@alfe.ai/openclaw-chat 0.5.1 → 0.6.0

package/dist/plugin2.js

@@ -1,5 +1,5 @@
 import { createRequire } from "node:module";
-import { mkdir, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { homedir } from "node:os";
 import { ChatServiceClient, resolveAlfeChat } from "@alfe.ai/chat";
@@ -369,6 +369,26 @@ async function appendActivity(sessionId, entries) {
 	writeLocks.set(sessionId, next);
 	await next;
 }
+const MAX_ROUTES_PER_SESSION = 8;
+/**
+* Record the OpenClaw route a turn dispatched through (idempotent upsert
+* by sessionKey). Called once per turn from the dispatch success path.
+*/
+async function recordRoute(sessionId, route) {
+	const next = (writeLocks.get(sessionId) ?? Promise.resolve()).then(async () => {
+		const session = await getSession(sessionId);
+		if (!session) return;
+		const routes = session.routes ?? [];
+		if (routes.some((r) => r.sessionKey === route.sessionKey)) return;
+		if (routes.length >= MAX_ROUTES_PER_SESSION) return;
+		session.routes = [...routes, route];
+		await saveSession(session);
+	}).finally(() => {
+		if (writeLocks.get(sessionId) === next) writeLocks.delete(sessionId);
+	});
+	writeLocks.set(sessionId, next);
+	await next;
+}
 async function listSessions(filters, limit = 50) {
 	await ensureDir();
 	let files;
@@ -406,244 +426,6 @@ async function listSessions(filters, limit = 50) {
 	return summaries.slice(0, limit);
 }
 //#endregion
-//#region src/a2a-tools.ts
-let conversationEndRequested = false;
-let a2aTurnArmed = false;
-/**
-* Clear the end signal AND arm the gate. Call immediately before an A2A
-* dispatch. Arming is what permits `end_conversation` to set the flag for the
-* duration of this turn.
-*/
-function resetA2AEndSignal() {
-	conversationEndRequested = false;
-	a2aTurnArmed = true;
-}
-/**
-* Clear the end signal AND disarm the gate. Call after an A2A dispatch (in a
-* `finally`, so it also runs on error). Disarming closes the gate so a later
-* NON-A2A turn invoking `end_conversation` can't set a flag the next A2A turn
-* would read.
-*/
-function disarmA2AEndSignal() {
-	conversationEndRequested = false;
-	a2aTurnArmed = false;
-}
-/** True if `end_conversation` was invoked since the last reset. */
-function isA2AEndSignalled() {
-	return conversationEndRequested;
-}
-function ok(result) {
-	return { content: [{
-		type: "text",
-		text: JSON.stringify(result)
-	}] };
-}
-function errResult(message) {
-	return { content: [{
-		type: "text",
-		text: JSON.stringify({ error: message })
-	}] };
-}
-function defineTool(def) {
-	return {
-		name: def.name,
-		description: def.description,
-		label: def.name,
-		parameters: def.parameters,
-		execute: async (_toolCallId, params) => {
-			try {
-				return ok(await def.handler(params));
-			} catch (e) {
-				return errResult(e.message);
-			}
-		}
-	};
-}
-function buildA2ATools(getChatClient, log) {
-	const requireClient = () => {
-		const client = getChatClient();
-		if (!client) throw new Error("chat service not connected yet — try again in a moment");
-		return client;
-	};
-	return [
-		defineTool({
-			name: "list_agents",
-			description: "List other agents in your organization that you can communicate with.",
-			parameters: {
-				type: "object",
-				properties: {},
-				required: []
-			},
-			handler: async () => {
-				log.info("list_agents tool called");
-				return await requireClient().sendRequest("a2a.list-agents", {});
-			}
-		}),
-		defineTool({
-			name: "message_agent",
-			description: "Send a message to another agent. Starts a new conversation thread, or continues an existing one. The conversation will bounce back and forth automatically until one agent calls end_conversation() or says [RESOLVED].",
-			parameters: {
-				type: "object",
-				properties: {
-					agent_id: {
-						type: "string",
-						description: "Target agent ID (use list_agents to find available agents)"
-					},
-					message: {
-						type: "string",
-						description: "Message to send to the agent"
-					},
-					thread_id: {
-						type: "string",
-						description: "Continue an existing conversation thread (omit to start a new one)"
-					},
-					max_depth: {
-						type: "number",
-						description: "Maximum number of back-and-forth exchanges (default: 10)"
-					}
-				},
-				required: ["agent_id", "message"]
-			},
-			handler: async (params) => {
-				const agentId = params.agent_id;
-				const message = params.message;
-				const threadId = params.thread_id;
-				const maxDepth = params.max_depth ?? 10;
-				if (!agentId || !message) throw new Error("agent_id and message are required");
-				log.info(`message_agent tool: sending to ${agentId}`);
-				return await requireClient().sendRequest("a2a.send", {
-					targetAgentId: agentId,
-					message,
-					threadId,
-					maxDepth
-				});
-			}
-		}),
-		defineTool({
-			name: "end_conversation",
-			description: "End the current agent-to-agent conversation. Call this when the discussion is resolved and no further exchanges are needed.",
-			parameters: {
-				type: "object",
-				properties: { summary: {
-					type: "string",
-					description: "Brief summary of what was discussed or resolved"
-				} },
-				required: []
-			},
-			handler: (params) => {
-				const summary = params.summary;
-				log.info(`end_conversation tool called${summary ? `: ${summary}` : ""}`);
-				if (a2aTurnArmed) conversationEndRequested = true;
-				return Promise.resolve({
-					status: "conversation_ended",
-					summary
-				});
-			}
-		})
-	];
-}
-//#endregion
-//#region src/attachment-url.ts
-/**
-* Attachment URL validation for the openclaw-chat plugin.
-*
-* This package runs inside user-installed OpenClaw agents and has no
-* dependency on the internal @alfe/api-core SSRF validator, so the
-* plumbing is inlined here. The rules are deliberately conservative:
-*
-* - `https:` only.
-* - Userinfo (`https://u:p@host/...`) is rejected.
-* - IP-literal hosts (v4 or bracketed v6) are rejected outright — only
-*   DNS names for known provider CDNs are acceptable.
-* - The host must match a curated allowlist of Alfe-issued / channel-
-*   provider CDNs. Anything else is dropped before we fetch it.
-*
-* Operators running an agent in a private network that needs to dereference
-* additional hosts can extend the list via the
-* `ALFE_ATTACHMENT_ALLOWED_HOSTS` env var (comma-separated, entries prefixed
-* with `.` match suffixes).
-*/
-const DEFAULT_EXACT_HOSTS = [
-	"s3.amazonaws.com",
-	"api.twilio.com",
-	"graph.microsoft.com",
-	"mmg.whatsapp.net"
-];
-const DEFAULT_SUFFIX_HOSTS = [
-	".s3.amazonaws.com",
-	".amazonaws.com",
-	".twiliocdn.com",
-	".cdn.discordapp.com",
-	".discordapp.net",
-	".telegram.org",
-	".alfe.ai"
-];
-function parseExtraHosts(raw) {
-	const exact = /* @__PURE__ */ new Set();
-	const suffix = [];
-	if (!raw) return {
-		exact,
-		suffix
-	};
-	for (const part of raw.split(",")) {
-		const trimmed = part.trim().toLowerCase();
-		if (!trimmed) continue;
-		if (trimmed.startsWith(".")) suffix.push(trimmed);
-		else exact.add(trimmed);
-	}
-	return {
-		exact,
-		suffix
-	};
-}
-function isIpLiteral(host) {
-	if (host.startsWith("[") && host.endsWith("]")) return true;
-	return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
-}
-function validateAttachmentUrl(input, opts = {}) {
-	if (!input || input.trim() === "") return {
-		ok: false,
-		reason: "empty"
-	};
-	let url;
-	try {
-		url = new URL(input);
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid_url"
-		};
-	}
-	if (url.protocol !== "https:") return {
-		ok: false,
-		reason: "not_https"
-	};
-	if (url.username !== "" || url.password !== "") return {
-		ok: false,
-		reason: "userinfo_not_allowed"
-	};
-	const host = url.hostname.toLowerCase();
-	if (!host) return {
-		ok: false,
-		reason: "empty_host"
-	};
-	if (isIpLiteral(host)) return {
-		ok: false,
-		reason: "ip_literal"
-	};
-	if (host === "localhost" || host === "metadata" || host === "metadata.google.internal") return {
-		ok: false,
-		reason: "blocked_host"
-	};
-	const extra = parseExtraHosts(opts.extraHosts ?? process.env.ALFE_ATTACHMENT_ALLOWED_HOSTS);
-	if (new Set([...DEFAULT_EXACT_HOSTS.map((h) => h.toLowerCase()), ...extra.exact]).has(host)) return { ok: true };
-	if ([...DEFAULT_SUFFIX_HOSTS.map((h) => h.toLowerCase()), ...extra.suffix].some((rule) => host === rule.slice(1) || host.endsWith(rule))) return { ok: true };
-	return {
-		ok: false,
-		reason: "host_not_in_allowlist"
-	};
-}
-//#endregion
 //#region src/activity-serialize.ts
 /**
 * Console-grade tool-activity serialization (Slice 3).
@@ -873,99 +655,514 @@ function extractResultText(result) {
 	return parts.join("\n");
 }
 //#endregion
-//#region src/think-tags.ts
+//#region src/think-tags.ts
+/**
+* Inline `<think>` span handling for assistant text.
+*
+* Reasoning models routed through the AI proxy (DeepSeek `deepseek-*`,
+* Zhipu `glm-*`, …) emit their reasoning INLINE as `<think>…</think>` inside
+* the normal content stream instead of a structured thinking channel. The
+* openclaw-chat plugin (0.4.0+) diverts those spans into thinking activity
+* frames at the source; this relay-side copy is the DEFENSIVE layer for
+* agents still running older plugin versions — leaked reasoning is dropped
+* here, never synthesized into activity (that's the plugin's job).
+*
+* KEEP IN SYNC (byte-identical): this module exists at BOTH
+*   `services/chat/src/lib/think-tags.ts`        (relay, defensive layer)
+*   `packages/openclaw-chat/src/think-tags.ts`   (plugin, at-source divert)
+* The published plugin cannot import service internals, so the module is
+* duplicated, same as the ChatActivity shape.
+*
+* Known accepted limitation: a literal `<think>` in legitimate prose or a
+* code fence is treated as reasoning and stripped/diverted.
+*/
+const OPEN_TAG = "<think>";
+const CLOSE_TAG = "</think>";
+/**
+* Split CUMULATIVE assistant text into the user-visible part and the
+* reasoning part.
+*
+* Invariant (load-bearing): for successive cumulative snapshots that grow by
+* appending, `visible` is monotonically append-only — `visible(n)` is always
+* a prefix of `visible(n + 1)`. The delta relays slice by a `lastSentLength`
+* offset into this string; if `visible` ever shrank or rewrote earlier
+* characters, clients would receive corrupted deltas. This holds because the
+* scan is deterministic left-to-right and a trailing PARTIAL tag (any strict
+* prefix of the next expected tag, e.g. `"<thi"` or `"</th"`) is HELD BACK
+* from both outputs until later text disambiguates it.
+*/
+function splitThinkTags(cumulative) {
+	let visible = "";
+	let thinking = "";
+	let inThink = false;
+	let i = 0;
+	const n = cumulative.length;
+	while (i < n) {
+		const tag = inThink ? CLOSE_TAG : OPEN_TAG;
+		const idx = cumulative.indexOf(tag, i);
+		if (idx !== -1) {
+			const chunk = cumulative.slice(i, idx);
+			if (inThink) thinking += chunk;
+			else visible += chunk;
+			inThink = !inThink;
+			i = idx + tag.length;
+			continue;
+		}
+		let rest = cumulative.slice(i);
+		const held = trailingPartialTagLength(rest, tag);
+		if (held > 0) rest = rest.slice(0, rest.length - held);
+		if (inThink) thinking += rest;
+		else visible += rest;
+		break;
+	}
+	return {
+		visible,
+		thinking
+	};
+}
+/** Length of the longest strict prefix of `tag` that is a suffix of `text`. */
+function trailingPartialTagLength(text, tag) {
+	const max = Math.min(text.length, tag.length - 1);
+	for (let len = max; len > 0; len--) if (text.endsWith(tag.slice(0, len))) return len;
+	return 0;
+}
+/**
+* Strip `<think>…</think>` spans (and an unclosed trailing `<think>…`) from
+* FINAL text, then tidy the whitespace the spans leave behind.
+*
+* Idempotent — `stripThinkSpans(stripThinkSpans(x)) === stripThinkSpans(x)`.
+* New plugin + new relay both strip, so the second pass must be a no-op; the
+* fixpoint loop also covers pathological inputs where removing one span
+* makes the surrounding fragments form a new one.
+*
+* NOT for sliced/streaming paths — the trim + blank-line collapse breaks
+* prefix alignment with `lastSentLength`; those paths use
+* `splitThinkTags(...).visible` instead.
+*/
+function stripThinkSpans(text) {
+	let out = text;
+	let prev;
+	do {
+		prev = out;
+		out = out.replace(/<think>[\s\S]*?<\/think>/g, "");
+	} while (out !== prev);
+	out = out.replace(/<think>[\s\S]*$/, "");
+	return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+//#endregion
+//#region src/transcript-activity.ts
+/**
+* Transcript-backed activity history — read tool calls + thinking for a
+* conversation from OPENCLAW'S OWN session transcripts.
+*
+* Why: every chat turn dispatches through OpenClaw's standard pipeline,
+* which records a full per-session JSONL transcript (assistant `thinking`
+* and `toolCall` content parts, separate `toolResult` messages, exact
+* timestamps) under `~/.openclaw/agents/{agentId}/sessions/`. That store is
+* the console's history source and has FULL fidelity — including turns
+* that ran before this plugin started persisting its own activity records.
+* `sessions.get` therefore prefers the transcript; the plugin's own
+* `SessionData.activity` records remain the FALLBACK for transcripts that
+* are missing (deleted / rotated / compacted).
+*
+* Layout (verified against openclaw 2026.5.x, matches the plugin-sdk's
+* `resolveSessionTranscriptPathInDir`):
+*   {storeDir}/sessions.json               — index: sessionKey → {sessionId}
+*   {storeDir}/{sessionId}.jsonl           — the transcript
+* where `storePath` (as returned by dispatchInboundDirectDmWithRuntime)
+* points at sessions.json.
+*
+* Conversation → transcript mapping: routes recorded at dispatch time
+* (exact sessionKey + storePath) cover every conversation shape going
+* forward. The additional `:conv:{conversationId}` index scan is the
+* RETROACTIVE path for conversations that predate route recording — it
+* only applies to DIRECT web-chat conversations (their peer id embeds the
+* `:conv:` segment); group and single-threaded SMS/WhatsApp keys carry no
+* such segment and rely entirely on recorded routes. All matched sessions
+* (a direct conversation can span one per sender) merge by timestamp.
+*/
+const MAX_ENTRIES = 500;
+const MAX_THINKING_CHARS = 16e3;
+const MAX_TRANSCRIPT_BYTES = 4 * 1024 * 1024;
+/** Default OpenClaw store for the daemon's single agent ("main"). */
+function defaultStorePath() {
+	return join(homedir(), ".openclaw", "agents", "main", "sessions", "sessions.json");
+}
+function parseTs(iso) {
+	const ts = iso ? Date.parse(iso) : NaN;
+	return Number.isFinite(ts) ? ts : 0;
+}
+/**
+* Read at most the trailing MAX_TRANSCRIPT_BYTES of a transcript. When the
+* cap truncates, the first (partial) line is dropped so parsing starts on a
+* record boundary. Returns null when the file is unreadable.
+*/
+async function readTranscriptTail(path) {
+	try {
+		const handle = await open(path, "r");
+		try {
+			const { size } = await handle.stat();
+			if (size <= MAX_TRANSCRIPT_BYTES) return await handle.readFile({ encoding: "utf-8" });
+			const buf = Buffer.alloc(MAX_TRANSCRIPT_BYTES);
+			await handle.read(buf, 0, MAX_TRANSCRIPT_BYTES, size - MAX_TRANSCRIPT_BYTES);
+			const text = buf.toString("utf-8");
+			const firstNewline = text.indexOf("\n");
+			return firstNewline === -1 ? "" : text.slice(firstNewline + 1);
+		} finally {
+			await handle.close();
+		}
+	} catch {
+		return null;
+	}
+}
+/**
+* Find the transcript files for a conversation: exact route matches first,
+* then an index scan for `:conv:{conversationId}` keys (retroactive path).
+* Returns absolute jsonl paths, deduped.
+*/
+async function resolveTranscriptPaths(conversationId, routes) {
+	const storePaths = new Set((routes ?? []).map((r) => r.storePath));
+	if (storePaths.size === 0) storePaths.add(defaultStorePath());
+	const routeKeys = new Set((routes ?? []).map((r) => r.sessionKey));
+	const convSegment = `:conv:${conversationId}`;
+	const files = /* @__PURE__ */ new Set();
+	for (const storePath of storePaths) {
+		let index;
+		try {
+			index = JSON.parse(await readFile(storePath, "utf-8"));
+		} catch {
+			continue;
+		}
+		const dir = dirname(storePath);
+		for (const [key, entry] of Object.entries(index)) {
+			if (!entry.sessionId) continue;
+			if (!(routeKeys.has(key) || key.endsWith(convSegment) || key.includes(`${convSegment}:`))) continue;
+			if (!/^[A-Za-z0-9._-]+$/.test(entry.sessionId)) continue;
+			files.add(join(dir, `${entry.sessionId}.jsonl`));
+		}
+	}
+	return [...files];
+}
+/**
+* Parse one transcript file into terminal activity records.
+*
+* - assistant `thinking` parts (and `<think>`-tagged text for inline
+*   reasoning models) aggregate into ONE thinking record per assistant
+*   message;
+* - `toolCall` parts open a tool record; the matching `toolResult` message
+*   completes it (status/result). Tools with no result stay `interrupted`.
+*/
+async function parseTranscriptActivity(path) {
+	const raw = await readTranscriptTail(path);
+	if (raw === null) return [];
+	const records = [];
+	const openTools = /* @__PURE__ */ new Map();
+	for (const line of raw.split("\n")) {
+		if (!line.trim()) continue;
+		let entry;
+		try {
+			entry = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (entry.type !== "message" || !entry.message) continue;
+		const ts = parseTs(entry.timestamp);
+		const msg = entry.message;
+		if (msg.role === "assistant" && Array.isArray(msg.content)) {
+			let thinkingText = "";
+			const tools = [];
+			for (const part of msg.content) if (part.type === "thinking" && typeof part.thinking === "string") thinkingText += part.thinking;
+			else if (part.type === "text" && typeof part.text === "string") thinkingText += splitThinkTags(part.text).thinking;
+			else if (part.type === "toolCall" && typeof part.id === "string" && typeof part.name === "string") {
+				const args = serializeArgs(part.arguments);
+				const tool = {
+					kind: "tool",
+					toolCallId: part.id,
+					name: part.name,
+					status: "interrupted",
+					...args ? { argsText: args.text } : {},
+					...args?.truncated ? { truncated: { args: true } } : {},
+					ts
+				};
+				openTools.set(part.id, tool);
+				tools.push(tool);
+			}
+			if (thinkingText.trim()) records.push({
+				kind: "thinking",
+				text: thinkingText.length > MAX_THINKING_CHARS ? thinkingText.slice(0, MAX_THINKING_CHARS) : thinkingText,
+				ts
+			});
+			records.push(...tools);
+			continue;
+		}
+		if (msg.role === "toolResult" && typeof msg.toolCallId === "string") {
+			const tool = openTools.get(msg.toolCallId);
+			if (!tool) continue;
+			tool.status = msg.isError === true ? "failed" : "done";
+			if (msg.isError === true) tool.isError = true;
+			const result = serializeResult({ content: msg.content });
+			if (result) {
+				tool.resultText = result.text;
+				if (result.truncated) tool.truncated = {
+					...tool.truncated ?? {},
+					result: true
+				};
+			}
+			openTools.delete(msg.toolCallId);
+		}
+	}
+	return records;
+}
+/**
+* Full conversation activity from OpenClaw's transcripts: resolve, parse,
+* merge (a group conversation can span several per-sender sessions), sort
+* by timestamp, keep the most recent MAX_ENTRIES. Empty array when no
+* transcript could be found — the caller falls back to the plugin's own
+* persisted activity records.
+*/
+async function collectTranscriptActivity(conversationId, routes) {
+	const paths = await resolveTranscriptPaths(conversationId, routes);
+	if (paths.length === 0) return [];
+	const merged = (await Promise.all(paths.map((p) => parseTranscriptActivity(p)))).flat().sort((a, b) => a.ts - b.ts);
+	return merged.length > MAX_ENTRIES ? merged.slice(merged.length - MAX_ENTRIES) : merged;
+}
+//#endregion
+//#region src/a2a-tools.ts
+let conversationEndRequested = false;
+let a2aTurnArmed = false;
+/**
+* Clear the end signal AND arm the gate. Call immediately before an A2A
+* dispatch. Arming is what permits `end_conversation` to set the flag for the
+* duration of this turn.
+*/
+function resetA2AEndSignal() {
+	conversationEndRequested = false;
+	a2aTurnArmed = true;
+}
+/**
+* Clear the end signal AND disarm the gate. Call after an A2A dispatch (in a
+* `finally`, so it also runs on error). Disarming closes the gate so a later
+* NON-A2A turn invoking `end_conversation` can't set a flag the next A2A turn
+* would read.
+*/
+function disarmA2AEndSignal() {
+	conversationEndRequested = false;
+	a2aTurnArmed = false;
+}
+/** True if `end_conversation` was invoked since the last reset. */
+function isA2AEndSignalled() {
+	return conversationEndRequested;
+}
+function ok(result) {
+	return { content: [{
+		type: "text",
+		text: JSON.stringify(result)
+	}] };
+}
+function errResult(message) {
+	return { content: [{
+		type: "text",
+		text: JSON.stringify({ error: message })
+	}] };
+}
+function defineTool(def) {
+	return {
+		name: def.name,
+		description: def.description,
+		label: def.name,
+		parameters: def.parameters,
+		execute: async (_toolCallId, params) => {
+			try {
+				return ok(await def.handler(params));
+			} catch (e) {
+				return errResult(e.message);
+			}
+		}
+	};
+}
+function buildA2ATools(getChatClient, log) {
+	const requireClient = () => {
+		const client = getChatClient();
+		if (!client) throw new Error("chat service not connected yet — try again in a moment");
+		return client;
+	};
+	return [
+		defineTool({
+			name: "list_agents",
+			description: "List other agents in your organization that you can communicate with.",
+			parameters: {
+				type: "object",
+				properties: {},
+				required: []
+			},
+			handler: async () => {
+				log.info("list_agents tool called");
+				return await requireClient().sendRequest("a2a.list-agents", {});
+			}
+		}),
+		defineTool({
+			name: "message_agent",
+			description: "Send a message to another agent. Starts a new conversation thread, or continues an existing one. The conversation will bounce back and forth automatically until one agent calls end_conversation() or says [RESOLVED].",
+			parameters: {
+				type: "object",
+				properties: {
+					agent_id: {
+						type: "string",
+						description: "Target agent ID (use list_agents to find available agents)"
+					},
+					message: {
+						type: "string",
+						description: "Message to send to the agent"
+					},
+					thread_id: {
+						type: "string",
+						description: "Continue an existing conversation thread (omit to start a new one)"
+					},
+					max_depth: {
+						type: "number",
+						description: "Maximum number of back-and-forth exchanges (default: 10)"
+					}
+				},
+				required: ["agent_id", "message"]
+			},
+			handler: async (params) => {
+				const agentId = params.agent_id;
+				const message = params.message;
+				const threadId = params.thread_id;
+				const maxDepth = params.max_depth ?? 10;
+				if (!agentId || !message) throw new Error("agent_id and message are required");
+				log.info(`message_agent tool: sending to ${agentId}`);
+				return await requireClient().sendRequest("a2a.send", {
+					targetAgentId: agentId,
+					message,
+					threadId,
+					maxDepth
+				});
+			}
+		}),
+		defineTool({
+			name: "end_conversation",
+			description: "End the current agent-to-agent conversation. Call this when the discussion is resolved and no further exchanges are needed.",
+			parameters: {
+				type: "object",
+				properties: { summary: {
+					type: "string",
+					description: "Brief summary of what was discussed or resolved"
+				} },
+				required: []
+			},
+			handler: (params) => {
+				const summary = params.summary;
+				log.info(`end_conversation tool called${summary ? `: ${summary}` : ""}`);
+				if (a2aTurnArmed) conversationEndRequested = true;
+				return Promise.resolve({
+					status: "conversation_ended",
+					summary
+				});
+			}
+		})
+	];
+}
+//#endregion
+//#region src/attachment-url.ts
 /**
-* Inline `<think>` span handling for assistant text.
-*
-* Reasoning models routed through the AI proxy (DeepSeek `deepseek-*`,
-* Zhipu `glm-*`, …) emit their reasoning INLINE as `<think>…</think>` inside
-* the normal content stream instead of a structured thinking channel. The
-* openclaw-chat plugin (0.4.0+) diverts those spans into thinking activity
-* frames at the source; this relay-side copy is the DEFENSIVE layer for
-* agents still running older plugin versions — leaked reasoning is dropped
-* here, never synthesized into activity (that's the plugin's job).
+* Attachment URL validation for the openclaw-chat plugin.
 *
-* KEEP IN SYNC (byte-identical): this module exists at BOTH
-*   `services/chat/src/lib/think-tags.ts`        (relay, defensive layer)
-*   `packages/openclaw-chat/src/think-tags.ts`   (plugin, at-source divert)
-* The published plugin cannot import service internals, so the module is
-* duplicated, same as the ChatActivity shape.
+* This package runs inside user-installed OpenClaw agents and has no
+* dependency on the internal @alfe/api-core SSRF validator, so the
+* plumbing is inlined here. The rules are deliberately conservative:
 *
-* Known accepted limitation: a literal `<think>` in legitimate prose or a
-* code fence is treated as reasoning and stripped/diverted.
-*/
-const OPEN_TAG = "<think>";
-const CLOSE_TAG = "</think>";
-/**
-* Split CUMULATIVE assistant text into the user-visible part and the
-* reasoning part.
+* - `https:` only.
+* - Userinfo (`https://u:p@host/...`) is rejected.
+* - IP-literal hosts (v4 or bracketed v6) are rejected outright — only
+*   DNS names for known provider CDNs are acceptable.
+* - The host must match a curated allowlist of Alfe-issued / channel-
+*   provider CDNs. Anything else is dropped before we fetch it.
 *
-* Invariant (load-bearing): for successive cumulative snapshots that grow by
-* appending, `visible` is monotonically append-only — `visible(n)` is always
-* a prefix of `visible(n + 1)`. The delta relays slice by a `lastSentLength`
-* offset into this string; if `visible` ever shrank or rewrote earlier
-* characters, clients would receive corrupted deltas. This holds because the
-* scan is deterministic left-to-right and a trailing PARTIAL tag (any strict
-* prefix of the next expected tag, e.g. `"<thi"` or `"</th"`) is HELD BACK
-* from both outputs until later text disambiguates it.
+* Operators running an agent in a private network that needs to dereference
+* additional hosts can extend the list via the
+* `ALFE_ATTACHMENT_ALLOWED_HOSTS` env var (comma-separated, entries prefixed
+* with `.` match suffixes).
 */
-function splitThinkTags(cumulative) {
-	let visible = "";
-	let thinking = "";
-	let inThink = false;
-	let i = 0;
-	const n = cumulative.length;
-	while (i < n) {
-		const tag = inThink ? CLOSE_TAG : OPEN_TAG;
-		const idx = cumulative.indexOf(tag, i);
-		if (idx !== -1) {
-			const chunk = cumulative.slice(i, idx);
-			if (inThink) thinking += chunk;
-			else visible += chunk;
-			inThink = !inThink;
-			i = idx + tag.length;
-			continue;
-		}
-		let rest = cumulative.slice(i);
-		const held = trailingPartialTagLength(rest, tag);
-		if (held > 0) rest = rest.slice(0, rest.length - held);
-		if (inThink) thinking += rest;
-		else visible += rest;
-		break;
+const DEFAULT_EXACT_HOSTS = [
+	"s3.amazonaws.com",
+	"api.twilio.com",
+	"graph.microsoft.com",
+	"mmg.whatsapp.net"
+];
+const DEFAULT_SUFFIX_HOSTS = [
+	".s3.amazonaws.com",
+	".amazonaws.com",
+	".twiliocdn.com",
+	".cdn.discordapp.com",
+	".discordapp.net",
+	".telegram.org",
+	".alfe.ai"
+];
+function parseExtraHosts(raw) {
+	const exact = /* @__PURE__ */ new Set();
+	const suffix = [];
+	if (!raw) return {
+		exact,
+		suffix
+	};
+	for (const part of raw.split(",")) {
+		const trimmed = part.trim().toLowerCase();
+		if (!trimmed) continue;
+		if (trimmed.startsWith(".")) suffix.push(trimmed);
+		else exact.add(trimmed);
 	}
 	return {
-		visible,
-		thinking
+		exact,
+		suffix
 	};
 }
-/** Length of the longest strict prefix of `tag` that is a suffix of `text`. */
-function trailingPartialTagLength(text, tag) {
-	const max = Math.min(text.length, tag.length - 1);
-	for (let len = max; len > 0; len--) if (text.endsWith(tag.slice(0, len))) return len;
-	return 0;
+function isIpLiteral(host) {
+	if (host.startsWith("[") && host.endsWith("]")) return true;
+	return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
 }
-/**
-* Strip `<think>…</think>` spans (and an unclosed trailing `<think>…`) from
-* FINAL text, then tidy the whitespace the spans leave behind.
-*
-* Idempotent — `stripThinkSpans(stripThinkSpans(x)) === stripThinkSpans(x)`.
-* New plugin + new relay both strip, so the second pass must be a no-op; the
-* fixpoint loop also covers pathological inputs where removing one span
-* makes the surrounding fragments form a new one.
-*
-* NOT for sliced/streaming paths — the trim + blank-line collapse breaks
-* prefix alignment with `lastSentLength`; those paths use
-* `splitThinkTags(...).visible` instead.
-*/
-function stripThinkSpans(text) {
-	let out = text;
-	let prev;
-	do {
-		prev = out;
-		out = out.replace(/<think>[\s\S]*?<\/think>/g, "");
-	} while (out !== prev);
-	out = out.replace(/<think>[\s\S]*$/, "");
-	return out.replace(/\n{3,}/g, "\n\n").trim();
+function validateAttachmentUrl(input, opts = {}) {
+	if (!input || input.trim() === "") return {
+		ok: false,
+		reason: "empty"
+	};
+	let url;
+	try {
+		url = new URL(input);
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid_url"
+		};
+	}
+	if (url.protocol !== "https:") return {
+		ok: false,
+		reason: "not_https"
+	};
+	if (url.username !== "" || url.password !== "") return {
+		ok: false,
+		reason: "userinfo_not_allowed"
+	};
+	const host = url.hostname.toLowerCase();
+	if (!host) return {
+		ok: false,
+		reason: "empty_host"
+	};
+	if (isIpLiteral(host)) return {
+		ok: false,
+		reason: "ip_literal"
+	};
+	if (host === "localhost" || host === "metadata" || host === "metadata.google.internal") return {
+		ok: false,
+		reason: "blocked_host"
+	};
+	const extra = parseExtraHosts(opts.extraHosts ?? process.env.ALFE_ATTACHMENT_ALLOWED_HOSTS);
+	if (new Set([...DEFAULT_EXACT_HOSTS.map((h) => h.toLowerCase()), ...extra.exact]).has(host)) return { ok: true };
+	if ([...DEFAULT_SUFFIX_HOSTS.map((h) => h.toLowerCase()), ...extra.suffix].some((rule) => host === rule.slice(1) || host.endsWith(rule))) return { ok: true };
+	return {
+		ok: false,
+		reason: "host_not_in_allowlist"
+	};
 }
 //#endregion
 //#region src/plugin.ts
@@ -1622,7 +1819,7 @@ async function handleAgentRequest(request, log) {
 			requestSessionKey: legacySessionKey,
 			routeSessionKey
 		};
-		runGate.sessionKey = (await dispatchInbound({
+		const result = await dispatchInbound({
 			cfg,
 			runtime: { channel: runtime.channel },
 			channel: "alfe",
@@ -1680,7 +1877,14 @@ async function handleAgentRequest(request, log) {
 			onDispatchError: (err, info) => {
 				log.error(`Dispatch error (${info.kind}): ${err instanceof Error ? err.message : String(err)}`);
 			}
-		})).route.sessionKey;
+		});
+		runGate.sessionKey = result.route.sessionKey;
+		recordRoute(sessionId, {
+			sessionKey: result.route.sessionKey,
+			storePath: result.storePath
+		}).catch((err) => {
+			log.warn(`recordRoute failed: ${err instanceof Error ? err.message : String(err)}`);
+		});
 		if (isA2A) {
 			const a2aResolved = isA2AEndSignalled();
 			chatClient?.notify("a2a-complete", buildA2ACompletePayload({
@@ -1723,6 +1927,20 @@ async function handleSessionsList(request, log) {
 		chatClient?.sendResponse(request.id, false, { message: errMsg });
 	}
 }
+/**
+* History activity for a conversation: OpenClaw's own transcript is the
+* PRIMARY source (full fidelity — tool results included — and retroactive
+* for conversations that predate the plugin's activity persistence); the
+* plugin's per-turn records are the fallback for missing/rotated
+* transcripts. Never throws — history must not fail a sessions.get.
+*/
+async function resolveHistoryActivity(session) {
+	try {
+		const fromTranscript = await collectTranscriptActivity(session.sessionId, session.routes);
+		if (fromTranscript.length > 0) return fromTranscript;
+	} catch {}
+	return (session.activity ?? []).map((a) => ({ ...a }));
+}
 async function handleSessionsGet(request, log) {
 	try {
 		const params = request.params;
@@ -1754,7 +1972,7 @@ async function handleSessionsGet(request, log) {
 				content: m.content,
 				timestamp: m.timestamp
 			})),
-			activity: (session.activity ?? []).map((a) => ({ ...a }))
+			activity: await resolveHistoryActivity(session)
 		});
 	} catch (err) {
 		const errMsg = err instanceof Error ? err.message : String(err);
@@ -1894,7 +2112,7 @@ const plugin = {
 						content: m.content,
 						timestamp: m.timestamp
 					})),
-					activity: (session.activity ?? []).map((a) => ({ ...a }))
+					activity: await resolveHistoryActivity(session)
 				};
 			});
 			gw.__alfeChatGatewayMethodsRegistered = true;