Add Paperclip
to your OpenClaw

I need you to add Paperclip to my existing OpenClaw setup. Here are my details:

- VPS Tailscale IP: YOUR_TAILSCALE_IP
- OpenClaw container name: YOUR_OPENCLAW_CONTAINER (find with: docker ps)

Please SSH into the VPS and do the following:

## 1. Install Paperclip (Docker)
Paperclip runs via Docker Compose. DO NOT install it natively.

- mkdir ~/paperclip && cd ~/paperclip
- git clone https://github.com/paperclipai/paperclip.git .

IMPORTANT: The upstream Dockerfile has bugs (as of March 2026). Apply these 3 fixes before building:

Fix 1 - Lockfile: In the Dockerfile, change:
  "pnpm install --frozen-lockfile" to "pnpm install --no-frozen-lockfile"

Fix 2 - Missing packages: After the line
  "COPY packages/adapters/pi-local/package.json packages/adapters/pi-local/"
add these lines:
  COPY packages/plugins/sdk/package.json packages/plugins/sdk/
  COPY packages/plugins/create-paperclip-plugin/package.json packages/plugins/create-paperclip-plugin/
  COPY packages/plugins/examples/ packages/plugins/examples/

Fix 3 - Build order: Change
  "RUN pnpm --filter @paperclipai/ui build"
to:
  RUN pnpm --filter @paperclipai/plugin-sdk build 2>/dev/null; pnpm --filter @paperclipai/ui build

Create docker-compose.override.yml to bind to Tailscale only:
  services:
    db:
      ports: !override
        - "127.0.0.1:5433:5432"
    server:
      ports: !override
        - "YOUR_TAILSCALE_IP:3100:3100"
      environment:
        PAPERCLIP_PUBLIC_URL: "http://YOUR_TAILSCALE_IP:3100"

Create .env with: BETTER_AUTH_SECRET=(generate with: openssl rand -hex 32)

Build and start: docker compose up -d --build
Run onboard: docker exec paperclip-server-1 pnpm paperclipai onboard --yes
This prints a CEO invite URL - show it to me so I can open it in my browser.

## 2. Connect Docker networks
The Paperclip and OpenClaw containers need to talk to each other:

a) Connect them to the same network:
   docker network connect $(docker inspect YOUR_OPENCLAW_CONTAINER --format '{{range $k, $v := .NetworkSettings.Networks}}{{$k}}{{end}}') paperclip-server-1

b) Add the container hostname to Paperclip's allowed hosts:
   docker exec paperclip-server-1 pnpm paperclipai allowed-hostname YOUR_OPENCLAW_CONTAINER
   cd ~/paperclip && docker compose restart server

c) Verify connectivity:
   docker exec YOUR_OPENCLAW_CONTAINER curl -s -o /dev/null -w "%{http_code}" http://paperclip-server-1:3100/api/health
   (Should return 200)

## 3. Register the OpenClaw agent in Paperclip

a) Get the OpenClaw gateway token from your OpenClaw config:
   The token is in openclaw.json under gateway.auth.token

b) Use the Paperclip API to create the agent (replace values):
   - Sign in: POST http://YOUR_TAILSCALE_IP:3100/api/auth/sign-in/email
   - Create agent: POST /api/companies/COMPANY_ID/agents with:
     {
       "name": "Your Agent Name",
       "role": "ceo",
       "adapterType": "openclaw_gateway",
       "adapterConfig": {
         "url": "ws://YOUR_OPENCLAW_CONTAINER:18789",
         "authToken": "GATEWAY_TOKEN",
         "paperclipApiUrl": "http://paperclip-server-1:3100",
         "disableDeviceAuth": true,
         "waitTimeoutMs": 120000,
         "sessionKeyStrategy": "issue",
         "role": "operator",
         "scopes": ["operator.admin"]
       }
     }
   Include Origin: http://YOUR_TAILSCALE_IP:3100 header on all mutation requests.

## 4. Install Paperclip skills
Fetch and install the Paperclip skills into the OpenClaw workspace:

   mkdir -p WORKSPACE/skills/paperclip WORKSPACE/skills/paperclip-create-agent
   curl -s http://YOUR_TAILSCALE_IP:3100/api/skills/paperclip > WORKSPACE/skills/paperclip/SKILL.md
   curl -s http://YOUR_TAILSCALE_IP:3100/api/skills/paperclip-create-agent > WORKSPACE/skills/paperclip-create-agent/SKILL.md

(Replace WORKSPACE with the actual OpenClaw workspace path)

## 5. Generate agent API key
The agent needs a JWT to authenticate with the Paperclip API:

a) Read the JWT secret:
   docker exec paperclip-server-1 cat /paperclip/instances/default/.env | grep PAPERCLIP_AGENT_JWT_SECRET

b) Generate a JWT with these exact claims:
   - sub: the agent ID from step 3
   - company_id: the company ID
   - adapter_type: "openclaw_gateway"
   - run_id: "persistent-key"
   - iss: "paperclip"
   - aud: "paperclip-api"
   - exp: 1 year from now
   Algorithm: HS256 with the JWT secret

c) Save to workspace:
   echo '{"token":"THE_JWT","agentId":"AGENT_ID","companyId":"COMPANY_ID","apiUrl":"http://paperclip-server-1:3100"}' > WORKSPACE/paperclip-claimed-api-key.json
   chmod 600 WORKSPACE/paperclip-claimed-api-key.json

## 6. Test the integration
Trigger a wakeup via the API:
   POST http://YOUR_TAILSCALE_IP:3100/api/agents/AGENT_ID/wakeup
   with body: {"reason":"Integration test"}

The agent should wake up, read its Paperclip skill, check for assigned tasks, and exit cleanly with a message like "No issues assigned. Heartbeat complete."

Show me the result of the heartbeat run.

Go step by step. Ask me for input when needed (CEO invite URL, etc).