@alfe.ai/openclaw 0.4.10 → 0.4.11

package/README.md

@@ -74,6 +74,16 @@ Integration management (install, remove, configure, health) is handled by
 the gateway service directly — this plugin does not process integration
 commands.
 
+## Tool Safety
+
+- `install_integration` requires `confirm: true` after the user approves the
+  runtime change.
+- `remove_integration` requires `confirmIntegrationId` to exactly match the id
+  being removed.
+- `set_avatar` accepts a stage-matched Alfe agent-assets URL or a
+  workspace-relative PNG/JPEG/WebP path up to 5 MiB. It does not fetch arbitrary
+  public URLs or read absolute paths outside the agent workspace.
+
 ## Links
 
 - 🌐 Website: <https://alfe.ai>

package/dist/index.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_plugin = require("./plugin2.cjs");
-let events = require("events");
+let node_module = require("node:module");
+let node_events = require("node:events");
 let crypto = require("crypto");
 //#region ../../node_modules/.pnpm/ws@8.19.0_bufferutil@4.1.0_utf-8-validate@6.0.6/node_modules/ws/lib/constants.js
 var require_constants = /* @__PURE__ */ require_plugin.__commonJSMin(((exports, module) => {
@@ -3748,7 +3749,7 @@ require_websocket_server();
 var wrapper_default = import_websocket.default;
 //#endregion
 //#region ../../packages-internal/agent-client/dist/chat-event-bus.js
-var ChatEventBus = class extends events.EventEmitter {
+var ChatEventBus = class extends node_events.EventEmitter {
 	constructor() {
 		super();
 		this.setMaxListeners(100);
@@ -3768,14 +3769,14 @@ const chatEventBus = new ChatEventBus();
 //#endregion
 //#region ../../packages-internal/agent-client/dist/base-client.js
 const defaultLogger = {
-	info: (msg) => {
-		console.log(msg);
+	info: (msg, ...args) => {
+		console.log(msg, ...args);
 	},
-	warn: (msg) => {
-		console.warn(msg);
+	warn: (msg, ...args) => {
+		console.warn(msg, ...args);
 	},
-	error: (msg) => {
-		console.error(msg);
+	error: (msg, ...args) => {
+		console.error(msg, ...args);
 	},
 	debug: () => {}
 };
@@ -3785,9 +3786,11 @@ var BaseAgentClient = class {
 	closed = false;
 	backoffMs = 1e3;
 	pending = /* @__PURE__ */ new Map();
+	reconnectTimer = null;
 	readyResolve = () => {};
 	readyReject = () => {};
 	readyPromise;
+	readySettled = false;
 	log;
 	opts;
 	instanceId;
@@ -3795,10 +3798,7 @@ var BaseAgentClient = class {
 		this.opts = opts;
 		this.log = opts.logger ?? defaultLogger;
 		this.instanceId = opts.instanceId ?? (0, crypto.randomUUID)().slice(0, 8);
-		this.readyPromise = new Promise((resolve, reject) => {
-			this.readyResolve = resolve;
-			this.readyReject = reject;
-		});
+		this.resetReady();
 	}
 	get isConnected() {
 		return this.connected && this.ws?.readyState === wrapper_default.OPEN;
@@ -3808,13 +3808,26 @@ var BaseAgentClient = class {
 			this.log.info("[agent-client] URL not set — skipping");
 			return;
 		}
+		if (this.isConnected) return;
+		if (this.ws || this.reconnectTimer) return this.readyPromise;
+		if (this.readySettled) this.resetReady();
 		this.closed = false;
-		this.doConnect();
+		try {
+			this.doConnect();
+		} catch (err) {
+			const error = err instanceof Error ? err : new Error(String(err));
+			this.rejectReady(error);
+		}
 		return this.readyPromise;
 	}
 	stop() {
 		this.closed = true;
 		this.connected = false;
+		if (this.reconnectTimer) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = null;
+		}
+		this.rejectReady(/* @__PURE__ */ new Error("Client stopped"));
 		this.onDisconnected();
 		this.ws?.close();
 		this.ws = null;
@@ -3822,8 +3835,11 @@ var BaseAgentClient = class {
 	}
 	request(method, params, opts) {
 		if (this.ws?.readyState !== wrapper_default.OPEN) return Promise.reject(/* @__PURE__ */ new Error("Gateway WS not connected"));
+		if (method.trim().length === 0) return Promise.reject(/* @__PURE__ */ new TypeError("Gateway method must not be empty"));
 		const id = (0, crypto.randomUUID)();
 		const timeoutMs = opts?.timeoutMs ?? 3e4;
+		if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) return Promise.reject(/* @__PURE__ */ new RangeError("Gateway timeoutMs must be a positive integer no greater than 2147483647"));
+		const ws = this.ws;
 		return new Promise((resolve, reject) => {
 			const timer = setTimeout(() => {
 				this.pending.delete(id);
@@ -3840,13 +3856,29 @@ var BaseAgentClient = class {
 				},
 				expectFinal: opts?.expectFinal === true
 			});
-			const ws = this.ws;
-			if (ws) ws.send(JSON.stringify({
-				type: "req",
-				id,
-				method,
-				params
-			}));
+			try {
+				ws.send(JSON.stringify({
+					type: "req",
+					id,
+					method,
+					params
+				}), (err) => {
+					if (!err) return;
+					const pending = this.pending.get(id);
+					if (!pending) return;
+					this.pending.delete(id);
+					pending.reject(err);
+				});
+			} catch (err) {
+				const error = err instanceof Error ? err : new Error(String(err));
+				const pending = this.pending.get(id);
+				this.pending.delete(id);
+				if (pending) pending.reject(error);
+				else {
+					clearTimeout(timer);
+					reject(error);
+				}
+			}
 		});
 	}
 	/**
@@ -3871,88 +3903,131 @@ var BaseAgentClient = class {
 	}
 	/** Resolve the ready promise (call after handshake + onConnected). */
 	resolveReady() {
+		if (this.readySettled) return;
+		this.readySettled = true;
 		this.readyResolve();
 	}
 	/** Reject the ready promise (call on handshake failure). */
 	rejectReady(err) {
+		if (this.readySettled) return;
+		this.readySettled = true;
 		this.readyReject(err);
 	}
 	doConnect() {
 		if (this.closed) return;
-		this.ws = new wrapper_default(this.opts.url, { maxPayload: this.opts.maxPayload ?? 10 * 1024 * 1024 });
-		this.ws.on("open", () => {
-			this.log.info(`[agent-client] Connected to ${this.opts.url}`);
-			this.initiateHandshake();
+		const ws = new wrapper_default(this.opts.url, { maxPayload: this.opts.maxPayload ?? 10 * 1024 * 1024 });
+		this.ws = ws;
+		ws.on("open", () => {
+			if (this.ws !== ws || this.closed) {
+				ws.close();
+				return;
+			}
+			this.log.info("[agent-client] WebSocket connected");
+			this.initiateHandshake(ws);
 		});
-		this.ws.on("message", (data) => {
+		ws.on("message", (data) => {
+			if (this.ws !== ws || this.closed) return;
 			const raw = Buffer.isBuffer(data) ? data.toString("utf-8") : data instanceof ArrayBuffer ? Buffer.from(data).toString("utf-8") : Buffer.concat(data).toString("utf-8");
 			this.handleMessage(raw);
 		});
-		this.ws.on("close", (code, reason) => {
+		ws.on("close", (code, reason) => {
+			if (this.ws !== ws) return;
 			this.log.warn(`[agent-client] Closed (${String(code)}): ${reason.toString()}`);
 			this.ws = null;
 			this.connected = false;
 			this.flushPending(/* @__PURE__ */ new Error(`Gateway closed (${String(code)})`));
-			this.onDisconnected();
-			this.scheduleReconnect();
+			if (!this.closed) {
+				this.onDisconnected();
+				if (this.readySettled) this.resetReady();
+				this.scheduleReconnect();
+			}
 		});
-		this.ws.on("error", (err) => {
+		ws.on("error", (err) => {
+			if (this.ws !== ws || this.closed) return;
 			this.log.error(`[agent-client] Error: ${err.message}`);
-			if (!this.connected) this.readyReject(err);
+			if (!this.connected) this.rejectReady(err);
 		});
 	}
-	async initiateHandshake() {
+	async initiateHandshake(ws) {
 		try {
 			await this.performHandshake();
+			if (!this.isCurrentConnection(ws)) return;
 			this.setConnected();
 			this.log.info("[agent-client] Handshake complete");
 			await this.onConnected();
+			if (!this.isCurrentConnection(ws)) return;
 			this.resolveReady();
 		} catch (err) {
+			if (!this.isCurrentConnection(ws)) return;
 			const message = err instanceof Error ? err.message : String(err);
 			this.log.error(`[agent-client] Handshake failed: ${message}`);
 			this.rejectReady(err instanceof Error ? err : new Error(message));
-			this.ws?.close(1008, "handshake failed");
+			ws.close(1008, "handshake failed");
 		}
 	}
+	isCurrentConnection(ws) {
+		return this.ws === ws && !this.closed;
+	}
 	handleMessage(raw) {
 		try {
 			const parsed = JSON.parse(raw);
-			if ("event" in parsed) {
+			if (!isRecord$1(parsed)) {
+				this.log.warn("[agent-client] Ignoring malformed message");
+				return;
+			}
+			if (typeof parsed.event === "string") {
 				this.handleEvent(parsed.event, parsed.payload);
 				return;
 			}
-			if ("id" in parsed && "ok" in parsed) {
-				const rpc = parsed;
+			if (typeof parsed.id === "string" && typeof parsed.ok === "boolean") {
+				const rpc = {
+					id: parsed.id,
+					ok: parsed.ok,
+					payload: parsed.payload,
+					error: parsed.error
+				};
 				const pending = this.pending.get(rpc.id);
 				if (!pending) return;
-				if (pending.expectFinal && rpc.payload?.status === "accepted") return;
+				if (pending.expectFinal && rpc.ok && isRecord$1(rpc.payload) && rpc.payload.status === "accepted") return;
 				this.pending.delete(rpc.id);
 				if (rpc.ok) pending.resolve(rpc.payload);
-				else pending.reject(new Error(rpc.error?.message ?? "Gateway request failed"));
+				else {
+					const message = isRecord$1(rpc.error) && typeof rpc.error.message === "string" ? rpc.error.message : "Gateway request failed";
+					pending.reject(new Error(message));
+				}
+				return;
 			}
+			this.log.warn("[agent-client] Ignoring malformed message");
 		} catch (err) {
 			this.log.error(`[agent-client] Parse error: ${String(err)}`);
 		}
 	}
 	scheduleReconnect() {
-		if (this.closed) return;
+		if (this.closed || this.reconnectTimer) return;
 		const delay = this.backoffMs;
 		this.backoffMs = Math.min(this.backoffMs * 2, 3e4);
 		this.log.info(`[agent-client] Reconnecting in ${String(delay)}ms...`);
-		setTimeout(() => {
-			this.readyPromise = new Promise((resolve, reject) => {
-				this.readyResolve = resolve;
-				this.readyReject = reject;
-			});
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = null;
 			this.doConnect();
 		}, delay);
 	}
+	resetReady() {
+		this.readySettled = false;
+		this.readyPromise = new Promise((resolve, reject) => {
+			this.readyResolve = resolve;
+			this.readyReject = reject;
+		});
+		this.readyPromise.catch(() => void 0);
+	}
 	flushPending(err) {
 		for (const [, p] of this.pending) p.reject(err);
 		this.pending.clear();
 	}
 };
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //#endregion
 //#region src/ws-client.ts
 /**
@@ -3965,6 +4040,7 @@ var BaseAgentClient = class {
 *   - Agent response parsing (multi-format)
 *   - Session key formatting
 */
+const pkg = (0, node_module.createRequire)(require("url").pathToFileURL(__filename).href)("../package.json");
 var OpenClawGatewayAdapter = class extends BaseAgentClient {
 	tickTimer = null;
 	lastTick = 0;
@@ -3984,7 +4060,7 @@ var OpenClawGatewayAdapter = class extends BaseAgentClient {
 				client: {
 					id: this.opts.clientId,
 					displayName: this.opts.displayName,
-					version: this.opts.version ?? "0.1.0",
+					version: this.opts.version ?? pkg.version,
 					platform: process.platform,
 					mode: "backend",
 					instanceId: this.instanceId
@@ -4031,13 +4107,13 @@ var OpenClawGatewayAdapter = class extends BaseAgentClient {
 	}
 	/** Parse the standard agent response format into plain text. */
 	static parseAgentResponse(response) {
-		if (typeof response !== "object" || response === null) return "";
+		if (typeof response !== "object" || response === null || Array.isArray(response)) return "";
 		const r = response;
-		const result = r.result;
-		if (result?.payloads) return result.payloads.map((p) => p.text).filter(Boolean).join("\n\n");
-		if (typeof r.text === "string") return r.text;
-		if (typeof r.content === "string") return r.content;
-		if (typeof r.message === "string") return r.message;
+		const result = isRecord(r.result) ? r.result : void 0;
+		if (Array.isArray(result?.payloads)) return result.payloads.slice(0, 1e3).filter(isRecord).map((payload) => payload.text).filter((text) => typeof text === "string").join("\n\n").slice(0, 1024 * 1024);
+		if (typeof r.text === "string") return r.text.slice(0, 1024 * 1024);
+		if (typeof r.content === "string") return r.content.slice(0, 1024 * 1024);
+		if (typeof r.message === "string") return r.message.slice(0, 1024 * 1024);
 		return "";
 	}
 	/** Format a session key with the standard agent prefix. */
@@ -4045,6 +4121,9 @@ var OpenClawGatewayAdapter = class extends BaseAgentClient {
 		return `agent:${agentId}:${sessionKey}`;
 	}
 };
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 //#endregion
 exports.IPCClient = require_plugin.IPCClient;
 exports.OpenClawGatewayAdapter = OpenClawGatewayAdapter;

package/dist/index.d.cts

@@ -42,42 +42,42 @@ declare function isIPCEvent(msg: unknown): msg is IPCEvent;
 declare const PROTOCOL_VERSION = 1;
 //#endregion
 //#region src/ipc-client.d.ts
-
+interface Logger$1 {
+  info(msg: string, ...args: unknown[]): void;
+  warn(msg: string, ...args: unknown[]): void;
+  error(msg: string, ...args: unknown[]): void;
+  debug(msg: string, ...args: unknown[]): void;
+}
 declare class IPCClient extends EventEmitter {
+  private readonly socketPath;
+  private readonly log;
   private socket;
-  private socketPath;
   private buffer;
+  private decoder;
   private backoffMs;
   private closed;
-  private _connected;
+  private isSocketConnected;
   private reconnectTimer;
-  private pending;
-  private log;
-  constructor(socketPath: string);
+  private readonly pending;
+  constructor(socketPath: string, log?: Logger$1);
   get connected(): boolean;
-  /**
-   * Start the IPC connection with auto-reconnect.
-   */
   start(): void;
-  /**
-   * Stop the IPC connection and all timers.
-   */
   stop(): void;
-  /**
-   * Send a request to the daemon and wait for a response.
-   */
   request(method: string, params?: Record<string, unknown>, timeoutMs?: number): Promise<IPCResponse>;
-  /**
-   * Send a response to a daemon request.
-   * Used internally by the request event handler.
-   */
   sendResponse(response: IPCResponse): void;
-  private doConnect;
+  private openSocket;
   private processBuffer;
   private handleResponse;
+  private handleEvent;
   private handleIncomingRequest;
+  private serializeFrame;
+  private closeOversized;
+  private resolveAllPending;
   private scheduleReconnect;
   private clearReconnectTimer;
+  private resetDecoder;
+  private errorResponse;
+  private safeEmit;
 }
 //#endregion
 //#region src/capability-reporter.d.ts
@@ -119,10 +119,12 @@ declare abstract class BaseAgentClient {
   private connected;
   private closed;
   private backoffMs;
-  private pending;
+  private readonly pending;
+  private reconnectTimer;
   private readyResolve;
   private readyReject;
   private readyPromise;
+  private readySettled;
   protected readonly log: Logger;
   protected readonly opts: BaseClientOptions;
   protected readonly instanceId: string;
@@ -130,7 +132,7 @@ declare abstract class BaseAgentClient {
   get isConnected(): boolean;
   start(): Promise<void>;
   stop(): void;
-  request(method: string, params: object, opts?: {
+  request(method: string, params: Record<string, unknown>, opts?: {
     expectFinal?: boolean;
     timeoutMs?: number;
   }): Promise<unknown>;
@@ -155,8 +157,10 @@ declare abstract class BaseAgentClient {
   protected rejectReady(err: Error): void;
   protected doConnect(): void;
   private initiateHandshake;
+  private isCurrentConnection;
   private handleMessage;
   private scheduleReconnect;
+  private resetReady;
   private flushPending;
 }
 //# sourceMappingURL=base-client.d.ts.map

package/dist/index.d.ts

@@ -42,42 +42,42 @@ declare function isIPCEvent(msg: unknown): msg is IPCEvent;
 declare const PROTOCOL_VERSION = 1;
 //#endregion
 //#region src/ipc-client.d.ts
-
+interface Logger$1 {
+  info(msg: string, ...args: unknown[]): void;
+  warn(msg: string, ...args: unknown[]): void;
+  error(msg: string, ...args: unknown[]): void;
+  debug(msg: string, ...args: unknown[]): void;
+}
 declare class IPCClient extends EventEmitter {
+  private readonly socketPath;
+  private readonly log;
   private socket;
-  private socketPath;
   private buffer;
+  private decoder;
   private backoffMs;
   private closed;
-  private _connected;
+  private isSocketConnected;
   private reconnectTimer;
-  private pending;
-  private log;
-  constructor(socketPath: string);
+  private readonly pending;
+  constructor(socketPath: string, log?: Logger$1);
   get connected(): boolean;
-  /**
-   * Start the IPC connection with auto-reconnect.
-   */
   start(): void;
-  /**
-   * Stop the IPC connection and all timers.
-   */
   stop(): void;
-  /**
-   * Send a request to the daemon and wait for a response.
-   */
   request(method: string, params?: Record<string, unknown>, timeoutMs?: number): Promise<IPCResponse>;
-  /**
-   * Send a response to a daemon request.
-   * Used internally by the request event handler.
-   */
   sendResponse(response: IPCResponse): void;
-  private doConnect;
+  private openSocket;
   private processBuffer;
   private handleResponse;
+  private handleEvent;
   private handleIncomingRequest;
+  private serializeFrame;
+  private closeOversized;
+  private resolveAllPending;
   private scheduleReconnect;
   private clearReconnectTimer;
+  private resetDecoder;
+  private errorResponse;
+  private safeEmit;
 }
 //#endregion
 //#region src/capability-reporter.d.ts
@@ -119,10 +119,12 @@ declare abstract class BaseAgentClient {
   private connected;
   private closed;
   private backoffMs;
-  private pending;
+  private readonly pending;
+  private reconnectTimer;
   private readyResolve;
   private readyReject;
   private readyPromise;
+  private readySettled;
   protected readonly log: Logger;
   protected readonly opts: BaseClientOptions;
   protected readonly instanceId: string;
@@ -130,7 +132,7 @@ declare abstract class BaseAgentClient {
   get isConnected(): boolean;
   start(): Promise<void>;
   stop(): void;
-  request(method: string, params: object, opts?: {
+  request(method: string, params: Record<string, unknown>, opts?: {
     expectFinal?: boolean;
     timeoutMs?: number;
   }): Promise<unknown>;
@@ -155,8 +157,10 @@ declare abstract class BaseAgentClient {
   protected rejectReady(err: Error): void;
   protected doConnect(): void;
   private initiateHandshake;
+  private isCurrentConnection;
   private handleMessage;
   private scheduleReconnect;
+  private resetReady;
   private flushPending;
 }
 //# sourceMappingURL=base-client.d.ts.map