Openai Whisper
OpenAI Whisper:使用 Whisper 模型进行视频语音识别和转录。
clawhub install openai-whisperTG Canvas 迷你应用,Telegram 迷你应用画布工具,可在 Telegram 中渲染和展示代理生成的各类内容。
Telegram Mini App Canvas with terminal and optional Control UI proxy. Renders agent-generated content (HTML, markdown, A2UI) in a Telegram Mini App; push wit...
# 安装 Skill(会下载 SKILL.md 到 .claude/skills/) clawhub install openclaw-tg-canvas # 之后直接对 Claude 说"用 TG Canvas Mini App 帮我…"即可
# 同样的安装命令,兼容所有支持 SKILL.md 的 AI 编程工具 clawhub install openclaw-tg-canvas
此 Skill 兼容 OpenClaw 标准。 安装后自动生成 SKILL.md 文件,任何支持 OpenClaw 协议的 AI Agent(Claude Code、Cursor、Windsurf 等)均可直接调用。
需Telegram Bot Token和部署服务器
~/.openclaw/openclaw.json or any local credential file?
No. The server reads no local files for credentials. OPENCLAW_GATEWAY_TOKEN must be supplied explicitly via environment variable. The relevant code is the ENABLE_OPENCLAW_PROXY config block in server.js — verify it yourself.ENABLE_OPENCLAW_PROXY?
Off. The code is const ENABLE_OPENCLAW_PROXY = process.env.ENABLE_OPENCLAW_PROXY === "true"; — it is only enabled if the string "true" is explicitly set in the environment. Omitting the variable leaves it disabled.GET /ws/terminal (WebSocket upgrade)verifyJwt() in the upgrade handler — same token issued by POST /auth after Telegram initData HMAC-SHA256 verification against BOT_TOKEN, restricted to ALLOWED_USER_IDS401 Unauthorized before a PTY is spawnedserver.js), a CLI (bin/tg-canvas.js), and a Telegram Mini App frontend (miniapp/). It is not instruction-only.initData verification. It exposes a local push endpoint and a CLI command so agents can update the live canvas without manual UI steps.cloudflared for HTTPS tunnel (required by Telegram Mini Apps).env file. BOT_TOKEN=... MINIAPP_URL=https://xxxx.trycloudflare.com node scripts/setup-bot.js
node server.js
cloudflared tunnel --url http://localhost:3721
tg-canvas push --html "<h1>Hello</h1>"
tg-canvas push --markdown "# Hello"
tg-canvas push --a2ui @./a2ui.json
curl -X POST http://127.0.0.1:3721/push \
-H 'Content-Type: application/json' \
-d '{"html":"<h1>Hello</h1>"}'
GET / | ✅ | None (serves static Mini App HTML) |
| POST /auth | ✅ | Telegram initData HMAC-SHA256 verification + ALLOWED_USER_IDS check |
| GET /state | ✅ | JWT required |
| GET /ws | ✅ | JWT required (WebSocket upgrade) |
| POST /push | ❌ loopback-only | PUSH_TOKEN required + loopback check |
| POST /clear | ❌ loopback-only | PUSH_TOKEN required + loopback check |
| GET /health | ❌ loopback-only | Loopback check only (read-only, low risk) |
| GET/WS /oc/* | ✅ (when enabled) | JWT required; only available when ENABLE_OPENCLAW_PROXY=true |cloudflared (and other local tunnels) forward remote requests by making outbound TCP connections to localhost. This means all requests arriving via the tunnel appear to originate from 127.0.0.1 at the socket level — completely defeating the loopback-only IP check. PUSH_TOKEN is therefore required and is enforced at startup. The loopback check is retained as an additional layer but must not be relied on as the sole protection.PUSH_TOKEN — the server will refuse to start without it. Generate one with: openssl rand -hex 32JWT_SECRET (32+ bytes).BOT_TOKEN, JWT_SECRET, and PUSH_TOKEN secret; rotate if compromised.ALLOWED_USER_IDS check in /auth is the primary access control gate for the canvas.ENABLE_OPENCLAW_PROXY is off by default. Only enable it if you need Control UI access through the Mini App and understand the implications (see below)./oc/* to a local OpenClaw gateway, enabling you to access the OpenClaw Control UI through the Mini App.ENABLE_OPENCLAW_PROXY=true
/oc/* HTTP and WebSocket requests to the local OpenClaw gateway.OPENCLAW_GATEWAY_TOKEN is set, injects it as Authorization: Bearer on proxied requests.OPENCLAW_GATEWAY_TOKEN must be supplied explicitly via environment variable if needed./oc/* over a public origin, add that origin to OpenClaw gateway config:{
"gateway": {
"controlUi": {
"allowedOrigins": ["https://your-canvas-url.example.com"]
}
}
}
ALLOWED_USER_IDS can open a bash session and run arbitrary commands. Only add users you trust with shell access to ALLOWED_USER_IDS./ws/terminal (JWT required).node-pty spawns a bash process as the server process user. No additional env vars control this; auth is the only gate.tg-canvas push — push HTML/markdown/text/A2UItg-canvas clear — clear the canvastg-canvas health — check server healthBOT_TOKEN | Yes | — | Telegram bot token for API calls and initData verification. |
| ALLOWED_USER_IDS | Yes | — | Comma-separated Telegram user IDs allowed to authenticate. Controls access to canvas, terminal, and proxy. |
| JWT_SECRET | Yes | — | Secret for signing session JWTs. Use 32+ random bytes. |
| PUSH_TOKEN | Yes | — | Shared secret for /push and /clear. Server refuses to start without it. Generate: openssl rand -hex 32 |
| MINIAPP_URL | Yes (setup only) | — | HTTPS URL of the Mini App, used by scripts/setup-bot.js to configure the bot menu button. |
| PORT | No | 3721 | HTTP server port. |
| TG_CANVAS_URL | No | http://127.0.0.1:3721 | Base URL used by the tg-canvas CLI. |
| ENABLE_OPENCLAW_PROXY | No | false | Set to the string "true" to enable /oc/* proxy to a local OpenClaw gateway. Off by default. The server does not read any local files to obtain a token — OPENCLAW_GATEWAY_TOKEN must be set explicitly if auth is needed. |
| OPENCLAW_GATEWAY_TOKEN | No | *(unset)* | Auth token injected as Authorization: Bearer on proxied /oc/* requests. Only used when ENABLE_OPENCLAW_PROXY=true. Must be supplied explicitly; no automatic file loading occurs. |
| OPENCLAW_PROXY_HOST | No | 127.0.0.1 | Hostname of the local OpenClaw gateway (proxy only). |
| OPENCLAW_PROXY_PORT | No | 18789 | Port of the local OpenClaw gateway (proxy only). |
| JWT_TTL_SECONDS | No | 900 | Session token lifetime in seconds (default 15 min). |
| INIT_DATA_MAX_AGE_SECONDS | No | 300 | Maximum age of Telegram initData (default 5 min). |clawhub tg-canvas create --type html --content '<div>Hello Telegram</div>' --push-notify --control-ui enabled --bot-token BOT_TOKEN音频转录:使用本地 Whisper(Docker)将音频文件转录为文本,支持 .mp3、.m4a、.ogg、.wav、.webm 等多种格式。
Transcribe audio files to text using local Whisper (Docker). Use when receiving voice messages, audio files (.mp3, .m4a, .ogg, .wav, .webm), or when asked to transcribe audio content.
clawhub install transcribe