Fix/jupyter conda security flags

jupyter-conda-22-04/files/etc/jupyter/constraints.txt

@@ -0,0 +1,3 @@
+# CVE-2026-25645 — constrain transitive requests from jupyterlab/jupyter-server.
+# requirements.txt line 1: -c constraints.txt (resolved next to this file for pip and SCA tools).
+requests==2.33.1

jupyter-conda-22-04/files/etc/jupyter/requirements.txt

@@ -1,3 +1,4 @@
+-c constraints.txt
 jupyterlab-lsp
 ipywidgets
 ipykernel

jupyter-conda-22-04/files/var/lib/cloud/scripts/per-instance/001_onboot

@@ -1,7 +1,7 @@
 #!/bin/bash -x
 exec > >(tee /var/log/one_click_setup.log) 2>&1
 
-sudo -u ananconda bash <<EOF
+sudo -u anaconda bash <<EOF
 echo "Now upgrading jupyter environment"
 
 cd ~
@@ -11,6 +11,7 @@ conda activate jupyter
 
 yes| pip install  pip --upgrade
 yes| pip install  -r /etc/jupyter/requirements.txt --upgrade
+yes| pip install  "requests==2.33.1" --upgrade
 conda deactivate
 EOF
 

jupyter-conda-22-04/scripts/011-jupyter.sh

@@ -2,11 +2,16 @@
 
 set -e
 
-JUPYTERLAB="jupyterlab==${JUPYTERLAB_VERSION}"
-JUPYTER_AI="jupyter-ai==${JUPYTER_AI_VERSION}"
-
-echo "${JUPYTERLAB}" >> /etc/jupyter/requirements.txt
-echo "${JUPYTER_AI}" >> /etc/jupyter/requirements.txt
+# Merge pinned Jupyter packages first (matches jupyter-conda-24-04); keep -c constraints line on top.
+REQS_TMP=$(mktemp)
+{
+  echo "-c constraints.txt"
+  echo "jupyterlab==${JUPYTERLAB_VERSION}"
+  echo "jupyter-ai==${JUPYTER_AI_VERSION}"
+  tail -n +2 /etc/jupyter/requirements.txt
+} > "${REQS_TMP}"
+mv "${REQS_TMP}" /etc/jupyter/requirements.txt
+chown anaconda: /etc/jupyter/requirements.txt
 
 # JUPYTER
 sudo -u anaconda bash <<EOF
@@ -20,6 +25,7 @@ conda activate jupyter
 
 yes| pip install  pip --upgrade
 yes| pip install  -r /etc/jupyter/requirements.txt
+yes| pip install  "requests==2.33.1" --upgrade
 
 conda deactivate
 EOF

zeroclaw-24-04/Catalog-README.md

@@ -0,0 +1,108 @@
+# ZeroClaw
+
+## Overview
+
+ZeroClaw is a fast, small, and fully autonomous AI assistant infrastructure built in Rust. It serves as the runtime operating system for agentic workflows — abstracting models, tools, memory, and execution so agents can be built once and run anywhere.
+
+With a memory footprint under 5MB and cold start times under 10ms, ZeroClaw is designed for cost-efficient deployment on minimal hardware.
+
+## Features
+
+- **Lean Runtime:** Single Rust binary with <5MB RAM usage and near-instant startup
+- **Provider Agnostic:** Supports OpenAI, Anthropic, OpenRouter, Ollama, and any OpenAI-compatible endpoint
+- **Multi-Channel:** CLI, Telegram, Discord, Slack, WhatsApp, and more
+- **Built-in Memory:** SQLite hybrid search with vector + keyword retrieval
+- **Secure by Default:** Gateway pairing, sandbox execution, filesystem scoping, encrypted secrets
+- **Fully Swappable:** Every subsystem is a trait — swap providers, channels, tools, and memory with config changes
+
+## System Components
+
+| Component | Details |
+|-----------|---------|
+| ZeroClaw | v0.1.9a (pre-built Rust binary) |
+| Caddy | Reverse proxy with automatic TLS |
+| UFW | Firewall (HTTP, HTTPS, SSH) |
+| fail2ban | SSH brute-force protection |
+| Ubuntu | 24.04 LTS |
+
+## Getting Started
+
+1. **Create a Droplet** using this 1-Click image
+2. **SSH into your Droplet** — the setup wizard will run automatically on first login
+3. **Select an AI provider** (DigitalOcean Gradient, OpenAI, Anthropic, or OpenRouter). For Gradient, choose an inference model (default: Kimi K2.5).
+4. **Enter your API key** when prompted
+5. **Access the gateway** at `https://your-droplet-ip`
+
+### DigitalOcean Gradient
+
+Gradient uses a single model access key for serverless inference at `https://inference.do-ai.run/v1`. The default model is **Kimi K2.5** (`kimi-k2.5`). During first-login setup you can choose **Kimi K2.5**, **MiniMax M2.5** (`minimax-m2.5`), **GLM 5** (`glm-5`), or **Claude Sonnet 4.5** (`anthropic-claude-4.5-sonnet`). Re-run `sudo /etc/setup_wizard.sh` to switch models, or edit `default_model` in `/home/zeroclaw/.zeroclaw/config.toml`.
+
+## Managing ZeroClaw
+
+### Service Control
+
+```bash
+# Restart the service
+systemctl restart zeroclaw
+
+# Check service status
+systemctl status zeroclaw
+
+# View logs
+journalctl -u zeroclaw -f
+```
+
+### Helper Scripts
+
+```bash
+# Restart with status check
+/opt/restart-zeroclaw.sh
+
+# Show status and version
+/opt/status-zeroclaw.sh
+
+# Update to latest version
+sudo /opt/update-zeroclaw.sh
+
+# Configure custom domain with TLS
+sudo /opt/setup-zeroclaw-domain.sh
+
+# Run CLI commands
+/opt/zeroclaw-cli.sh status
+/opt/zeroclaw-cli.sh doctor
+/opt/zeroclaw-cli.sh agent -m "Hello, ZeroClaw!"
+```
+
+### Reconfigure Provider
+
+```bash
+sudo /etc/setup_wizard.sh
+```
+
+### Custom Domain with HTTPS
+
+Point your domain's DNS to your Droplet's IP, then run:
+
+```bash
+sudo /opt/setup-zeroclaw-domain.sh
+```
+
+This configures Caddy with automatic Let's Encrypt TLS certificates.
+
+### Update ZeroClaw
+
+```bash
+sudo /opt/update-zeroclaw.sh
+```
+
+This downloads the latest release binary from GitHub and restarts the service.
+
+## Configuration
+
+The main configuration file is located at `/home/zeroclaw/.zeroclaw/config.toml`. See the [ZeroClaw documentation](https://zeroclawlabs.ai) for all configuration options.
+
+## Resources
+
+- [ZeroClaw GitHub](https://github.com/zeroclaw-labs/zeroclaw)
+- [ZeroClaw Documentation](https://zeroclawlabs.ai)
+- [ZeroClaw Releases](https://github.com/zeroclaw-labs/zeroclaw/releases)

zeroclaw-24-04/README.md

@@ -0,0 +1,55 @@
+# ZeroClaw 1-Click Droplet
+
+This Packer template builds a DigitalOcean Marketplace 1-Click image for [ZeroClaw](https://github.com/zeroclaw-labs/zeroclaw) — a fast, small, and fully autonomous AI assistant infrastructure written in Rust.
+
+## What's Included
+
+- **ZeroClaw** v0.1.9a (pre-built binary)
+- **Caddy** reverse proxy with automatic TLS via Let's Encrypt
+- **UFW** firewall (ports 80, 443, 22)
+- **fail2ban** for SSH brute-force protection
+- **Ubuntu 24.04 LTS** base image
+
+## How It Works
+
+ZeroClaw is installed as a pre-built binary at `/usr/local/bin/zeroclaw`. It runs as a systemd service under a dedicated `zeroclaw` user. On first SSH login, an interactive setup wizard prompts you to select an AI provider (DigitalOcean Gradient, OpenAI, Anthropic, or OpenRouter), choose a Gradient inference model when applicable, and enter your API key.
+
+Caddy provides HTTPS via IP-based TLS certificates from Let's Encrypt, reverse-proxying to ZeroClaw's gateway on port 42617.
+
+### DigitalOcean Gradient
+
+When you choose **DigitalOcean Gradient** in the setup wizard, inference uses `https://inference.do-ai.run/v1` with a Gradient model access key. The default model is **Kimi K2.5** (`kimi-k2.5`). You can pick another model during setup or change `default_model` in `/home/zeroclaw/.zeroclaw/config.toml` later.
+
+| Model | Model ID |
+|-------|----------|
+| Kimi K2.5 (default) | `kimi-k2.5` |
+| MiniMax M2.5 | `minimax-m2.5` |
+| GLM 5 | `glm-5` |
+| Claude Sonnet 4.5 | `anthropic-claude-4.5-sonnet` |
+
+## Building
+
+```bash
+export DIGITALOCEAN_API_TOKEN="your-token"
+packer validate zeroclaw-24-04/template.json
+packer build zeroclaw-24-04/template.json
+```
+
+## Droplet Size
+
+ZeroClaw is extremely lightweight (<5MB RAM, ~8.8MB binary). The minimum `s-1vcpu-1gb` droplet is more than sufficient.
+
+## Files
+
+| Path | Purpose |
+|------|---------|
+| `template.json` | Packer build template |
+| `scripts/010-zeroclaw.sh` | Main install script |
+| `files/etc/setup_wizard.sh` | Interactive first-login provider setup |
+| `files/etc/config/*.toml` | Provider config templates |
+| `files/etc/systemd/system/zeroclaw.service` | Systemd unit file |
+| `files/etc/caddy/Caddyfile.tmp` | Caddy config template |
+| `files/etc/update-motd.d/99-one-click` | MOTD with usage instructions |
+| `files/opt/zeroclaw.env` | Environment configuration |
+| `files/opt/*.sh` | Helper scripts (restart, status, update, domain, cli) |
+| `files/var/lib/cloud/scripts/per-instance/001_onboot` | First-boot initialization |

zeroclaw-24-04/files/etc/caddy/Caddyfile.tmp

@@ -0,0 +1,10 @@
+PLACEHOLDER_IP {
+    tls {
+        issuer acme {
+            dir https://acme-v02.api.letsencrypt.org/directory
+            profile shortlived
+        }
+    }
+    reverse_proxy localhost:42617
+    header X-DO-MARKETPLACE "zeroclaw"
+}

zeroclaw-24-04/files/etc/config/anthropic.toml

@@ -0,0 +1,23 @@
+api_key = "PLACEHOLDER"
+default_provider = "anthropic"
+default_model = "claude-sonnet-4-6"
+default_temperature = 0.7
+
+[memory]
+backend = "sqlite"
+auto_save = true
+embedding_provider = "none"
+
+[gateway]
+port = 42617
+host = "127.0.0.1"
+require_pairing = true
+allow_public_bind = false
+
+[autonomy]
+level = "supervised"
+workspace_only = true
+allowed_commands = ["git", "npm", "cargo", "ls", "cat", "grep"]
+
+[secrets]
+encrypt = true

zeroclaw-24-04/files/etc/config/digitalocean-gradient.toml

@@ -0,0 +1,25 @@
+api_key = "PLACEHOLDER"
+default_provider = "custom:https://inference.do-ai.run/v1"
+# Default: Kimi K2.5 (open source on Gradient). Alternatives: minimax-m2.5, glm-5,
+# anthropic-claude-4.5-sonnet (Claude Sonnet 4.5).
+default_model = "kimi-k2.5"
+default_temperature = 0.7
+
+[memory]
+backend = "sqlite"
+auto_save = true
+embedding_provider = "none"
+
+[gateway]
+port = 42617
+host = "127.0.0.1"
+require_pairing = true
+allow_public_bind = false
+
+[autonomy]
+level = "supervised"
+workspace_only = true
+allowed_commands = ["git", "npm", "cargo", "ls", "cat", "grep"]
+
+[secrets]
+encrypt = true

zeroclaw-24-04/files/etc/config/openai.toml

@@ -0,0 +1,23 @@
+api_key = "PLACEHOLDER"
+default_provider = "openai"
+default_model = "gpt-4o-mini"
+default_temperature = 0.7
+
+[memory]
+backend = "sqlite"
+auto_save = true
+embedding_provider = "none"
+
+[gateway]
+port = 42617
+host = "127.0.0.1"
+require_pairing = true
+allow_public_bind = false
+
+[autonomy]
+level = "supervised"
+workspace_only = true
+allowed_commands = ["git", "npm", "cargo", "ls", "cat", "grep"]
+
+[secrets]
+encrypt = true

zeroclaw-24-04/files/etc/config/openrouter.toml

@@ -0,0 +1,23 @@
+api_key = "PLACEHOLDER"
+default_provider = "openrouter"
+default_model = "anthropic/claude-sonnet-4-6"
+default_temperature = 0.7
+
+[memory]
+backend = "sqlite"
+auto_save = true
+embedding_provider = "none"
+
+[gateway]
+port = 42617
+host = "127.0.0.1"
+require_pairing = true
+allow_public_bind = false
+
+[autonomy]
+level = "supervised"
+workspace_only = true
+allowed_commands = ["git", "npm", "cargo", "ls", "cat", "grep"]
+
+[secrets]
+encrypt = true