@a1hvdy/cc-openclaw 0.27.2 → 0.27.6

package/dist/src/openai-compat/non-streaming-handler.js

@@ -61,6 +61,17 @@ slashCommand) {
     // v0.15.0 Slice 1: hoist userText so the catch-path probe emit can reference
     // it (originally declared inside try at line ~133, post-recovery-pipeline).
     const probeUserText = userMessageToText(userMessage);
+    // v0.27.6 — report-drop fix (Killer #2), mirror of the streaming handler.
+    // The non-streaming path had NO disconnect tracking, so we add it: if the
+    // gateway socket dies mid-turn the buffered JSON reply reaches no one, and
+    // finalize() would otherwise wipe the card → total silence. Track the close,
+    // hoist deliveredText to function scope (same pattern as probeUserText above),
+    // and the finally block keeps the text on the card only when disconnected.
+    let clientDisconnected = false;
+    res.on('close', () => {
+        clientDisconnected = true;
+    });
+    let deliveredText = '';
     try {
         reportStatus('thinking', 'Processing request...');
         // v0.7.1: accumulate thinking-block content when surfaceThinking is on.
@@ -163,6 +174,9 @@ slashCommand) {
         // card. reply_dispatch in inbound-handler will fire shortly after and
         // re-render the card with state='done', picking up this text inline.
         mirrorPushAssistantText(outputText);
+        // v0.27.6 — remember the text the card is showing so the finally block can
+        // re-apply it if the socket died (see clientDisconnected note above).
+        deliveredText = outputText;
         // Parse tool_calls from response text when caller provided tools
         let traceToolCount = 0;
         let traceFinishReason = 'stop';
@@ -256,7 +270,10 @@ slashCommand) {
         // v0.26.1 — finalize the Telegram mirror card at the true end of the model
         // turn (see handleStreaming counterpart). Best-effort.
         try {
-            await mirrorFinalizeActiveCards();
+            // v0.27.6 — report-drop fix (Killer #2): keep the report on the card when
+            // the socket died (mirror of the streaming handler). Happy path passes
+            // undefined → card wiped → gateway delivers (no duplicate).
+            await mirrorFinalizeActiveCards(clientDisconnected ? deliveredText : undefined);
         }
         catch {
             /* finalize is cosmetic; never propagate */

package/dist/src/openai-compat/openai-compat.js

@@ -10,7 +10,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { resolveEngineAndModel } from '../models.js';
-import { OPENAI_COMPAT_DEFAULT_MODEL, OPENAI_COMPAT_AUTO_COMPACT_THRESHOLD, } from '../constants.js';
+import { OPENAI_COMPAT_DEFAULT_MODEL, OPENAI_COMPAT_AUTO_COMPACT_THRESHOLD, RESUME_FRESHNESS_MS, } from '../constants.js';
 import { isToolsPerMessageModeEnabled, isToolStreamMode } from './mode-flags.js';
 import { resolveSessionKey, sessionNameFromKey } from './session-key-resolver.js';
 import { buildSessionSystemPrompt, buildToolPromptBlock } from './prompts.js';
@@ -32,6 +32,8 @@ import { TTS_RULE } from './tts-rule.js';
 import { extractUserMessage, } from './message-extractor.js';
 import { handleNonStreaming } from './non-streaming-handler.js';
 import { handleStreaming } from './streaming-handler.js';
+import { getDedupWindowMs, computeSignature, findInFlight, registerLeader, awaitLeader, replayCoalesced, } from './request-coalescer.js';
+import { resolveTurnTimeoutMs } from '../lib/env-overrides.js';
 // Re-export for backward compat — Cluster B extracted these to dedicated
 // modules; keep the original import surface stable for any external caller.
 // See src/openai-compat/{mode-flags,session-key-resolver,prompts,tool-calls-parser,tool-results-serializer}.ts.
@@ -272,6 +274,17 @@ export async function handleChatCompletion(manager, body, headers, res) {
             // Note: noSessionPersistence (--no-session-persistence) is NOT set
             // because some CLI forks don't support this flag.
             skipPersistence: true,
+            // v0.27.4 (M4/M6): opt this session into freshness-windowed --resume so a
+            // gateway restart or stalled-session watchdog SIGTERM doesn't wipe the
+            // conversation. Persists the claudeSessionId (despite skipPersistence) and
+            // the next turn for this chat resumes it iff it was active within the
+            // window — older sessions still start fresh (anti-stale). Env override
+            // CC_OPENCLAW_RESUME_FRESHNESS_MS; default RESUME_FRESHNESS_MS (30 min).
+            resumeFreshnessMs: (() => {
+                const v = process.env.CC_OPENCLAW_RESUME_FRESHNESS_MS;
+                const n = v !== undefined ? parseInt(v, 10) : NaN;
+                return Number.isFinite(n) && n > 0 ? n : RESUME_FRESHNESS_MS;
+            })(),
             // v0.7.4 EMERGENCY RESTORE: re-enable --include-partial-messages for
             // openai-compat sessions. v0.6.0 made this opt-in (default OFF) for
             // a 10-100× JSON overhead drop, but the engine never grew the
@@ -405,13 +418,48 @@ export async function handleChatCompletion(manager, body, headers, res) {
         userMessage = `${toolBlock}\n\n${userMessage}`;
     }
     const completionId = `chatcmpl-${randomUUID().replace(/-/g, '').slice(0, 29)}`;
+    // ── v0.27.5 single-flight request coalescing (streaming path) ─────────────
+    // When OpenClaw retries a request whose stream it perceived as dead (the
+    // 2026-05-22 OOM/exit-137 incident), the retry carries a byte-identical body.
+    // Without this guard, session-manager's per-session send-chain SERIALIZES the
+    // retry into a SECOND full model run → a duplicate Telegram message. Here the
+    // first such request is the leader (runs once); a duplicate within the dedup
+    // window is a follower that replays the leader's result. FAIL-OPEN: any error,
+    // an empty/failed leader, or a leader that exceeds the turn timeout all fall
+    // THROUGH to a normal dispatch — this can never drop a real reply.
+    const dedupWindowMs = getDedupWindowMs();
+    let coalesceLeader;
+    if (isStreaming && dedupWindowMs > 0) {
+        try {
+            const sig = computeSignature(sessionName, sendInput);
+            const existing = findInFlight(sig, dedupWindowMs);
+            if (existing) {
+                const leaderResult = await awaitLeader(existing, resolveTurnTimeoutMs());
+                if (leaderResult && leaderResult.text.length > 0) {
+                    replayCoalesced(res, completionId, resolvedModel, leaderResult);
+                    emitTrajectory('response_complete', { engine, model: resolvedModel, latencyMs: Date.now() - _t0, ok: true, coalesced: true }, sessionName);
+                    return; // duplicate served from the leader — no second model run
+                }
+                // leader failed / produced no text / timed out → fail-open below
+            }
+            else {
+                coalesceLeader = registerLeader(sig);
+            }
+        }
+        catch {
+            coalesceLeader = undefined; // any coalescer fault → behave as before
+        }
+    }
     // Pillar B v0.4.1: bracket dispatch with try/finally so response_complete
     // fires for both success and failure (the latter relabelled). Latency is
     // measured from request_in's _t0 above.
     let _ok = true;
     try {
         if (isStreaming) {
-            await handleStreaming(manager, sessionName, resolvedModel, sendInput, completionId, res, hasTools, extracted.slashCommand);
+            await handleStreaming(manager, sessionName, resolvedModel, sendInput, completionId, res, hasTools, extracted.slashCommand, 
+            // v0.27.5: capture this leader's result so a coalesced follower can
+            // replay it. handleStreaming calls this only on a successful turn.
+            coalesceLeader ? (r) => coalesceLeader.resolve(r) : undefined);
         }
         else {
             await handleNonStreaming(manager, sessionName, resolvedModel, sendInput, completionId, res, hasTools, extracted.slashCommand);
@@ -422,6 +470,17 @@ export async function handleChatCompletion(manager, body, headers, res) {
         throw err;
     }
     finally {
+        // v0.27.5: ALWAYS settle the leader so followers never hang. After a
+        // successful capture this is a no-op (resolve is idempotent); on error or
+        // an empty turn it resolves null → followers fail-open to a fresh run.
+        if (coalesceLeader) {
+            try {
+                coalesceLeader.resolve(null);
+            }
+            catch {
+                /* already settled */
+            }
+        }
         let tokensIn;
         let tokensOut;
         try {

package/dist/src/openai-compat/request-coalescer.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Single-flight request coalescer for the openai-compat streaming path (v0.27.5).
+ *
+ * THE PROBLEM (2026-05-22 incident)
+ * ─────────────────────────────────
+ * When a turn is OOM-killed mid-stream (exit 137) — or simply runs long enough
+ * that OpenClaw's HTTP client perceives the SSE stream as dead — OpenClaw fires
+ * a RETRY with a byte-identical request body. session-manager.sendMessage()
+ * *serializes* concurrent same-session sends via a per-session promise chain
+ * (session-manager.ts:437-453) rather than coalescing them, so the retry runs
+ * the FULL turn a second time and delivers a second, identical Telegram message
+ * (the "two identical messages" the user reported).
+ *
+ * THE FIX
+ * ───────
+ * Classic single-flight (a.k.a. request coalescing): the FIRST request for a
+ * given signature becomes the "leader" and runs the model once; any duplicate
+ * arriving within DEDUP_WINDOW_MS becomes a "follower" that AWAITS the leader's
+ * result and replays it — no second subprocess, no divergent second generation.
+ * In the common retry-after-perceived-death case, OpenClaw has already abandoned
+ * the leader's connection, so only the follower delivers → exactly one message.
+ *
+ * SAFETY: FAIL-OPEN BY CONSTRUCTION
+ * ─────────────────────────────────
+ * The caller wraps every coalescer interaction in try/catch and, on ANY error
+ * (or a leader that produced empty text, or a leader that exceeds the turn
+ * timeout), falls THROUGH to a normal dispatch. The worst case this can produce
+ * is the prior behavior (a possible duplicate) — it can NEVER drop a real reply.
+ * That property is the whole point: the user's deepest pain is missing messages,
+ * so the duplicate defense must not be able to cause a miss.
+ */
+import type * as http from 'node:http';
+/** The leader's captured turn output, replayed verbatim to followers. */
+export interface CoalescedResult {
+    text: string;
+    finishReason: 'stop' | 'tool_calls';
+    usage?: {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    };
+}
+interface InFlightEntry {
+    startedAt: number;
+    /** Resolves when the leader's turn completes. `null` ⇒ leader failed or
+     *  produced no replayable text; followers must fail-open to a fresh run. */
+    resultPromise: Promise<CoalescedResult | null>;
+}
+/** Resolve the dedup window. CC_OPENCLAW_DEDUP_WINDOW_MS=0 disables coalescing
+ *  entirely (the caller then never enters the leader/follower branches). */
+export declare function getDedupWindowMs(): number;
+/** Stable signature for "the same turn". Session-scoped so two chats sending
+ *  identical text never collide. SHA-256 of sessionName + NUL + serialized
+ *  input keeps the key bounded regardless of prompt size. */
+export declare function computeSignature(sessionName: string, input: unknown): string;
+/** Return a live (within-window) in-flight entry for `sig`, or undefined.
+ *  Prunes a stale entry as a side effect so the map self-heals. */
+export declare function findInFlight(sig: string, windowMs: number): InFlightEntry | undefined;
+/** Register the current request as the leader for `sig`. Returns a `resolve`
+ *  the caller MUST invoke in a finally block with the captured result (or
+ *  `null` on failure) so followers never hang. The entry is retained for the
+ *  window after resolution, then evicted. */
+export declare function registerLeader(sig: string): {
+    resolve: (r: CoalescedResult | null) => void;
+};
+/** Await a leader's result with a hard cap so a wedged leader can't hang the
+ *  follower forever. On timeout returns `null` ⇒ caller fails open. */
+export declare function awaitLeader(entry: InFlightEntry, timeoutMs: number): Promise<CoalescedResult | null>;
+/** Replay a leader's captured result to a follower's response as a complete,
+ *  well-formed SSE stream (role chunk → content chunk → final chunk → [DONE]).
+ *  Mirrors the shape handleStreaming emits so OpenClaw sees an ordinary, valid
+ *  completion. Best-effort writes: a disconnected follower socket is harmless. */
+export declare function replayCoalesced(res: http.ServerResponse, completionId: string, model: string, result: CoalescedResult): void;
+/** Test-only helpers. */
+export declare function _resetForTest(): void;
+export declare function _size(): number;
+export {};

package/dist/src/openai-compat/request-coalescer.js

@@ -0,0 +1,157 @@
+/**
+ * Single-flight request coalescer for the openai-compat streaming path (v0.27.5).
+ *
+ * THE PROBLEM (2026-05-22 incident)
+ * ─────────────────────────────────
+ * When a turn is OOM-killed mid-stream (exit 137) — or simply runs long enough
+ * that OpenClaw's HTTP client perceives the SSE stream as dead — OpenClaw fires
+ * a RETRY with a byte-identical request body. session-manager.sendMessage()
+ * *serializes* concurrent same-session sends via a per-session promise chain
+ * (session-manager.ts:437-453) rather than coalescing them, so the retry runs
+ * the FULL turn a second time and delivers a second, identical Telegram message
+ * (the "two identical messages" the user reported).
+ *
+ * THE FIX
+ * ───────
+ * Classic single-flight (a.k.a. request coalescing): the FIRST request for a
+ * given signature becomes the "leader" and runs the model once; any duplicate
+ * arriving within DEDUP_WINDOW_MS becomes a "follower" that AWAITS the leader's
+ * result and replays it — no second subprocess, no divergent second generation.
+ * In the common retry-after-perceived-death case, OpenClaw has already abandoned
+ * the leader's connection, so only the follower delivers → exactly one message.
+ *
+ * SAFETY: FAIL-OPEN BY CONSTRUCTION
+ * ─────────────────────────────────
+ * The caller wraps every coalescer interaction in try/catch and, on ANY error
+ * (or a leader that produced empty text, or a leader that exceeds the turn
+ * timeout), falls THROUGH to a normal dispatch. The worst case this can produce
+ * is the prior behavior (a possible duplicate) — it can NEVER drop a real reply.
+ * That property is the whole point: the user's deepest pain is missing messages,
+ * so the duplicate defense must not be able to cause a miss.
+ */
+import { createHash } from 'node:crypto';
+import { DEDUP_WINDOW_MS } from '../constants.js';
+import { formatCompletionChunk } from './response-formatter.js';
+/** Module-scoped registry. Keyed by signature. Entries linger for the window
+ *  after completion so a late retry (arriving just after the leader finished)
+ *  still coalesces against the already-resolved result. */
+const inFlight = new Map();
+/** Resolve the dedup window. CC_OPENCLAW_DEDUP_WINDOW_MS=0 disables coalescing
+ *  entirely (the caller then never enters the leader/follower branches). */
+export function getDedupWindowMs() {
+    const raw = process.env.CC_OPENCLAW_DEDUP_WINDOW_MS;
+    const n = raw !== undefined ? parseInt(raw, 10) : NaN;
+    if (Number.isFinite(n) && n >= 0)
+        return n;
+    return DEDUP_WINDOW_MS;
+}
+/** Stable signature for "the same turn". Session-scoped so two chats sending
+ *  identical text never collide. SHA-256 of sessionName + NUL + serialized
+ *  input keeps the key bounded regardless of prompt size. */
+export function computeSignature(sessionName, input) {
+    const raw = typeof input === 'string' ? input : JSON.stringify(input);
+    return createHash('sha256').update(sessionName).update('\0').update(raw).digest('hex');
+}
+/** Return a live (within-window) in-flight entry for `sig`, or undefined.
+ *  Prunes a stale entry as a side effect so the map self-heals. */
+export function findInFlight(sig, windowMs) {
+    const entry = inFlight.get(sig);
+    if (!entry)
+        return undefined;
+    // >= (not >): a window of 0 means "no coalescing window" → every entry is
+    // already stale and must be pruned (matches CC_OPENCLAW_DEDUP_WINDOW_MS=0
+    // disabling coalescing). With `>`, a same-millisecond lookup (elapsed 0)
+    // wrongly treated a 0-window entry as live. Real windows are unaffected
+    // (elapsed 0 >= 45000 is still false → live).
+    if (Date.now() - entry.startedAt >= windowMs) {
+        inFlight.delete(sig);
+        return undefined;
+    }
+    return entry;
+}
+/** Register the current request as the leader for `sig`. Returns a `resolve`
+ *  the caller MUST invoke in a finally block with the captured result (or
+ *  `null` on failure) so followers never hang. The entry is retained for the
+ *  window after resolution, then evicted. */
+export function registerLeader(sig) {
+    let resolveFn;
+    const resultPromise = new Promise((res) => {
+        resolveFn = res;
+    });
+    const entry = { startedAt: Date.now(), resultPromise };
+    inFlight.set(sig, entry);
+    // Idempotent: the caller resolves from BOTH the success-path capture callback
+    // and a finally-block backstop (which passes null). Only the first wins; the
+    // backstop is a no-op after a successful capture.
+    let settled = false;
+    return {
+        resolve: (r) => {
+            if (settled)
+                return;
+            settled = true;
+            resolveFn(r);
+            const t = setTimeout(() => {
+                if (inFlight.get(sig) === entry)
+                    inFlight.delete(sig);
+            }, getDedupWindowMs());
+            // Don't let the eviction timer keep the process alive.
+            t.unref?.();
+        },
+    };
+}
+/** Await a leader's result with a hard cap so a wedged leader can't hang the
+ *  follower forever. On timeout returns `null` ⇒ caller fails open. */
+export async function awaitLeader(entry, timeoutMs) {
+    let timer;
+    const timeout = new Promise((res) => {
+        timer = setTimeout(() => res(null), timeoutMs);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([entry.resultPromise, timeout]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+/** Replay a leader's captured result to a follower's response as a complete,
+ *  well-formed SSE stream (role chunk → content chunk → final chunk → [DONE]).
+ *  Mirrors the shape handleStreaming emits so OpenClaw sees an ordinary, valid
+ *  completion. Best-effort writes: a disconnected follower socket is harmless. */
+export function replayCoalesced(res, completionId, model, result) {
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        Connection: 'keep-alive',
+        'X-Accel-Buffering': 'no',
+    });
+    const write = (data) => {
+        try {
+            res.write(`data: ${data}\n\n`);
+        }
+        catch {
+            /* follower disconnected — nothing to deliver, safe to ignore */
+        }
+    };
+    write(JSON.stringify(formatCompletionChunk(completionId, model, { role: 'assistant' }, null)));
+    write(JSON.stringify(formatCompletionChunk(completionId, model, { content: result.text }, null)));
+    const finalChunk = formatCompletionChunk(completionId, model, {}, result.finishReason);
+    if (result.usage)
+        finalChunk.usage = result.usage;
+    write(JSON.stringify(finalChunk));
+    write('[DONE]');
+    try {
+        res.end();
+    }
+    catch {
+        /* already closed */
+    }
+}
+/** Test-only helpers. */
+export function _resetForTest() {
+    inFlight.clear();
+}
+export function _size() {
+    return inFlight.size;
+}

package/dist/src/openai-compat/streaming-handler.d.ts

@@ -41,4 +41,12 @@ import type { UserMessageBlock } from './message-extractor.js';
 export declare function handleStreaming(manager: SessionManagerLike, sessionName: string, model: string, userMessage: string | UserMessageBlock[], completionId: string, res: http.ServerResponse, hasTools: boolean, slashCommand?: {
     cmd: string;
     mode?: string;
-}): Promise<void>;
+}, onFinalText?: (result: {
+    text: string;
+    finishReason: 'stop' | 'tool_calls';
+    usage?: {
+        prompt_tokens: number;
+        completion_tokens: number;
+        total_tokens: number;
+    };
+}) => void): Promise<void>;

package/dist/src/openai-compat/streaming-handler.js

@@ -43,7 +43,7 @@ import { emit as emitTrajectory, emitTurnTrace } from '../lib/trajectory.js';
 import { formatError, ERROR_CODES } from '../lib/error-formatter.js';
 import { getSurfaceThinkingEnabled, getTtsAutoMode } from '../lib/config.js';
 import { applyVoiceRecovery, detectVoiceIntent, hasTtsMarkers, _logVoiceDebug } from './voice-recovery.js';
-import { pushToolUse as mirrorPushToolUse, pushToolResult as mirrorPushToolResult, pushAssistantText as mirrorPushAssistantText, finalizeActiveCards as mirrorFinalizeActiveCards, failActiveCards as mirrorFailActiveCards, classifyFailure, setCardMeta as mirrorSetCardMeta, readQuotaMeta as mirrorReadQuotaMeta, } from '../channels/telegram-mirror/turn-bridge.js';
+import { pushToolUse as mirrorPushToolUse, pushToolResult as mirrorPushToolResult, pushAssistantText as mirrorPushAssistantText, pushThinking as mirrorPushThinking, finalizeActiveCards as mirrorFinalizeActiveCards, failActiveCards as mirrorFailActiveCards, classifyFailure, setCardMeta as mirrorSetCardMeta, readQuotaMeta as mirrorReadQuotaMeta, } from '../channels/telegram-mirror/turn-bridge.js';
 import { cardStateDebug as mirrorCardStateDebug } from '../channels/telegram-mirror/card-state.js';
 import { writePerfEvent } from '../observability/perf-telemetry.js';
 /** Coerce a userMessage (string | UserMessageBlock[]) to a flat string
@@ -69,7 +69,12 @@ userMessage, completionId, res, hasTools,
 // v0.19.1 M3: slash command captured by extractUserMessage, threaded to
 // the patched sendMessage so the live-card pill renders the original
 // /<slash> even when maybeInlineSkill replaced the message body.
-slashCommand) {
+slashCommand, 
+// v0.27.5: leader-result capture for the single-flight request coalescer.
+// Invoked exactly once on a SUCCESSFUL turn (never on the error path) with
+// the final assistant text + finish reason + usage, so a coalesced follower
+// can replay this turn's output instead of running the model a second time.
+onFinalText) {
     // v0.26.1 observability: confirm the wired handler runs AND how many mirror
     // cards THIS module instance sees. If cards=0 here while the inbound handler
     // logged a registered card, the cardState singleton split across instances
@@ -125,7 +130,14 @@ slashCommand) {
     };
     // Initial chunk with role
     writeSSE(JSON.stringify(formatCompletionChunk(completionId, model, { role: 'assistant' }, null)));
-    // SSE keepalive heartbeat
+    // SSE keepalive heartbeat. v0.27.5: 30s → 15s. A long quiet phase (Claude
+    // CLI thinking, a slow Bash/tool step) with no SSE write can make OpenClaw's
+    // HTTP client perceive the stream as dead and fire a RETRY — which the
+    // session-manager send-chain serializes into a SECOND full turn → duplicate
+    // Telegram message (2026-05-22 incident). A tighter heartbeat keeps the
+    // connection demonstrably alive between content events, cutting spurious
+    // retries at the source. (The request-coalescer is the second line of
+    // defense for the retries that still slip through.)
     const heartbeatTimer = setInterval(() => {
         if (!clientDisconnected) {
             try {
@@ -135,7 +147,7 @@ slashCommand) {
                 clientDisconnected = true;
             }
         }
-    }, 30_000);
+    }, 15_000);
     // Phase 2 R1+R2: in tool-stream mode, bridge session-manager's pre-parsed
     // tool_use events directly to OpenAI tool_calls SSE deltas. Skips the
     // legacy "buffer text + regex-parse <tool_calls> XML" path entirely.
@@ -327,6 +339,12 @@ slashCommand) {
                     if (!text)
                         return;
                     thinkingBuffer += text;
+                    // v0.27.4 M1 — surface thinking on the live Telegram card too (gap
+                    // #1). Pass the cumulative buffer; pushThinking overwrites
+                    // turn.thinkingText so the 💭 block grows in place. Same surfacing
+                    // gate as the SSE reasoning emit below (this callback only exists
+                    // when surfaceThinking is on).
+                    mirrorPushThinking(thinkingBuffer);
                     const chunk = {
                         id: completionId,
                         object: 'chat.completion.chunk',
@@ -528,6 +546,18 @@ slashCommand) {
             tool_calls: toolCallsEmitted,
             bytes_out: accumulatedText.length,
         });
+        // v0.27.5: hand the captured turn output to the coalescer (success only).
+        // A coalesced follower replays exactly this — so the model runs once even
+        // when OpenClaw retries. Guarded: a capture-callback throw must never break
+        // the SSE response that just succeeded.
+        if (onFinalText) {
+            try {
+                onFinalText({ text: accumulatedText, finishReason: traceFinishReason, usage });
+            }
+            catch {
+                /* capture is best-effort; the real reply already streamed */
+            }
+        }
         writeSSE('[DONE]');
     }
     catch (err) {
@@ -597,7 +627,12 @@ slashCommand) {
         // turn. reply_dispatch (gateway) fires too early to own this; the handler
         // does. Best-effort: a finalize failure must not break the SSE response.
         try {
-            await mirrorFinalizeActiveCards();
+            // v0.27.6 — report-drop fix (Killer #2): when the gateway socket died
+            // mid-turn (clientDisconnected), the gateway delivers nothing separately,
+            // so pass the accumulated text and the finalized card KEEPS it as the
+            // sole delivery channel. Happy path (connected) passes undefined → card
+            // wiped → gateway delivers the reply (no duplicate).
+            await mirrorFinalizeActiveCards(clientDisconnected ? accumulatedText : undefined);
         }
         catch {
             /* finalize is cosmetic; never propagate */

package/dist/src/session/persisted-sessions.d.ts

@@ -21,6 +21,17 @@ export interface PersistedSession {
     lastResumed: string;
     lastActivity: number;
 }
+/**
+ * v0.27.4 (M4/M6) — resume-freshness gate. A persisted Claude session is
+ * eligible for --resume only if its last activity is within `freshnessMs`.
+ * This restores cross-restart / post-watchdog-kill conversation continuity for
+ * openai-compat sessions WITHOUT reintroducing the stale-resume hazard that
+ * motivated skipPersistence: a session idle longer than the window starts
+ * fresh. Returns false for a missing entry, a non-numeric lastActivity, or a
+ * non-positive/non-finite window (resume disabled). Pure + side-effect-free so
+ * the decision is unit-testable independent of the disk layer.
+ */
+export declare function isPersistedSessionFresh(persisted: Pick<PersistedSession, 'lastActivity'> | undefined, now: number, freshnessMs: number): boolean;
 export declare function loadPersistedSessions(): Map<string, PersistedSession>;
 export declare function savePersistedSessions(sessions: Map<string, PersistedSession>, logger?: Logger): void;
 export declare function savePersistedSessionsAsync(sessions: Map<string, PersistedSession>, logger?: Logger): void;

package/dist/src/session/persisted-sessions.js

@@ -14,6 +14,23 @@ import { createConsoleLogger } from '../logger.js';
 import { PERSIST_DISK_TTL_MS } from '../constants.js';
 export const PERSIST_DIR = path.join(os.homedir(), '.openclaw');
 export const PERSIST_FILE = path.join(PERSIST_DIR, 'claude-sessions.json');
+/**
+ * v0.27.4 (M4/M6) — resume-freshness gate. A persisted Claude session is
+ * eligible for --resume only if its last activity is within `freshnessMs`.
+ * This restores cross-restart / post-watchdog-kill conversation continuity for
+ * openai-compat sessions WITHOUT reintroducing the stale-resume hazard that
+ * motivated skipPersistence: a session idle longer than the window starts
+ * fresh. Returns false for a missing entry, a non-numeric lastActivity, or a
+ * non-positive/non-finite window (resume disabled). Pure + side-effect-free so
+ * the decision is unit-testable independent of the disk layer.
+ */
+export function isPersistedSessionFresh(persisted, now, freshnessMs) {
+    if (!persisted || typeof persisted.lastActivity !== 'number')
+        return false;
+    if (!Number.isFinite(freshnessMs) || freshnessMs <= 0)
+        return false;
+    return now - persisted.lastActivity <= freshnessMs;
+}
 export function loadPersistedSessions() {
     try {
         if (!fs.existsSync(PERSIST_FILE))

package/dist/src/session/session-manager.js

@@ -33,7 +33,7 @@ function getPluginVersion() {
 // ─── Persistence ─────────────────────────────────────────────────────────────
 // Extracted to `./persisted-sessions.ts` 2026-05-13 — coherent persistence
 // layer (load + sync atomic-write + async-write + types + constants).
-import { loadPersistedSessions, savePersistedSessions, savePersistedSessionsAsync, } from './persisted-sessions.js';
+import { loadPersistedSessions, savePersistedSessions, savePersistedSessionsAsync, isPersistedSessionFresh, } from './persisted-sessions.js';
 // Debounce helper — coalesces rapid writes into one
 // `makeDebounced` extracted to `../lib/debounce.ts` 2026-05-13 —
 // pure-function hot-path decomposition.
@@ -158,10 +158,21 @@ export class SessionManager {
         }
         this._recordSpawn();
         // Auto-resume: if we have a persisted claudeSessionId for this name, inject it.
-        // Skip when config.skipPersistence is set (e.g. openai-compat bridge sessions
-        // that must NOT resume stale CLI state from a previous server run).
+        // Normal (non-skipPersistence) sessions resume unconditionally as before.
+        // skipPersistence sessions normally must NOT resume stale CLI state from a
+        // previous server run — EXCEPT v0.27.4 (M4/M6): when they opt into
+        // freshness-windowed resume (config.resumeFreshnessMs, set by the
+        // openai-compat bridge), resume the prior session iff it's still fresh, so
+        // Savvy keeps context across a gateway restart / watchdog-kill while a
+        // long-idle session still starts fresh.
         const skipPersist = !!config.skipPersistence;
-        const persisted = skipPersist ? undefined : this.persistedSessions.get(name);
+        let persisted = skipPersist ? undefined : this.persistedSessions.get(name);
+        if (skipPersist && typeof config.resumeFreshnessMs === 'number') {
+            const candidate = this.persistedSessions.get(name);
+            if (isPersistedSessionFresh(candidate, Date.now(), config.resumeFreshnessMs)) {
+                persisted = candidate;
+            }
+        }
         // Unified: only use resumeSessionId (claudeResumeId is an internal alias, not exposed)
         const resumeId = config.resumeSessionId ?? persisted?.claudeSessionId;
         const fullConfig = {
@@ -349,10 +360,15 @@ export class SessionManager {
             }
             const result = await managed.session.send(message, sendOpts);
             // Update session ID if available (skip disk persist for ephemeral
-            // sessions that were started with skipPersistence)
+            // sessions that were started with skipPersistence) — EXCEPT v0.27.4
+            // (M4/M6): a session that opted into freshness-windowed resume must be
+            // persisted (even though skipPersistence is true) so its claudeSessionId
+            // is on disk for the next turn / a post-restart resume.
             if (managed.session.sessionId) {
                 managed.claudeSessionId = managed.session.sessionId;
-                if (this.persistedSessions.has(name)) {
+                const optedIntoFreshResume = typeof managed.config.resumeFreshnessMs === 'number' &&
+                    managed.config.resumeFreshnessMs > 0;
+                if (this.persistedSessions.has(name) || optedIntoFreshResume) {
                     this._persistSession(name, managed);
                 }
             }

package/dist/src/session/watchdogs.d.ts

@@ -27,6 +27,9 @@ export interface WatchdogManagedSession {
         getStats(): {
             lastActivity?: string | null | undefined;
             lastProgressAt?: string | null | undefined;
+            /** v0.27.6 — count of in-flight tool calls; > 0 means a tool is running
+             *  (alive), so the stalled check is skipped no matter how quiet it is. */
+            inFlightTools?: number | undefined;
         };
         stop(): void;
     };

package/dist/src/session/watchdogs.js

@@ -46,6 +46,12 @@ export function watchStalledSessions(opts) {
         if (!managed.session.isBusy)
             continue;
         const stats = managed.session.getStats();
+        // v0.27.6 (Killer #1) — a session with a tool in flight is ALIVE, not
+        // stalled, no matter how long the tool runs quiet (a 40-min build/test emits
+        // no stream events while it works). Skip it entirely; the age/threshold
+        // check below only governs a genuine silent wedge with NO tool running.
+        if ((stats.inFlightTools ?? 0) > 0)
+            continue;
         // v0.27.x — prefer the PROGRESS timestamp (real output: text/tool/result),
         // which excludes `system/api_retry` pings. Keying off lastActivity let a
         // retry-storm reset the clock forever so the watchdog never fired. Fall back

package/dist/src/session-bootstrap/cwd-patch.js

@@ -84,8 +84,6 @@ const PATHS = {
 const DEPS_STUB_PATH = join(PATHS.openclawDist, 'commands-status-deps.runtime.js');
 const STATUS_STUB_PATH = join(PATHS.openclawRoot, 'status.runtime.js');
 const AUTO_REPLY_STATUS_PATH = join(PATHS.autoReplyDir, 'commands-status.runtime.js');
-const SAVVY_REGISTRY_PATH = join(HOME, '.openclaw/savvy-resume-registry.json');
-const CLAUDE_SESSIONS_PATH = join(HOME, '.openclaw/claude-sessions.json');
 const CACHE_PARITY_REGISTRY_PATH = join(HOME, '.openclaw/openclaw-cache-parity-registry.json');
 // Patch identity symbols (module-scoped, stable across re-imports within a process)
 const PATCH_MARKER = Symbol.for('claude-local-enhancer:patched');
@@ -166,6 +164,7 @@ function _setToolDumpCacheEntry(key, val) {
 let _lastToolDumpHash = null;
 // ── sessionId capture state ───────────────────────────────────────────────
 let _lastCapturedJson = '';
+// ── Resume registry helpers ───────────────────────────────────────────────
 // `restoreClaudeSessionsFromBackup` + `writeBackupRegistry` extracted to
 // `./resume-registry.ts` 2026-05-13. The wrapper preserves the caller-less
 // call signature locally by closing over the module `logger`.

package/dist/src/types.d.ts

@@ -137,6 +137,13 @@ export interface SessionConfig {
     sessionName?: string;
     claudeResumeId?: string;
     resumeSessionId?: string;
+    /** v0.27.4 (M4/M6) — opt a skipPersistence session into freshness-windowed
+     *  --resume across restart / watchdog-kill. When set (ms), the SessionManager
+     *  persists this session's claudeSessionId and, on the next start for the same
+     *  name, resumes it iff its last activity is within this window. Used by the
+     *  openai-compat bridge so Savvy keeps context across a gateway restart while
+     *  still starting fresh after a long idle gap. */
+    resumeFreshnessMs?: number;
     forkSession?: boolean;
     addDir?: string[];
     effort?: EffortLevel;
@@ -190,6 +197,10 @@ export interface SessionStats {
      *  events like `system/api_retry`. The stalled-session watchdog keys off this
      *  so an API retry-storm (no output) is fast-failed instead of looking busy. */
     lastProgressAt: string | null;
+    /** v0.27.6 — tool calls currently in flight (dispatched without a matching
+     *  result yet). Optional: only the Claude persistent-session engine populates
+     *  it; the stalled-session watchdog treats > 0 as "alive, don't kill". */
+    inFlightTools?: number;
     /**
      * Approximate context window utilization (0-100).
      * Estimated as (tokensIn + tokensOut) / 200,000 * 100.