@2en/clawly-plugins 1.28.0 → 1.28.1

package/config-setup.ts

@@ -35,6 +35,7 @@ export interface ConfigPluginConfig {
   workspaceDir?: string
   defaultModel?: string
   defaultImageModel?: string
+  defaultHeartbeatModel?: string
   elevenlabsApiKey?: string
   modelGatewayBaseUrl?: string
   modelGatewayToken?: string
@@ -201,6 +202,20 @@ export function patchGateway(config: Record<string, unknown>): boolean {
     dirty = true
   }
 
+  // controlUi.allowedOrigins: enforce wildcard.
+  // OpenClaw v2026.2.26+ enforces origin checks for ANY browser WebSocket
+  // client (not just Control UI / Webchat). Without this, the Clawly web app
+  // fails to connect because the browser auto-sends an Origin header that
+  // doesn't match any allowlist entry. Wildcard is safe here — these are
+  // dedicated per-user sprites protected by token + device auth.
+  const controlUi = (gateway.controlUi ?? {}) as Record<string, unknown>
+  const allowedOrigins = controlUi.allowedOrigins
+  if (!Array.isArray(allowedOrigins) || allowedOrigins.length !== 1 || allowedOrigins[0] !== '*') {
+    controlUi.allowedOrigins = ['*']
+    gateway.controlUi = controlUi
+    dirty = true
+  }
+
   if (dirty) config.gateway = gateway
   return dirty
 }
@@ -454,6 +469,39 @@ export function patchMemorySearch(
   return dirty
 }
 
+const DEFAULT_HEARTBEAT_MODEL = `${PROVIDER_NAME}/qwen/qwen3.5-flash-02-23`
+
+function resolveDefaultHeartbeatModel(pc: ConfigPluginConfig): string {
+  return toProviderModelId(pc.defaultHeartbeatModel) || DEFAULT_HEARTBEAT_MODEL
+}
+
+export function patchHeartbeat(config: Record<string, unknown>, pc: ConfigPluginConfig): boolean {
+  let dirty = false
+  const agents = (config.agents ?? {}) as Record<string, unknown>
+  const defaults = (agents.defaults ?? {}) as Record<string, unknown>
+  const heartbeat = (defaults.heartbeat ?? {}) as Record<string, unknown>
+
+  // model: set-if-missing
+  if (!heartbeat.model) {
+    heartbeat.model = resolveDefaultHeartbeatModel(pc)
+    dirty = true
+  }
+
+  // lightContext: set-if-missing
+  if (heartbeat.lightContext === undefined) {
+    heartbeat.lightContext = true
+    dirty = true
+  }
+
+  if (dirty) {
+    defaults.heartbeat = heartbeat
+    agents.defaults = defaults
+    config.agents = agents
+  }
+
+  return dirty
+}
+
 // TODO: Re-enable patchToolPolicy once rollback-safe (deny is sticky — rolling back
 // the plugin leaves web_search permanently denied). Tracked in ENG-1493.
 // export function patchToolPolicy(config: Record<string, unknown>, pc: ConfigPluginConfig): boolean {
@@ -608,6 +656,7 @@ function reconcileRuntimeConfig(
 
   let dirty = false
   dirty = patchAgent(config, pc) || dirty
+  dirty = patchHeartbeat(config, pc) || dirty
   dirty = patchGateway(config) || dirty
   dirty = patchBrowser(config) || dirty
   dirty = patchSession(config) || dirty

package/openclaw.plugin.json

@@ -56,6 +56,7 @@
       "workspaceDir": { "type": "string" },
       "defaultModel": { "type": "string" },
       "defaultImageModel": { "type": "string" },
+      "defaultHeartbeatModel": { "type": "string" },
       "elevenlabsApiKey": { "type": "string" },
       "otelToken": { "type": "string" },
       "otelDataset": { "type": "string" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2en/clawly-plugins",
-  "version": "1.28.0",
+  "version": "1.28.1",
   "module": "index.ts",
   "type": "module",
   "repository": {