@alfe.ai/openclaw-chat 0.2.5 → 0.3.1

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { a as AlfeChannelConfig, i as createAlfeChannelPlugin, n as plugin, o as AlfePluginConfig, s as AlfeResolvedAccount } from "./plugin.cjs";
+import { a as plugin, c as AlfeChannelConfig, l as AlfePluginConfig, s as createAlfeChannelPlugin, u as AlfeResolvedAccount } from "./plugin.cjs";
 
 //#region src/session-store.d.ts
 

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { a as AlfeChannelConfig, i as createAlfeChannelPlugin, n as plugin, o as AlfePluginConfig, s as AlfeResolvedAccount } from "./plugin.js";
+import { a as plugin, c as AlfeChannelConfig, l as AlfePluginConfig, s as createAlfeChannelPlugin, u as AlfeResolvedAccount } from "./plugin.js";
 
 //#region src/session-store.d.ts
 

package/dist/index.js

@@ -1,2 +1,2 @@
-import { i as createAlfeChannelPlugin, n as plugin } from "./plugin2.js";
+import { i as plugin, o as createAlfeChannelPlugin } from "./plugin2.js";
 export { createAlfeChannelPlugin, plugin as default };

package/dist/plugin.cjs

@@ -3,6 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_plugin = require("./plugin2.cjs");
+exports.admitAgentEvent = require_plugin.admitAgentEvent;
 exports.buildA2ACompletePayload = require_plugin.buildA2ACompletePayload;
+exports.buildToolActivity = require_plugin.buildToolActivity;
 exports.default = require_plugin.plugin;
 exports.stripLeakedToolSummary = require_plugin.stripLeakedToolSummary;

package/dist/plugin.d.cts

@@ -268,12 +268,80 @@ interface AgentEventPayload {
   data: Record<string, unknown>;
   sessionKey?: string;
 }
+interface RunEventGate {
+  runId: string | null;
+  sessionKey: string | null;
+}
+/**
+ * Decide whether an agent-event belongs to THIS turn's run and should be
+ * forwarded as a delta / activity frame.
+ *
+ * Why gate on `runId`, not `sessionKey`:
+ * On OpenClaw 2026.x the daemon registers this ('alfe') channel's main run
+ * with `isControlUiVisible: false` — only the built-in "webchat" surface is
+ * treated as control-UI-visible (`isInternalMessageChannel`). The shared
+ * agent-event bus then NULLS `sessionKey` on every event of a
+ * non-control-UI run (`agent-events`: `sessionKey = isControlUiVisible ? … :
+ * undefined`). So main-run assistant/thinking/tool events arrive with
+ * `sessionKey: undefined`, and the old `!evt.sessionKey` + key-equality gate
+ * silently dropped ALL activity — replies still landed because they come via
+ * the `deliver()` callback, not the event bus (the reported "replies arrive,
+ * zero activity" symptom). Verified against openclaw@2026.6.10 and
+ * back-compatible with 2026.4.2 (identical emit semantics). `runId` is always
+ * present on every emitted event.
+ *
+ * Isolation is preserved: turns to a daemon are serialised
+ * (`enqueueAgentTurn`) and the listener is torn down before the next turn
+ * dispatches, so the first relevant event locks onto THIS turn's main run.
+ * Concurrent heartbeat/cron runs and subagent / side-question runs carry a
+ * different `runId` and are excluded — exactly the leakage the gate exists to
+ * prevent. When a run IS control-UI-visible and both keys are present, a
+ * mismatched `sessionKey` is still rejected as a secondary defence.
+ *
+ * Exported for unit tests — this gate is the fix's load-bearing logic and is
+ * pinned against real 2026.6.10 event shapes.
+ */
+declare function admitAgentEvent(gate: RunEventGate, evt: Pick<AgentEventPayload, 'runId' | 'stream' | 'sessionKey'>): boolean;
 interface PluginServiceContext {
   config: Record<string, unknown>;
   workspaceDir?: string;
   stateDir: string;
   logger: PluginLogger;
 }
+type ChatActivity = {
+  kind: 'thinking';
+  text: string;
+  delta?: boolean;
+  ts?: number;
+  seq?: number;
+} | {
+  kind: 'tool';
+  toolCallId: string;
+  name: string;
+  phase?: string;
+  status: 'running' | 'done' | 'failed';
+  summary?: string;
+  argsText?: string;
+  progressText?: string;
+  resultText?: string;
+  isError?: boolean;
+  durationMs?: number;
+  truncated?: {
+    args?: boolean;
+    progress?: boolean;
+    result?: boolean;
+  };
+  ts?: number;
+  seq?: number;
+};
+/**
+ * Extract structured tool status from an OpenClaw `tool`-stream event.
+ * We send the emoji-free raw `name` plus a lifecycle `status` and let the
+ * web render the `🛠️ <Label>: <summary> ✓/✗` row — never OpenClaw's raw
+ * `(+N steps)` string. `summary` carries OpenClaw's short detail when the
+ * event already provides one (title/summary/label/description), trimmed.
+ */
+declare function buildToolActivity(data: Record<string, unknown>): ChatActivity | null;
 declare function stripLeakedToolSummary(text: string): string;
 /**
  * Build the `a2a-complete` notify payload. ALWAYS fired for an A2A turn —
@@ -328,4 +396,4 @@ declare const plugin: {
   deactivate(api: PluginApi): Promise<void>;
 };
 //#endregion
-export { AlfeChannelConfig as a, createAlfeChannelPlugin as i, plugin as n, AlfePluginConfig as o, stripLeakedToolSummary as r, AlfeResolvedAccount as s, buildA2ACompletePayload as t };
+export { plugin as a, AlfeChannelConfig as c, buildToolActivity as i, AlfePluginConfig as l, admitAgentEvent as n, stripLeakedToolSummary as o, buildA2ACompletePayload as r, createAlfeChannelPlugin as s, RunEventGate as t, AlfeResolvedAccount as u };

package/dist/plugin.d.ts

@@ -268,12 +268,80 @@ interface AgentEventPayload {
   data: Record<string, unknown>;
   sessionKey?: string;
 }
+interface RunEventGate {
+  runId: string | null;
+  sessionKey: string | null;
+}
+/**
+ * Decide whether an agent-event belongs to THIS turn's run and should be
+ * forwarded as a delta / activity frame.
+ *
+ * Why gate on `runId`, not `sessionKey`:
+ * On OpenClaw 2026.x the daemon registers this ('alfe') channel's main run
+ * with `isControlUiVisible: false` — only the built-in "webchat" surface is
+ * treated as control-UI-visible (`isInternalMessageChannel`). The shared
+ * agent-event bus then NULLS `sessionKey` on every event of a
+ * non-control-UI run (`agent-events`: `sessionKey = isControlUiVisible ? … :
+ * undefined`). So main-run assistant/thinking/tool events arrive with
+ * `sessionKey: undefined`, and the old `!evt.sessionKey` + key-equality gate
+ * silently dropped ALL activity — replies still landed because they come via
+ * the `deliver()` callback, not the event bus (the reported "replies arrive,
+ * zero activity" symptom). Verified against openclaw@2026.6.10 and
+ * back-compatible with 2026.4.2 (identical emit semantics). `runId` is always
+ * present on every emitted event.
+ *
+ * Isolation is preserved: turns to a daemon are serialised
+ * (`enqueueAgentTurn`) and the listener is torn down before the next turn
+ * dispatches, so the first relevant event locks onto THIS turn's main run.
+ * Concurrent heartbeat/cron runs and subagent / side-question runs carry a
+ * different `runId` and are excluded — exactly the leakage the gate exists to
+ * prevent. When a run IS control-UI-visible and both keys are present, a
+ * mismatched `sessionKey` is still rejected as a secondary defence.
+ *
+ * Exported for unit tests — this gate is the fix's load-bearing logic and is
+ * pinned against real 2026.6.10 event shapes.
+ */
+declare function admitAgentEvent(gate: RunEventGate, evt: Pick<AgentEventPayload, 'runId' | 'stream' | 'sessionKey'>): boolean;
 interface PluginServiceContext {
   config: Record<string, unknown>;
   workspaceDir?: string;
   stateDir: string;
   logger: PluginLogger;
 }
+type ChatActivity = {
+  kind: 'thinking';
+  text: string;
+  delta?: boolean;
+  ts?: number;
+  seq?: number;
+} | {
+  kind: 'tool';
+  toolCallId: string;
+  name: string;
+  phase?: string;
+  status: 'running' | 'done' | 'failed';
+  summary?: string;
+  argsText?: string;
+  progressText?: string;
+  resultText?: string;
+  isError?: boolean;
+  durationMs?: number;
+  truncated?: {
+    args?: boolean;
+    progress?: boolean;
+    result?: boolean;
+  };
+  ts?: number;
+  seq?: number;
+};
+/**
+ * Extract structured tool status from an OpenClaw `tool`-stream event.
+ * We send the emoji-free raw `name` plus a lifecycle `status` and let the
+ * web render the `🛠️ <Label>: <summary> ✓/✗` row — never OpenClaw's raw
+ * `(+N steps)` string. `summary` carries OpenClaw's short detail when the
+ * event already provides one (title/summary/label/description), trimmed.
+ */
+declare function buildToolActivity(data: Record<string, unknown>): ChatActivity | null;
 declare function stripLeakedToolSummary(text: string): string;
 /**
  * Build the `a2a-complete` notify payload. ALWAYS fired for an A2A turn —
@@ -328,4 +396,4 @@ declare const plugin: {
   deactivate(api: PluginApi): Promise<void>;
 };
 //#endregion
-export { AlfeChannelConfig as a, createAlfeChannelPlugin as i, plugin as n, AlfePluginConfig as o, stripLeakedToolSummary as r, AlfeResolvedAccount as s, buildA2ACompletePayload as t };
+export { plugin as a, AlfeChannelConfig as c, buildToolActivity as i, AlfePluginConfig as l, admitAgentEvent as n, stripLeakedToolSummary as o, buildA2ACompletePayload as r, createAlfeChannelPlugin as s, RunEventGate as t, AlfeResolvedAccount as u };

package/dist/plugin.js

@@ -1,2 +1,2 @@
-import { n as plugin, r as stripLeakedToolSummary, t as buildA2ACompletePayload } from "./plugin2.js";
-export { buildA2ACompletePayload, plugin as default, stripLeakedToolSummary };
+import { a as stripLeakedToolSummary, i as plugin, n as buildA2ACompletePayload, r as buildToolActivity, t as admitAgentEvent } from "./plugin2.js";
+export { admitAgentEvent, buildA2ACompletePayload, buildToolActivity, plugin as default, stripLeakedToolSummary };

package/dist/plugin2.cjs

@@ -619,6 +619,235 @@ function validateAttachmentUrl(input, opts = {}) {
 	};
 }
 //#endregion
+//#region src/activity-serialize.ts
+/**
+* Console-grade tool-activity serialization (Slice 3).
+*
+* The chat plugin forwards a curated activity stream to the chat service.
+* For tool calls we now carry the args / streaming progress / final result
+* so the client can render an OpenClaw-console-grade card. Those payloads
+* arrive from OpenClaw's `onAgentEvent` bus as arbitrary `unknown`-shaped
+* objects (`args` is the raw tool-call arguments; `partialResult` / `result`
+* are tool-result envelopes). We must render them to BOUNDED strings BEFORE
+* they cross the WS to the chat service, because:
+*
+*  1. Daemon WS frames are `maxPayload`-bounded — an uncapped multi-MB tool
+*     stdout would drop the WHOLE frame (losing the status transition too),
+*     so the cap has to live on the emit side, not the client.
+*  2. The relay is a dumb passthrough and the reducer is pure — neither
+*     should have to serialize or sanitize unknown objects. The wire carries
+*     display text, never raw objects.
+*
+* OpenClaw's own `sanitizeToolResult` already strips standard image content
+* blocks (`{type:'image', data}` → `{omitted:true}`) and truncates text on
+* the `result`/`partialResult` path — but (a) its helpers are NOT importable
+* from the plugin (openclaw is a runtime peer dep, absent from node_modules),
+* and (b) `args` is NOT sanitized at all and can carry base64 (an inline
+* image arg, a `data:` URI in a write). So we reimplement a defensive
+* strip+cap here and apply it to every field, regardless of upstream
+* sanitization.
+*/
+/** Args render cap — args are usually small; 4KB is generous. */
+const ARGS_CAP = 4 * 1024;
+/** Streaming progress window — keep the newest 4KB (tail-truncated). */
+const PROGRESS_CAP = 4 * 1024;
+/** Final result cap — results can be large (file reads, search); 16KB. */
+const RESULT_CAP = 16 * 1024;
+/**
+* Replace long base64 runs, `data:` URIs, and known image content-block
+* shapes with a placeholder. Runs BEFORE JSON serialization on a deep-cloned
+* structure so we never mutate OpenClaw's live objects.
+*
+* Detection heuristics (all conservative — we only replace clear payloads):
+*  - A string that is a `data:` URI → `[data-uri omitted]`.
+*  - A string that is a long (≥256 char) run of base64 chars → `[base64 omitted]`.
+*    256 is well above any realistic id/token/hash and below inline media.
+*  - An object that looks like an image content block (`type:'image'` with a
+*    `data`/`source`/`url` field, OR an Anthropic `{source:{data}}` shape) →
+*    the payload field is replaced with `[image omitted]`.
+*/
+const DATA_URI_RE = /^data:[^;,]*(;[^,]*)?,/i;
+const BASE64_BLOB_RE = /^[A-Za-z0-9+/=\r\n]+$/;
+const BASE64_MIN_LEN = 256;
+function looksLikeBase64Blob(s) {
+	if (s.length < BASE64_MIN_LEN) return false;
+	return s.replace(/[\r\n]/g, "").length >= BASE64_MIN_LEN && BASE64_BLOB_RE.test(s);
+}
+const EMBEDDED_DATA_URI_RE = /data:[^;,\s"'`]{0,64}(?:;[^,\s"'`]{0,32})?,[A-Za-z0-9+/=]{128,}/g;
+const EMBEDDED_BASE64_RE = /[A-Za-z0-9+/]{512,}={0,2}/g;
+/**
+* Post-match filter for EMBEDDED_BASE64_RE: real base64 media is
+* high-entropy — a 512+ char run virtually always mixes lower, upper, and
+* digits. This keeps legitimate long runs (a repeated fill char in test
+* output, an ASCII divider) from being eaten by the strip.
+*/
+function looksHighEntropyBase64(run) {
+	return /[a-z]/.test(run) && /[A-Z]/.test(run) && /\d/.test(run);
+}
+function stripStringMedia(s) {
+	if (DATA_URI_RE.test(s)) return "[data-uri omitted]";
+	if (looksLikeBase64Blob(s)) return "[base64 omitted]";
+	if (s.length >= 128) return s.replace(EMBEDDED_DATA_URI_RE, "[data-uri omitted]").replace(EMBEDDED_BASE64_RE, (m) => looksHighEntropyBase64(m) ? "[base64 omitted]" : m);
+	return s;
+}
+const MEDIA_PAYLOAD_KEYS = new Set([
+	"data",
+	"base64",
+	"b64_json",
+	"bytes"
+]);
+function isImageBlock(obj) {
+	const type = typeof obj.type === "string" ? obj.type.toLowerCase() : "";
+	if (type === "image" || type === "image_url" || type === "input_image") return true;
+	if (obj.source && typeof obj.source === "object") {
+		const src = obj.source;
+		if (typeof src.data === "string" || typeof src.url === "string") return true;
+	}
+	return false;
+}
+/**
+* Deep-clone `value` while stripping media. Guards against cycles (returns
+* `'[circular]'`) and caps recursion depth. Non-plain values (functions,
+* symbols) are dropped by JSON semantics later; here we normalize them so the
+* safe-JSON pass can't throw.
+*/
+function stripMediaDeep(value, seen, depth) {
+	if (depth > 12) return "[max-depth]";
+	if (value === null) return null;
+	const t = typeof value;
+	if (t === "string") return stripStringMedia(value);
+	if (t === "number" || t === "boolean") return value;
+	if (t === "bigint") return `${value.toString()}n`;
+	if (t === "undefined" || t === "function" || t === "symbol") return void 0;
+	const obj = value;
+	if (seen.has(obj)) return "[circular]";
+	seen.add(obj);
+	try {
+		if (Array.isArray(obj)) return obj.map((item) => stripMediaDeep(item, seen, depth + 1));
+		const record = obj;
+		const imageBlock = isImageBlock(record);
+		const out = {};
+		for (const [key, v] of Object.entries(record)) {
+			if (imageBlock && MEDIA_PAYLOAD_KEYS.has(key)) {
+				out[key] = "[image omitted]";
+				continue;
+			}
+			if (imageBlock && key === "source" && v && typeof v === "object") {
+				const src = { ...v };
+				for (const mk of MEDIA_PAYLOAD_KEYS) if (typeof src[mk] === "string") src[mk] = "[image omitted]";
+				out[key] = src;
+				continue;
+			}
+			out[key] = stripMediaDeep(v, seen, depth + 1);
+		}
+		return out;
+	} finally {
+		seen.delete(obj);
+	}
+}
+/**
+* Cycle- and BigInt-safe JSON stringify. Returns `undefined` when there's
+* nothing meaningful to render (null/undefined). A plain string value is
+* returned as-is (unquoted) — args like `"ls -la"` read better raw than
+* `"\"ls -la\""`.
+*/
+function safeJson(value) {
+	if (value === null || value === void 0) return void 0;
+	const stripped = stripMediaDeep(value, /* @__PURE__ */ new WeakSet(), 0);
+	if (stripped === void 0) return void 0;
+	if (typeof stripped === "string") return stripped;
+	try {
+		return JSON.stringify(stripped, null, 2);
+	} catch {
+		return "[unserializable]";
+	}
+}
+/** Head-truncate: keep the START of the text (for args/results). */
+function capHead(text, cap) {
+	if (text.length <= cap) return {
+		text,
+		truncated: false
+	};
+	return {
+		text: `${text.slice(0, cap)}\n… [truncated ${String(text.length - cap)} chars]`,
+		truncated: true
+	};
+}
+/** Tail-truncate: keep the END of the text (for streaming progress). */
+function capTail(text, cap) {
+	if (text.length <= cap) return {
+		text,
+		truncated: false
+	};
+	return {
+		text: `… [truncated ${String(text.length - cap)} chars]\n${text.slice(text.length - cap)}`,
+		truncated: true
+	};
+}
+/**
+* Serialize + strip + head-cap the tool-call `args` (from `phase:start`).
+* Returns `undefined` when there's nothing to show.
+*/
+function serializeArgs(args) {
+	const rendered = safeJson(args);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capHead(rendered, ARGS_CAP);
+}
+/**
+* Serialize + strip + head-cap the final tool `result` (from `phase:result`).
+* Prefers rendering the result's text content when it's a standard
+* `{content:[{type:'text',text}]}` envelope (reads far better than the raw
+* JSON), falling back to the full JSON otherwise.
+*/
+function serializeResult(result) {
+	if (isEmptyEnvelope(result)) return void 0;
+	const rendered = extractResultText(result) ?? safeJson(result);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capHead(stripStringMedia(rendered), RESULT_CAP);
+}
+/**
+* Serialize + strip + TAIL-cap a streaming `partialResult` (from
+* `phase:update`). Tail-truncation keeps the NEWEST output — for a bash/exec
+* stream the tail is what the user cares about. Whether OpenClaw's
+* `partialResult` is cumulative or incremental is version-dependent; treating
+* it as "the latest window" (overwrite, not append — see the reducer) is
+* correct for both: a cumulative stream's newest frame already contains the
+* full window (tail-capped), and an incremental stream's newest frame is the
+* latest chunk.
+*/
+function serializeProgress(partial) {
+	if (isEmptyEnvelope(partial)) return void 0;
+	const rendered = extractResultText(partial) ?? safeJson(partial);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capTail(stripStringMedia(rendered), PROGRESS_CAP);
+}
+/**
+* Pull the concatenated `text` blocks out of a standard tool-result envelope
+* (`{content:[{type:'text',text}, {type:'image',omitted:true}]}`). Returns
+* `undefined` when the shape isn't a text-bearing envelope, so callers fall
+* back to full-JSON rendering.
+*/
+/** True for a tool-result envelope with an empty `content` array. */
+function isEmptyEnvelope(value) {
+	if (!value || typeof value !== "object") return false;
+	const content = value.content;
+	return Array.isArray(content) && content.length === 0;
+}
+function extractResultText(result) {
+	if (!result || typeof result !== "object") return void 0;
+	const content = result.content;
+	if (!Array.isArray(content)) return void 0;
+	const parts = [];
+	for (const item of content) {
+		if (!item || typeof item !== "object") continue;
+		const entry = item;
+		if (entry.type === "text" && typeof entry.text === "string") parts.push(entry.text);
+		else if (entry.type === "image" || entry.omitted === true) parts.push("[image omitted]");
+	}
+	if (parts.length === 0) return void 0;
+	return parts.join("\n");
+}
+//#endregion
 //#region src/plugin.ts
 /**
 * @alfe.ai/openclaw-chat — OpenClaw chat channel plugin.
@@ -635,6 +864,45 @@ function validateAttachmentUrl(input, opts = {}) {
 */
 const require$1 = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href);
 const pkg = require$1("../package.json");
+/**
+* Decide whether an agent-event belongs to THIS turn's run and should be
+* forwarded as a delta / activity frame.
+*
+* Why gate on `runId`, not `sessionKey`:
+* On OpenClaw 2026.x the daemon registers this ('alfe') channel's main run
+* with `isControlUiVisible: false` — only the built-in "webchat" surface is
+* treated as control-UI-visible (`isInternalMessageChannel`). The shared
+* agent-event bus then NULLS `sessionKey` on every event of a
+* non-control-UI run (`agent-events`: `sessionKey = isControlUiVisible ? … :
+* undefined`). So main-run assistant/thinking/tool events arrive with
+* `sessionKey: undefined`, and the old `!evt.sessionKey` + key-equality gate
+* silently dropped ALL activity — replies still landed because they come via
+* the `deliver()` callback, not the event bus (the reported "replies arrive,
+* zero activity" symptom). Verified against openclaw@2026.6.10 and
+* back-compatible with 2026.4.2 (identical emit semantics). `runId` is always
+* present on every emitted event.
+*
+* Isolation is preserved: turns to a daemon are serialised
+* (`enqueueAgentTurn`) and the listener is torn down before the next turn
+* dispatches, so the first relevant event locks onto THIS turn's main run.
+* Concurrent heartbeat/cron runs and subagent / side-question runs carry a
+* different `runId` and are excluded — exactly the leakage the gate exists to
+* prevent. When a run IS control-UI-visible and both keys are present, a
+* mismatched `sessionKey` is still rejected as a secondary defence.
+*
+* Exported for unit tests — this gate is the fix's load-bearing logic and is
+* pinned against real 2026.6.10 event shapes.
+*/
+function admitAgentEvent(gate, evt) {
+	if (!(evt.stream === "assistant" || evt.stream === "thinking" || evt.stream === "tool")) return false;
+	if (gate.runId === null) {
+		gate.runId = evt.runId;
+		if (evt.sessionKey) gate.sessionKey ??= evt.sessionKey;
+	}
+	if (evt.runId !== gate.runId) return false;
+	if (gate.sessionKey && evt.sessionKey && evt.sessionKey !== gate.sessionKey) return false;
+	return true;
+}
 function asString(v) {
 	return typeof v === "string" && v.length > 0 ? v : void 0;
 }
@@ -668,17 +936,58 @@ function buildToolActivity(data) {
 	const rawStatus = (phase ?? "").toLowerCase();
 	let status;
 	if (rawStatus === "error" || rawStatus === "failed" || data.error != null || data.isError === true) status = "failed";
-	else if (rawStatus === "end" || rawStatus === "done" || rawStatus === "success" || rawStatus === "complete") status = "done";
+	else if (rawStatus === "result" || rawStatus === "end" || rawStatus === "done" || rawStatus === "success" || rawStatus === "complete") status = "done";
 	else status = "running";
 	const summaryRaw = asString(data.summary) ?? asString(data.title) ?? asString(data.label) ?? asString(data.description);
 	const summary = summaryRaw ? summaryRaw.slice(0, 200) : void 0;
+	const truncated = {};
+	let argsText;
+	let progressText;
+	let resultText;
+	let isError;
+	if (rawStatus === "start" || rawStatus === "running" || rawStatus === "") {
+		const a = serializeArgs(data.args ?? data.arguments ?? data.input);
+		if (a) {
+			argsText = a.text;
+			if (a.truncated) truncated.args = true;
+		}
+	}
+	const partial = data.partialResult ?? data.partial ?? data.delta;
+	if (partial !== void 0) {
+		const p = serializeProgress(partial);
+		if (p) {
+			progressText = p.text;
+			if (p.truncated) truncated.progress = true;
+		}
+	}
+	const resultRaw = data.result ?? data.output;
+	if (resultRaw !== void 0 || status === "done" || status === "failed") {
+		if (resultRaw !== void 0) {
+			const r = serializeResult(resultRaw);
+			if (r) {
+				resultText = r.text;
+				if (r.truncated) truncated.result = true;
+			}
+		}
+		if (data.isError === true || status === "failed") isError = true;
+		else if (data.isError === false) isError = false;
+	}
+	const durationRaw = data.durationMs ?? data.duration;
+	const durationMs = typeof durationRaw === "number" && Number.isFinite(durationRaw) ? durationRaw : void 0;
+	const hasTruncated = truncated.args === true || truncated.progress === true || truncated.result === true;
 	return {
 		kind: "tool",
 		toolCallId,
 		name,
 		...phase ? { phase } : {},
 		status,
-		...summary ? { summary } : {}
+		...summary ? { summary } : {},
+		...argsText !== void 0 ? { argsText } : {},
+		...progressText !== void 0 ? { progressText } : {},
+		...resultText !== void 0 ? { resultText } : {},
+		...isError !== void 0 ? { isError } : {},
+		...durationMs !== void 0 ? { durationMs } : {},
+		...hasTruncated ? { truncated } : {}
 	};
 }
 /**
@@ -858,11 +1167,25 @@ async function handleAgentRequest(request, log) {
 	const sessionId = conversationId ?? legacySessionKey;
 	if (!await getSession(sessionId)) await createSession(sessionId, "", "alfe", tenantId, userId);
 	await addMessage(sessionId, "user", message, userId ?? senderId, displayName ?? senderId);
-	let resolvedOpenClawKey = null;
+	const runGate = {
+		runId: null,
+		sessionKey: null
+	};
+	const UPDATE_THROTTLE_MS = 250;
+	const pendingUpdates = /* @__PURE__ */ new Map();
+	const flushToolUpdate = (toolCallId) => {
+		const pending = pendingUpdates.get(toolCallId);
+		if (!pending) return;
+		clearTimeout(pending.timer);
+		pendingUpdates.delete(toolCallId);
+		pending.send();
+	};
+	const clearAllToolUpdates = () => {
+		for (const pending of pendingUpdates.values()) clearTimeout(pending.timer);
+		pendingUpdates.clear();
+	};
 	const unsubscribe = runtime.events.onAgentEvent((evt) => {
-		if (!evt.sessionKey) return;
-		if (evt.stream === "assistant" || evt.stream === "thinking" || evt.stream === "tool") resolvedOpenClawKey ??= evt.sessionKey;
-		if (evt.sessionKey !== resolvedOpenClawKey) return;
+		if (!admitAgentEvent(runGate, evt)) return;
 		if (evt.stream === "assistant") {
 			chatClient?.sendEvent("chat", {
 				runId: evt.runId,
@@ -890,17 +1213,38 @@ async function handleAgentRequest(request, log) {
 		}
 		if (evt.stream === "tool") {
 			const activity = buildToolActivity(evt.data);
-			if (activity) chatClient?.sendEvent("chat-activity", {
-				runId: evt.runId,
-				sessionKey: legacySessionKey,
-				seq: evt.seq,
-				state: "activity",
-				activity: {
-					...activity,
-					ts: evt.ts,
-					seq: evt.seq
+			if (activity?.kind !== "tool") return;
+			const toolCallId = activity.toolCallId;
+			const send = () => {
+				chatClient?.sendEvent("chat-activity", {
+					runId: evt.runId,
+					sessionKey: legacySessionKey,
+					seq: evt.seq,
+					state: "activity",
+					activity: {
+						...activity,
+						ts: evt.ts,
+						seq: evt.seq
+					}
+				});
+			};
+			const rawPhase = (activity.phase ?? "").toLowerCase();
+			if (rawPhase === "update" || activity.status === "running" && rawPhase !== "start" && rawPhase !== "") {
+				const existing = pendingUpdates.get(toolCallId);
+				if (existing) existing.send = send;
+				else {
+					const timer = setTimeout(() => {
+						flushToolUpdate(toolCallId);
+					}, UPDATE_THROTTLE_MS);
+					pendingUpdates.set(toolCallId, {
+						timer,
+						send
+					});
 				}
-			});
+				return;
+			}
+			flushToolUpdate(toolCallId);
+			send();
 			return;
 		}
 	});
@@ -919,7 +1263,7 @@ async function handleAgentRequest(request, log) {
 		const conversationLabel = conversationType === "group" ? shortConvId ? `[${channelLabel}] Group (${shortConvId})` : `[${channelLabel}] Group` : shortConvId ? `[${channelLabel}] ${userLabel} (${shortConvId})` : `[${channelLabel}] ${userLabel}`;
 		let a2aResponseBuffer = "";
 		if (isA2A) resetA2AEndSignal();
-		resolvedOpenClawKey = (await dispatchInbound({
+		runGate.sessionKey = (await dispatchInbound({
 			cfg,
 			runtime: { channel: runtime.channel },
 			channel: "alfe",
@@ -972,7 +1316,7 @@ async function handleAgentRequest(request, log) {
 				chatClient?.notify("agent-message", {
 					conversationId: conversationId ?? legacySessionKey,
 					text: responseText,
-					sessionKey: resolvedOpenClawKey ?? legacySessionKey,
+					sessionKey: runGate.sessionKey ?? legacySessionKey,
 					messageId: chatMessageId ?? request.id,
 					...mediaUrls.length ? { mediaUrls } : {}
 				});
@@ -993,14 +1337,15 @@ async function handleAgentRequest(request, log) {
 				resolved: a2aResolved
 			}));
 		}
-		chatClient?.sendResponse(request.id, true, { sessionKey: resolvedOpenClawKey });
-		log.info(`Agent dispatch complete: sessionKey=${resolvedOpenClawKey}`);
+		chatClient?.sendResponse(request.id, true, { sessionKey: runGate.sessionKey });
+		log.info(`Agent dispatch complete: sessionKey=${runGate.sessionKey}`);
 	} catch (err) {
 		const errMsg = err instanceof Error ? err.message : String(err);
 		log.error(`Agent dispatch failed: ${errMsg}`);
 		chatClient?.sendResponse(request.id, false, { message: errMsg });
 	} finally {
 		unsubscribe();
+		clearAllToolUpdates();
 		if (isA2A) disarmA2AEndSignal();
 	}
 }
@@ -1229,12 +1574,24 @@ const plugin = {
 	}
 };
 //#endregion
+Object.defineProperty(exports, "admitAgentEvent", {
+	enumerable: true,
+	get: function() {
+		return admitAgentEvent;
+	}
+});
 Object.defineProperty(exports, "buildA2ACompletePayload", {
 	enumerable: true,
 	get: function() {
 		return buildA2ACompletePayload;
 	}
 });
+Object.defineProperty(exports, "buildToolActivity", {
+	enumerable: true,
+	get: function() {
+		return buildToolActivity;
+	}
+});
 Object.defineProperty(exports, "createAlfeChannelPlugin", {
 	enumerable: true,
 	get: function() {

package/dist/plugin2.d.cts

@@ -1,2 +1,2 @@
-import { n as plugin, r as stripLeakedToolSummary, t as buildA2ACompletePayload } from "./plugin.cjs";
-export { buildA2ACompletePayload, plugin as default, stripLeakedToolSummary };
+import { a as plugin, i as buildToolActivity, n as admitAgentEvent, o as stripLeakedToolSummary, r as buildA2ACompletePayload, t as RunEventGate } from "./plugin.cjs";
+export { RunEventGate, admitAgentEvent, buildA2ACompletePayload, buildToolActivity, plugin as default, stripLeakedToolSummary };

package/dist/plugin2.d.ts

@@ -1,2 +1,2 @@
-import { n as plugin, r as stripLeakedToolSummary, t as buildA2ACompletePayload } from "./plugin.js";
-export { buildA2ACompletePayload, plugin as default, stripLeakedToolSummary };
+import { a as plugin, i as buildToolActivity, n as admitAgentEvent, o as stripLeakedToolSummary, r as buildA2ACompletePayload, t as RunEventGate } from "./plugin.js";
+export { RunEventGate, admitAgentEvent, buildA2ACompletePayload, buildToolActivity, plugin as default, stripLeakedToolSummary };

package/dist/plugin2.js

@@ -619,6 +619,235 @@ function validateAttachmentUrl(input, opts = {}) {
 	};
 }
 //#endregion
+//#region src/activity-serialize.ts
+/**
+* Console-grade tool-activity serialization (Slice 3).
+*
+* The chat plugin forwards a curated activity stream to the chat service.
+* For tool calls we now carry the args / streaming progress / final result
+* so the client can render an OpenClaw-console-grade card. Those payloads
+* arrive from OpenClaw's `onAgentEvent` bus as arbitrary `unknown`-shaped
+* objects (`args` is the raw tool-call arguments; `partialResult` / `result`
+* are tool-result envelopes). We must render them to BOUNDED strings BEFORE
+* they cross the WS to the chat service, because:
+*
+*  1. Daemon WS frames are `maxPayload`-bounded — an uncapped multi-MB tool
+*     stdout would drop the WHOLE frame (losing the status transition too),
+*     so the cap has to live on the emit side, not the client.
+*  2. The relay is a dumb passthrough and the reducer is pure — neither
+*     should have to serialize or sanitize unknown objects. The wire carries
+*     display text, never raw objects.
+*
+* OpenClaw's own `sanitizeToolResult` already strips standard image content
+* blocks (`{type:'image', data}` → `{omitted:true}`) and truncates text on
+* the `result`/`partialResult` path — but (a) its helpers are NOT importable
+* from the plugin (openclaw is a runtime peer dep, absent from node_modules),
+* and (b) `args` is NOT sanitized at all and can carry base64 (an inline
+* image arg, a `data:` URI in a write). So we reimplement a defensive
+* strip+cap here and apply it to every field, regardless of upstream
+* sanitization.
+*/
+/** Args render cap — args are usually small; 4KB is generous. */
+const ARGS_CAP = 4 * 1024;
+/** Streaming progress window — keep the newest 4KB (tail-truncated). */
+const PROGRESS_CAP = 4 * 1024;
+/** Final result cap — results can be large (file reads, search); 16KB. */
+const RESULT_CAP = 16 * 1024;
+/**
+* Replace long base64 runs, `data:` URIs, and known image content-block
+* shapes with a placeholder. Runs BEFORE JSON serialization on a deep-cloned
+* structure so we never mutate OpenClaw's live objects.
+*
+* Detection heuristics (all conservative — we only replace clear payloads):
+*  - A string that is a `data:` URI → `[data-uri omitted]`.
+*  - A string that is a long (≥256 char) run of base64 chars → `[base64 omitted]`.
+*    256 is well above any realistic id/token/hash and below inline media.
+*  - An object that looks like an image content block (`type:'image'` with a
+*    `data`/`source`/`url` field, OR an Anthropic `{source:{data}}` shape) →
+*    the payload field is replaced with `[image omitted]`.
+*/
+const DATA_URI_RE = /^data:[^;,]*(;[^,]*)?,/i;
+const BASE64_BLOB_RE = /^[A-Za-z0-9+/=\r\n]+$/;
+const BASE64_MIN_LEN = 256;
+function looksLikeBase64Blob(s) {
+	if (s.length < BASE64_MIN_LEN) return false;
+	return s.replace(/[\r\n]/g, "").length >= BASE64_MIN_LEN && BASE64_BLOB_RE.test(s);
+}
+const EMBEDDED_DATA_URI_RE = /data:[^;,\s"'`]{0,64}(?:;[^,\s"'`]{0,32})?,[A-Za-z0-9+/=]{128,}/g;
+const EMBEDDED_BASE64_RE = /[A-Za-z0-9+/]{512,}={0,2}/g;
+/**
+* Post-match filter for EMBEDDED_BASE64_RE: real base64 media is
+* high-entropy — a 512+ char run virtually always mixes lower, upper, and
+* digits. This keeps legitimate long runs (a repeated fill char in test
+* output, an ASCII divider) from being eaten by the strip.
+*/
+function looksHighEntropyBase64(run) {
+	return /[a-z]/.test(run) && /[A-Z]/.test(run) && /\d/.test(run);
+}
+function stripStringMedia(s) {
+	if (DATA_URI_RE.test(s)) return "[data-uri omitted]";
+	if (looksLikeBase64Blob(s)) return "[base64 omitted]";
+	if (s.length >= 128) return s.replace(EMBEDDED_DATA_URI_RE, "[data-uri omitted]").replace(EMBEDDED_BASE64_RE, (m) => looksHighEntropyBase64(m) ? "[base64 omitted]" : m);
+	return s;
+}
+const MEDIA_PAYLOAD_KEYS = new Set([
+	"data",
+	"base64",
+	"b64_json",
+	"bytes"
+]);
+function isImageBlock(obj) {
+	const type = typeof obj.type === "string" ? obj.type.toLowerCase() : "";
+	if (type === "image" || type === "image_url" || type === "input_image") return true;
+	if (obj.source && typeof obj.source === "object") {
+		const src = obj.source;
+		if (typeof src.data === "string" || typeof src.url === "string") return true;
+	}
+	return false;
+}
+/**
+* Deep-clone `value` while stripping media. Guards against cycles (returns
+* `'[circular]'`) and caps recursion depth. Non-plain values (functions,
+* symbols) are dropped by JSON semantics later; here we normalize them so the
+* safe-JSON pass can't throw.
+*/
+function stripMediaDeep(value, seen, depth) {
+	if (depth > 12) return "[max-depth]";
+	if (value === null) return null;
+	const t = typeof value;
+	if (t === "string") return stripStringMedia(value);
+	if (t === "number" || t === "boolean") return value;
+	if (t === "bigint") return `${value.toString()}n`;
+	if (t === "undefined" || t === "function" || t === "symbol") return void 0;
+	const obj = value;
+	if (seen.has(obj)) return "[circular]";
+	seen.add(obj);
+	try {
+		if (Array.isArray(obj)) return obj.map((item) => stripMediaDeep(item, seen, depth + 1));
+		const record = obj;
+		const imageBlock = isImageBlock(record);
+		const out = {};
+		for (const [key, v] of Object.entries(record)) {
+			if (imageBlock && MEDIA_PAYLOAD_KEYS.has(key)) {
+				out[key] = "[image omitted]";
+				continue;
+			}
+			if (imageBlock && key === "source" && v && typeof v === "object") {
+				const src = { ...v };
+				for (const mk of MEDIA_PAYLOAD_KEYS) if (typeof src[mk] === "string") src[mk] = "[image omitted]";
+				out[key] = src;
+				continue;
+			}
+			out[key] = stripMediaDeep(v, seen, depth + 1);
+		}
+		return out;
+	} finally {
+		seen.delete(obj);
+	}
+}
+/**
+* Cycle- and BigInt-safe JSON stringify. Returns `undefined` when there's
+* nothing meaningful to render (null/undefined). A plain string value is
+* returned as-is (unquoted) — args like `"ls -la"` read better raw than
+* `"\"ls -la\""`.
+*/
+function safeJson(value) {
+	if (value === null || value === void 0) return void 0;
+	const stripped = stripMediaDeep(value, /* @__PURE__ */ new WeakSet(), 0);
+	if (stripped === void 0) return void 0;
+	if (typeof stripped === "string") return stripped;
+	try {
+		return JSON.stringify(stripped, null, 2);
+	} catch {
+		return "[unserializable]";
+	}
+}
+/** Head-truncate: keep the START of the text (for args/results). */
+function capHead(text, cap) {
+	if (text.length <= cap) return {
+		text,
+		truncated: false
+	};
+	return {
+		text: `${text.slice(0, cap)}\n… [truncated ${String(text.length - cap)} chars]`,
+		truncated: true
+	};
+}
+/** Tail-truncate: keep the END of the text (for streaming progress). */
+function capTail(text, cap) {
+	if (text.length <= cap) return {
+		text,
+		truncated: false
+	};
+	return {
+		text: `… [truncated ${String(text.length - cap)} chars]\n${text.slice(text.length - cap)}`,
+		truncated: true
+	};
+}
+/**
+* Serialize + strip + head-cap the tool-call `args` (from `phase:start`).
+* Returns `undefined` when there's nothing to show.
+*/
+function serializeArgs(args) {
+	const rendered = safeJson(args);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capHead(rendered, ARGS_CAP);
+}
+/**
+* Serialize + strip + head-cap the final tool `result` (from `phase:result`).
+* Prefers rendering the result's text content when it's a standard
+* `{content:[{type:'text',text}]}` envelope (reads far better than the raw
+* JSON), falling back to the full JSON otherwise.
+*/
+function serializeResult(result) {
+	if (isEmptyEnvelope(result)) return void 0;
+	const rendered = extractResultText(result) ?? safeJson(result);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capHead(stripStringMedia(rendered), RESULT_CAP);
+}
+/**
+* Serialize + strip + TAIL-cap a streaming `partialResult` (from
+* `phase:update`). Tail-truncation keeps the NEWEST output — for a bash/exec
+* stream the tail is what the user cares about. Whether OpenClaw's
+* `partialResult` is cumulative or incremental is version-dependent; treating
+* it as "the latest window" (overwrite, not append — see the reducer) is
+* correct for both: a cumulative stream's newest frame already contains the
+* full window (tail-capped), and an incremental stream's newest frame is the
+* latest chunk.
+*/
+function serializeProgress(partial) {
+	if (isEmptyEnvelope(partial)) return void 0;
+	const rendered = extractResultText(partial) ?? safeJson(partial);
+	if (rendered === void 0 || rendered === "" || rendered === "{}") return void 0;
+	return capTail(stripStringMedia(rendered), PROGRESS_CAP);
+}
+/**
+* Pull the concatenated `text` blocks out of a standard tool-result envelope
+* (`{content:[{type:'text',text}, {type:'image',omitted:true}]}`). Returns
+* `undefined` when the shape isn't a text-bearing envelope, so callers fall
+* back to full-JSON rendering.
+*/
+/** True for a tool-result envelope with an empty `content` array. */
+function isEmptyEnvelope(value) {
+	if (!value || typeof value !== "object") return false;
+	const content = value.content;
+	return Array.isArray(content) && content.length === 0;
+}
+function extractResultText(result) {
+	if (!result || typeof result !== "object") return void 0;
+	const content = result.content;
+	if (!Array.isArray(content)) return void 0;
+	const parts = [];
+	for (const item of content) {
+		if (!item || typeof item !== "object") continue;
+		const entry = item;
+		if (entry.type === "text" && typeof entry.text === "string") parts.push(entry.text);
+		else if (entry.type === "image" || entry.omitted === true) parts.push("[image omitted]");
+	}
+	if (parts.length === 0) return void 0;
+	return parts.join("\n");
+}
+//#endregion
 //#region src/plugin.ts
 /**
 * @alfe.ai/openclaw-chat — OpenClaw chat channel plugin.
@@ -635,6 +864,45 @@ function validateAttachmentUrl(input, opts = {}) {
 */
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
+/**
+* Decide whether an agent-event belongs to THIS turn's run and should be
+* forwarded as a delta / activity frame.
+*
+* Why gate on `runId`, not `sessionKey`:
+* On OpenClaw 2026.x the daemon registers this ('alfe') channel's main run
+* with `isControlUiVisible: false` — only the built-in "webchat" surface is
+* treated as control-UI-visible (`isInternalMessageChannel`). The shared
+* agent-event bus then NULLS `sessionKey` on every event of a
+* non-control-UI run (`agent-events`: `sessionKey = isControlUiVisible ? … :
+* undefined`). So main-run assistant/thinking/tool events arrive with
+* `sessionKey: undefined`, and the old `!evt.sessionKey` + key-equality gate
+* silently dropped ALL activity — replies still landed because they come via
+* the `deliver()` callback, not the event bus (the reported "replies arrive,
+* zero activity" symptom). Verified against openclaw@2026.6.10 and
+* back-compatible with 2026.4.2 (identical emit semantics). `runId` is always
+* present on every emitted event.
+*
+* Isolation is preserved: turns to a daemon are serialised
+* (`enqueueAgentTurn`) and the listener is torn down before the next turn
+* dispatches, so the first relevant event locks onto THIS turn's main run.
+* Concurrent heartbeat/cron runs and subagent / side-question runs carry a
+* different `runId` and are excluded — exactly the leakage the gate exists to
+* prevent. When a run IS control-UI-visible and both keys are present, a
+* mismatched `sessionKey` is still rejected as a secondary defence.
+*
+* Exported for unit tests — this gate is the fix's load-bearing logic and is
+* pinned against real 2026.6.10 event shapes.
+*/
+function admitAgentEvent(gate, evt) {
+	if (!(evt.stream === "assistant" || evt.stream === "thinking" || evt.stream === "tool")) return false;
+	if (gate.runId === null) {
+		gate.runId = evt.runId;
+		if (evt.sessionKey) gate.sessionKey ??= evt.sessionKey;
+	}
+	if (evt.runId !== gate.runId) return false;
+	if (gate.sessionKey && evt.sessionKey && evt.sessionKey !== gate.sessionKey) return false;
+	return true;
+}
 function asString(v) {
 	return typeof v === "string" && v.length > 0 ? v : void 0;
 }
@@ -668,17 +936,58 @@ function buildToolActivity(data) {
 	const rawStatus = (phase ?? "").toLowerCase();
 	let status;
 	if (rawStatus === "error" || rawStatus === "failed" || data.error != null || data.isError === true) status = "failed";
-	else if (rawStatus === "end" || rawStatus === "done" || rawStatus === "success" || rawStatus === "complete") status = "done";
+	else if (rawStatus === "result" || rawStatus === "end" || rawStatus === "done" || rawStatus === "success" || rawStatus === "complete") status = "done";
 	else status = "running";
 	const summaryRaw = asString(data.summary) ?? asString(data.title) ?? asString(data.label) ?? asString(data.description);
 	const summary = summaryRaw ? summaryRaw.slice(0, 200) : void 0;
+	const truncated = {};
+	let argsText;
+	let progressText;
+	let resultText;
+	let isError;
+	if (rawStatus === "start" || rawStatus === "running" || rawStatus === "") {
+		const a = serializeArgs(data.args ?? data.arguments ?? data.input);
+		if (a) {
+			argsText = a.text;
+			if (a.truncated) truncated.args = true;
+		}
+	}
+	const partial = data.partialResult ?? data.partial ?? data.delta;
+	if (partial !== void 0) {
+		const p = serializeProgress(partial);
+		if (p) {
+			progressText = p.text;
+			if (p.truncated) truncated.progress = true;
+		}
+	}
+	const resultRaw = data.result ?? data.output;
+	if (resultRaw !== void 0 || status === "done" || status === "failed") {
+		if (resultRaw !== void 0) {
+			const r = serializeResult(resultRaw);
+			if (r) {
+				resultText = r.text;
+				if (r.truncated) truncated.result = true;
+			}
+		}
+		if (data.isError === true || status === "failed") isError = true;
+		else if (data.isError === false) isError = false;
+	}
+	const durationRaw = data.durationMs ?? data.duration;
+	const durationMs = typeof durationRaw === "number" && Number.isFinite(durationRaw) ? durationRaw : void 0;
+	const hasTruncated = truncated.args === true || truncated.progress === true || truncated.result === true;
 	return {
 		kind: "tool",
 		toolCallId,
 		name,
 		...phase ? { phase } : {},
 		status,
-		...summary ? { summary } : {}
+		...summary ? { summary } : {},
+		...argsText !== void 0 ? { argsText } : {},
+		...progressText !== void 0 ? { progressText } : {},
+		...resultText !== void 0 ? { resultText } : {},
+		...isError !== void 0 ? { isError } : {},
+		...durationMs !== void 0 ? { durationMs } : {},
+		...hasTruncated ? { truncated } : {}
 	};
 }
 /**
@@ -858,11 +1167,25 @@ async function handleAgentRequest(request, log) {
 	const sessionId = conversationId ?? legacySessionKey;
 	if (!await getSession(sessionId)) await createSession(sessionId, "", "alfe", tenantId, userId);
 	await addMessage(sessionId, "user", message, userId ?? senderId, displayName ?? senderId);
-	let resolvedOpenClawKey = null;
+	const runGate = {
+		runId: null,
+		sessionKey: null
+	};
+	const UPDATE_THROTTLE_MS = 250;
+	const pendingUpdates = /* @__PURE__ */ new Map();
+	const flushToolUpdate = (toolCallId) => {
+		const pending = pendingUpdates.get(toolCallId);
+		if (!pending) return;
+		clearTimeout(pending.timer);
+		pendingUpdates.delete(toolCallId);
+		pending.send();
+	};
+	const clearAllToolUpdates = () => {
+		for (const pending of pendingUpdates.values()) clearTimeout(pending.timer);
+		pendingUpdates.clear();
+	};
 	const unsubscribe = runtime.events.onAgentEvent((evt) => {
-		if (!evt.sessionKey) return;
-		if (evt.stream === "assistant" || evt.stream === "thinking" || evt.stream === "tool") resolvedOpenClawKey ??= evt.sessionKey;
-		if (evt.sessionKey !== resolvedOpenClawKey) return;
+		if (!admitAgentEvent(runGate, evt)) return;
 		if (evt.stream === "assistant") {
 			chatClient?.sendEvent("chat", {
 				runId: evt.runId,
@@ -890,17 +1213,38 @@ async function handleAgentRequest(request, log) {
 		}
 		if (evt.stream === "tool") {
 			const activity = buildToolActivity(evt.data);
-			if (activity) chatClient?.sendEvent("chat-activity", {
-				runId: evt.runId,
-				sessionKey: legacySessionKey,
-				seq: evt.seq,
-				state: "activity",
-				activity: {
-					...activity,
-					ts: evt.ts,
-					seq: evt.seq
+			if (activity?.kind !== "tool") return;
+			const toolCallId = activity.toolCallId;
+			const send = () => {
+				chatClient?.sendEvent("chat-activity", {
+					runId: evt.runId,
+					sessionKey: legacySessionKey,
+					seq: evt.seq,
+					state: "activity",
+					activity: {
+						...activity,
+						ts: evt.ts,
+						seq: evt.seq
+					}
+				});
+			};
+			const rawPhase = (activity.phase ?? "").toLowerCase();
+			if (rawPhase === "update" || activity.status === "running" && rawPhase !== "start" && rawPhase !== "") {
+				const existing = pendingUpdates.get(toolCallId);
+				if (existing) existing.send = send;
+				else {
+					const timer = setTimeout(() => {
+						flushToolUpdate(toolCallId);
+					}, UPDATE_THROTTLE_MS);
+					pendingUpdates.set(toolCallId, {
+						timer,
+						send
+					});
 				}
-			});
+				return;
+			}
+			flushToolUpdate(toolCallId);
+			send();
 			return;
 		}
 	});
@@ -919,7 +1263,7 @@ async function handleAgentRequest(request, log) {
 		const conversationLabel = conversationType === "group" ? shortConvId ? `[${channelLabel}] Group (${shortConvId})` : `[${channelLabel}] Group` : shortConvId ? `[${channelLabel}] ${userLabel} (${shortConvId})` : `[${channelLabel}] ${userLabel}`;
 		let a2aResponseBuffer = "";
 		if (isA2A) resetA2AEndSignal();
-		resolvedOpenClawKey = (await dispatchInbound({
+		runGate.sessionKey = (await dispatchInbound({
 			cfg,
 			runtime: { channel: runtime.channel },
 			channel: "alfe",
@@ -972,7 +1316,7 @@ async function handleAgentRequest(request, log) {
 				chatClient?.notify("agent-message", {
 					conversationId: conversationId ?? legacySessionKey,
 					text: responseText,
-					sessionKey: resolvedOpenClawKey ?? legacySessionKey,
+					sessionKey: runGate.sessionKey ?? legacySessionKey,
 					messageId: chatMessageId ?? request.id,
 					...mediaUrls.length ? { mediaUrls } : {}
 				});
@@ -993,14 +1337,15 @@ async function handleAgentRequest(request, log) {
 				resolved: a2aResolved
 			}));
 		}
-		chatClient?.sendResponse(request.id, true, { sessionKey: resolvedOpenClawKey });
-		log.info(`Agent dispatch complete: sessionKey=${resolvedOpenClawKey}`);
+		chatClient?.sendResponse(request.id, true, { sessionKey: runGate.sessionKey });
+		log.info(`Agent dispatch complete: sessionKey=${runGate.sessionKey}`);
 	} catch (err) {
 		const errMsg = err instanceof Error ? err.message : String(err);
 		log.error(`Agent dispatch failed: ${errMsg}`);
 		chatClient?.sendResponse(request.id, false, { message: errMsg });
 	} finally {
 		unsubscribe();
+		clearAllToolUpdates();
 		if (isA2A) disarmA2AEndSignal();
 	}
 }
@@ -1229,4 +1574,4 @@ const plugin = {
 	}
 };
 //#endregion
-export { createAlfeChannelPlugin as i, plugin as n, stripLeakedToolSummary as r, buildA2ACompletePayload as t };
+export { stripLeakedToolSummary as a, plugin as i, buildA2ACompletePayload as n, createAlfeChannelPlugin as o, buildToolActivity as r, admitAgentEvent as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-chat",
-  "version": "0.2.5",
+  "version": "0.3.1",
   "description": "OpenClaw chat plugin for Alfe — web widget and mobile app channels",
   "type": "module",
   "main": "./dist/plugin.js",