@alfe.ai/openclaw-chat 0.9.8 → 0.9.10

package/dist/plugin2.cjs

@@ -1,4 +1,5 @@
 let node_module = require("node:module");
+let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_fs = require("node:fs");
 let node_child_process = require("node:child_process");
@@ -7,7 +8,7 @@ let node_url = require("node:url");
 let node_os = require("node:os");
 let _alfe_ai_chat = require("@alfe.ai/chat");
 let _alfe_ai_agent_api_client = require("@alfe.ai/agent-api-client");
-let node_crypto = require("node:crypto");
+let _alfe_ai_openclaw_plugin_kit = require("@alfe.ai/openclaw-plugin-kit");
 let _alfe_ai_config = require("@alfe.ai/config");
 //#region src/outbound-media.ts
 /**
@@ -154,29 +155,40 @@ async function uploadLocalFile(localPath, log, deps) {
 	const client = deps.getClient ? deps.getClient() : getUploadClient(log);
 	if (!client) return null;
 	let size;
+	let body;
 	try {
-		const st = await (0, node_fs_promises.stat)(localPath);
-		if (!st.isFile()) {
-			log.warn(`Outbound media ref is not a file — skipping: ${localPath}`);
-			return null;
+		const handle = await (0, node_fs_promises.open)(localPath, node_fs.constants.O_RDONLY | node_fs.constants.O_NOFOLLOW);
+		try {
+			const before = await handle.stat();
+			if (!before.isFile()) {
+				log.warn(`Outbound media ref is not a file — skipping: ${localPath}`);
+				return null;
+			}
+			size = before.size;
+			if (size <= 0) {
+				log.warn(`Outbound media file is empty — skipping: ${localPath}`);
+				return null;
+			}
+			if (size > 26214400) {
+				log.warn(`Outbound media exceeds ${String(MAX_OUTBOUND_MEDIA_SIZE)} bytes (${String(size)}) — skipping: ${localPath}`);
+				return null;
+			}
+			body = Uint8Array.from(await handle.readFile());
+			const after = await handle.stat();
+			if (after.dev !== before.dev || after.ino !== before.ino || after.size !== before.size || body.length !== before.size) {
+				log.warn(`Outbound media changed while being read — skipping: ${localPath}`);
+				return null;
+			}
+		} finally {
+			await handle.close();
 		}
-		size = st.size;
 	} catch {
 		log.warn(`Outbound media file not found — skipping: ${localPath}`);
 		return null;
 	}
-	if (size <= 0) {
-		log.warn(`Outbound media file is empty — skipping: ${localPath}`);
-		return null;
-	}
-	if (size > 26214400) {
-		log.warn(`Outbound media exceeds ${String(MAX_OUTBOUND_MEDIA_SIZE)} bytes (${String(size)}) — skipping: ${localPath}`);
-		return null;
-	}
 	const filename = (0, node_path.basename)(localPath);
 	const mimeType = mimeFromPath(localPath);
 	try {
-		const body = await (0, node_fs_promises.readFile)(localPath);
 		const { attachments } = await client.presignAttachments([{
 			filename,
 			mimeType,
@@ -407,13 +419,17 @@ function isSafeComponentUrl(raw) {
 		return false;
 	}
 	if (u.protocol !== "https:") return false;
+	if (u.username || u.password) return false;
 	const host = u.hostname.toLowerCase();
 	return host === "alfe.ai" || host.endsWith(".alfe.ai");
 }
 const MAX_COMPONENTS_PER_MESSAGE = 10;
-const MAX_COMPONENT_LABEL_CHARS = 120;
-const MAX_COMPONENT_VALUE_CHARS = 400;
+const MAX_COMPONENT_LABEL_CHARS$1 = 120;
+const MAX_COMPONENT_VALUE_CHARS$1 = 400;
 const MAX_OPTIONS_PER_COMPONENT = 25;
+const MAX_COMPONENT_ID_CHARS$1 = 128;
+const MAX_CONVERSATION_ID_CHARS = 512;
+const MAX_USER_ID_CHARS = 256;
 /** Cap a maybe-string; returns '' for non-strings so callers can `if (!x)`. */
 function capStr(v, max) {
 	return typeof v === "string" ? v.slice(0, max) : "";
@@ -430,8 +446,8 @@ function sanitizeOptions(raw) {
 		if (out.length >= MAX_OPTIONS_PER_COMPONENT) break;
 		if (!item || typeof item !== "object") continue;
 		const o = item;
-		const label = capStr(o.label, MAX_COMPONENT_LABEL_CHARS);
-		const value = capStr(o.value, MAX_COMPONENT_VALUE_CHARS);
+		const label = capStr(o.label, MAX_COMPONENT_LABEL_CHARS$1);
+		const value = capStr(o.value, MAX_COMPONENT_VALUE_CHARS$1);
 		if (!label || !value) continue;
 		out.push({
 			label,
@@ -457,8 +473,8 @@ function sanitizeComponents(raw) {
 		if (out.length >= MAX_COMPONENTS_PER_MESSAGE) break;
 		if (!item || typeof item !== "object") continue;
 		const c = item;
-		const label = capStr(c.label, MAX_COMPONENT_LABEL_CHARS);
-		let id = typeof c.id === "string" && c.id ? c.id : (0, node_crypto.randomUUID)();
+		const label = capStr(c.label, MAX_COMPONENT_LABEL_CHARS$1);
+		let id = typeof c.id === "string" && c.id ? c.id.slice(0, MAX_COMPONENT_ID_CHARS$1) : (0, node_crypto.randomUUID)();
 		if (usedIds.has(id)) id = (0, node_crypto.randomUUID)();
 		usedIds.add(id);
 		const style = c.style === "primary" || c.style === "secondary" || c.style === "danger" ? c.style : void 0;
@@ -476,7 +492,7 @@ function sanitizeComponents(raw) {
 			});
 		} else if (c.type === "quick_reply") {
 			if (!label) continue;
-			const value = capStr(c.value, MAX_COMPONENT_VALUE_CHARS);
+			const value = capStr(c.value, MAX_COMPONENT_VALUE_CHARS$1);
 			if (!value) continue;
 			out.push({
 				type: "quick_reply",
@@ -488,7 +504,7 @@ function sanitizeComponents(raw) {
 		} else if (c.type === "select") {
 			const options = sanitizeOptions(c.options);
 			if (options.length === 0) continue;
-			const placeholder = capStr(c.placeholder, MAX_COMPONENT_LABEL_CHARS);
+			const placeholder = capStr(c.placeholder, MAX_COMPONENT_LABEL_CHARS$1);
 			out.push({
 				type: "select",
 				id,
@@ -499,7 +515,7 @@ function sanitizeComponents(raw) {
 		} else if (c.type === "multi_select") {
 			const options = sanitizeOptions(c.options);
 			if (options.length === 0) continue;
-			const submitLabel = capStr(c.submitLabel, MAX_COMPONENT_LABEL_CHARS);
+			const submitLabel = capStr(c.submitLabel, MAX_COMPONENT_LABEL_CHARS$1);
 			out.push({
 				type: "multi_select",
 				id,
@@ -508,11 +524,11 @@ function sanitizeComponents(raw) {
 				...submitLabel ? { submitLabel } : {}
 			});
 		} else if (c.type === "confirm") {
-			const confirmLabel = capStr(c.confirmLabel, MAX_COMPONENT_LABEL_CHARS);
-			const confirmValue = capStr(c.confirmValue, MAX_COMPONENT_VALUE_CHARS);
+			const confirmLabel = capStr(c.confirmLabel, MAX_COMPONENT_LABEL_CHARS$1);
+			const confirmValue = capStr(c.confirmValue, MAX_COMPONENT_VALUE_CHARS$1);
 			if (!confirmLabel || !confirmValue) continue;
-			const cancelLabel = capStr(c.cancelLabel, MAX_COMPONENT_LABEL_CHARS);
-			const cancelValue = capStr(c.cancelValue, MAX_COMPONENT_VALUE_CHARS);
+			const cancelLabel = capStr(c.cancelLabel, MAX_COMPONENT_LABEL_CHARS$1);
+			const cancelValue = capStr(c.cancelValue, MAX_COMPONENT_VALUE_CHARS$1);
 			out.push({
 				type: "confirm",
 				id,
@@ -520,11 +536,11 @@ function sanitizeComponents(raw) {
 				confirmLabel,
 				confirmValue,
 				...cancelLabel ? { cancelLabel } : {},
-				...cancelValue ? { cancelValue } : {}
+				...cancelLabel && cancelValue ? { cancelValue } : {}
 			});
 		} else if (c.type === "copy_button") {
 			if (!label) continue;
-			const value = capStr(c.value, MAX_COMPONENT_VALUE_CHARS);
+			const value = capStr(c.value, MAX_COMPONENT_VALUE_CHARS$1);
 			if (!value) continue;
 			out.push({
 				type: "copy_button",
@@ -538,6 +554,23 @@ function sanitizeComponents(raw) {
 }
 const CHANNEL_ID = "alfe";
 const DEFAULT_ACCOUNT_ID = "default";
+/** Persist only bucket-backed media; passthrough URLs have no stable id. */
+function mediaToStoredAttachments(media) {
+	const stored = [];
+	for (const item of media) {
+		if (!item.attachmentId) continue;
+		const mimeType = item.mimeType ?? "application/octet-stream";
+		const type = mimeType.startsWith("image/") ? "image" : mimeType.startsWith("video/") ? "video" : mimeType.startsWith("audio/") ? "audio" : mimeType === "application/pdf" ? "document" : "file";
+		stored.push({
+			attachmentId: item.attachmentId,
+			type,
+			mimeType,
+			filename: item.filename ?? "file",
+			...typeof item.size === "number" && item.size > 0 ? { size: item.size } : {}
+		});
+	}
+	return stored.length ? stored : void 0;
+}
 async function sendViaChat(deps, ctx, mediaUrl, components) {
 	const client = deps.getChatClient();
 	if (!client) throw new Error("Chat service not connected — cannot deliver");
@@ -563,7 +596,8 @@ async function sendViaChat(deps, ctx, mediaUrl, components) {
 			await deps.createSession(conversationId, "", "alfe", void 0, userId);
 		}
 	}
-	if (components?.length) await deps.addMessage(conversationId, "assistant", text, void 0, void 0, components);
+	const storedMedia = mediaToStoredAttachments(media.attachments);
+	if (components?.length || storedMedia?.length) await deps.addMessage(conversationId, "assistant", text, void 0, void 0, components, storedMedia);
 	else await deps.addMessage(conversationId, "assistant", text);
 	const messageId = (0, node_crypto.randomUUID)();
 	client.notify("agent-message", {
@@ -701,17 +735,22 @@ function createAlfeChannelPlugin(deps) {
 					error: /* @__PURE__ */ new Error("Missing target — use user:{userId} or conv:{conversationId}")
 				};
 				if (to.startsWith("conv:")) {
-					if (!to.slice(5)) return {
+					const convId = to.slice(5);
+					if (!convId) return {
 						ok: false,
 						error: /* @__PURE__ */ new Error("Empty conversation ID")
 					};
+					if (convId.length > MAX_CONVERSATION_ID_CHARS || /\s/.test(convId)) return {
+						ok: false,
+						error: /* @__PURE__ */ new Error("Invalid conversation ID")
+					};
 					return {
 						ok: true,
 						to
 					};
 				}
 				const userId = to.startsWith("user:") ? to.slice(5) : to;
-				if (!userId || userId === "anon") return {
+				if (!userId || userId === "anon" || userId.length > MAX_USER_ID_CHARS || /\s/.test(userId)) return {
 					ok: false,
 					error: /* @__PURE__ */ new Error("Invalid target: userId is required")
 				};
@@ -749,18 +788,27 @@ function createAlfeChannelPlugin(deps) {
 				return params.accountId ?? DEFAULT_ACCOUNT_ID;
 			},
 			applyAccountConfig(params) {
-				const cfg = { ...params.cfg };
-				cfg.channels ??= {};
-				cfg.channels.alfe ??= {};
-				const section = cfg.channels.alfe;
+				const previousChannels = params.cfg.channels ?? {};
+				const previousSection = previousChannels.alfe ?? {};
+				const section = {
+					...previousSection,
+					...previousSection.accounts ? { accounts: { ...previousSection.accounts } } : {}
+				};
+				const cfg = {
+					...params.cfg,
+					channels: {
+						...previousChannels,
+						alfe: section
+					}
+				};
 				if (params.accountId === DEFAULT_ACCOUNT_ID) section.enabled = true;
-				else {
-					section.accounts ??= {};
-					section.accounts[params.accountId] = {
-						enabled: true,
-						...params.input
-					};
-				}
+				else section.accounts = {
+					...section.accounts,
+					[params.accountId]: {
+						...params.input,
+						enabled: true
+					}
+				};
 				return cfg;
 			}
 		}
@@ -775,8 +823,7 @@ function createAlfeChannelPlugin(deps) {
 function isAlfeSessionKey(key) {
 	if (key.startsWith("alfe:")) return true;
 	if (key.includes(":alfe:")) return true;
-	if (key.includes("chat-") || key.startsWith("sms-") || key.startsWith("wa-")) return true;
-	return false;
+	return /^(?:agent:[^:]+:)?(?:chat-|sms-|wa-)/.test(key);
 }
 /**
 * Extract the channel mode from a standardized session key or conversationId.
@@ -786,6 +833,25 @@ function extractChannelMode(conversationId, fallback = "chat") {
 	return /^alfe:(\w+):/.exec(conversationId)?.[1] ?? fallback;
 }
 //#endregion
+//#region src/inbound-hook-routing.ts
+/**
+* Preserve Alfe's authoritative identity route on OpenClaw's canonical inbound
+* fields. Arbitrary `extraContext` values are not copied into plugin message
+* hooks, while these fields become `metadata.provider`, `ctx.channelId`, and
+* `ctx.conversationId` respectively.
+*/
+function buildInboundHookRouting(identityProvider, channelMode, conversationId) {
+	const explicitProvider = identityProvider?.trim();
+	const modeProvider = channelMode.trim();
+	const provider = explicitProvider && explicitProvider.length > 0 ? explicitProvider : modeProvider.length > 0 ? modeProvider : "chat";
+	return {
+		provider,
+		surface: "alfe",
+		originatingChannel: provider,
+		...conversationId ? { originatingTo: conversationId } : {}
+	};
+}
+//#endregion
 //#region src/session-store.ts
 /**
 * Session Store — persists chat sessions to the local filesystem.
@@ -812,6 +878,94 @@ async function ensureDir() {
 function sessionPath(sessionId) {
 	return (0, node_path.join)(SESSIONS_DIR, `${sessionId.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
 }
+function isRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isOptionalString(value) {
+	return value === void 0 || typeof value === "string";
+}
+function isOptionalBoolean(value) {
+	return value === void 0 || typeof value === "boolean";
+}
+function isStoredSelectOption(value) {
+	return isRecord(value) && typeof value.label === "string" && typeof value.value === "string";
+}
+function isStoredMessageComponent(value) {
+	if (!isRecord(value) || typeof value.type !== "string" || typeof value.id !== "string") return false;
+	if (!(value.style === void 0 || typeof value.style === "string" && [
+		"primary",
+		"secondary",
+		"danger"
+	].includes(value.style))) return false;
+	switch (value.type) {
+		case "link_button": return typeof value.label === "string" && typeof value.url === "string" && (value.target === void 0 || typeof value.target === "string" && [
+			"same-tab",
+			"new-tab",
+			"popup"
+		].includes(value.target));
+		case "quick_reply": return typeof value.label === "string" && typeof value.value === "string";
+		case "select": return isOptionalString(value.label) && isOptionalString(value.placeholder) && Array.isArray(value.options) && value.options.every(isStoredSelectOption);
+		case "multi_select": return isOptionalString(value.label) && isOptionalString(value.submitLabel) && Array.isArray(value.options) && value.options.every(isStoredSelectOption);
+		case "confirm": return isOptionalString(value.label) && typeof value.confirmLabel === "string" && typeof value.confirmValue === "string" && isOptionalString(value.cancelLabel) && isOptionalString(value.cancelValue);
+		case "copy_button": return typeof value.label === "string" && typeof value.value === "string";
+		default: return false;
+	}
+}
+function isStoredAttachment(value) {
+	return isRecord(value) && typeof value.attachmentId === "string" && typeof value.type === "string" && [
+		"image",
+		"video",
+		"audio",
+		"document",
+		"file"
+	].includes(value.type) && typeof value.mimeType === "string" && typeof value.filename === "string" && (value.size === void 0 || typeof value.size === "number" && Number.isFinite(value.size) && value.size >= 0);
+}
+function isChatActivityRecord(value) {
+	if (!isRecord(value) || typeof value.ts !== "number" || !Number.isFinite(value.ts)) return false;
+	if (value.kind === "thinking") return typeof value.text === "string";
+	if (value.kind !== "tool") return false;
+	if (typeof value.toolCallId !== "string" || typeof value.name !== "string" || typeof value.status !== "string" || ![
+		"done",
+		"failed",
+		"interrupted"
+	].includes(value.status) || !isOptionalString(value.summary) || !isOptionalString(value.argsText) || !isOptionalString(value.resultText) || !isOptionalBoolean(value.isError) || value.durationMs !== void 0 && (typeof value.durationMs !== "number" || !Number.isFinite(value.durationMs) || value.durationMs < 0)) return false;
+	if (value.truncated === void 0) return true;
+	return isRecord(value.truncated) && isOptionalBoolean(value.truncated.args) && isOptionalBoolean(value.truncated.progress) && isOptionalBoolean(value.truncated.result);
+}
+function isStoredRoute(value) {
+	return isRecord(value) && typeof value.sessionKey === "string" && typeof value.storePath === "string";
+}
+/** Parse the local persistence boundary without trusting a JSON cast. */
+function asSessionData(value, expectedSessionId) {
+	if (!isRecord(value)) return null;
+	const record = value;
+	if (typeof record.sessionId !== "string" || expectedSessionId !== void 0 && record.sessionId !== expectedSessionId || typeof record.agentId !== "string" || typeof record.channel !== "string" || !isOptionalString(record.tenantId) || !isOptionalString(record.userId) || typeof record.createdAt !== "string" || typeof record.updatedAt !== "string" || !Array.isArray(record.messages)) return null;
+	if (!record.messages.every((message) => {
+		if (!message || typeof message !== "object" || Array.isArray(message)) return false;
+		const item = message;
+		return (item.role === "user" || item.role === "assistant") && typeof item.content === "string" && typeof item.timestamp === "number" && Number.isFinite(item.timestamp) && isOptionalString(item.senderId) && isOptionalString(item.senderName) && (item.components === void 0 || Array.isArray(item.components) && item.components.every(isStoredMessageComponent)) && (item.attachments === void 0 || Array.isArray(item.attachments) && item.attachments.every(isStoredAttachment));
+	})) return null;
+	if (record.activity !== void 0 && (!Array.isArray(record.activity) || !record.activity.every(isChatActivityRecord))) return null;
+	if (record.routes !== void 0 && (!Array.isArray(record.routes) || !record.routes.every(isStoredRoute))) return null;
+	return record;
+}
+/**
+* Replace a session file atomically with owner-only permissions. Temporary
+* names never end in `.json`, so list/backfill scanners ignore crash debris.
+*/
+async function writeTextAtomically(path, contents) {
+	const temporary = (0, node_path.join)((0, node_path.dirname)(path), `.${(0, node_path.basename)(path)}.${String(process.pid)}.${(0, node_crypto.randomUUID)()}.tmp`);
+	try {
+		await (0, node_fs_promises.writeFile)(temporary, contents, {
+			encoding: "utf-8",
+			mode: 384
+		});
+		await (0, node_fs_promises.rename)(temporary, path);
+	} catch (error) {
+		await (0, node_fs_promises.unlink)(temporary).catch(() => void 0);
+		throw error;
+	}
+}
 async function cleanupOldSessions() {
 	if (Date.now() - lastCleanupAt < CLEANUP_INTERVAL_MS) return;
 	try {
@@ -822,6 +976,7 @@ async function cleanupOldSessions() {
 				const filePath = (0, node_path.join)(SESSIONS_DIR, file);
 				if (now - (await (0, node_fs_promises.stat)(filePath)).mtimeMs > MAX_AGE_MS) await (0, node_fs_promises.unlink)(filePath);
 			} catch {}
+			lastCleanupAt = Date.now();
 			return;
 		}
 		const fileStats = [];
@@ -849,7 +1004,7 @@ async function cleanupOldSessions() {
 async function getSession(sessionId) {
 	try {
 		const data = await (0, node_fs_promises.readFile)(sessionPath(sessionId), "utf-8");
-		return JSON.parse(data);
+		return asSessionData(JSON.parse(data), sessionId);
 	} catch {
 		return null;
 	}
@@ -857,7 +1012,7 @@ async function getSession(sessionId) {
 async function saveSession(session) {
 	await ensureDir();
 	session.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-	await (0, node_fs_promises.writeFile)(sessionPath(session.sessionId), JSON.stringify(session, null, 2), "utf-8");
+	await writeTextAtomically(sessionPath(session.sessionId), JSON.stringify(session, null, 2));
 }
 async function createSession(sessionId, agentId, channel, tenantId, userId) {
 	const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -953,7 +1108,8 @@ async function listSessions(filters, limit = 50) {
 	const summaries = [];
 	for (const file of jsonFiles) try {
 		const data = await (0, node_fs_promises.readFile)((0, node_path.join)(SESSIONS_DIR, file), "utf-8");
-		const session = JSON.parse(data);
+		const session = asSessionData(JSON.parse(data));
+		if (!session) continue;
 		if (filters?.agentId && session.agentId !== filters.agentId) continue;
 		if (filters?.channel && session.channel !== filters.channel) continue;
 		if (filters?.tenantId && session.tenantId !== filters.tenantId) continue;
@@ -975,7 +1131,8 @@ async function listSessions(filters, limit = 50) {
 		const aTime = a.lastMessageAt ?? a.createdAt;
 		return (b.lastMessageAt ?? b.createdAt).localeCompare(aTime);
 	});
-	return summaries.slice(0, limit);
+	const boundedLimit = Number.isFinite(limit) ? Math.min(100, Math.max(1, Math.trunc(limit))) : 50;
+	return summaries.slice(0, boundedLimit);
 }
 //#endregion
 //#region src/activity-serialize.ts
@@ -1336,6 +1493,7 @@ function stripThinkSpans(text) {
 const MAX_ENTRIES = 500;
 const MAX_THINKING_CHARS = 16e3;
 const MAX_TRANSCRIPT_BYTES = 4 * 1024 * 1024;
+const MAX_TRANSCRIPT_INDEX_BYTES = 4 * 1024 * 1024;
 /** Default OpenClaw store for the daemon's single agent ("main"). */
 function defaultStorePath() {
 	return (0, node_path.join)((0, node_os.homedir)(), ".openclaw", "agents", "main", "sessions", "sessions.json");
@@ -1356,8 +1514,8 @@ async function readTranscriptTail(path) {
 			const { size } = await handle.stat();
 			if (size <= MAX_TRANSCRIPT_BYTES) return await handle.readFile({ encoding: "utf-8" });
 			const buf = Buffer.alloc(MAX_TRANSCRIPT_BYTES);
-			await handle.read(buf, 0, MAX_TRANSCRIPT_BYTES, size - MAX_TRANSCRIPT_BYTES);
-			const text = buf.toString("utf-8");
+			const { bytesRead } = await handle.read(buf, 0, MAX_TRANSCRIPT_BYTES, size - MAX_TRANSCRIPT_BYTES);
+			const text = buf.subarray(0, bytesRead).toString("utf-8");
 			const firstNewline = text.indexOf("\n");
 			return firstNewline === -1 ? "" : text.slice(firstNewline + 1);
 		} finally {
@@ -1367,30 +1525,44 @@ async function readTranscriptTail(path) {
 		return null;
 	}
 }
+/** Read a complete JSON index only when it stays inside the local memory cap. */
+async function readTranscriptIndex(path) {
+	try {
+		const handle = await (0, node_fs_promises.open)(path, "r");
+		try {
+			const { size } = await handle.stat();
+			if (size < 1 || size > MAX_TRANSCRIPT_INDEX_BYTES) return null;
+			return JSON.parse(await handle.readFile({ encoding: "utf-8" }));
+		} finally {
+			await handle.close();
+		}
+	} catch {
+		return null;
+	}
+}
 /**
 * Find the transcript files for a conversation: exact route matches first,
 * then an index scan for `:conv:{conversationId}` keys (retroactive path).
 * Returns absolute jsonl paths, deduped.
 */
 async function resolveTranscriptPaths(conversationId, routes) {
-	const storePaths = new Set((routes ?? []).map((r) => r.storePath));
+	const validRoutes = (routes ?? []).filter((route) => Boolean(route) && typeof route === "object" && typeof route.sessionKey === "string" && route.sessionKey.length > 0 && typeof route.storePath === "string" && route.storePath.length > 0 && route.storePath.length <= 4096);
+	const storePaths = new Set(validRoutes.map((r) => r.storePath));
 	if (storePaths.size === 0) storePaths.add(defaultStorePath());
-	const routeKeys = new Set((routes ?? []).map((r) => r.sessionKey));
+	const routeKeys = new Set(validRoutes.map((r) => r.sessionKey));
 	const convSegment = `:conv:${conversationId}`;
 	const files = /* @__PURE__ */ new Set();
 	for (const storePath of storePaths) {
-		let index;
-		try {
-			index = JSON.parse(await (0, node_fs_promises.readFile)(storePath, "utf-8"));
-		} catch {
-			continue;
-		}
+		const parsed = await readTranscriptIndex(storePath);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) continue;
 		const dir = (0, node_path.dirname)(storePath);
-		for (const [key, entry] of Object.entries(index)) {
-			if (!entry.sessionId) continue;
+		for (const [key, value] of Object.entries(parsed)) {
+			if (!value || typeof value !== "object" || Array.isArray(value)) continue;
+			const sessionId = value.sessionId;
+			if (typeof sessionId !== "string" || !sessionId) continue;
 			if (!(routeKeys.has(key) || key.endsWith(convSegment) || key.includes(`${convSegment}:`))) continue;
-			if (!/^[A-Za-z0-9._-]+$/.test(entry.sessionId)) continue;
-			files.add((0, node_path.join)(dir, `${entry.sessionId}.jsonl`));
+			if (!/^[A-Za-z0-9._-]+$/.test(sessionId)) continue;
+			files.add((0, node_path.join)(dir, `${sessionId}.jsonl`));
 		}
 	}
 	return [...files];
@@ -1480,6 +1652,18 @@ async function collectTranscriptActivity(conversationId, routes) {
 }
 //#endregion
 //#region src/a2a-tools.ts
+const MAX_AGENT_ID_CHARS = 256;
+const MAX_A2A_MESSAGE_CHARS = 32e3;
+const MAX_THREAD_ID_CHARS = 128;
+const MAX_A2A_DEPTH = 20;
+const MAX_COMPONENT_TARGET_CHARS = 512;
+const MAX_COMPONENT_TEXT_CHARS = 32e3;
+const MAX_COMPONENT_ID_CHARS = 128;
+const MAX_COMPONENT_LABEL_CHARS = 120;
+const MAX_COMPONENT_VALUE_CHARS = 400;
+const MAX_COMPONENT_URL_CHARS = 2048;
+const MAX_COMPONENTS = 10;
+const MAX_COMPONENT_OPTIONS = 25;
 let conversationEndRequested = false;
 let a2aTurnArmed = false;
 /**
@@ -1505,41 +1689,14 @@ function disarmA2AEndSignal() {
 function isA2AEndSignalled() {
 	return conversationEndRequested;
 }
-function ok(result) {
-	return { content: [{
-		type: "text",
-		text: JSON.stringify(result)
-	}] };
-}
-function errResult(message) {
-	return { content: [{
-		type: "text",
-		text: JSON.stringify({ error: message })
-	}] };
-}
-function defineTool(def) {
-	return {
-		name: def.name,
-		description: def.description,
-		label: def.name,
-		parameters: def.parameters,
-		execute: async (_toolCallId, params) => {
-			try {
-				return ok(await def.handler(params));
-			} catch (e) {
-				return errResult(e.message);
-			}
-		}
-	};
-}
 function buildA2ATools(getChatClient, log, present) {
 	const requireClient = () => {
 		const client = getChatClient();
-		if (!client) throw new Error("chat service not connected yet — try again in a moment");
+		if (!client) throw (0, _alfe_ai_openclaw_plugin_kit.publicToolError)("chat service not connected yet — try again in a moment");
 		return client;
 	};
 	const tools = [
-		defineTool({
+		(0, _alfe_ai_openclaw_plugin_kit.defineTool)({
 			name: "list_agents",
 			description: "List other agents in your organization that you can communicate with.",
 			parameters: {
@@ -1552,26 +1709,35 @@ function buildA2ATools(getChatClient, log, present) {
 				return await requireClient().sendRequest("a2a.list-agents", {});
 			}
 		}),
-		defineTool({
+		(0, _alfe_ai_openclaw_plugin_kit.defineTool)({
 			name: "message_agent",
-			description: "Send a message to another agent. Starts a new conversation thread, or continues an existing one. The conversation will bounce back and forth automatically until one agent calls end_conversation() or says [RESOLVED].",
+			description: "Send a message to another agent. Starts a new conversation thread, or continues an existing one. The conversation will bounce back and forth automatically until an agent calls end_conversation() or the server depth limit is reached.",
 			parameters: {
 				type: "object",
 				properties: {
 					agent_id: {
 						type: "string",
+						minLength: 1,
+						maxLength: MAX_AGENT_ID_CHARS,
 						description: "Target agent ID (use list_agents to find available agents)"
 					},
 					message: {
 						type: "string",
+						minLength: 1,
+						maxLength: MAX_A2A_MESSAGE_CHARS,
 						description: "Message to send to the agent"
 					},
 					thread_id: {
 						type: "string",
+						minLength: 1,
+						maxLength: MAX_THREAD_ID_CHARS,
+						pattern: "^[A-Za-z0-9_-]+$",
 						description: "Continue an existing conversation thread (omit to start a new one)"
 					},
 					max_depth: {
-						type: "number",
+						type: "integer",
+						minimum: 1,
+						maximum: MAX_A2A_DEPTH,
 						description: "Maximum number of back-and-forth exchanges (default: 10)"
 					}
 				},
@@ -1582,7 +1748,7 @@ function buildA2ATools(getChatClient, log, present) {
 				const message = params.message;
 				const threadId = params.thread_id;
 				const maxDepth = params.max_depth ?? 10;
-				if (!agentId || !message) throw new Error("agent_id and message are required");
+				if (typeof agentId !== "string" || agentId.length < 1 || agentId.length > MAX_AGENT_ID_CHARS || typeof message !== "string" || message.length < 1 || message.length > MAX_A2A_MESSAGE_CHARS || threadId !== void 0 && (typeof threadId !== "string" || threadId.length < 1 || threadId.length > MAX_THREAD_ID_CHARS || !/^[A-Za-z0-9_-]+$/.test(threadId)) || !Number.isInteger(maxDepth) || maxDepth < 1 || maxDepth > MAX_A2A_DEPTH) throw (0, _alfe_ai_openclaw_plugin_kit.publicToolError)("Invalid message_agent parameters");
 				log.info(`message_agent tool: sending to ${agentId}`);
 				return await requireClient().sendRequest("a2a.send", {
 					targetAgentId: agentId,
@@ -1592,13 +1758,14 @@ function buildA2ATools(getChatClient, log, present) {
 				});
 			}
 		}),
-		defineTool({
+		(0, _alfe_ai_openclaw_plugin_kit.defineTool)({
 			name: "end_conversation",
 			description: "End the current agent-to-agent conversation. Call this when the discussion is resolved and no further exchanges are needed.",
 			parameters: {
 				type: "object",
 				properties: { summary: {
 					type: "string",
+					maxLength: 1e3,
 					description: "Brief summary of what was discussed or resolved"
 				} },
 				required: []
@@ -1614,7 +1781,7 @@ function buildA2ATools(getChatClient, log, present) {
 			}
 		})
 	];
-	if (present) tools.push(defineTool({
+	if (present) tools.push((0, _alfe_ai_openclaw_plugin_kit.defineTool)({
 		name: "chat_present_components",
 		description: "Attach interactive UI components to a chat message so the user can act with a tap instead of typing. PREFER components whenever you offer the user a discrete set of choices — a quick_reply or select reads far better than \"reply 1, 2, or 3\". Use:\n  • quick_reply — one-tap canned replies for a short set of options.\n  • select — a single choice from a longer list (dropdown).\n  • multi_select — let the user pick MANY options, then submit.\n  • confirm — an approval / yes-no decision (primary + secondary button).\n  • link_button — an actionable LINK (open a dashboard, a browser-takeover deep link). URL must be https on an Alfe-owned host.\n  • copy_button — let the user copy a value (token, id, snippet) to their clipboard.\nChoosing/submitting an interactive component sends the chosen value back AS THE USER'S NEXT MESSAGE, so the conversation continues normally — you will see it as ordinary user input. Don't button-spam: components are for real interactions, not decoration, and each message allows at most 10. Components degrade to plain text on clients that don't render them, so keep the essentials in `text` too.\nExamples:\n  Approval: { to:\"conv:abc\", text:\"Deploy to production?\", components:[ { type:\"confirm\", id:\"c1\", confirmLabel:\"Deploy\", confirmValue:\"yes, deploy\", cancelLabel:\"Cancel\", cancelValue:\"no, hold off\" } ] }\n  Pick one: { to:\"user:u_123\", text:\"Which environment?\", components:[ { type:\"select\", id:\"s1\", placeholder:\"Choose an environment\", options:[ { label:\"Dev\", value:\"dev\" }, { label:\"Staging\", value:\"staging\" }, { label:\"Prod\", value:\"prod\" } ] } ] }\n  Link: { to:\"conv:abc\", text:\"I need you to finish the login step.\", components:[ { type:\"link_button\", id:\"b1\", label:\"Open browser session\", url:\"https://app.alfe.ai/agents/x?tab=browser\", target:\"new-tab\", style:\"primary\" } ] }",
 		parameters: {
@@ -1622,14 +1789,20 @@ function buildA2ATools(getChatClient, log, present) {
 			properties: {
 				to: {
 					type: "string",
+					minLength: 6,
+					maxLength: MAX_COMPONENT_TARGET_CHARS + 5,
+					pattern: "^(conv|user):.+$",
 					description: "Target conversation: \"conv:{conversationId}\" or \"user:{userId}\"."
 				},
 				text: {
 					type: "string",
+					maxLength: MAX_COMPONENT_TEXT_CHARS,
 					description: "Optional message text rendered above the components. Keep the key info here too — it is the fallback on clients that cannot render components."
 				},
 				components: {
 					type: "array",
+					minItems: 1,
+					maxItems: MAX_COMPONENTS,
 					description: "Interactive components to attach (at least one, at most 10).",
 					items: {
 						type: "object",
@@ -1648,14 +1821,18 @@ function buildA2ATools(getChatClient, log, present) {
 							},
 							id: {
 								type: "string",
+								minLength: 1,
+								maxLength: MAX_COMPONENT_ID_CHARS,
 								description: "Stable id (optional — auto-generated when omitted)."
 							},
 							label: {
 								type: "string",
+								maxLength: MAX_COMPONENT_LABEL_CHARS,
 								description: "Button/control text. Required for link_button, quick_reply, copy_button; optional heading for select / multi_select."
 							},
 							url: {
 								type: "string",
+								maxLength: MAX_COMPONENT_URL_CHARS,
 								description: "link_button only: https URL on an Alfe-owned host to open when clicked."
 							},
 							target: {
@@ -1669,24 +1846,32 @@ function buildA2ATools(getChatClient, log, present) {
 							},
 							value: {
 								type: "string",
+								maxLength: MAX_COMPONENT_VALUE_CHARS,
 								description: "quick_reply: the text submitted as the user's next message when tapped. copy_button: the value copied to the clipboard."
 							},
 							placeholder: {
 								type: "string",
+								maxLength: MAX_COMPONENT_LABEL_CHARS,
 								description: "select only: the empty-state prompt shown before a choice is made."
 							},
 							options: {
 								type: "array",
+								minItems: 1,
+								maxItems: MAX_COMPONENT_OPTIONS,
 								description: "select / multi_select only: the choices (max 25). Each is { label, value }; `value` is what gets submitted (multi_select joins checked values with \", \").",
 								items: {
 									type: "object",
 									properties: {
 										label: {
 											type: "string",
+											minLength: 1,
+											maxLength: MAX_COMPONENT_LABEL_CHARS,
 											description: "Option text shown to the user."
 										},
 										value: {
 											type: "string",
+											minLength: 1,
+											maxLength: MAX_COMPONENT_VALUE_CHARS,
 											description: "Value submitted when chosen."
 										}
 									},
@@ -1695,22 +1880,27 @@ function buildA2ATools(getChatClient, log, present) {
 							},
 							submitLabel: {
 								type: "string",
+								maxLength: MAX_COMPONENT_LABEL_CHARS,
 								description: "multi_select only: submit button caption (default \"Submit\")."
 							},
 							confirmLabel: {
 								type: "string",
+								maxLength: MAX_COMPONENT_LABEL_CHARS,
 								description: "confirm only: primary button text (e.g. \"Approve\")."
 							},
 							confirmValue: {
 								type: "string",
+								maxLength: MAX_COMPONENT_VALUE_CHARS,
 								description: "confirm only: value submitted when the primary button is tapped."
 							},
 							cancelLabel: {
 								type: "string",
+								maxLength: MAX_COMPONENT_LABEL_CHARS,
 								description: "confirm only: secondary button text (omit to show only the primary)."
 							},
 							cancelValue: {
 								type: "string",
+								maxLength: MAX_COMPONENT_VALUE_CHARS,
 								description: "confirm only: value submitted when the secondary button is tapped."
 							},
 							style: {
@@ -1731,14 +1921,20 @@ function buildA2ATools(getChatClient, log, present) {
 		},
 		handler: async (params) => {
 			const to = params.to;
-			if (!to || !to.startsWith("conv:") && !to.startsWith("user:")) throw new Error("`to` must be \"conv:{conversationId}\" or \"user:{userId}\"");
+			if (!to || !to.startsWith("conv:") && !to.startsWith("user:") || to.length > MAX_COMPONENT_TARGET_CHARS + 5 || to.slice(to.indexOf(":") + 1).length < 1) throw (0, _alfe_ai_openclaw_plugin_kit.publicToolError)("`to` must be \"conv:{conversationId}\" or \"user:{userId}\"");
 			const text = params.text;
+			if (text !== void 0 && (typeof text !== "string" || text.length > MAX_COMPONENT_TEXT_CHARS)) throw (0, _alfe_ai_openclaw_plugin_kit.publicToolError)("`text` exceeds the 32000-character limit");
 			log.info("chat_present_components tool called");
-			return await present({
-				to,
-				text,
-				components: params.components
-			});
+			try {
+				return await present({
+					to,
+					text,
+					components: params.components
+				});
+			} catch (error) {
+				if (error instanceof Error && error.message === "At least one valid component is required") throw (0, _alfe_ai_openclaw_plugin_kit.publicToolError)(error.message);
+				throw error;
+			}
 		}
 	}));
 	return tools;
@@ -1771,14 +1967,27 @@ const DEFAULT_EXACT_HOSTS = [
 	"mmg.whatsapp.net"
 ];
 const DEFAULT_SUFFIX_HOSTS = [
-	".s3.amazonaws.com",
-	".amazonaws.com",
 	".twiliocdn.com",
 	".cdn.discordapp.com",
 	".discordapp.net",
 	".telegram.org",
 	".alfe.ai"
 ];
+const AWS_REGION = /^(?:[a-z]{2}(?:-gov)?|us-iso[a-z]?|eusc(?:-[a-z]{2})?)-[a-z0-9-]+-\d$/;
+/** Keep byte-for-byte policy parity with services/chat/src/lib/media-url. */
+function isAmazonS3Host(host) {
+	if (host === "s3.amazonaws.com" || host.endsWith(".s3.amazonaws.com")) return true;
+	if (!host.endsWith(".amazonaws.com")) return false;
+	const labels = host.slice(0, -14).split(".");
+	return labels.some((service, index) => {
+		const tail = labels.slice(index + 1);
+		if (/^s3-(?:[a-z]{2}(?:-gov)?|us-iso[a-z]?|eusc(?:-[a-z]{2})?)-[a-z0-9-]+-\d$/.test(service)) return tail.length === 0;
+		if (service === "s3-accelerate") return tail.length === 0 || tail.length === 1 && tail[0] === "dualstack";
+		if (service !== "s3" && service !== "s3-fips" && service !== "s3-accesspoint" && service !== "s3-object-lambda" && service !== "s3-outposts") return false;
+		if (tail.length === 1) return AWS_REGION.test(tail[0] ?? "");
+		return tail.length === 2 && tail[0] === "dualstack" && AWS_REGION.test(tail[1] ?? "");
+	});
+}
 function parseExtraHosts(raw) {
 	const exact = /* @__PURE__ */ new Set();
 	const suffix = [];
@@ -1837,7 +2046,9 @@ function validateAttachmentUrl(input, opts = {}) {
 		reason: "blocked_host"
 	};
 	const extra = parseExtraHosts(opts.extraHosts ?? process.env.ALFE_ATTACHMENT_ALLOWED_HOSTS);
-	if (new Set([...DEFAULT_EXACT_HOSTS.map((h) => h.toLowerCase()), ...extra.exact]).has(host)) return { ok: true };
+	const exact = new Set([...DEFAULT_EXACT_HOSTS.map((h) => h.toLowerCase()), ...extra.exact]);
+	if (isAmazonS3Host(host)) return { ok: true };
+	if (exact.has(host)) return { ok: true };
 	if ([...DEFAULT_SUFFIX_HOSTS.map((h) => h.toLowerCase()), ...extra.suffix].some((rule) => host === rule.slice(1) || host.endsWith(rule))) return { ok: true };
 	return {
 		ok: false,
@@ -1845,6 +2056,40 @@ function validateAttachmentUrl(input, opts = {}) {
 	};
 }
 //#endregion
+//#region src/local-ai-proxy-identity.ts
+const LOCAL_AI_PROXY_IDENTITY_URL = "http://127.0.0.1:18193/__alfe/set-identity";
+const LOCAL_AI_PROXY_CONTROL_TIMEOUT_MS = 1e3;
+const MAX_IDENTITY_ID_CHARS = 256;
+/**
+* Best-effort loopback identity handshake for the local AI proxy.
+*
+* A turn awaits this before model dispatch so attribution cannot lose a race
+* with the first LLM request. Failure never rejects the chat turn.
+*/
+async function syncLocalAiProxyIdentity(identityId, fetchFn = fetch) {
+	if (identityId !== void 0 && !isValidIdentityId(identityId)) return false;
+	try {
+		const response = await fetchFn(LOCAL_AI_PROXY_IDENTITY_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ identityId: identityId ?? null }),
+			signal: AbortSignal.timeout(LOCAL_AI_PROXY_CONTROL_TIMEOUT_MS)
+		});
+		try {
+			await response.body?.cancel();
+		} catch {}
+		return response.ok;
+	} catch {
+		return false;
+	}
+}
+function isValidIdentityId(value) {
+	return value.length > 0 && value.length <= MAX_IDENTITY_ID_CHARS && !Array.from(value).some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
+	});
+}
+//#endregion
 //#region src/plugin.ts
 /**
 * @alfe.ai/openclaw-chat — OpenClaw chat channel plugin.
@@ -2233,6 +2478,7 @@ async function resolveOpenClawSdk(log) {
 	} catch {}
 	log.warn(`OpenClaw SDK not resolvable — chat dispatch will not work. argv1=${process.argv[1] ?? "<none>"} execPath=${process.execPath} PATH=${pathEnv ? "set" : "EMPTY"} anchorsTried=[${anchors.join(", ")}]`);
 }
+const CHAT_ACTIVATION_KEY = (0, _alfe_ai_openclaw_plugin_kit.getActivationKey)("chat");
 let pluginRuntime = null;
 let chatClient = null;
 let connectingPromise = null;
@@ -2335,7 +2581,7 @@ function replayAttachments(atts) {
 		...typeof a.size === "number" ? { size: a.size } : {}
 	}));
 }
-const MAX_FILE_SIZE = 50 * 1024 * 1024;
+const MAX_INBOUND_ATTACHMENT_SIZE = 50 * 1024 * 1024;
 const DOWNLOAD_TIMEOUT_MS = 3e4;
 const MAX_REDIRECTS = 5;
 /**
@@ -2368,13 +2614,62 @@ async function fetchAttachmentWithValidation(url, signal) {
 	}
 	throw new Error("too_many_redirects");
 }
+/**
+* Read a response body without ever retaining more than the attachment cap.
+* `arrayBuffer()` cannot enforce a cap until after the entire response has
+* already been allocated, so both declared and streamed sizes are checked.
+*/
+async function readAttachmentBodyBounded(response, maxBytes = MAX_INBOUND_ATTACHMENT_SIZE) {
+	const declaredRaw = response.headers.get("content-length");
+	if (declaredRaw !== null) {
+		const declared = Number(declaredRaw);
+		if (Number.isFinite(declared) && declared > maxBytes) throw new Error("attachment_too_large");
+	}
+	if (!response.body) return new Uint8Array();
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel("attachment_too_large").catch(() => void 0);
+				throw new Error("attachment_too_large");
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return body;
+}
+/** Build one safe, collision-resistant filename inside the attachment dir. */
+function buildAttachmentLocalFilename(att) {
+	const safeId = att.id.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 256) || "attachment";
+	const safeName = Array.from(att.filename ?? "file", (character) => {
+		const code = character.codePointAt(0) ?? 0;
+		return code <= 31 || code === 127 ? "_" : character;
+	}).join("").replace(/[\\/]/g, "_").replace(/\.\./g, "_").slice(0, 512) || "file";
+	return `${safeId}_${(0, node_crypto.randomUUID)()}_${safeName}`;
+}
 async function downloadAttachments(attachments, log) {
 	const attachDir = (0, node_path.join)((0, node_os.homedir)(), ".alfe", "attachments");
-	await (0, node_fs_promises.mkdir)(attachDir, { recursive: true });
+	await (0, node_fs_promises.mkdir)(attachDir, {
+		recursive: true,
+		mode: 448
+	});
 	const results = [];
-	for (const att of attachments) {
-		const filename = (att.filename ?? att.id).replace(/[/\\]/g, "_").replace(/\.\./g, "_").replace(/\0/g, "");
-		const localPath = (0, node_path.join)(attachDir, `${att.id}_${filename}`);
+	for (const att of attachments.slice(0, 10)) {
+		const filename = (att.filename ?? "file").slice(0, 512) || "file";
+		const localPath = (0, node_path.join)(attachDir, buildAttachmentLocalFilename(att));
 		const controller = new AbortController();
 		const timeout = setTimeout(() => {
 			controller.abort();
@@ -2385,12 +2680,11 @@ async function downloadAttachments(attachments, log) {
 				log.warn(`Failed to download attachment ${att.id}: ${String(res.status)}`);
 				continue;
 			}
-			const buffer = Buffer.from(await res.arrayBuffer());
-			if (buffer.length > MAX_FILE_SIZE) {
-				log.warn(`Attachment ${att.id} exceeds max size (${String(buffer.length)} bytes) — skipping`);
-				continue;
-			}
-			await (0, node_fs_promises.writeFile)(localPath, buffer);
+			const buffer = await readAttachmentBodyBounded(res);
+			await (0, node_fs_promises.writeFile)(localPath, buffer, {
+				flag: "wx",
+				mode: 384
+			});
 			results.push({
 				localPath,
 				filename,
@@ -2398,6 +2692,7 @@ async function downloadAttachments(attachments, log) {
 			});
 			log.info(`Downloaded attachment: ${localPath} (${String(buffer.length)} bytes)`);
 		} catch (err) {
+			if ((err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : void 0) !== "EEXIST") await (0, node_fs_promises.unlink)(localPath).catch(() => void 0);
 			log.error(`Failed to download attachment ${att.id}: ${err instanceof Error ? err.message : String(err)}`);
 		} finally {
 			clearTimeout(timeout);
@@ -2537,6 +2832,20 @@ const VOICE_REPLY_SYSTEM_PROMPT = [
 */
 const CROSS_AGENT_TOOLS_SYSTEM_PROMPT = ["Cross-agent messaging: to contact another Alfe agent (IDs like agt_…), use list_agents to discover and message_agent to send.", "The runtime's sessions_send / sessions_spawn tools do NOT know Alfe agent IDs and will fail with \"agent not found\" — never use them to reach another agent."].join("\n");
 /**
+* Rules for an inbound agent-to-agent turn. This must ride the runtime-rendered
+* `GroupSystemPrompt` field; arbitrary extra-context keys are not shown to the
+* model. Keep the instruction structural: `end_conversation` is the plugin's
+* authoritative turn-local completion signal. The relay still accepts the
+* legacy trailing `[RESOLVED]` sentinel for older plugin versions.
+*/
+const A2A_REPLY_SYSTEM_PROMPT = [
+	"This is an agent-to-agent conversation with another Alfe agent.",
+	"Rules:",
+	"- Only respond if you have new information, a question, or an action to coordinate.",
+	"- When the discussion is complete, call the end_conversation tool.",
+	"- Do not respond just to acknowledge receipt; that creates unproductive reply loops."
+].join("\n");
+/**
 * Per-turn envelope context derived from the RPC `origin` flag, returned as a
 * `GroupSystemPrompt` block — the PROVEN runtime-rendered seam for per-turn
 * system-prompt guidance: dispatchInbound spreads `extraContext` into
@@ -2564,6 +2873,11 @@ function buildOriginEnvelopeContext(origin) {
 	if (origin === "voice") return { GroupSystemPrompt: `${VOICE_REPLY_SYSTEM_PROMPT}\n\n${CROSS_AGENT_TOOLS_SYSTEM_PROMPT}` };
 	return { GroupSystemPrompt: CROSS_AGENT_TOOLS_SYSTEM_PROMPT };
 }
+/** Build the single live per-turn prompt block without competing object keys. */
+function buildTurnEnvelopeContext(origin, isA2A) {
+	const originPrompt = String(buildOriginEnvelopeContext(origin).GroupSystemPrompt);
+	return { GroupSystemPrompt: isA2A ? `${originPrompt}\n\n${A2A_REPLY_SYSTEM_PROMPT}` : originPrompt };
+}
 async function handleAgentRequest(request, log) {
 	const runtime = pluginRuntime;
 	if (!runtime) {
@@ -2574,7 +2888,7 @@ async function handleAgentRequest(request, log) {
 		chatClient?.sendResponse(request.id, false, { message: "OpenClaw SDK not available — cannot dispatch" });
 		return;
 	}
-	const { message, sessionKey: legacySessionKey, userId, conversationId, conversationType, tenantId, clientType, origin, displayName, identityId, senderPermissions, attachments: rawAttachments, a2a, chatMessageId } = request.params;
+	const { message, sessionKey: legacySessionKey, userId, conversationId, conversationType, tenantId, clientType, origin, displayName, identityId, identityProvider, attachments: rawAttachments, a2a, chatMessageId } = request.params;
 	const isA2A = !!a2a;
 	if (!message && !rawAttachments?.length) {
 		chatClient?.sendResponse(request.id, false, { message: "Missing message" });
@@ -2732,15 +3046,15 @@ async function handleAgentRequest(request, log) {
 			return;
 		}
 	});
+	let localProxyIdentityActive = false;
 	try {
 		const downloadedFiles = rawAttachments?.length ? await downloadAttachments(rawAttachments, log) : [];
 		const bodyForAgent = downloadedFiles.length ? `${message || ""}\n\n[Attached files:\n${downloadedFiles.map((f) => `- ${f.filename}: ${f.localPath}`).join("\n")}]` : void 0;
-		if (identityId) fetch("http://127.0.0.1:18193/__alfe/set-identity", {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ identityId })
-		}).catch(() => {});
+		const identitySynced = await syncLocalAiProxyIdentity(identityId);
+		localProxyIdentityActive = identitySynced && identityId !== void 0;
+		if (!identitySynced) log.debug("Local AI proxy identity attribution unavailable");
 		const channelMode = isA2A ? "a2a" : extractChannelMode(conversationId ?? "", clientType ?? "chat");
+		const inboundHookRouting = buildInboundHookRouting(identityProvider, channelMode, conversationId);
 		const channelLabel = channelMode === "sms" ? "SMS" : channelMode === "whatsapp" ? "WhatsApp" : channelMode === "a2a" ? "Agent" : "Alfe";
 		const shortConvId = conversationId?.slice(-8) ?? "";
 		const userLabel = displayName ?? userId ?? senderId;
@@ -2787,6 +3101,7 @@ async function handleAgentRequest(request, log) {
 			bodyForAgent,
 			messageId: request.id,
 			timestamp: Date.now(),
+			...inboundHookRouting,
 			extraContext: {
 				...tenantId ? { TenantId: tenantId } : {},
 				...clientType ? { ClientType: clientType } : {},
@@ -2794,22 +3109,13 @@ async function handleAgentRequest(request, log) {
 				...displayName ? { SenderName: displayName } : {},
 				...identityId ? { IdentityId: identityId } : {},
 				...userId ? { UserId: userId } : {},
-				...senderPermissions?.length ? { SenderPermissions: senderPermissions } : {},
 				ChannelMode: channelMode,
-				...buildOriginEnvelopeContext(origin),
+				...buildTurnEnvelopeContext(origin, isA2A),
 				...isA2A ? {
 					CallerType: "agent",
 					CallerAgentId: a2a.sourceAgentId,
 					CallerAgentName: a2a.sourceAgentName,
-					InteractionDepth: String(a2a.depth),
-					A2ASystemPrompt: [
-						`This is an agent-to-agent conversation with ${a2a.sourceAgentName}.`,
-						"Rules:",
-						"- Only respond if you have new information, a question, or an action to coordinate.",
-						"- When the discussion is complete, call the end_conversation() tool AND end your final message with the literal token [RESOLVED] (uppercase, in square brackets, as the last thing in the message).",
-						"- Do NOT write the word \"resolved\" in prose unless you mean to end — only the exact token [RESOLVED] ends the thread.",
-						"- Do NOT respond just to acknowledge — that creates infinite loops."
-					].join("\n")
+					InteractionDepth: String(a2a.depth)
 				} : {}
 			},
 			deliver: async (payload) => {
@@ -2866,6 +3172,9 @@ async function handleAgentRequest(request, log) {
 		activeRun = null;
 		unsubscribe();
 		clearAllToolUpdates();
+		if (localProxyIdentityActive) {
+			if (!await syncLocalAiProxyIdentity(void 0)) log.debug("Local AI proxy identity attribution clear failed");
+		}
 		try {
 			await flushTurnActivity();
 		} catch (err) {
@@ -3009,7 +3318,7 @@ const plugin = {
 						chatWsUrl: pluginConfig.chatWsUrl
 					});
 					if (chatWsUrl && apiKey) {
-						log.info(`Connecting to chat service: ${chatWsUrl}`);
+						log.info("Connecting to chat service relay");
 						chatClient = new _alfe_ai_chat.ChatServiceClient({
 							wsUrl: chatWsUrl,
 							apiKey,
@@ -3056,7 +3365,6 @@ const plugin = {
 			connectingPromise = thisConnect;
 		};
 		const stopChatService = async () => {
-			globalThis.__alfeChatPluginActivated = false;
 			if (connectingPromise) {
 				await connectingPromise.catch((err) => {
 					log.debug(`Connection attempt failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -3070,6 +3378,7 @@ const plugin = {
 			}
 			pluginRuntime = null;
 			dispatchInbound = null;
+			(0, _alfe_ai_openclaw_plugin_kit.resetActivation)(CHAT_ACTIVATION_KEY);
 			log.info("Chat plugin deactivated");
 		};
 		const gw = globalThis;
@@ -3147,7 +3456,6 @@ const plugin = {
 		log.info("Chat plugin registered");
 	},
 	async deactivate(api) {
-		globalThis.__alfeChatPluginActivated = false;
 		const log = api.logger;
 		log.info("Chat plugin deactivating...");
 		if (connectingPromise) {
@@ -3163,16 +3471,29 @@ const plugin = {
 		}
 		pluginRuntime = null;
 		dispatchInbound = null;
+		(0, _alfe_ai_openclaw_plugin_kit.resetActivation)(CHAT_ACTIVATION_KEY);
 		log.info("Chat plugin deactivated");
 	}
 };
 //#endregion
+Object.defineProperty(exports, "A2A_REPLY_SYSTEM_PROMPT", {
+	enumerable: true,
+	get: function() {
+		return A2A_REPLY_SYSTEM_PROMPT;
+	}
+});
 Object.defineProperty(exports, "CROSS_AGENT_TOOLS_SYSTEM_PROMPT", {
 	enumerable: true,
 	get: function() {
 		return CROSS_AGENT_TOOLS_SYSTEM_PROMPT;
 	}
 });
+Object.defineProperty(exports, "MAX_INBOUND_ATTACHMENT_SIZE", {
+	enumerable: true,
+	get: function() {
+		return MAX_INBOUND_ATTACHMENT_SIZE;
+	}
+});
 Object.defineProperty(exports, "VOICE_REPLY_SYSTEM_PROMPT", {
 	enumerable: true,
 	get: function() {
@@ -3209,6 +3530,12 @@ Object.defineProperty(exports, "buildA2ACompletePayload", {
 		return buildA2ACompletePayload;
 	}
 });
+Object.defineProperty(exports, "buildAttachmentLocalFilename", {
+	enumerable: true,
+	get: function() {
+		return buildAttachmentLocalFilename;
+	}
+});
 Object.defineProperty(exports, "buildOriginEnvelopeContext", {
 	enumerable: true,
 	get: function() {
@@ -3221,6 +3548,12 @@ Object.defineProperty(exports, "buildToolActivity", {
 		return buildToolActivity;
 	}
 });
+Object.defineProperty(exports, "buildTurnEnvelopeContext", {
+	enumerable: true,
+	get: function() {
+		return buildTurnEnvelopeContext;
+	}
+});
 Object.defineProperty(exports, "computeOpenClawSdkAnchors", {
 	enumerable: true,
 	get: function() {
@@ -3251,6 +3584,12 @@ Object.defineProperty(exports, "plugin", {
 		return plugin;
 	}
 });
+Object.defineProperty(exports, "readAttachmentBodyBounded", {
+	enumerable: true,
+	get: function() {
+		return readAttachmentBodyBounded;
+	}
+});
 Object.defineProperty(exports, "resolveAbortTargetKeys", {
 	enumerable: true,
 	get: function() {