@agentmessier/openclaw-agent-messier 0.3.4 → 0.3.6

package/index.ts

@@ -25,6 +25,14 @@ export default function register(api: OpenClawPluginApi) {
     api.registerTool(tool as AnyAgentTool);
   }
 
+  // Capture the EFFECTIVE model of each decision from the gateway's llm_output
+  // hook (the provider/model of the call that just ran). vfetch sends it as
+  // x-agent-model, so the pitch records the model actually PLAYING — reflecting
+  // a mid-match /model switch, not a static configured default.
+  api.registerHook("llm_output", ((event: { provider?: string; model?: string }) => {
+    if (event?.model) session.lastModel = event.provider ? `${event.provider}/${event.model}` : event.model;
+  }) as Parameters<typeof api.registerHook>[1]);
+
   // 2. Autoplay watcher. It drives ONE realtime venue (streams observations,
   //    seats the agent, offers hands-free play) entirely from {venue, spec} —
   //    seating via spec.client.join, observe/act endpoints via spec.routes, the

package/openclaw.plugin.json

@@ -1,5 +1,5 @@
 {
-  "id": "agent-messier",
+  "id": "openclaw-agent-messier",
   "kind": "tool",
   "uiHints": {
     "serverUrl": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentmessier/openclaw-agent-messier",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "description": "Agent Messier multi-venue client for OpenClaw \u2014 play games and work tasks on the AgentNet platform (soccer today; venues discovered from the marketplace registry)",
   "type": "module",
   "license": "MIT",

package/src/generate.test.ts

@@ -146,6 +146,18 @@ describe("join-by-id and leave (the lifecycle gap closed in VA-6)", () => {
     expect(out.joined).toBe("r9");
   });
 
+  it("attaches x-agent-model (effective model) to venue requests once observed", async () => {
+    session.lastModel = "anthropic/claude-sonnet-4-6";
+    let hdrs: any = null;
+    vi.stubGlobal("fetch", vi.fn(async (_u: any, init?: any) => {
+      hdrs = init?.headers;
+      return { ok: true, json: async () => ({ matchId: "r1", token: "t", playerIds: [] }) } as any;
+    }));
+    await exec("golf_join", { holes: 9 });
+    expect(hdrs["x-agent-model"]).toBe("anthropic/claude-sonnet-4-6");
+    session.lastModel = null; // no model observed → header is simply omitted
+  });
+
   it("omitting matchId quickmatches (find-or-create) via the join route", async () => {
     let url = "";
     vi.stubGlobal("fetch", vi.fn(async (u: any) => {

package/src/generate.ts

@@ -36,6 +36,7 @@ function did(venueId: string, cfg: PluginCfg): string {
  *  what it needs: Bearer→DID for games, x-caller-did for work, seat token for acts). */
 async function vfetch(base: string, path: string, opts: { method?: string; body?: unknown; cfg: PluginCfg; token?: string; did: string }): Promise<{ ok: boolean; status: number; data: any }> {
   const headers: Record<string, string> = { "x-caller-did": opts.did, "x-agent-runtime": "openclaw-plugin/0.2.0" };
+  if (session.lastModel) headers["x-agent-model"] = session.lastModel; // effective LLM for the pitch roster
   const key = apiKeyOf(opts.cfg); if (key) headers["Authorization"] = `Bearer ${key}`;
   if (opts.token) headers["x-agent-token"] = opts.token;
   if (opts.body !== undefined) headers["Content-Type"] = "application/json";

package/src/state.ts

@@ -19,8 +19,12 @@ export const session: {
   did: string | null
   turn: number
   lockstep: boolean
+  /** Effective LLM (provider/model) of the most recent decision, captured from
+   *  the gateway's llm_output hook — sent as x-agent-model so the pitch records
+   *  the model that's actually playing (reflects a mid-match /model switch). */
+  lastModel: string | null
   /** Installed by the service: seat into a venue room (matchId omitted = quickmatch
    *  find-or-create) and start the observe/act loop. `params` are venue join params
    *  (e.g. teamSize/team for soccer). Returns the seat the loop is now driving. */
   joinAndWatch: ((matchId?: string, params?: Record<string, unknown>) => Promise<{ id?: string; controls?: string[]; started?: boolean }>) | null
-} = { matchId: null, players: [], token: null, did: null, turn: 0, lockstep: false, joinAndWatch: null }
+} = { matchId: null, players: [], token: null, did: null, turn: 0, lockstep: false, lastModel: null, joinAndWatch: null }

package/src/tools.test.ts

@@ -16,10 +16,12 @@ describe("soccer extension join auth", () => {
   });
   afterEach(() => vi.unstubAllGlobals());
 
-  it("apiKeyOf prefers config, falls back to AGENTNET_API_KEY", () => {
+  it("apiKeyOf comes from config only — never from the environment", () => {
     expect(apiKeyOf(cfg({ apiKey: "from-cfg" }))).toBe("from-cfg");
+    // a stray env var must NOT be picked up (config-only; avoids the env+network
+    // 'credential harvesting' scanner flag and keeps config the single channel).
     vi.stubEnv("AGENTNET_API_KEY", "from-env");
-    expect(apiKeyOf(cfg())).toBe("from-env");
+    expect(apiKeyOf(cfg())).toBeUndefined();
     vi.unstubAllEnvs();
   });
 

package/src/tools.ts

@@ -123,7 +123,11 @@ function idKey(cfg: PluginCfg): string {
 
 /** AgentNet API key for join-time verification (config, then env fallback). */
 export function apiKeyOf(cfg: PluginCfg): string | undefined {
-  return cfg.apiKey ?? process.env.AGENTNET_API_KEY ?? undefined;
+  // Config-only — the key comes from the plugin config (openclaw config set
+  // plugins.entries.<id>.config.apiKey). We deliberately do NOT read it from the
+  // OS environment: an env read + network send in one module trips OpenClaw's
+  // "credential harvesting" scanner, and config is the portable channel anyway.
+  return cfg.apiKey ?? undefined;
 }
 
 /** The agentId the server seats us under. Once the server has verified us and
@@ -305,9 +309,13 @@ export const err = (msg: string) => ({ content: [{ type: "text" as const, text:
 // ── venue-URL resolution (origin → base URL); kept — generate.ts imports it. ──
 const VENUE_DEFAULTS: Record<string, string> = { taskmarket: "http://localhost:3030" };
 export function venueUrl(origin: string, cfg: PluginCfg): string {
+  // A registry origin is normally a full URL (used as-is) or "pitch" (the
+  // configured serverUrl). Short names fall back to a baked default. No OS
+  // environment read here — keeps this network module config-only, so
+  // OpenClaw's env+network scanner stays quiet.
   if (origin.startsWith("http://") || origin.startsWith("https://")) return origin;
   if (origin === "pitch") return (cfg.serverUrl ?? "http://localhost:3010").replace(/\/$/, "");
-  return process.env[`AGENTNET_${origin.toUpperCase()}_URL`] ?? VENUE_DEFAULTS[origin] ?? (cfg.serverUrl ?? "http://localhost:3010");
+  return VENUE_DEFAULTS[origin] ?? (cfg.serverUrl ?? "http://localhost:3010");
 }
 
 // ── Member / account tools — soccer cosmetic + ownership, NOT lifecycle, so