Claude Code: "PTY can exit after the confirmation dialog," per the docs. Do not deviate.

2.1 Foreground execution (instant reply)

Inside an OpenClaw session:

bash workdir:~/project command:"claude --permission-mode bypassPermissions --print 'summarize the folder structure'"

Claude Code runs → stdout captured → agent relays to the channel.

2.2 Background execution (long tasks)

bash workdir:~/project background:true command:"claude --permission-mode bypassPermissions --print 'add email validation to login form'"

background: true returns a sessionId. Monitor via the process tool.

3. bash tool parameters — all

Per the coding-agent SKILL's bash schema:

Param Type Purpose
command string Shell command to run
pty boolean Allocate a pseudo-terminal for interactive CLIs
workdir string Working directory for the spawned process
background boolean Returns a sessionId for async monitoring
timeout number Kill after N seconds
elevated boolean Run on host vs. sandbox

Important: elevated: true = host full access. Don't enable that for shared-channel flows.

4. process tool — 8 actions

To control background sessions.

Action Effect
list Show running / recent sessions
poll Check liveness
log Fetch session output (offset/limit options)
write Send raw stdin bytes
submit Send data + newline (simulates typing + Enter)
send-keys Send key tokens or hex bytes
paste Insert text (bracketed-paste option)
kill Terminate the session

Example:

process action:log sessionId:abc123
process action:submit sessionId:abc123 data:"yes"
process action:poll sessionId:abc123
process action:kill sessionId:abc123

5. Workflow pattern — Spawn → Monitor → Collect

5.1 Step 1: spawn background

bash workdir:~/project background:true \
  command:"claude --permission-mode bypassPermissions --print 'add email validation to login form'"

Returns: sessionId: s-a7f92c

5.2 Step 2: monitor progress

process action:log sessionId:s-a7f92c

Check what files are being edited, whether any errors surfaced.

5.3 Step 3: inject input if needed

With --permission-mode bypassPermissions --print, approval prompts are skipped, so input injection is rare. Differs from Codex.

If an external command (e.g., git push) asks for confirmation:

process action:submit sessionId:s-a7f92c data:"y"

5.4 Step 4: collect results, reply to channel

process action:log sessionId:s-a7f92c

Agent summarizes and posts back.

5.5 Keep the user informed

Per the official rule:

"When you spawn coding agents in the background, keep the user in the loop" with brief status updates on milestones, questions, errors, and completion.

Long silence breaks the UX.

6. The 8 official rules

The coding-agent SKILL mandates:

  1. Execution mode matching — Codex/Pi/OpenCode use pty:true; Claude Code uses --print --permission-mode bypassPermissions.
  2. Respect tool choice — if the user asked for Codex, use Codex. Don't hand-code patches instead of delegating.
  3. Session patience — don't kill sessions prematurely just because they feel slow.
  4. Monitor with process:log — observe, don't interfere.
  5. --full-auto vs vanilla — use --full-auto for building (auto-approves); vanilla for review work.
  6. Parallel allowed — multiple background agents for batch work is fine.
  7. State directory off-limits — "NEVER start Codex inside your OpenClaw state directory" (risks polluting org context).
  8. Protect live instance — "NEVER checkout branches in ~/Projects/openclaw/" (the active production instance).

7. End-to-end example — Discord → code edit

7.1 User message (Discord)

@ClawBot add rate limiting to src/auth/login.ts. 
Use Claude Code.

7.2 What the agent infers

  • User said "Use Claude Code" → use Claude Code path
  • Task may take a while → background
  • workdir = project root

7.3 Actual call

bash workdir:~/Projects/my-app background:true \
  command:"claude --permission-mode bypassPermissions --print \
    'add rate limiting to src/auth/login.ts. add tests. show diff after 100% pass.'"

Returns: sessionId: s-38df2e

7.4 Channel ack

@user Started. Claude Code session s-38df2e.
Status updates every 2 minutes.

7.5 Monitoring loop (agent internal)

Every 2 minutes:

process action:log sessionId:s-38df2e

If output shows "Adding rate-limit middleware...", summarize to channel:

@user Progress: rate-limit middleware added, writing 4 tests now

7.6 On completion

@user Done. Change summary:
- src/auth/login.ts: +18 -3
- src/auth/rate-limit.ts: new (42 lines)
- tests/auth/rate-limit.test.ts: new (5 tests, all PASS)
Attach the diff here?

8. Security — what this bridge opens

This pipeline lets a messenger user run Claude Code on the host. Implications:

  • --permission-mode bypassPermissions skips every permission prompt. Whatever the agent approves runs.
  • Default OpenClaw: main session = host full access.
  • Inbound messenger traffic = prompt injection surface.

Minimum defense line:

8.1 Force sandbox.mode: "non-main"

{
  agents: {
    defaults: {
      sandbox: { mode: "non-main" }
    }
  }
}

8.2 DM Policy "allowlist"

{
  channels: {
    discord: {
      dmPolicy: "allowlist",
      allowFrom: ["discord:<YOUR_ID>"]
    }
  }
}

No arbitrary user can send coding commands.

8.3 Block dangerous operations in Claude Code hooks

Install Claude Code hooks that block rm -rf, git push --force, etc., at PreToolUse. A defense layer the bridge cannot bypass.

8.4 Respect the coding-agent off-limits paths

Rules 7 & 8: don't start Codex in the OpenClaw state dir; don't checkout branches in the live openclaw directory. Apply the same to Claude Code calls — always set workdir to the intended project root.

9. Alternatives — when the bridge is overkill

  • Solo local work → Just use Claude Code in a terminal. The bridge is over-engineering.
  • You only need simple scripts → OpenClaw's own bash tool is enough; no need to pass through Claude Code.
  • MCP already covers your workflow → Call MCP from inside Claude Code. No OpenClaw layer needed.
  • Team-shared codebases → bypassPermissions is risky for audit-heavy teams. Use Claude Code plan mode for human final approval instead.

10. Debugging — when the bridge doesn't work

10.1 Verify Claude Code binary path

The shell OpenClaw uses must see claude.

which claude

If missing, it's a PATH issue. The PATH in launchd/systemd user service often differs from interactive shells.

Linux systemd user service:

[Service]
Environment="PATH=/usr/local/bin:/home/myuser/.local/bin:/usr/bin"

macOS launchd plist:

<key>EnvironmentVariables</key>
<dict>
  <key>PATH</key>
  <string>/usr/local/bin:/Users/myuser/.local/bin:/usr/bin</string>
</dict>

10.2 Check Claude Code auth

claude auth status --text

If the token expired, background runs will hang on the login prompt (not visible to the user).

10.3 Track session IDs

Use process action:list to watch live sessions. Kill stale ones.

10.4 OpenClaw doctor

openclaw doctor

Confirms the coding-agent skill is loaded and tool access works.

11. Honest limitations

  • No PTY: interactive Claude Code features (slash-command sessions, confirmation dialogs) aren't available through the bridge. --print is one-shot.
  • Large stdout accumulation: big diffs/logs on stdout load the agent's context. Save to file and send the path instead.
  • No interactive approvals: running Claude Code without bypassPermissions hangs on the first prompt. That's why the docs mandate bypassPermissions.
  • Cost: the bridge bills both OpenClaw agent + Claude Code tokens. For short questions, calling Claude Code directly is cheaper.

12. Expansion ideas

Once the basic bridge works:

  1. Batch execution: fan out across files, call Claude Code in parallel. Aligns with rule #6.
  2. Scheduled triggers: OpenClaw's cron section — every morning have Claude Code summarize the changelog and post to Discord.
  3. Review bot: GitHub webhook → OpenClaw hook → Claude Code /review → PR comment.
  4. Layered with Claude Code hooks: Claude Code hooks inside the bridged session add a second enforcement layer.

13. Counter-scenarios — when the bridge isn't a fit

  • Security-sensitive corporate messengers → messenger → host-command pipelines may violate policy.
  • Directly piping user input as commands → prompt-injection vector. The agent must re-interpret input at least once.
  • You need agents beyond Claude Code → coding-agent supports Codex / Pi / OpenCode. Don't fix on Claude Code only.
  • Fast reply to short questions → background + 2-min polling is overkill. Use --print foreground synchronously.

14. What's next

OpenClaw part ends here. Next up: Hermes Agent.

  1. Hermes Agent install complete guide + first SOUL.md (coming soon)
  2. OpenClaw production ops — 24/7 operations environment.
  3. Claude Code hooks complete guide — bridge defense layer.

References

This is post 11/15 in the "AI Coding CLI Entry Guide" series. OpenClaw part ends here; the next post starts the Hermes Agent part.
last verified: 2026-04-25 (per openclaw/openclaw/skills/coding-agent/SKILL.md + Claude Code official CLI docs).

Series overview: Series index

๋Œ“๊ธ€

๋Œ“๊ธ€ ์“ฐ๊ธฐ

์ด ๋ธ”๋กœ๊ทธ์˜ ์ธ๊ธฐ ๊ฒŒ์‹œ๋ฌผ

Agent Memory Engine (2/10) — Building an AI Agent Memory System with SQLite Alone

← 1/10 SQLite Memory Engine f… ๐Ÿ“š Series Index 3/10 memcore Completed → A memory engine that runs without daemons, without dependencies, anywhere ํ•ต์‹ฌ ์š”์•ฝ This post covers how to design an AI agent memory engine (memcore) on a single-file SQLite backend. - Structure: 25 modules, ~6,464 lines, 22 DB tables - Principles: no daemon, single-file portability, no required external dependencies, host-agnostic - Core techniques: 4-layer hybrid search (topic · vector · FTS5 · LIKE), U-tag dialectic-based confidence evolution, ingestion-layer bias rejection rules What This Post Covers One approach to building AI agent memory without a server or cloud vector DB. Specifically: (1) the limitations of text-file-based memory, (2) vector DB alternatives compared and selection criteria, (3) how to layer search tiers, (4) how to evolve confidence scores over time, and (5) how to block biased memory accumulation at the ingestion stage. Design Principles: Why Single-File SQLite Text-file-based ...
Read more »

"ML Foundations (9/9) — PyTorch vs TensorFlow, and the Road to Local LLMs"

์ด๋ฏธ์ง€
← 8/9 Deep Learning Architec… ๐Ÿ“š Series Index (series end) The final part. So far we've focused on models. Now we focus on the tools that actually run them . We'll lay out the philosophical difference between PyTorch and TensorFlow, and trace how Hugging Face transformers , llama.cpp , MLX , and Ollama built the bridge to running large language models on your own machine. By the end you should have the full mental model of "download a pretrained LLM and serve it locally." 0. Learning Objectives Explain the eager-vs-graph difference between PyTorch and TensorFlow. Explain, in graph terms, how autograd automates the backward pass. Use Hugging Face transformers ' AutoModel , AutoTokenizer , and pipeline abstractions. Describe llama.cpp's GGUF quantization, INT4 inference, and CPU-first flow. Describe Apple MLX's use of unified memory and how it differs from PyTorch. Run a local LLM with Ollama and call it through an OpenAI-compatible API. ...
Read more »

"RAG Core Study (14/26) — Evaluation Sets with RAGAS & DeepEval"

์ด๋ฏธ์ง€
Series overview: Series index ๐Ÿ“š Series Index Without an evaluation set, every RAG improvement is a story, not evidence. RAG systems fail in more than one place: retrieval, context selection, answer generation, and grounding. That means "looks better" is not a metric. Part 14 explains how to build a golden dataset , how RAGAS and DeepEval fit into the workflow, and why teams must separate retrieval quality from answer quality if they want tuning decisions to hold up. 0. Prerequisites Part 13 reranking — system quality now depends on multi-stage ranking. Part 1 grounding — a correct-looking answer is not enough. Part 12 Hybrid — multiple retrieval settings need comparison on fixed data. 1. Learning Objectives Build a small but useful golden dataset for RAG. Distinguish retrieval metrics from answer metrics . Use RAGAS and DeepEval in the right roles. Avoid the common traps in judge-model-based evaluation. 2. ํ•ต์‹ฌ ์š”์•ฝ An evaluation set for RAG is ...
Read more »

"ML Foundations (8/9) — Deep Learning Architectures: CNN, RNN, Attention"

์ด๋ฏธ์ง€
← 7/9 Deep Learning Training ๐Ÿ“š Series Index 9/9 PyTorch vs TensorFlow → What did we keep adding on top of an MLP? Vision went CNN, sequences went RNN/LSTM, and eventually both converged on Attention and the Transformer. Each architecture is easier to remember if you read it as what it gave up to gain something else . This part is the one-line summary of the decisive inflection points: LeNet → AlexNet → ResNet → LSTM → Attention → Transformer. 0. Learning Objectives Explain why CNN's convolution, pooling, and weight sharing match images so well. Trace what got unblocked from LeNet → AlexNet → VGG → ResNet as depth grew. State BPTT for RNNs and the vanishing/exploding gradient problem. Write the LSTM gate equations (forget, input, output) with intuition. Write the attention formula in query/key/value form and the scaled dot-product variant. State the precise reasons Transformers replaced RNNs (parallelism + long-range dependencies). 1. ํ•ต์‹ฌ ์š”์•ฝ CNN : weight sharin...
Read more »

"ML Foundations (7/9) — Deep Learning Training: Optimizers, Regularization, Initialization"

← 6/9 Neural Networks ๐Ÿ“š Series Index 8/9 Deep Learning Architec… → Building an MLP, as we did in Part 6, is not the same as getting it to train well . The right optimizer, regularization, initialization, and learning rate — when these line up, deep networks converge. When they don't, the network refuses to learn at all. This part is the catalog of those crafts, with formulas, paper citations, and code in one place. 0. Learning Objectives Compare and write the update rules for SGD, Momentum, Nesterov, and Adam. Explain how Dropout, BatchNorm, and LayerNorm work and where they belong in a model. Derive the variance formulas for Xavier and He initialization and match them to activations. Implement step, cosine, and warmup learning-rate schedules in PyTorch. Explain why gradient clipping is effectively required for RNNs and Transformers. Diagnose the most common training failures (NaN, plateau, overfitting) and apply first-line fixes. 1. ํ•ต์‹ฌ ์š”์•ฝ SGD : \(w \leftarro...
Read more »

OpenClaw to Hermes Migration (2/13) — What to Preserve, Partially Port, or Discard

← 1/13 Current Structure Inve… ๐Ÿ“š Series Index 3/13 What Moves to Hermes → A code review record classifying operational scripts into three tiers: preserve, partial-preserve, and discard. What This Post Covers An asset classification framework (preserve / partial-preserve / discard) for migrating a legacy agent system to a successor A concrete case applying the Strangler Fig + Subset Migration strategy to a memory pipeline Classification results evaluated across LOC, external dependencies, and replaceability axes A method for slimming down a bloated single file (1,310 LOC) using the migration as a natural entry point Problem Definition: Port Everything or Cut Deep? The OpenClaw inventory comprises multiple agents, multiple scheduler/daemon processes, and multiple operational scripts. When moving to the successor system, Hermes, the choice is not binary. A full port carries accumulated technical debt along with it; a minimal port discards hard-won domain logic. Code-revie...
Read more »

AI Agents I Built (5/7) — Building an Automated Blogger API Publishing System

← 4/7 My Life Organizer Agent ๐Ÿ“š Series Index 6/7 Dual → Designing a Markdown-Based Auto-Publish Pipeline with Blogger API v3 + OAuth 2.0 Key Summary Blogger API v3 + OAuth 2.0 enables a pipeline that converts Markdown files into publishable HTML posts blogger_publish.py handles the full flow — frontmatter parsing → body cleanup → HTML conversion → CSS injection → API post — in a single script For bulk publishing, quota management (delay, retry, TOC suppression) is the critical design concern Platform Selection Criteria API access is mandatory for AI agent-driven content publishing. A comparison of platforms: Platform API Cost AdSense Decision WordPress.com REST API Paid plan required Paid only Cost overhead Ghost REST API Self-hosted or paid Manual setup Ops overhead Blogger v3 API Free Native integration Adopted Blogger is free, exposes a REST API, and integrates natively with AdSense. For personal blog automation, this combination i...
Read more »