[p-diogo]

Two npm packages show no README on npmjs.com, and a third has an inaccurate one. This makes the next publish of each package ship a correct README. Nothing is published here.

Why each README was missing

@totalreclaw/core: npm shows the 28-character ERROR: No README data found!. #634 (Aug 16) already added a step that copies a root README into the composed pkg/. The last core publish (2.6.0) went out about 7 hours before #634 merged, so no published version has a root README yet. This PR:

• switches the copied file to a new rust/totalreclaw-core/README.npm.md, written for JS readers. The crate README.md stays as it is for crates.io and PyPI.
• deletes the wasm-pack README copies under pkg/nodejs/ and pkg/web/, so the root file is the only README in the tarball (see the nanoclaw finding below).

@totalreclaw/skill-nanoclaw: the registry has no readme, even though the published 3.0.0 and 3.1.1-rc.19 tarballs both contain a root README.md (checked by unpacking them). Of all our packages, only this tarball also has a nested mcp/README.md. npm sorts tarball entries by extension and then basename, so package/mcp/README.md comes before package/README.md. client, mcp-server and the plugin each ship a single root README and render fine. Core's old tarballs, which had only nested READMEs, also rendered nothing. The registry-side extraction rule isn't documented, so this is the best-supported explanation, not a proven one. The fix removes the variable anyway: !mcp/README.md in files, so the tarball has one README. (#634's npm@11 pin stays.) This PR also adds repository, homepage and bugs.

@totalreclaw/client (it renders, but the content was wrong): the Quick Start pointed TotalReclaw at api.totalreclaw.xyz and passed a phrase-looking string to register(). That class speaks the self-hosted HTTP protocol (/v1/register, /v1/store, /v1/search), and remember()/recall() throw until initLshFromSeed() or initLshFromMnemonic() is called. The example is rewritten and typechecked against client/src. Relative links are now absolute, because ../docs/... breaks on npmjs.com. The Smart Account bullet is gone (not exported from the package entry), and so is the stale test count.

README content

• core: what the package is; who should install the plugin, MCP server, Hermes or NanoClaw integration instead; the @totalreclaw/core (nodejs, CJS) and @totalreclaw/core/web (ESM, init()) entry points; a Node and a browser example; the export groups. Every function name was checked against both generated .d.ts files.
• skill-nanoclaw: rewritten to be short and npm-friendly. Pairing through totalreclaw_pair is the recommended setup. TOTALRECLAW_RECOVERY_PHRASE appears only under "Advanced: headless deployments", with secret-store guidance. Claims are checked against mcp/nanoclaw-agent-runner.ts: it starts the MCP server through npx or TOTALRECLAW_MCP_PATH, defaults to api.totalreclaw.xyz, maps the group folder to a namespace, and strips the phrase from the agent's Bash environment. The README does not claim that the runner wires the beforeAgentStart/agentEnd hooks; they are listed as library exports.
• The three npm READMEs are added to the scope of check-docs.sh and check-phrase-safety.sh.

Verification (local, nothing published)

• core: built both wasm-pack targets (v0.14.0, same as CI) and ran the workflow's own Compose and Copy README steps, extracted verbatim from the YAML. npm pack --dry-run (npm 10 and npm@11) shows 4.7kB README.md at the root, 11 files. The packed tarball has exactly one README (package/README.md), byte-identical to README.npm.md. Installed the tarball and ran the README's Node example (CJS), an ESM named import, and the ./web entry with init(). All three round-trip.
• skill-nanoclaw: npm run build then npm pack (npm 10 and npm@11) shows 4.8kB README.md, 47 files. mcp/README.md is excluded, mcp/SKILL.md and the rest of mcp/ still ship, and the packed package.json carries repository.
• client: npm pack --dry-run includes README.md. The Quick Start snippet typechecks with tsc --strict against client/src (the only tsc errors are in client/src/api/*, the ones build: tsc || true already ignores).
• scripts/check-docs.sh: OK. scripts/check-phrase-safety.sh: 84 artifacts clean (was 81). tests/phrase-safety/run-regression.sh: 5/5 pass. The nanoclaw terminology test patterns (seed phrase / recovery code / recovery key) find no matches. The workflow YAML and package.json parse.

Follow-ups (not in this PR)

• skill-nanoclaw stable goes out through promote-rc.yml (a dist-tag retag). A retag may not refresh the registry's top-level readme, so check npm view @totalreclaw/skill-nanoclaw readme after the next actual publish.
• @totalreclaw/client 1.3.0 depends on @totalreclaw/core ^1.1.0, while core is at 2.6.x.
• NanoClaw pairing is untested end to end. totalreclaw_pair writes ~/.totalreclaw/credentials.json, and the runner's first-run hook checks /workspace/.totalreclaw/credentials.json. The runner's first-run copy (mcp/nanoclaw-agent-runner.ts, src/onboarding/first-run.ts) still tells users to hand-write a mnemonic into credentials.json. That is phrase-safety territory, so it was not touched here.
• docs/guides/nanoclaw-getting-started.md says the runner defaults to http://totalreclaw-server:8080, but the code defaults to https://api.totalreclaw.xyz. The guide also leads with the env-var setup.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Bd3G1BkVMFSXkcdAQ7nFax