@2en/clawly-plugins 1.30.0-beta.1 → 1.30.0-beta.10

package/outbound.ts

@@ -18,6 +18,7 @@ import fsp from 'node:fs/promises'
 import type {IncomingMessage, ServerResponse} from 'node:http'
 import os from 'node:os'
 import path from 'node:path'
+import mime from 'mime'
 
 import type {PluginApi} from './index'
 import {createAccessToken, guardHttpAuth, resolveGatewaySecret, sendJson} from './lib/httpAuth'
@@ -132,24 +133,7 @@ export function registerOutboundMethods(api: PluginApi) {
 
 // ── HTTP route: GET /clawly/file/outbound?path=<original-path> ─────────────
 
-const MIME: Record<string, string> = {
-  '.mp3': 'audio/mpeg',
-  '.wav': 'audio/wav',
-  '.ogg': 'audio/ogg',
-  '.m4a': 'audio/mp4',
-  '.aac': 'audio/aac',
-  '.flac': 'audio/flac',
-  '.webm': 'audio/webm',
-  '.jpg': 'image/jpeg',
-  '.jpeg': 'image/jpeg',
-  '.png': 'image/png',
-  '.gif': 'image/gif',
-  '.webp': 'image/webp',
-  '.bmp': 'image/bmp',
-  '.heic': 'image/heic',
-  '.avif': 'image/avif',
-  '.ico': 'image/x-icon',
-}
+// Content-Type resolution via `mime` package (replaces hardcoded map)
 
 /** Directories from which direct-path serving is allowed (no hash required). */
 let allowedRoots: string[] | null = null
@@ -183,6 +167,12 @@ async function resolveOutboundFile(rawPath: string, stateDir?: string): Promise<
   return null
 }
 
+export function buildContentDisposition(filename: string): string {
+  const asciiName = filename.replace(/[^\x20-\x7E]/g, '_').replace(/["\\]/g, '\\$&')
+  const utf8Name = encodeURIComponent(filename)
+  return `attachment; filename="${asciiName}"; filename*=UTF-8''${utf8Name}`
+}
+
 export function registerOutboundHttpRoute(api: PluginApi) {
   const stateDir = api.runtime.state.resolveStateDir()
 
@@ -219,8 +209,7 @@ export function registerOutboundHttpRoute(api: PluginApi) {
         return
       }
 
-      const ext = path.extname(resolved).toLowerCase()
-      const contentType = MIME[ext] ?? 'application/octet-stream'
+      const contentType = mime.getType(resolved) ?? 'application/octet-stream'
       const stat = await fsp.stat(resolved)
       const total = stat.size
 
@@ -230,6 +219,15 @@ export function registerOutboundHttpRoute(api: PluginApi) {
         return
       }
 
+      const downloadFilename = url.searchParams.get('download')
+      const baseHeaders: Record<string, string | number> = {
+        'Content-Type': contentType,
+        'Accept-Ranges': 'bytes',
+      }
+      if (downloadFilename && path.extname(downloadFilename) === path.extname(resolved)) {
+        baseHeaders['Content-Disposition'] = buildContentDisposition(downloadFilename)
+      }
+
       const rangeHeader = _req.headers.range
 
       if (rangeHeader) {
@@ -241,9 +239,8 @@ export function registerOutboundHttpRoute(api: PluginApi) {
           const stream = fs.createReadStream(resolved, {start, end})
 
           res.writeHead(206, {
-            'Content-Type': contentType,
+            ...baseHeaders,
             'Content-Range': `bytes ${start}-${end}/${total}`,
-            'Accept-Ranges': 'bytes',
             'Content-Length': chunkSize,
           })
           stream.pipe(res)
@@ -256,9 +253,8 @@ export function registerOutboundHttpRoute(api: PluginApi) {
 
       const buffer = await fsp.readFile(resolved)
       res.writeHead(200, {
-        'Content-Type': contentType,
+        ...baseHeaders,
         'Content-Length': total,
-        'Accept-Ranges': 'bytes',
       })
       res.end(buffer)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@2en/clawly-plugins",
-  "version": "1.30.0-beta.1",
+  "version": "1.30.0-beta.10",
   "module": "index.ts",
   "type": "module",
   "repository": {
@@ -13,8 +13,10 @@
     "@opentelemetry/exporter-logs-otlp-http": "^0.57.0",
     "@opentelemetry/resources": "^1.30.0",
     "@opentelemetry/sdk-logs": "^0.57.0",
-    "posthog-node": "^5.28.0",
     "file-type": "^21.3.0",
+    "json5": "^2.2.3",
+    "mime": "^4.1.0",
+    "posthog-node": "^5.28.0",
     "zx": "npm:zx@8.8.5-lite"
   },
   "files": [
@@ -47,8 +49,5 @@
     "extensions": [
       "./index.ts"
     ]
-  },
-  "devDependencies": {
-    "json5": "^2.2.3"
   }
 }

package/tools/clawly-calendar.ts

@@ -158,6 +158,26 @@ export function registerCalendarTools(api: PluginApi) {
         location: {type: 'string', description: 'Event location'},
         notes: {type: 'string', description: 'Event description/notes'},
         timeZone: {type: 'string', description: 'IANA time zone (e.g. America/New_York)'},
+        alarms: {
+          type: 'array',
+          description:
+            'Array of alarm objects to set reminders. Each alarm has a relativeOffset in minutes (negative = before event). Example: [{relativeOffset: -15}] for 15 minutes before. Only alarms with valid relativeOffset (number) or method (string) will be applied. To verify reminders were set, use clawly_calendar_list_events after creation.',
+          items: {
+            type: 'object',
+            properties: {
+              relativeOffset: {
+                type: 'number',
+                description:
+                  'Minutes relative to the event start time. Use negative values for reminders before the event (e.g. -15 = 15 min before, -60 = 1 hour before).',
+              },
+              method: {
+                type: 'string',
+                enum: ['alarm', 'alert', 'email', 'default', 'sms'],
+                description: 'Alarm method (Android only). iOS always uses notification.',
+              },
+            },
+          },
+        },
       },
     },
     async execute(_toolCallId, params) {
@@ -211,6 +231,9 @@ export function registerCalendarTools(api: PluginApi) {
         ...(params.location ? {location: params.location} : {}),
         ...(params.notes ? {notes: params.notes} : {}),
         ...(params.timeZone ? {timeZone: params.timeZone} : {}),
+        ...(Array.isArray(params.alarms) && params.alarms.length > 0
+          ? {alarms: params.alarms}
+          : {}),
       }
 
       const resultPromise = waitForActionResult(actionId)
@@ -290,6 +313,26 @@ export function registerCalendarTools(api: PluginApi) {
         location: {type: 'string', description: 'New event location'},
         notes: {type: 'string', description: 'New event description/notes'},
         timeZone: {type: 'string', description: 'IANA time zone (e.g. America/New_York)'},
+        alarms: {
+          type: 'array',
+          description:
+            'Array of alarm objects to set reminders. Each alarm has a relativeOffset in minutes (negative = before event). Example: [{relativeOffset: -15}] for 15 minutes before. Replaces all existing alarms. Pass an empty array [] to clear all existing reminders.',
+          items: {
+            type: 'object',
+            properties: {
+              relativeOffset: {
+                type: 'number',
+                description:
+                  'Minutes relative to the event start time. Use negative values for reminders before the event (e.g. -15 = 15 min before, -60 = 1 hour before).',
+              },
+              method: {
+                type: 'string',
+                enum: ['alarm', 'alert', 'email', 'default', 'sms'],
+                description: 'Alarm method (Android only). iOS always uses notification.',
+              },
+            },
+          },
+        },
       },
     },
     async execute(_toolCallId, params) {
@@ -314,6 +357,7 @@ export function registerCalendarTools(api: PluginApi) {
         ...(params.location !== undefined ? {location: params.location} : {}),
         ...(params.notes !== undefined ? {notes: params.notes} : {}),
         ...(params.timeZone !== undefined ? {timeZone: params.timeZone} : {}),
+        ...(Array.isArray(params.alarms) ? {alarms: params.alarms} : {}),
       }
 
       const resultPromise = waitForActionResult(actionId)

package/tools/clawly-search.test.ts

@@ -1,6 +1,11 @@
 import {afterAll, beforeEach, describe, expect, test} from 'bun:test'
 import type {PluginApi} from '../types'
-import {registerDeepSearchTool, registerGrokSearchTool, registerSearchTool} from './clawly-search'
+import {
+  registerDeepSearchTool,
+  registerGrokSearchTool,
+  registerKimiSearchTool,
+  registerSearchTool,
+} from './clawly-search'
 
 // ── Helpers ──────────────────────────────────────────────────────
 
@@ -267,3 +272,45 @@ describe('clawly_grok_search', () => {
     expect(res.error).toContain('Grok API error 429')
   })
 })
+
+// ── clawly_kimi_search ──────────────────────────────────────────
+
+describe('clawly_kimi_search', () => {
+  test('uses Kimi gateway endpoint with web_search tool', async () => {
+    mockResponse.body = {
+      choices: [{message: {content: 'Kimi answer with [source](https://example.com/page)'}}],
+    }
+    const {execute} = createMockApi(registerKimiSearchTool)
+    const res = parseResult(await execute('tc-1', {query: 'Chinese news'}))
+
+    expect(fetchCalls).toHaveLength(1)
+    const call = fetchCalls[0]
+    expect(call.url).toBe('https://gw.example.com/v1/kimi/v1/chat/completions')
+    expect(call.body?.model).toBe('kimi-k2-turbo-preview')
+    expect(call.body?.stream).toBe(false)
+    expect(call.body?.messages).toEqual([{role: 'user', content: 'Chinese news'}])
+    expect(call.body?.tools).toEqual([{type: 'builtin_function', function: {name: 'web_search'}}])
+
+    expect(res.answer).toBe('Kimi answer with [source](https://example.com/page)')
+    expect(res.citations).toEqual(['https://example.com/page'])
+    expect(res.provider).toBe('kimi')
+  })
+
+  test('returns empty citations when response has no inline links', async () => {
+    mockResponse.body = {choices: [{message: {content: 'Plain answer'}}]}
+    const {execute} = createMockApi(registerKimiSearchTool)
+    const res = parseResult(await execute('tc-1', {query: 'test'}))
+
+    expect(res.answer).toBe('Plain answer')
+    expect(res.citations).toEqual([])
+    expect(res.provider).toBe('kimi')
+  })
+
+  test('returns error on Kimi API failure', async () => {
+    mockResponse = {ok: false, status: 429, body: {error: 'rate limited'}}
+    const {execute} = createMockApi(registerKimiSearchTool)
+    const res = parseResult(await execute('tc-1', {query: 'test'}))
+
+    expect(res.error).toContain('Kimi API error 429')
+  })
+})

package/tools/clawly-search.ts

@@ -1,9 +1,12 @@
 import {
   buildGrokBody,
   buildGrokUrl,
+  buildKimiBody,
+  buildKimiUrl,
   buildPerplexityUrl,
   createSearchToolRegistrar,
   parseGrokResponse,
+  parseKimiResponse,
 } from './create-search-tool'
 
 export const registerSearchTool = createSearchToolRegistrar({
@@ -40,3 +43,14 @@ export const registerGrokSearchTool = createSearchToolRegistrar({
   buildBody: buildGrokBody,
   parseResponse: parseGrokResponse,
 })
+
+export const registerKimiSearchTool = createSearchToolRegistrar({
+  toolName: 'clawly_kimi_search',
+  description: 'Search the web using Kimi. Good for Chinese-language queries and content.',
+  model: 'kimi-k2-turbo-preview',
+  buildUrl: buildKimiUrl,
+  timeoutMs: 30_000,
+  provider: 'kimi',
+  buildBody: buildKimiBody,
+  parseResponse: parseKimiResponse,
+})

package/tools/clawly-send-file.test.ts

@@ -0,0 +1,400 @@
+import {afterAll, beforeEach, describe, expect, mock, test} from 'bun:test'
+import fsp from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import type {PluginApi} from '../types'
+import {registerSendFileTool} from './clawly-send-file'
+
+// ── Mocks ────────────────────────────────────────────────────────
+
+let mockInjectParams: {sessionKey: string; message: string} | null = null
+let mockFileTypeFromBuffer: (buf: Uint8Array) => Promise<{mime: string; ext: string} | undefined>
+let mockFileTypeFromFile: (p: string) => Promise<{mime: string; ext: string} | undefined>
+
+mock.module('../gateway/inject', () => ({
+  resolveSessionKey: async () => 'agent:clawly:main',
+  injectAssistantMessage: async (params: {sessionKey: string; message: string}) => {
+    mockInjectParams = params
+    return {ok: true, messageId: 'msg-123'}
+  },
+}))
+
+mock.module('file-type', () => ({
+  fileTypeFromBuffer: async (buf: Uint8Array) => mockFileTypeFromBuffer(buf),
+  fileTypeFromFile: async (p: string) => mockFileTypeFromFile(p),
+}))
+
+// ── Helpers ──────────────────────────────────────────────────────
+
+type ToolExecute = (
+  toolCallId: string,
+  params: Record<string, unknown>,
+) => Promise<{content: {type: string; text: string}[]}>
+
+function createMockApi(stateDir?: string): {
+  api: PluginApi
+  logs: {level: string; msg: string}[]
+  execute: ToolExecute
+} {
+  const logs: {level: string; msg: string}[] = []
+  let registeredExecute: ToolExecute | null = null
+  const dir = stateDir ?? path.join(os.tmpdir(), `clawly-send-file-test-${Date.now()}`)
+
+  const api = {
+    id: 'test',
+    name: 'test',
+    logger: {
+      info: (msg: string) => logs.push({level: 'info', msg}),
+      warn: (msg: string) => logs.push({level: 'warn', msg}),
+      error: (msg: string) => logs.push({level: 'error', msg}),
+    },
+    runtime: {
+      state: {
+        resolveStateDir: () => dir,
+      },
+    },
+    registerTool: (tool: {execute: ToolExecute}) => {
+      registeredExecute = tool.execute
+    },
+  } as unknown as PluginApi
+
+  registerSendFileTool(api)
+
+  return {api, logs, execute: registeredExecute!}
+}
+
+function parseResult(res: {content: {type: string; text: string}[]}): Record<string, unknown> {
+  return JSON.parse(res.content[0].text)
+}
+
+// Minimal PNG magic bytes (first 8 bytes)
+const PNG_BYTES = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])
+
+let originalFetch: typeof globalThis.fetch
+
+beforeEach(() => {
+  mockInjectParams = null
+  mockFileTypeFromBuffer = async () => ({mime: 'image/png', ext: 'png'})
+  mockFileTypeFromFile = async () => ({mime: 'image/png', ext: 'png'})
+
+  originalFetch = globalThis.fetch
+  globalThis.fetch = (async (url: string, init?: RequestInit) => {
+    const body = new ReadableStream({
+      start(controller) {
+        controller.enqueue(PNG_BYTES)
+        controller.close()
+      },
+    })
+    return new Response(body, {
+      status: 200,
+      headers: {'content-length': String(PNG_BYTES.length)},
+    })
+  }) as typeof fetch
+})
+
+afterAll(() => {
+  globalThis.fetch = originalFetch
+})
+
+// ── Tests ────────────────────────────────────────────────────────
+
+describe('clawly_send_file', () => {
+  describe('validation', () => {
+    test('returns error for empty source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: ''}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for missing source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for empty array source', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: []}))
+      expect(res.error).toBe('source is required')
+    })
+
+    test('returns error for array of empty strings', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: ['', '  ', '']}))
+      expect(res.error).toBe('source is required')
+    })
+  })
+
+  describe('URL source', () => {
+    test('downloads URL and injects FILE message', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/image.png'}))
+
+      expect(res.sent).toBe(true)
+      expect(res.count).toBe(1)
+      expect(mockInjectParams).not.toBeNull()
+      expect(mockInjectParams!.message).toContain('FILE:')
+      expect(mockInjectParams!.message).toMatch(/FILE:\/.*\/[a-f0-9]+\.png\?filename=image\.png/)
+    })
+
+    test('rejects URL with executable extension', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/script.sh'}))
+
+      expect(res.error).toContain('executable extension')
+    })
+
+    test('rejects downloaded executable by MIME', async () => {
+      mockFileTypeFromBuffer = async () => ({
+        mime: 'application/x-elf',
+        ext: 'elf',
+      })
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: 'https://example.com/binary'}))
+
+      expect(res.error).toContain('executable')
+    })
+
+    test('uses caption when provided', async () => {
+      const {execute} = createMockApi()
+      await execute('tc-1', {
+        source: 'https://example.com/photo.jpg',
+        caption: 'Check this out',
+      })
+
+      expect(mockInjectParams!.message).toStartWith('Check this out')
+      expect(mockInjectParams!.message).toContain('FILE:')
+    })
+  })
+
+  describe('local file source', () => {
+    test('accepts file under /tmp', async () => {
+      const tmpFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(tmpFile, 'hello')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: tmpFile}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(1)
+        expect(mockInjectParams!.message).toContain('FILE:')
+      } finally {
+        await fsp.unlink(tmpFile).catch(() => {})
+      }
+    })
+
+    test('accepts file under $HOME', async () => {
+      const homeFile = path.join(os.homedir(), `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(homeFile, 'hello')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: homeFile}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(1)
+      } finally {
+        await fsp.unlink(homeFile).catch(() => {})
+      }
+    })
+
+    test('accepts tilde-expanded path', async () => {
+      const homeFile = path.join(os.homedir(), `clawly-send-file-test-${Date.now()}.txt`)
+      await fsp.writeFile(homeFile, 'hello')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: `~/${path.basename(homeFile)}`}))
+
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.unlink(homeFile).catch(() => {})
+      }
+    })
+
+    test('rejects file outside $HOME and /tmp', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: '/etc/hosts'}))
+
+      expect(res.error).toContain('$HOME or /tmp')
+    })
+
+    test('rejects dot files', async () => {
+      const dotFile = path.join('/tmp', `.clawly-send-file-test-${Date.now()}`)
+      await fsp.writeFile(dotFile, 'secret')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: dotFile}))
+
+        expect(res.error).toContain('dot files')
+      } finally {
+        await fsp.unlink(dotFile).catch(() => {})
+      }
+    })
+
+    test('rejects path with dot component (e.g. .openclaw)', async () => {
+      const inDotDir = path.join('/tmp', '.openclaw', `test-${Date.now()}.txt`)
+      await fsp.mkdir(path.dirname(inDotDir), {recursive: true})
+      await fsp.writeFile(inDotDir, 'config')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: inDotDir}))
+
+        expect(res.error).toContain('dot files')
+      } finally {
+        await fsp.unlink(inDotDir).catch(() => {})
+        await fsp.rmdir(path.dirname(inDotDir)).catch(() => {})
+      }
+    })
+
+    test('rejects executable by extension', async () => {
+      const shFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.sh`)
+      await fsp.writeFile(shFile, '#!/bin/bash\necho hi')
+      try {
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: shFile}))
+
+        expect(res.error).toContain('executable')
+      } finally {
+        await fsp.unlink(shFile).catch(() => {})
+      }
+    })
+
+    test('rejects executable by MIME', async () => {
+      const binFile = path.join('/tmp', `clawly-send-file-test-${Date.now()}.bin`)
+      await fsp.writeFile(binFile, '\x7fELF')
+      try {
+        mockFileTypeFromFile = async () => ({
+          mime: 'application/x-elf',
+          ext: 'elf',
+        })
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: binFile}))
+
+        expect(res.error).toContain('executable')
+      } finally {
+        await fsp.unlink(binFile).catch(() => {})
+      }
+    })
+
+    test('returns error for non-existent file', async () => {
+      const {execute} = createMockApi()
+      const res = parseResult(await execute('tc-1', {source: '/tmp/nonexistent-file-12345.txt'}))
+
+      expect(res.error).toContain('file not found')
+    })
+  })
+
+  describe('state dir restriction', () => {
+    test('rejects file directly under state dir', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const stateFile = path.join(stateDir, 'config.json')
+      await fsp.mkdir(stateDir, {recursive: true})
+      await fsp.writeFile(stateFile, '{}')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'application/json', ext: 'json'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: stateFile}))
+        expect(res.error).toContain('state directory')
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('rejects file in non-allowed state subdir', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const secretFile = path.join(stateDir, 'agents', 'secret.txt')
+      await fsp.mkdir(path.dirname(secretFile), {recursive: true})
+      await fsp.writeFile(secretFile, 'secret')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: secretFile}))
+        expect(res.error).toContain('state directory')
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir clawly/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'clawly', 'data.txt')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir canvas/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'canvas', 'sketch.png')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'image/png', ext: 'png'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+
+    test('allows file under state dir memory/', async () => {
+      const stateDir = path.join('/tmp', `.clawly-state-test-${Date.now()}`)
+      const allowedFile = path.join(stateDir, 'memory', 'note.md')
+      await fsp.mkdir(path.dirname(allowedFile), {recursive: true})
+      await fsp.writeFile(allowedFile, 'ok')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi(stateDir)
+        const res = parseResult(await execute('tc-1', {source: allowedFile}))
+        expect(res.sent).toBe(true)
+      } finally {
+        await fsp.rm(stateDir, {recursive: true}).catch(() => {})
+      }
+    })
+  })
+
+  describe('array source', () => {
+    test('processes multiple sources', async () => {
+      const tmp1 = path.join('/tmp', `clawly-send-file-a-${Date.now()}.txt`)
+      const tmp2 = path.join('/tmp', `clawly-send-file-b-${Date.now()}.txt`)
+      await fsp.writeFile(tmp1, 'a')
+      await fsp.writeFile(tmp2, 'b')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: [tmp1, tmp2]}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(2)
+        expect(mockInjectParams!.message.split('FILE:').length - 1).toBe(2)
+      } finally {
+        await fsp.unlink(tmp1).catch(() => {})
+        await fsp.unlink(tmp2).catch(() => {})
+      }
+    })
+
+    test('filters empty strings from array', async () => {
+      const tmpFile = path.join('/tmp', `clawly-send-file-${Date.now()}.txt`)
+      await fsp.writeFile(tmpFile, 'x')
+      try {
+        mockFileTypeFromFile = async () => ({mime: 'text/plain', ext: 'txt'})
+        const {execute} = createMockApi()
+        const res = parseResult(await execute('tc-1', {source: ['', tmpFile, '  ', tmpFile]}))
+
+        expect(res.sent).toBe(true)
+        expect(res.count).toBe(2)
+      } finally {
+        await fsp.unlink(tmpFile).catch(() => {})
+      }
+    })
+  })
+})