@byokit/openclaw 0.14.0 → 0.14.4

package/dist/runs.js

@@ -1,12 +1,12 @@
 // Runs: one Gateway run per spec, streamed through typed events, ending in a classified RunEnd (5.8, O8).
 import { randomUUID } from 'node:crypto';
 import { setTimeout as delay } from 'node:timers/promises';
-import { authStatus } from "./auth-status.js";
-import { outputSchema } from "./output.js";
-import { words } from "./words.js";
-import { classify } from "./classify.js";
-import { providerOf } from "./pick.js";
-import { catalogModelOf, clampThinking, levelsOf } from "./thinking.js";
+import { authStatus } from './auth-status.js';
+import { outputSchema } from './output.js';
+import { words } from './words.js';
+import { classify } from './classify.js';
+import { providerOf } from './pick.js';
+import { catalogModelOf, clampThinking, levelsOf } from './thinking.js';
 // The gateway gives up on a silent run after an hour; we wait ten minutes longer for the reply frame itself.
 const WAIT_MS = 3_600_000;
 const WAIT_CLIENT_MS = 3_610_000;

package/dist/signin.d.ts

@@ -15,6 +15,11 @@ export type SignInCtx = {
     restarted(authBefore: string | undefined, signal?: AbortSignal): Promise<boolean>;
     stopSignal?: AbortSignal;
     fresh?: boolean;
+    setProviderHeaders?(provider: string, headers: Record<string, string> | null): Promise<void>;
+    listWorkspaces?(key: string, signal: AbortSignal): Promise<{
+        id: string;
+        name: string;
+    }[]>;
 };
 /**
  * Drive the engine's provider-owned login. `on` sees every view the person watches; `done` resolves once, and

package/dist/signin.js

@@ -2,11 +2,12 @@
 // sign-in; OAuth credentials stay in the engine/CLI. Explicit API keys go only to engine activation (D11).
 import { randomUUID } from 'node:crypto';
 import { createServer } from 'node:http';
-import { activate, LATE_RESTART } from "./activation.js";
-import { authStatus } from "./auth-status.js";
-import { routes } from "./routes.js";
-import { signedInProviders } from "./runs.js";
-import { words } from "./words.js";
+import { activate, LATE_RESTART } from './activation.js';
+import { authStatus } from './auth-status.js';
+import { LIVE_CATALOGS } from './constants.js';
+import { routes } from './routes.js';
+import { signedInProviders } from './runs.js';
+import { words } from './words.js';
 // The pin's wizard contract (2026.8.1): steps arrive only from `wizard.next` (wizard.status answers {status, error}
 // and never carries a step), and one session at a time holds the gateway's single setup admission.
 const BUSY = /setup is already in progress|SETUP_ADMISSION_BUSY/i;
@@ -298,6 +299,55 @@ export function signIn(ctx, member, o, on) {
                 if (!apiKey)
                     return { state: 'failed', via, why: signal.aborted ? 'declined' : 'expired' };
                 secret = apiKey.trim() || undefined;
+                // A live-catalog key can act for several workspaces, and the Go gateway refuses every call until one is
+                // named (403 Workspace selection is required): the engine carries the workspace only from its provider
+                // config headers, so resolve it here the way the kit's key lane does, and write the header before the
+                // activation so the activation probe itself carries it. One workspace is used unasked; several ask here,
+                // answered through the same paste (an id or an exact name); a key the console refuses (a workspace-bound
+                // service key) needs none; a listing that cannot be read fails the sign-in before anything changes.
+                if (secret && keyRoute && LIVE_CATALOGS.includes(keyRoute.provider) && ctx.setProviderHeaders && ctx.listWorkspaces) {
+                    let workspaces;
+                    try {
+                        workspaces = await ctx.listWorkspaces(secret, signal);
+                    }
+                    catch {
+                        return { state: 'failed', via, why: 'failed', error: 'The workspace list could not be read. Try again.' };
+                    }
+                    if (signal.aborted)
+                        return cancelled();
+                    const pickable = workspaces.filter((w) => w.id);
+                    let orgId = workspaces.length === 1 ? pickable[0]?.id ?? '' : '';
+                    let retrying = false;
+                    while (orgId === '' && pickable.length > 1) {
+                        if (signal.aborted)
+                            return cancelled();
+                        // A re-ask says a different sentence, so an app that watches the prompt sees the answer was not taken.
+                        // Names alone: the ids are unbreakable noise on a phone; the answer may still be an id.
+                        say({ prompt: `${retrying ? 'That is not one of them. ' : ''}Which workspace? Paste one of: ${pickable.map((w) => w.name).join(', ')}` });
+                        retrying = true;
+                        const text = returned ?? await new Promise((resolve) => {
+                            const stop = (value) => { clearTimeout(timer); signal.removeEventListener('abort', abort); pasteIn = undefined; resolve(value); };
+                            const abort = () => stop();
+                            const timer = setTimeout(abort, PASTE_MS);
+                            pasteIn = stop;
+                            signal.addEventListener('abort', abort, { once: true });
+                            if (signal.aborted)
+                                abort();
+                        });
+                        returned = undefined;
+                        if (!text)
+                            return { state: 'failed', via, why: signal.aborted ? 'declined' : 'expired' };
+                        const given = text.trim().toLowerCase();
+                        const match = pickable.find((w) => w.id.toLowerCase() === given)
+                            ?? pickable.find((w) => w.name.toLowerCase() === given);
+                        if (match)
+                            orgId = match.id;
+                    }
+                    if (signal.aborted)
+                        return cancelled();
+                    if (orgId)
+                        await ctx.setProviderHeaders(keyRoute.provider, { 'x-opencode-org-id': orgId });
+                }
             }
             // The commit point: a phone cancel or host shutdown that landed before it activates nothing. Done waits for the gateway restart an `auth` change causes (activation.ts).
             // For Claude only host shutdown cuts that wait; a late restart has persisted the route and says saved. A key's cancel still declines its wait; a late key keeps the shared words.

package/dist/testing/browser.js

@@ -1,5 +1,5 @@
-import { fixtureBrowserHost, secureOrigin } from "../browser/host.js";
-import { emptySignIns, validateSignIns } from "../browser/store.js";
+import { fixtureBrowserHost, secureOrigin } from '../browser/host.js';
+import { emptySignIns, validateSignIns } from '../browser/store.js';
 function channel() {
     let pending;
     let value;

package/dist/testing/contract.js

@@ -7,9 +7,9 @@
 // and whose calls answer `note: <input.text>`. An optional model is a started model stub the kit was pointed at with `useModelStub`.
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { PROTOCOL_VERSION } from "../constants.js";
-import { GATEWAY_CAPS } from "../transport.js";
-import { releaseStub, stubHolding } from "./model-stub.js";
+import { PROTOCOL_VERSION } from '../constants.js';
+import { GATEWAY_CAPS } from '../transport.js';
+import { releaseStub, stubHolding } from './model-stub.js';
 /** The contract drives pass-through by method name, so results arrive untyped and are narrowed per case. */
 const call = (kit, method, params) => kit.call(method, params);
 const REQUIRED_METHODS = [

package/dist/testing/fake-gateway.js

@@ -5,9 +5,9 @@ import { connect } from 'node:net';
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { ENGINE_VERSION, PROTOCOL_VERSION } from "../constants.js";
-import { toolCalls } from "./model-stub.js";
-import { routes } from "../routes.js";
+import { ENGINE_VERSION, PROTOCOL_VERSION } from '../constants.js';
+import { toolCalls } from './model-stub.js';
+import { routes } from '../routes.js';
 // The device-code script from Crewhouse's openclaw-wizard.test.ts, ported: the step, then progress, then done.
 const DEVICE_STEP = {
     id: 'step-device', type: 'note', executor: 'client',
@@ -40,7 +40,9 @@ const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArr
 function mergeInto(target, patch) {
     for (const [key, value] of Object.entries(patch)) {
         const current = target[key];
-        if (isPlainObject(current) && isPlainObject(value))
+        if (value === null)
+            delete target[key]; // JSON merge-patch: null deletes, as the engine's config.patch does.
+        else if (isPlainObject(current) && isPlainObject(value))
             mergeInto(current, value);
         else
             target[key] = value;
@@ -378,11 +380,15 @@ export function fakeGateway(script, o) {
         // deleteFiles: false keeps the workspace, as the kit always asks; the agent's own store and model go.
         'agents.delete': (p) => {
             const id = String(p.agentId);
-            if (!agents.delete(id))
+            if (!agents.has(id))
                 throw new Error(`agent "${id}" not found`);
-            profiles.delete(id);
-            orders.delete(id);
-            models.delete(id);
+            const drop = () => { agents.delete(id); profiles.delete(id); orders.delete(id); models.delete(id); };
+            // With rosterApplyMs the fake mirrors the pinned engine: delete answers before the roster hot-reload
+            // drops the agent from agents.list (the create side lags the same way).
+            if (o?.rosterApplyMs)
+                setTimeout(drop, o.rosterApplyMs);
+            else
+                drop();
             return { ok: true, agentId: id, removedBindings: 0 };
         },
         // model: null clears the agent's primary (config.patch cannot delete a key); a string sets it.

package/dist/testing/index.js

@@ -1,5 +1,5 @@
 // The kit's fakes, contract suite and scripted model (5.11). Built in O7.
-export { fakeGateway } from "./fake-gateway.js";
-export { fakeBrowserHost, createBrowserHostFake, browserHostContract, memorySignInStore } from "./browser.js";
-export { openclawContract } from "./contract.js";
-export { STUB_USAGE, startModelStub, useModelStub, releaseStub, stubHolding, toolCalls } from "./model-stub.js";
+export { fakeGateway } from './fake-gateway.js';
+export { fakeBrowserHost, createBrowserHostFake, browserHostContract, memorySignInStore } from './browser.js';
+export { openclawContract } from './contract.js';
+export { STUB_USAGE, startModelStub, useModelStub, releaseStub, stubHolding, toolCalls } from './model-stub.js';

package/dist/testing/model-stub.d.ts

@@ -17,6 +17,7 @@ export type StubCall = {
     path: string;
     body: StubRequest;
     session?: string;
+    org?: string;
 };
 /** The token usage every stub reply reports when asked (`stream_options.include_usage`), per model call. */
 export declare const STUB_USAGE: {
@@ -45,6 +46,9 @@ export type ModelStubOptions = {
     idPattern?: RegExp;
     routingMarker?: string;
     onCall?: (call: StubCall) => void;
+    /** The Go gateway's own rule, for tests that prove the workspace header: a Go-route request without
+     *  `x-opencode-org-id` (or with another workspace's) is refused exactly as the real one refuses it. */
+    goWorkspace?: string;
 };
 export declare function startModelStub(script?: string[], o?: ModelStubOptions): Promise<ModelStub>;
 export declare function useModelStub(kit: OpenClawKit, stub: ModelStub): Promise<void>;

package/dist/testing/model-stub.js

@@ -78,9 +78,16 @@ export function startModelStub(script = [], o = {}) {
             return;
         }
         const call = { authorization: String(req.headers.authorization ?? ''), path: req.url ?? '', body,
-            ...(req.headers['x-opencode-session'] ? { session: String(req.headers['x-opencode-session']) } : {}) };
+            ...(req.headers['x-opencode-session'] ? { session: String(req.headers['x-opencode-session']) } : {}),
+            ...(req.headers['x-opencode-org-id'] ? { org: String(req.headers['x-opencode-org-id']) } : {}) };
         calls.push(call);
         o.onCall?.(call); // Fixture evidence is persisted before any response/hold awaits.
+        if (o.goWorkspace !== undefined && call.path.startsWith('/zen/go/')) {
+            if (call.org !== o.goWorkspace) {
+                res.writeHead(403, { 'content-type': 'application/json' });
+                return res.end(JSON.stringify({ type: 'error', error: { type: 'permission_error', message: 'Workspace selection is required' } }));
+            }
+        }
         if (req.url === '/api/embed' || req.url === '/api/embeddings') {
             res.writeHead(200, { 'content-type': 'application/json' });
             return res.end(JSON.stringify({

package/dist/transport.d.ts

@@ -3,7 +3,7 @@ import type { GatewayTransport } from './types.ts';
  * Client caps for the operator connection. `approvals` makes this connection an approval client, so the
  * engine delivers exec/plugin.approval.requested to it (B7); without it the broadcast set is empty.
  */
-export declare const GATEWAY_CAPS: readonly ["tool-events", "approvals"];
+export declare const GATEWAY_CAPS: readonly ['tool-events', 'approvals'];
 /**
  * Read the device key pair from `device.json`. The kit writes `{ privateKey, publicKey }` (PEM strings);
  * existing Crewhouse state carries `{ deviceId, publicKeyPem, privateKeyPem }` instead. Both shapes are

package/dist/transport.js

@@ -1,7 +1,7 @@
 import { createHash, createPrivateKey, createPublicKey, sign } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { GatewayClient } from '@openclaw/gateway-client';
-import { OPERATOR_SCOPES, PROTOCOL_VERSION } from "./constants.js";
+import { OPERATOR_SCOPES, PROTOCOL_VERSION } from './constants.js';
 /**
  * Client caps for the operator connection. `approvals` makes this connection an approval client, so the
  * engine delivers exec/plugin.approval.requested to it (B7); without it the broadcast set is empty.

package/engine/plugins.json

@@ -0,0 +1,150 @@
+{
+  "amazon-bedrock": {
+    "spec": "@openclaw/amazon-bedrock-provider@2026.8.35",
+    "integrity": "sha512-wYOiY7RaRo0SFXxcBVcqWnfwBH4TNc921Vlz7adBS+T5DIhtbnyzcAsMS1XsS9KvrYU3n1yW5SDdexvxop04hA=="
+  },
+  "amazon-bedrock-mantle": {
+    "spec": "@openclaw/amazon-bedrock-mantle-provider@2026.8.35",
+    "integrity": "sha512-bolUz+/osnBgarPBAko/+POthZ57JUXZ6T2nGMdQz+TfmdfnDhdZtXBRgy8JFjeDVgnNneWX4P1iuCgRRIsoJQ=="
+  },
+  "anthropic-vertex": {
+    "spec": "@openclaw/anthropic-vertex-provider@2026.8.35",
+    "integrity": "sha512-zQ5OYT7WvCgbyUnInz3+al/jCrN3RE2yMlC2wopVgjP9IMg1jANK0wPXArXWecT1p+j8+i2/TvxPI55U10Vdeg=="
+  },
+  "arcee": {
+    "spec": "@openclaw/arcee-provider@2026.8.35",
+    "integrity": "sha512-ViygKglSVjq5hQGVkduqe39Iiw9OBht/kTxOctLsgRvUzOWOqZvA9NvLybUtj230xLFCb/AVs1f3iGFRoXMBCA=="
+  },
+  "baseten": {
+    "spec": "@openclaw/baseten-provider@2026.8.35",
+    "integrity": "sha512-7zieofesRMB9fp41Ilh4VIFLIKJfRe1eT5ZYp3NKGwyON5rH0X11IcMXL1nRzIbIRyKnodfvl+H1EPO8NC4exA=="
+  },
+  "byteplus": {
+    "spec": "@openclaw/byteplus-provider@2026.8.35",
+    "integrity": "sha512-6Z9uHUxVSAt9TNNe5eiZfPhsExgInueEVCOeHxrZ6OybULJwDGx/cBJEY1LAy3MXzwCLX8ayENEtutcajxC0ew=="
+  },
+  "cerebras": {
+    "spec": "@openclaw/cerebras-provider@2026.8.35",
+    "integrity": "sha512-rqe2RMXn2hea0IpZuC01KwknMBOoH2fD9spGAvmffL8sX8qai+wSXW0Cn0pSOz9T+i862N5N3RXQP/K35QOvdA=="
+  },
+  "chutes": {
+    "spec": "@openclaw/chutes-provider@2026.8.35",
+    "integrity": "sha512-76+x2QS3NEgml0YnxV7fNbS7wO93oRtjlIFwkw0aUBYBzg1744aE3wEXXWkLcGpjVxp9bvgcpJ18Hp+gaW8F0A=="
+  },
+  "cloudflare-ai-gateway": {
+    "spec": "@openclaw/cloudflare-ai-gateway-provider@2026.8.35",
+    "integrity": "sha512-TjJJHTRdIiTVAM75w1xOed6VR0hQbAe30gNOc2ighi9G7FWU5wb3VeSQ9CtcJsAHYS5kurQNCf45owJfzkWGTg=="
+  },
+  "cohere": {
+    "spec": "@openclaw/cohere-provider@2026.8.35",
+    "integrity": "sha512-lA35F/ztGyYLAyRsrygogmL9WxU3M4X1lRSLCr1zZakXJDj0c6g46XtMmqxjtdQNCTo8TFni0gs4lqowZNq0OQ=="
+  },
+  "comfy": {
+    "spec": "@openclaw/comfy-provider@2026.8.35",
+    "integrity": "sha512-KHnjNwTCoy5l8Quq5zu7CwPBfg8XdTlI1W3GLg2CcamR+jksjbLpPzvrIObN8MineWVwpwmPgsdP3PyfyKxIaQ=="
+  },
+  "deepinfra": {
+    "spec": "@openclaw/deepinfra-provider@2026.8.35",
+    "integrity": "sha512-r4jktr88r3AFGmZRKtAjLkEOUQG5OAz+bXTwHpZxz4M28pbik3bJU2eBBaHAzahE7QdP9Xi3C3eIxoUl6/yi9w=="
+  },
+  "deepseek": {
+    "spec": "@openclaw/deepseek-provider@2026.8.35",
+    "integrity": "sha512-UVT+YusrPGSHLD7xd3YzJ45Hfe+ezFKEVBgaxPfYAUoXKvwN/OftG/kVga+bkjoxxSrp5Q+yI0Ec1kPBDhQ2RQ=="
+  },
+  "featherless": {
+    "spec": "@openclaw/featherless-provider@2026.8.35",
+    "integrity": "sha512-3XzG0avloplS8NVcNtq57JN91Sq6YnFcNSVcwz9IN8Q0oKcyxt5pabWfS6jCvsaBfV3sFaRf1Amn2PNrQKgHgQ=="
+  },
+  "fireworks": {
+    "spec": "@openclaw/fireworks-provider@2026.8.35",
+    "integrity": "sha512-CUms5nyK72D5VyNyXH5FZdy73gjlLMA3Vz6fpc6Z9ZtR6LxHjET7e91pM2cnjm6AkO4pUbh3sgiOeU/+lCYNPg=="
+  },
+  "gmi": {
+    "spec": "@openclaw/gmi-provider@2026.8.35",
+    "integrity": "sha512-OOLyjF58RdhwGgvaIyudhwpKzunSWbaOlyfUUr+oTFkOhb3ZzfLMx9Kqweql0ug04fh/aQ6s9IvX2jK2adAbBA=="
+  },
+  "groq": {
+    "spec": "@openclaw/groq-provider@2026.8.35",
+    "integrity": "sha512-/VmTp3GXaz1F06HfG0Xc83E8Ul/tsjQ6DRd6bscjmHOH8JtKv1U+AgQa8Uj5wMPmop9ttbqPXCqHuenMViankg=="
+  },
+  "kilocode": {
+    "spec": "@openclaw/kilocode-provider@2026.8.35",
+    "integrity": "sha512-O8hp8BQqAVElY2UXdE5EBBwzba7xevStF7TIi9TE59NTADK2JojK9bStF6rX4y9Ctp5NeMpf+KyYFTiSfm/N1A=="
+  },
+  "kimi": {
+    "spec": "@openclaw/kimi-provider@2026.8.35",
+    "integrity": "sha512-jeS3BmTXoa8A3OWXg6TB+vlKj1t+bvJFZQIvbXSGUNm2vIUSNXLYvgzNgmhF24MdwHwyBPdcUnJVZyMCklbEBw=="
+  },
+  "longcat": {
+    "spec": "@openclaw/longcat-provider@2026.8.35",
+    "integrity": "sha512-E4hHADSRpkHtiy6FfoHQpYD94usn+J0sVmY2fn94ftNNV4SjVvILqybjBiqfAlVy5FVOPRytL6P2y6hkdd52Cg=="
+  },
+  "meta": {
+    "spec": "@openclaw/meta-provider@2026.8.35",
+    "integrity": "sha512-3cEwNKmJW1wIwQE40crK1O4X4eo6n4xzH1v/7raa79DeoTOJ8pc8PWa66stv51ESwWhYDcCFVHU7XtnrbXyUXA=="
+  },
+  "mistral": {
+    "spec": "@openclaw/mistral-provider@2026.8.35",
+    "integrity": "sha512-TNULKvqsMMXz1ZNr89UPv9ucqcUYcw1hKLqoOo0yB/yRUazNErepds1qOzYJYA4lksylvhvvruDs9vIUMbfTjA=="
+  },
+  "moonshot": {
+    "spec": "@openclaw/moonshot-provider@2026.8.35",
+    "integrity": "sha512-gk9C4Hg/+K9taU/cRgNO77QzmPw46fo7klNB6y7qhefJQwoknbtCJLgnMpVEo97uiAxYxCTYRNvI+fOKF7Em5A=="
+  },
+  "novita": {
+    "spec": "@openclaw/novita-provider@2026.8.35",
+    "integrity": "sha512-TNui/LbLCsakaj677E+Xw2D1hRztQMOJWLj86JcqOfS7QzfEM6rA+FRs996HnXUIpqXeaefHc0qdVghKEXhgOw=="
+  },
+  "opencode": {
+    "spec": "@openclaw/opencode-provider@2026.8.35",
+    "integrity": "sha512-6wRKxfmgETuusys4K74cB0ixZVqQCgJBvD2g74cQAgx8w7BMr7+2965uYbU1sMjspreOigjgYLfePcMgV5conQ=="
+  },
+  "pixverse": {
+    "spec": "@openclaw/pixverse-provider@2026.8.35",
+    "integrity": "sha512-BbAp0Nfphem5LAytazWWAB5TJTM7L5zC7cWd+7r4iHU5iO7CyZYAGS5rjeLV3XEUwD2TAoWcHKBe8TiRXgsbaQ=="
+  },
+  "qianfan": {
+    "spec": "@openclaw/qianfan-provider@2026.8.35",
+    "integrity": "sha512-LSSz68Bv5/vRemKRrVNoDXA9zLx7yymMEY94fP5cgat9rsR83Fa6bA5hyEucutExz5wf2FJWmWqEJy2snm0k9A=="
+  },
+  "qwen": {
+    "spec": "@openclaw/qwen-provider@2026.8.35",
+    "integrity": "sha512-TaCx2LEOZgcXrWv0FLdBuFHoFvwDVNH+loGcO3MUIwhIBPoQTHD7Q+7DTOcLeK8qrQA/zGvWitT2WismCQJ7pw=="
+  },
+  "stepfun": {
+    "spec": "@openclaw/stepfun-provider@2026.8.35",
+    "integrity": "sha512-JBUKhN36cjUsMea8AOfX8yROEb7Zp01YPLpjzI/jnosalq2mhfYJY4kJTLou2RGwblDXx1dj0vB2HWidA+e/yw=="
+  },
+  "synthetic": {
+    "spec": "@openclaw/synthetic-provider@2026.8.35",
+    "integrity": "sha512-Lfs2lFTvsMEDNqZG2myoX8n7sbmIEVXMYV/Roa4umnPLsLT2aeqLkvWyesQWl9XRneSnGNtWS6yhbKLaqXU0Ng=="
+  },
+  "tencent": {
+    "spec": "@openclaw/tencent-provider@2026.8.35",
+    "integrity": "sha512-8khAe7ZaR0o3KPxiWnnyGaLFwDTF1ft1Cr3v1YrBntL1Nr8OvFM1XP/Lyifn3MJ7SK4lajYxLVsfuq2E18Jxeg=="
+  },
+  "venice": {
+    "spec": "@openclaw/venice-provider@2026.8.35",
+    "integrity": "sha512-c/Au2qkMeneJRKKm2o0/Fkf7dpcJR5RVJPmEPZhOsFaOUoq3zAk+Is/42khZ136Yj/UyQ09nFTUJsqmaeKoZVA=="
+  },
+  "vercel-ai-gateway": {
+    "spec": "@openclaw/vercel-ai-gateway-provider@2026.8.35",
+    "integrity": "sha512-gL9aGnfVGKVvB9mvMDRmIPOPTqQUqTr11DU60nn7BqDUCpLckoRUSXxzH3Rituxj+5dyoLI1LL5RiA9SPoImRA=="
+  },
+  "volcengine": {
+    "spec": "@openclaw/volcengine-provider@2026.8.35",
+    "integrity": "sha512-7dqdTtFgJcEBiSdzt5gLLPop/y6rK5FuobjiAGDwKxbPVENo0hmWJ8HGWbLKzRXerhzK20pvzF/+rr3OGDkRPQ=="
+  },
+  "vydra": {
+    "spec": "@openclaw/vydra-provider@2026.8.35",
+    "integrity": "sha512-Z0xHR8t+0Ge2GCgVDIlH1WLq4XeI5WoOgvkMvDvb4CQkxW+c251L0gbg37R6CNPkdfDFn8mh5/yIQrkazNj7dQ=="
+  },
+  "xiaomi": {
+    "spec": "@openclaw/xiaomi-provider@2026.8.35",
+    "integrity": "sha512-xtH3ESbMBcPQIciYiJCBP2ijd6MpP6tU/y27dJ3PGF8SluKZlbUfTUrqjT9U/NHo/bwafRISxL/HtAKYSm3Jkg=="
+  },
+  "zai": {
+    "spec": "@openclaw/zai-provider@2026.8.35",
+    "integrity": "sha512-g3ceSnLS84lNW2KlHznrO9vPXhX4ul1nQ+Dc0K4ccHdLOVfQ0DjjgV1NbT4CQZiTlN7Z2UFtGzl5EQeD1oCPfQ=="
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/openclaw",
-  "version": "0.14.0",
+  "version": "0.14.4",
   "description": "The OpenClaw runtime kit: the pinned engine's full operator surface with plain-words helpers for members, sign-in, runs and approvals.",
   "license": "Apache-2.0",
   "type": "module",
@@ -60,10 +60,10 @@
     "prepack": "tsc -b && node ../../scripts/fix-words-dts.cjs"
   },
   "dependencies": {
-    "@byokit/accounts": "0.23.0",
-    "@byokit/pair": "0.10.0",
-    "@byokit/relay": "0.6.1",
-    "@byokit/discover": "0.8.1",
+    "@byokit/accounts": "0.24.3",
+    "@byokit/pair": "0.10.2",
+    "@byokit/relay": "0.8.0",
+    "@byokit/discover": "0.8.3",
     "@byokit/seal": "0.3.0",
     "@byokit/secrets": "0.5.1",
     "@openclaw/gateway-client": "2026.8.35",
@@ -71,7 +71,7 @@
     "ws": "8.22.0"
   },
   "devDependencies": {
-    "@byokit/ui": "0.7.0"
+    "@byokit/ui": "0.9.0"
   },
   "publishConfig": {
     "access": "public"

package/policy/policy.mjs

@@ -6,11 +6,13 @@
 //   BYOKIT_TRUSTED_SKILLS  path to the trusted-skills JSON file (Crewhouse's trusted-skills.json shape):
 //                          either a list [{ id|name, version, sha256|hash }] or a map { "<id>": { version, sha256 } }.
 //   BYOKIT_OWN_ROOTS        JSON array of own content roots; skills sourced under them are the app's own.
+//   BYOKIT_PLUGIN_PINS      JSON array [{ spec: '<package>@<version>', integrity }] of the external plugins the kit
+//                          installs (engine/plugins.json at the engine pin).
 // Rules: any request kind containing 'depend' is blocked everywhere (own roots included);
 // dependency installers (a skill installSpec carrying bins/formula/package/module/url/archive) are blocked;
 // skill installs are allowed only from own roots or with an exact id + version + SKILL.md sha256 trusted match
 // (the version is request.origin.version when present, else the SKILL.md frontmatter version);
-// plugin installs are allowed only in the @openclaw/ scope.
+// plugin installs are allowed only from the npm registry at exactly a pinned spec, with the pinned integrity.
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
@@ -139,27 +141,54 @@ function decideSkill(request, trusted, roots) {
   return allow();
 }
 
+function pins() {
+  try {
+    const list = JSON.parse(process.env.BYOKIT_PLUGIN_PINS ?? '[]');
+    return Array.isArray(list) ? list.filter((p) => isRecord(p) && typeof p.spec === 'string' && typeof p.integrity === 'string') : [];
+  } catch {
+    return [];
+  }
+}
+
 function decidePlugin(request) {
   const plugin = isRecord(request.plugin) ? request.plugin : {};
-  const scope = [plugin.packageName, plugin.pluginId, request.targetName].find((v) => typeof v === 'string');
-  if (!scope || !scope.startsWith('@openclaw/')) {
-    return block(`only the @openclaw/ plugin scope is allowed, not ${scope ?? request.targetName}`);
-  }
-  // N4: the scope name above is self-declared (the candidate manifest's own
-  // `name`). Allow only with engine proof of registry origin on the pinned
-  // engine: source.kind 'npm' (engine-derived from the install request kind;
-  // npm installs always carry authority 'third-party') plus the
-  // operator-requested specifier in the @openclaw/ scope. Anything else is a
+  // N4: the names in `plugin` are self-declared (the candidate manifest's own `name`, or only its id for the
+  // dependency tree). Only engine proof of registry origin on the pinned engine counts: source.kind 'npm'
+  // (engine-derived from the install request kind) plus the operator-requested specifier. Anything else is a
   // local/archive/git/file candidate spoofing the name. Fail closed.
   const source = isRecord(request.source) ? request.source : undefined;
   const specifier =
     isRecord(request.request) && typeof request.request.requestedSpecifier === 'string'
       ? request.request.requestedSpecifier
       : undefined;
-  if (source?.kind === 'npm' && specifier !== undefined && specifier.startsWith('@openclaw/')) return allow();
-  return block(`@openclaw/ plugin install is not from the npm registry: ${specifier ?? request.targetName}`, [
-    { ruleId: 'plugin-source', severity: 'critical', message: 'self-declared @openclaw/ name without registry source proof' },
-  ]);
+  const npm = source?.kind === 'npm' && specifier !== undefined;
+  const scope = npm ? specifier : [plugin.packageName, plugin.pluginId, request.targetName].find((v) => typeof v === 'string');
+  if (!scope || !scope.startsWith('@openclaw/')) {
+    return block(`only the @openclaw/ plugin scope is allowed, not ${scope ?? request.targetName}`);
+  }
+  if (!npm) {
+    return block(`@openclaw/ plugin install is not from the npm registry: ${specifier ?? request.targetName}`, [
+      { ruleId: 'plugin-source', severity: 'critical', message: 'self-declared @openclaw/ name without registry source proof' },
+    ]);
+  }
+  // B7: exactly a pinned spec (`<package>@<engine version>`), never a range, tag or latest.
+  const pin = pins().find((p) => p.spec === specifier);
+  if (!pin) return block(`not a pinned plugin version: ${specifier}`);
+  // The preflight carries the registry's resolution as a file; the engine then checks the installed package
+  // against that resolution's integrity, so a matching pin here holds for the bytes installed.
+  if (request.sourcePathKind === 'file') {
+    let resolution;
+    try {
+      resolution = JSON.parse(readFileSync(request.sourcePath, 'utf8')).resolution;
+    } catch {
+      return block(`pinned plugin integrity unreadable: ${specifier}`);
+    }
+    if (!isRecord(resolution) || `${resolution.name}@${resolution.version}` !== pin.spec) {
+      return block(`not a pinned plugin version: ${specifier}`);
+    }
+    if (resolution.integrity !== pin.integrity) return block(`pinned plugin integrity mismatch: ${specifier}`);
+  }
+  return allow();
 }
 
 function decide(request) {