@byokit/openclaw 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 ## Unreleased
 
+## 0.14.2 (2026-10-16)
+
+- Dependency update: pins @byokit/relay 0.7.1.
+- Dependency update: pins @byokit/accounts 0.24.1.
+
+- FIX: `addKey` takes `orgId` for the Go live-catalog route and writes it into the engine's provider config (`models.providers['opencode-go'].headers['x-opencode-org-id']`) before the activation, so a multi-workspace login token is accepted — the engine's own probe and every run carry the header, and the first chat runs. The slot is provider-wide (shared by every member's key on one engine): a replacement key with no `orgId` keeps the standing workspace, `removeKey` drops it, and naming an `orgId` on a route with no workspace is refused `not_included`/`model` instead of silently dropped. Keys and workspace ids never reach logs, errors or views.
+
+## 0.14.1 (2026-10-16)
+
+- Dependency update: pins @byokit/ui 0.8.0.
+- Dependency update: pins @byokit/discover 0.8.2.
+- Dependency update: pins @byokit/relay 0.7.0.
+- Dependency update: pins @byokit/pair 0.10.1.
+- Dependency update: pins @byokit/accounts 0.24.0.
+
+- FIX: when the engine answers a sign-in's cancel `cancelled`, `done` now also waits (up to 10 s) for it to free its setup admission, so a sign-in started right after is admitted instead of ending `why: 'busy'`.
+- FIX: The kit now resolves `stateDir` to one absolute path through no symlink before it uses it. A native Claude CLI sign-in (`claude-cli`, browser or phone) with a relative `stateDir`, or one under a symlinked folder such as macOS `/tmp` or `os.tmpdir()`, failed with "The app supplied invalid account options." Engine paths the kit reports (for example the bridge socket and `identityPath`) now use that resolved path.
+- FIX: `removeKey` (and `signOut`, which calls it for that provider) also drops the lane's `<provider>.key` index entry, so `accounts()` no longer lists a removed key; a scoped removal keeps another provider's entry.
+- FIX: `pick` builds its live room/models reads from the filtered pick rows, so an Auto pick for a member whose only other account is the unnamed key lane makes no `models.list`/`models.authStatus` calls for the lane it never consults.
+- FIX: the key-lane docs now scope the "no `<member>--<hex6>` per later key" claim to the `addKey` path; a plan key added with `addAccount` when the member agent already holds that provider still mints one `<member>--<hex6>` agent per key. The Choosing spec names the kit-only lane filter.
+- The README states platform support: Linux and macOS x64/arm64 supported, Windows unsupported. CI runs the offline suite on macOS.
+
 ## 0.14.0 (2026-10-15)
 
 - Dependency update: pins @byokit/accounts 0.23.0.

package/README.md

@@ -568,7 +568,8 @@ for await (const e of oc.run('Say hello.')) console.log(e);
 
 ## Isolation and billing
 
-The kit writes only under the `stateDir` the app passes. It spawns the engine with an explicit isolated environment
+The kit writes only under the `stateDir` the app passes, resolved to one absolute path through no symlink (so a
+relative path or macOS `os.tmpdir()` works, and paths the kit reports use the resolved form). It spawns the engine with an explicit isolated environment
 (never `process.env`), reads no environment variables except `PATH` to find `npm`, and never bills an API behind the
 person's back (memory search is never a paid provider).
 
@@ -685,6 +686,8 @@ retained-login cleanup and sealed approval limits.
 
 ## Status
 
+Linux and macOS x64/arm64 are supported; Windows is unsupported.
+
 Pinned to OpenClaw `2026.8.35` (protocol 4); `ENGINE_VERSION` and `PROTOCOL_VERSION` carry the pin. Signatures are
 frozen (docs/runtime-kits.md §5).
 

package/dist/accounts.js

@@ -10,11 +10,11 @@ import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync
 import { randomBytes, randomUUID } from 'node:crypto';
 import { join } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
-import { providerOf, resolveSelection } from "./pick.js";
-import { agentOf, memberOf as baseMemberOf } from "./attribution.js";
-import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, keyAgentId, untilListed } from "./members.js";
-import { routes, routeFor } from "./routes.js";
-import { words } from "./words.js";
+import { providerOf, resolveSelection } from './pick.js';
+import { agentOf, memberOf as baseMemberOf } from './attribution.js';
+import { KEY_PREFIX, MEMBER_ID, NEW_MEMBER_ID, keyAgentId, untilListed } from './members.js';
+import { routes, routeFor } from './routes.js';
+import { words } from './words.js';
 const record = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 // `models.list { agentId, view: 'default' }` rows of the account's provider, mapped to `provider/model`. The pin
 // reports no per-plan availability, so `why: 'plan'` only comes from a run ending `plan`, never from here.

package/dist/approvals.js

@@ -1,6 +1,6 @@
 // Native approvals: exec.approval.*, plugin.approval.* and question.* surfaced through the same Approval shape (5.9, O5).
 import { randomBytes } from 'node:crypto';
-import { MEMBER_ID } from "./members.js";
+import { MEMBER_ID } from './members.js';
 const strip = (a) => {
     const { native, ...approval } = a;
     void native;

package/dist/auth-status.js

@@ -1,6 +1,6 @@
 import { statSync } from 'node:fs';
 import { join } from 'node:path';
-import { signedInProviders, USABLE } from "./runs.js";
+import { signedInProviders, USABLE } from './runs.js';
 /** Native Claude login stays in Claude Code. The pin's profile status does not include this synthetic auth;
  * setup detection asks the CLI itself, without handing credentials to the kit. */
 export async function authStatus(request, agentId, refresh = false, native = false) {

package/dist/auth-store.js

@@ -7,8 +7,8 @@
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, writeFileSync, closeSync, fsyncSync, openSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { EngineAlreadyRunningError, pidAlive as live } from "./engine-status.js";
-import { damagedAccountMembers, heldBackAgent, removedAccountAgents, sweepOrphans } from "./accounts.js";
+import { EngineAlreadyRunningError, pidAlive as live } from './engine-status.js';
+import { damagedAccountMembers, heldBackAgent, removedAccountAgents, sweepOrphans } from './accounts.js';
 const agentDirOf = (path) => path.startsWith('state/agents/') ? path.split('/')[2] : undefined;
 const encoder = new TextEncoder();
 const archive = (name) => !name.endsWith('.sealed') && (/^(auth-profiles|auth-state|auth|oauth)\.json\.(migrated-.+|sqlite-import\..+\.bak)$/.test(name)

package/dist/bridge.js

@@ -3,7 +3,7 @@ import { randomBytes } from 'node:crypto';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createServer } from 'node:net';
 import { rm } from 'node:fs/promises';
-import { words } from "./words.js";
+import { words } from './words.js';
 /** Newline-framed JSON, one request per connection; anything larger is not a gate request. */
 const FRAME_CAP = 1_000_000;
 /**

package/dist/browser/host.js

@@ -1,8 +1,8 @@
 // Internal host runtime (5.17). Production handoff is deliberately unprotected until W7/O17 qualification.
 import { randomBytes } from 'node:crypto';
-import { BrowserStoreError, checkUrl, validOrigin } from "./store.js";
-import { validateVerifiers, verifySignIn } from "./verify.js";
-import { dispatchResume, newResume, recoverResume } from "./resume.js";
+import { BrowserStoreError, checkUrl, validOrigin } from './store.js';
+import { validateVerifiers, verifySignIn } from './verify.js';
+import { dispatchResume, newResume, recoverResume } from './resume.js';
 export class SignInRefused extends Error {
     why;
     constructor(why) { super(`sign-in refused: ${why}`); this.why = why; }

package/dist/browser/verify.js

@@ -1,4 +1,4 @@
-import { checkUrl, validOrigin } from "./store.js";
+import { checkUrl, validOrigin } from './store.js';
 export function validateVerifiers(verifiers) {
     for (const v of verifiers) {
         validOrigin(v.origin);

package/dist/config.js

@@ -1,6 +1,6 @@
 import { dirname, join } from 'node:path';
-import { routes } from "./routes.js";
-import { MEMBER_ID, KEY_PREFIX, BASE_AGENT, keyAgentId } from "./members.js";
+import { routes } from './routes.js';
+import { MEMBER_ID, KEY_PREFIX, BASE_AGENT, keyAgentId } from './members.js';
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const merge = (a, b) => {
     for (const [k, v] of Object.entries(b))

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
 export declare const ENGINE_VERSION = "2026.8.35";
 export declare const PROTOCOL_VERSION = 4;
 export declare const LIVE_CATALOGS: string[];
-export declare const OPERATOR_SCOPES: readonly ["operator.read", "operator.write", "operator.admin", "operator.approvals", "operator.questions", "operator.pairing", "operator.talk"];
+export declare const OPERATOR_SCOPES: readonly ['operator.read', 'operator.write', 'operator.admin', 'operator.approvals', 'operator.questions', 'operator.pairing', 'operator.talk'];

package/dist/day-usage.js

@@ -1,5 +1,5 @@
 // Portable additive day reader. No host files, pricing guesses or side totals for persisted turns.
-import { agentUsageOf } from "./usage.js";
+import { agentUsageOf } from './usage.js';
 const object = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
 const count = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
 const text = (v) => typeof v === 'string' && v.length > 0 && v.length <= 512;

package/dist/device.js

@@ -1,7 +1,7 @@
 import { openBoxFromSeed, boxKeyPairFromSeed } from '@byokit/seal';
-import { memberOf } from "./attribution.js";
-import { toAccountView } from "./words.js";
-import { b64urlDecode, b64urlEncode, openNotice } from "./notices.js";
+import { memberOf } from './attribution.js';
+import { toAccountView } from './words.js';
+import { b64urlDecode, b64urlEncode, openNotice } from './notices.js';
 /**
  * The host ended a stream with its own words (e.g. a refusal). Portable twin of link's PublicLinkError:
  * same shape ({ code: 'failed', sealed: true }) so a screen can show .message the same way. A device-side
@@ -418,8 +418,8 @@ export function openclawDevice(link) {
     };
 }
 // Portable, re-exported by ./device (7.3).
-export { openNotice } from "./notices.js";
-export { readAgentUsage, agentUsageOf } from "./usage.js";
-export { readAgentDayUsage } from "./day-usage.js";
+export { openNotice } from './notices.js';
+export { readAgentUsage, agentUsageOf } from './usage.js';
+export { readAgentDayUsage } from './day-usage.js';
 // The kit's sentences, so a phone or browser shows the same words the computer does (5.14).
-export { stateWords, toAccountView, words } from "./words.js";
+export { stateWords, toAccountView, words } from './words.js';

package/dist/engine.d.ts

@@ -2,6 +2,9 @@ import { remoteCliHost } from '@byokit/accounts/cli';
 import { AuthStore, AuthStoreSealSizeError } from './auth-store.ts';
 import type { KitOptions } from './kit.ts';
 import type { KitState, ToolSpec } from './types.ts';
+/** The app's stateDir as an absolute path with no symlinked ancestor (macOS /tmp and /var are symlinks):
+ * the native Claude login's accounts store refuses any other, so a relative or symlinked stateDir failed it. */
+export declare function canonicalStateDir(dir: string): string;
 export type EngineOptions = Pick<KitOptions, 'stateDir' | 'engineDir' | 'npmPath' | 'enginePath' | 'config' | 'offered' | 'appOwnedSessions' | 'installPolicy' | 'log' | 'bridge' | 'authSeal'> & {
     pluginId: string;
     tools: ToolSpec[];

package/dist/engine.js

@@ -2,18 +2,30 @@ import { spawn, spawnSync } from 'node:child_process';
 import { randomBytes, generateKeyPairSync, randomUUID } from 'node:crypto';
 import { accessSync, constants, closeSync, existsSync, mkdirSync, openSync, readFileSync, writeFileSync, copyFileSync, rmSync, realpathSync, statSync } from 'node:fs';
 import { createServer } from 'node:net';
-import { basename, join, dirname } from 'node:path';
+import { basename, join, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
 import { cliAccounts, remoteCliHost } from '@byokit/accounts/cli';
-import { AuthStore, AuthStoreUnreadableError, AuthStoreSealSizeError } from "./auth-store.js";
-import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from "./engine-status.js";
-import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, sha256, verifyEngineSet } from "./engine-patches.js";
-import { ENGINE_VERSION } from "./constants.js";
-import { appendUsageBoot } from "./usage-boots.js";
-import { reconcileConfig, appRecoveryPrefixes } from "./config.js";
-import { writePlugin, resolveBridge } from "./bridge.js";
-import { sweepOrphans } from "./accounts.js";
+import { AuthStore, AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.js';
+import { EngineAlreadyRunningError, pidAlive, StartedProcesses } from './engine-status.js';
+import { EnginePatchError, atomic, prepareEngineSet, processStartTime, readPatchSet, sha256, verifyEngineSet } from './engine-patches.js';
+import { ENGINE_VERSION } from './constants.js';
+import { appendUsageBoot } from './usage-boots.js';
+import { reconcileConfig, appRecoveryPrefixes } from './config.js';
+import { writePlugin, resolveBridge } from './bridge.js';
+import { sweepOrphans } from './accounts.js';
+/** The app's stateDir as an absolute path with no symlinked ancestor (macOS /tmp and /var are symlinks):
+ * the native Claude login's accounts store refuses any other, so a relative or symlinked stateDir failed it. */
+export function canonicalStateDir(dir) {
+    const path = resolve(dir);
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        const parent = dirname(path);
+        return parent === path ? path : join(canonicalStateDir(parent), basename(path));
+    }
+}
 const kitDir = dirname(dirname(fileURLToPath(import.meta.url)));
 const putOnce = (path, data) => { if (!existsSync(path))
     writeFileSync(path, data, { mode: 0o600, flag: 'wx' }); };
@@ -95,6 +107,7 @@ export class Engine {
     appOwnedSessionPrefixes;
     constructor(o) {
         this.appOwnedSessionPrefixes = appRecoveryPrefixes(o.appOwnedSessions);
+        o = { ...o, stateDir: canonicalStateDir(o.stateDir) };
         this.o = o;
         const bridge = resolveBridge(o.bridge);
         this.root = join(o.stateDir, 'openclaw');

package/dist/index.js

@@ -1,10 +1,10 @@
 // @byokit/openclaw — the OpenClaw runtime kit, host side (docs/runtime-kits.md 5.3). Entries: `.` (this),
 // `./device` (portable), `./link` (Node host-side adapter), `./testing` (fakes and contract suite).
-export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from "./constants.js";
-export { OpenClawKit } from "./kit.js";
-export { stateWords, toAccountView, words } from "./words.js";
-export { chooseAccount, consider, resolveSelection } from "./pick.js";
-export { AuthStoreUnreadableError, AuthStoreSealSizeError } from "./auth-store.js";
-export { EngineAlreadyRunningError } from "./engine-status.js";
-export { readAgentDayUsage } from "./day-usage.js";
-export { readAgentUsage, agentUsageOf } from "./usage.js";
+export { ENGINE_VERSION, OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.js';
+export { OpenClawKit } from './kit.js';
+export { stateWords, toAccountView, words } from './words.js';
+export { chooseAccount, consider, resolveSelection } from './pick.js';
+export { AuthStoreUnreadableError, AuthStoreSealSizeError } from './auth-store.js';
+export { EngineAlreadyRunningError } from './engine-status.js';
+export { readAgentDayUsage } from './day-usage.js';
+export { readAgentUsage, agentUsageOf } from './usage.js';

package/dist/keys.d.ts

@@ -22,6 +22,9 @@ export declare function createKeys(ctx: ActivationCtx & {
     indexLane(member: Member, route: RouteView): Promise<void>;
     dropLane(member: Member, provider?: string): Promise<void>;
     backfillLane(member: Member, model: string | undefined): Promise<void>;
+    /** The provider config headers a live-catalog key's calls and probes must carry (`null` clears them),
+     *  written through the kit's own config patch. The Go workspace header is the one user. */
+    setProviderHeaders(provider: string, headers: Record<string, string> | null): Promise<void>;
 }): {
     models: (member: Member, o: {
         authChoice: string;
@@ -31,6 +34,7 @@ export declare function createKeys(ctx: ActivationCtx & {
         authChoice: string;
         apiKey: string;
         model?: string;
+        orgId?: string;
     }): AddKeyHandle;
     ready(member: Member, o?: {
         once?: boolean;

package/dist/keys.js

@@ -1,10 +1,10 @@
 import { join } from 'node:path';
-import { activate } from "./activation.js";
-import { keyAgentId, MEMBER_ID, KEY_PREFIX, untilListed } from "./members.js";
-import { providerOf } from "./pick.js";
-import { routes } from "./routes.js";
-import { modelsOf } from "./accounts.js";
-import { LIVE_CATALOGS } from "./constants.js";
+import { activate } from './activation.js';
+import { keyAgentId, MEMBER_ID, KEY_PREFIX, untilListed } from './members.js';
+import { providerOf } from './pick.js';
+import { routes } from './routes.js';
+import { modelsOf } from './accounts.js';
+import { LIVE_CATALOGS } from './constants.js';
 export function createKeys(ctx) {
     // Serialize key replacement and key runs, so an in-flight run never sees a half-installed replacement.
     const tails = new Map();
@@ -86,6 +86,15 @@ export function createKeys(ctx) {
                 const route = routes().find((r) => r.choice === o.authChoice && r.keyEntry && r.readiness === 'ready');
                 if (!route || (o.model !== undefined && !LIVE_CATALOGS.includes(route.provider)))
                     return failure('not_included', 'model');
+                // A workspace names a live-catalog login's own workspace only; another route takes no header, and a
+                // refusal here leaves the member's lanes untouched (it lands before any prepare or activation).
+                const orgId = typeof o.orgId === 'string' ? o.orgId.trim() : '';
+                if (orgId) {
+                    if (orgId.length > 256)
+                        return failure('invalid', 'auth');
+                    if (!LIVE_CATALOGS.includes(route.provider))
+                        return failure('not_included', 'model');
+                }
                 if (ac.signal.aborted)
                     return failure('retry', 'busy');
                 return exclusive(member, async () => {
@@ -112,6 +121,11 @@ export function createKeys(ctx) {
                             return cancelled();
                         if (!(await control(member, 'prepare', route.provider)).ok)
                             return failure('retry', 'engine');
+                        // The workspace rides the provider's probe and every run from its config; it is written before the
+                        // activation, so the probe itself carries it. The slot is provider-wide (shared by every member's
+                        // key on this engine), so a replacement with no `orgId` keeps the standing one and `removeKey` drops it.
+                        if (orgId)
+                            await ctx.setProviderHeaders(route.provider, { 'x-opencode-org-id': orgId });
                         // The public pin's typed API-key path, never a CLI-login import. Discard the engine's lines/errors.
                         sent = true;
                         if (ac.signal.aborted)
@@ -187,9 +201,13 @@ export function createKeys(ctx) {
                     else if (ready.ok !== true || providerOf(ready.model ?? '') !== o.provider)
                         return;
                 }
+                // The lane's own provider, when the removal can name it: the header clear below is scoped like the removal.
                 const cleared = await control(member, 'clear').catch(() => undefined);
                 if (cleared?.ok !== true && cleared?.absent !== true)
                     refused();
+                // A workspace header the removed key named must not outlive it; the next add names its own (or none).
+                if (o.provider !== undefined && LIVE_CATALOGS.includes(o.provider))
+                    await ctx.setProviderHeaders(o.provider, null).catch(() => { throw new Error('The key could not be removed.'); });
                 await ctx.dropLane(member, o.provider);
             });
         },

package/dist/kit.d.ts

@@ -153,11 +153,14 @@ export declare class OpenClawKit {
     removeAccount(member: Member, id: AccountId): Promise<void>;
     defaults(member: Member): Promise<Defaults>;
     setDefaults(member: Member, d: Defaults): Promise<void>;
-    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
+    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent.
+     * `orgId` names the workspace a Go plan login acts for (the pick the app captured at connect);
+     * it rides every probe and run as `x-opencode-org-id`, and replacing the key rewrites it. */
     addKey(agentId: Member, o: {
         authChoice: string;
         apiKey: string;
         model?: string;
+        orgId?: string;
     }): AddKeyHandle;
     private indexKeyLane;
     /** Remove this member's saved key (the `byokit-key-<member>` lane: its credential store and ready marker), so

package/dist/kit.js

@@ -3,29 +3,29 @@ import { join } from 'node:path';
 import { setTimeout as delay } from 'node:timers/promises';
 import { isDeepStrictEqual } from 'node:util';
 import { fileURLToPath } from 'node:url';
-import { PROTOCOL_VERSION, LIVE_CATALOGS } from "./constants.js";
-import { atomic } from "./engine-patches.js";
-import { Approvals } from "./approvals.js";
-import { Bridge } from "./bridge.js";
-import { Engine, refusedOnly } from "./engine.js";
-import { AuthStoreSealSizeError } from "./auth-store.js";
-import { gatewayTransport } from "./transport.js";
-import { createMembers } from "./members.js";
-import { createAccounts, memberOfAccount } from "./accounts.js";
-import { createLocks } from "./locks.js";
-import { keyAgentId, KEY_PREFIX, MEMBER_ID } from "./members.js";
-import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from "./migrate.js";
-import { createRuns, signedInProviders } from "./runs.js";
-import { authStatus, createAuthStatus } from "./auth-status.js";
-import { outputSchema } from "./output.js";
-import { createKeys } from "./keys.js";
-import { routes as routeTable } from "./routes.js";
-import { providerOf } from "./pick.js";
-import { signIn as startSignIn, signOut as engineSignOut } from "./signin.js";
-import { reconcileConfig, browserToolPolicySafe, browserProfileAcknowledged, browserSessionMayRun, memoryLimited as configMemoryLimited, configKeyPath, readConfigKey, writeConfigKey } from "./config.js";
-import { createBrowserHost } from "./browser/host.js";
-import { fileSignInStore } from "./browser/store.js";
-import { launchBroker } from "./browser/broker.js";
+import { PROTOCOL_VERSION, LIVE_CATALOGS } from './constants.js';
+import { atomic } from './engine-patches.js';
+import { Approvals } from './approvals.js';
+import { Bridge } from './bridge.js';
+import { Engine, canonicalStateDir, refusedOnly } from './engine.js';
+import { AuthStoreSealSizeError } from './auth-store.js';
+import { gatewayTransport } from './transport.js';
+import { createMembers } from './members.js';
+import { createAccounts, memberOfAccount } from './accounts.js';
+import { createLocks } from './locks.js';
+import { keyAgentId, KEY_PREFIX, MEMBER_ID } from './members.js';
+import { confirmRetainedLogin as confirmLogin, migrateRetainedLogin as migrateLogin } from './migrate.js';
+import { createRuns, signedInProviders } from './runs.js';
+import { authStatus, createAuthStatus } from './auth-status.js';
+import { outputSchema } from './output.js';
+import { createKeys } from './keys.js';
+import { routes as routeTable } from './routes.js';
+import { providerOf } from './pick.js';
+import { signIn as startSignIn, signOut as engineSignOut } from './signin.js';
+import { reconcileConfig, browserToolPolicySafe, browserProfileAcknowledged, browserSessionMayRun, memoryLimited as configMemoryLimited, configKeyPath, readConfigKey, writeConfigKey } from './config.js';
+import { createBrowserHost } from './browser/host.js';
+import { fileSignInStore } from './browser/store.js';
+import { launchBroker } from './browser/broker.js';
 /** The engine's learning-mode config key (5.6 "Engine learning state"). */
 const LEARNING_KEY = 'skills.workshop.autonomous.mode';
 const RESTART_MS = 60_000;
@@ -651,7 +651,7 @@ export class OpenClawKit {
                 || (o.browser && ['browser', 'request_sign_in', 'exec', 'process', 'code_execution', 'terminal', 'read', 'write', 'edit', 'apply_patch', 'gateway'].includes(t.name)))
                 throw new Error(`invalid tool name: ${t.name}`);
         }
-        this.o = o;
+        this.o = { ...o, stateDir: canonicalStateDir(o.stateDir) };
         this.engine = new Engine({ ...o, pluginId: o.plugin?.id ?? 'byokit', tools: [...o.tools ?? [], ...(o.browser ? [{
                         name: 'request_sign_in', description: 'Ask the person to sign in to the current browser site.',
                         parameters: { type: 'object', additionalProperties: false, properties: {
@@ -671,7 +671,8 @@ export class OpenClawKit {
             request: (method, params, options) => this.request()(method, params, options),
             ensure: (member) => this.ensureMember(member),
             authConfig: () => this.authSnapshot(),
-            restarted: (authBefore, signal) => this.restarted(authBefore, signal) });
+            restarted: (authBefore, signal) => this.restarted(authBefore, signal),
+            setProviderHeaders: (provider, headers) => this.patchConfig({ models: { providers: { [provider]: { headers: headers ?? null } } } }) });
         const slot = {};
         this.approvalsCtl = new Approvals({
             request: (method, params, co) => this.request()(method, params, co),
@@ -1068,7 +1069,9 @@ export class OpenClawKit {
             return Promise.reject(new Error('gateway not ready'));
         return this.accountsCtl.setDefaults(member, d);
     }
-    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent. */
+    /** Save an explicitly supplied API key (billed per use) in this member's separate key agent.
+     * `orgId` names the workspace a Go plan login acts for (the pick the app captured at connect);
+     * it rides every probe and run as `x-opencode-org-id`, and replacing the key rewrites it. */
     addKey(agentId, o) {
         return this.keys.add(agentId, o);
     }

package/dist/link.js

@@ -7,11 +7,11 @@ import { createServer } from 'node:http';
 import { WebSocketServer } from 'ws';
 import { PublicLinkError, } from '@byokit/pair';
 import { reach } from '@byokit/discover';
-import { ENGINE_VERSION } from "./constants.js";
-import { b64urlDecode, b64urlEncode, sealNotice } from "./notices.js";
-import { routeFor } from "./routes.js";
-import { outputSchema } from "./output.js";
-import { stateWords, words } from "./words.js";
+import { ENGINE_VERSION } from './constants.js';
+import { b64urlDecode, b64urlEncode, sealNotice } from './notices.js';
+import { routeFor } from './routes.js';
+import { outputSchema } from './output.js';
+import { stateWords, words } from './words.js';
 const VIEW_OPS = new Set(['oc.state', 'oc.routes', 'oc.signin.view', 'oc.sessions', 'oc.approvals', 'oc.events',
     'oc.browser.state', 'oc.browser.signins', 'oc.browser.thumb']);
 // This kit's own version, read once from its package.json (beside src/ and dist/ alike).

package/dist/migrate.js

@@ -2,9 +2,9 @@
 // only when the Gateway itself reports every provider signed in.
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { retireArchive } from "./auth-store.js";
-import { MEMBER_ID } from "./members.js";
-import { providers } from "./signin.js";
+import { retireArchive } from './auth-store.js';
+import { MEMBER_ID } from './members.js';
+import { providers } from './signin.js';
 const MOVED = '.moved-to-engine';
 const MARKER = '.canonicalized';
 const TRY_MS = 1_500;

package/dist/pick.js

@@ -1,4 +1,4 @@
-import { words } from "./words.js";
+import { words } from './words.js';
 const DAY_MS = 24 * 60 * 60 * 1000;
 const finite = (n) => typeof n === 'number' && Number.isFinite(n);
 /** The lowercased provider of a well-formed `provider/model` reference; undefined when the reference is malformed. */

package/dist/runs.js

@@ -1,12 +1,12 @@
 // Runs: one Gateway run per spec, streamed through typed events, ending in a classified RunEnd (5.8, O8).
 import { randomUUID } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
-import { authStatus } from "./auth-status.js";
-import { outputSchema } from "./output.js";
-import { words } from "./words.js";
-import { classify } from "./classify.js";
-import { providerOf } from "./pick.js";
-import { catalogModelOf, clampThinking, levelsOf } from "./thinking.js";
+import { authStatus } from './auth-status.js';
+import { outputSchema } from './output.js';
+import { words } from './words.js';
+import { classify } from './classify.js';
+import { providerOf } from './pick.js';
+import { catalogModelOf, clampThinking, levelsOf } from './thinking.js';
 // The gateway gives up on a silent run after an hour; we wait ten minutes longer for the reply frame itself.
 const WAIT_MS = 3_600_000;
 const WAIT_CLIENT_MS = 3_610_000;

package/dist/signin.js

@@ -2,11 +2,11 @@
 // sign-in; OAuth credentials stay in the engine/CLI. Explicit API keys go only to engine activation (D11).
 import { randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
-import { activate, LATE_RESTART } from "./activation.js";
-import { authStatus } from "./auth-status.js";
-import { routes } from "./routes.js";
-import { signedInProviders } from "./runs.js";
-import { words } from "./words.js";
+import { activate, LATE_RESTART } from './activation.js';
+import { authStatus } from './auth-status.js';
+import { routes } from './routes.js';
+import { signedInProviders } from './runs.js';
+import { words } from './words.js';
 // The pin's wizard contract (2026.8.1): steps arrive only from `wizard.next` (wizard.status answers {status, error}
 // and never carries a step), and one session at a time holds the gateway's single setup admission.
 const BUSY = /setup is already in progress|SETUP_ADMISSION_BUSY/i;

package/dist/testing/browser.js

@@ -1,5 +1,5 @@
-import { fixtureBrowserHost, secureOrigin } from "../browser/host.js";
-import { emptySignIns, validateSignIns } from "../browser/store.js";
+import { fixtureBrowserHost, secureOrigin } from '../browser/host.js';
+import { emptySignIns, validateSignIns } from '../browser/store.js';
 function channel() {
     let pending;
     let value;

package/dist/testing/contract.js

@@ -7,9 +7,9 @@
 // and whose calls answer `note: <input.text>`. An optional model is a started model stub the kit was pointed at with `useModelStub`.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { PROTOCOL_VERSION } from "../constants.js";
-import { GATEWAY_CAPS } from "../transport.js";
-import { releaseStub, stubHolding } from "./model-stub.js";
+import { PROTOCOL_VERSION } from '../constants.js';
+import { GATEWAY_CAPS } from '../transport.js';
+import { releaseStub, stubHolding } from './model-stub.js';
 /** The contract drives pass-through by method name, so results arrive untyped and are narrowed per case. */
 const call = (kit, method, params) => kit.call(method, params);
 const REQUIRED_METHODS = [

package/dist/testing/fake-gateway.js

@@ -5,9 +5,9 @@ import { connect } from 'node:net';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { ENGINE_VERSION, PROTOCOL_VERSION } from "../constants.js";
-import { toolCalls } from "./model-stub.js";
-import { routes } from "../routes.js";
+import { ENGINE_VERSION, PROTOCOL_VERSION } from '../constants.js';
+import { toolCalls } from './model-stub.js';
+import { routes } from '../routes.js';
 // The device-code script from Crewhouse's openclaw-wizard.test.ts, ported: the step, then progress, then done.
 const DEVICE_STEP = {
     id: 'step-device', type: 'note', executor: 'client',
@@ -40,7 +40,9 @@ const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArr
 function mergeInto(target, patch) {
     for (const [key, value] of Object.entries(patch)) {
         const current = target[key];
-        if (isPlainObject(current) && isPlainObject(value))
+        if (value === null)
+            delete target[key]; // JSON merge-patch: null deletes, as the engine's config.patch does.
+        else if (isPlainObject(current) && isPlainObject(value))
             mergeInto(current, value);
         else
             target[key] = value;

package/dist/testing/index.js

@@ -1,5 +1,5 @@
 // The kit's fakes, contract suite and scripted model (5.11). Built in O7.
-export { fakeGateway } from "./fake-gateway.js";
-export { fakeBrowserHost, createBrowserHostFake, browserHostContract, memorySignInStore } from "./browser.js";
-export { openclawContract } from "./contract.js";
-export { STUB_USAGE, startModelStub, useModelStub, releaseStub, stubHolding, toolCalls } from "./model-stub.js";
+export { fakeGateway } from './fake-gateway.js';
+export { fakeBrowserHost, createBrowserHostFake, browserHostContract, memorySignInStore } from './browser.js';
+export { openclawContract } from './contract.js';
+export { STUB_USAGE, startModelStub, useModelStub, releaseStub, stubHolding, toolCalls } from './model-stub.js';

package/dist/testing/model-stub.d.ts

@@ -17,6 +17,7 @@ export type StubCall = {
     path: string;
     body: StubRequest;
     session?: string;
+    org?: string;
 };
 /** The token usage every stub reply reports when asked (`stream_options.include_usage`), per model call. */
 export declare const STUB_USAGE: {
@@ -45,6 +46,9 @@ export type ModelStubOptions = {
     idPattern?: RegExp;
     routingMarker?: string;
     onCall?: (call: StubCall) => void;
+    /** The Go gateway's own rule, for tests that prove the workspace header: a Go-route request without
+     *  `x-opencode-org-id` (or with another workspace's) is refused exactly as the real one refuses it. */
+    goWorkspace?: string;
 };
 export declare function startModelStub(script?: string[], o?: ModelStubOptions): Promise<ModelStub>;
 export declare function useModelStub(kit: OpenClawKit, stub: ModelStub): Promise<void>;

package/dist/testing/model-stub.js

@@ -78,9 +78,16 @@ export function startModelStub(script = [], o = {}) {
             return;
         }
         const call = { authorization: String(req.headers.authorization ?? ''), path: req.url ?? '', body,
-            ...(req.headers['x-opencode-session'] ? { session: String(req.headers['x-opencode-session']) } : {}) };
+            ...(req.headers['x-opencode-session'] ? { session: String(req.headers['x-opencode-session']) } : {}),
+            ...(req.headers['x-opencode-org-id'] ? { org: String(req.headers['x-opencode-org-id']) } : {}) };
         calls.push(call);
         o.onCall?.(call); // Fixture evidence is persisted before any response/hold awaits.
+        if (o.goWorkspace !== undefined && call.path.startsWith('/zen/go/')) {
+            if (call.org !== o.goWorkspace) {
+                res.writeHead(403, { 'content-type': 'application/json' });
+                return res.end(JSON.stringify({ type: 'error', error: { type: 'permission_error', message: 'Workspace selection is required' } }));
+            }
+        }
         if (req.url === '/api/embed' || req.url === '/api/embeddings') {
             res.writeHead(200, { 'content-type': 'application/json' });
             return res.end(JSON.stringify({

package/dist/transport.d.ts

@@ -3,7 +3,7 @@ import type { GatewayTransport } from './types.ts';
  * Client caps for the operator connection. `approvals` makes this connection an approval client, so the
  * engine delivers exec/plugin.approval.requested to it (B7); without it the broadcast set is empty.
  */
-export declare const GATEWAY_CAPS: readonly ["tool-events", "approvals"];
+export declare const GATEWAY_CAPS: readonly ['tool-events', 'approvals'];
 /**
  * Read the device key pair from `device.json`. The kit writes `{ privateKey, publicKey }` (PEM strings);
  * existing Crewhouse state carries `{ deviceId, publicKeyPem, privateKeyPem }` instead. Both shapes are

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { GatewayClient } from '@openclaw/gateway-client';
-import { OPERATOR_SCOPES, PROTOCOL_VERSION } from "./constants.js";
+import { OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.js';
 /**
  * Client caps for the operator connection. `approvals` makes this connection an approval client, so the
  * engine delivers exec/plugin.approval.requested to it (B7); without it the broadcast set is empty.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -60,10 +60,10 @@
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"
   },
   "dependencies": {
-    "@byokit/accounts": "0.23.0",
-    "@byokit/pair": "0.10.0",
-    "@byokit/relay": "0.6.1",
-    "@byokit/discover": "0.8.1",
+    "@byokit/accounts": "0.24.1",
+    "@byokit/pair": "0.10.1",
+    "@byokit/relay": "0.7.1",
+    "@byokit/discover": "0.8.2",
     "@byokit/seal": "0.3.0",
     "@byokit/secrets": "0.5.1",
     "@openclaw/gateway-client": "2026.8.35",
@@ -71,7 +71,7 @@
     "ws": "8.22.0"
   },
   "devDependencies": {
-    "@byokit/ui": "0.7.0"
+    "@byokit/ui": "0.8.0"
   },
   "publishConfig": {
     "access": "public"