@chrysb/alphaclaw 0.9.15 → 0.9.17

package/lib/server/init/server-lifecycle.js

@@ -3,34 +3,11 @@ const startServerLifecycle = ({
   PORT,
   isOnboarded,
   runOnboardedBootSequence,
-  ensureManagedExecDefaults,
-  ensureUsageTrackerPluginConfig,
-  doSyncPromptFiles,
-  reloadEnv,
-  syncChannelConfig,
-  readEnvFile,
-  ensureGatewayProxyConfig,
-  resolveSetupUrl,
-  startGateway,
-  watchdog,
-  gmailWatchService,
 }) => {
   server.listen(PORT, "0.0.0.0", () => {
     console.log(`[alphaclaw] Express listening on :${PORT}`);
     if (isOnboarded()) {
-      runOnboardedBootSequence({
-        ensureManagedExecDefaults,
-        ensureUsageTrackerPluginConfig,
-        doSyncPromptFiles,
-        reloadEnv,
-        syncChannelConfig,
-        readEnvFile,
-        ensureGatewayProxyConfig,
-        resolveSetupUrl,
-        startGateway,
-        watchdog,
-        gmailWatchService,
-      });
+      runOnboardedBootSequence();
     } else {
       console.log("[alphaclaw] Awaiting onboarding via Setup UI");
     }

package/lib/server/login-throttle.js

@@ -1,77 +1,255 @@
-const { kLoginWindowMs, kLoginMaxAttempts, kLoginBaseLockMs, kLoginMaxLockMs, kLoginStateTtlMs } = require("./constants");
-
-const createLoginThrottle = () => {
-  const kLoginAttemptStates = new Map();
-
-  const getOrCreateLoginAttemptState = (clientKey, now) => {
-    const existing = kLoginAttemptStates.get(clientKey);
-    if (existing) {
-      existing.lastSeenAt = now;
-      return existing;
-    }
-    const next = {
-      attempts: 0,
-      windowStart: now,
-      lockUntil: 0,
-      failStreak: 0,
-      lastSeenAt: now,
-    };
-    kLoginAttemptStates.set(clientKey, next);
-    return next;
-  };
+const {
+  kLoginWindowMs,
+  kLoginMaxAttempts,
+  kLoginBaseLockMs,
+  kLoginMaxLockMs,
+  kLoginGlobalWindowMs,
+  kLoginGlobalMaxAttempts,
+  kLoginGlobalBaseLockMs,
+  kLoginGlobalMaxLockMs,
+  kLoginStateTtlMs,
+} = require("./constants");
 
-  const evaluateLoginThrottle = (state, now) => {
-    if (!state) return { blocked: false, retryAfterSec: 0 };
-    if (state.lockUntil > now) {
-      return {
-        blocked: true,
-        retryAfterSec: Math.max(1, Math.ceil((state.lockUntil - now) / 1000)),
-      };
-    }
-    if (now - state.windowStart >= kLoginWindowMs) {
-      state.attempts = 0;
-      state.windowStart = now;
-    }
-    return { blocked: false, retryAfterSec: 0 };
+const kGlobalStateKey = "global:login";
+
+const createLoginAttemptState = (now) => ({
+  attempts: 0,
+  windowStart: now,
+  lockUntil: 0,
+  failStreak: 0,
+  lastSeenAt: now,
+});
+
+const normalizeState = (state, now) => ({
+  attempts: Number.parseInt(String(state?.attempts ?? 0), 10) || 0,
+  windowStart: Number.parseInt(String(state?.windowStart ?? now), 10) || now,
+  lockUntil: Number.parseInt(String(state?.lockUntil ?? 0), 10) || 0,
+  failStreak: Number.parseInt(String(state?.failStreak ?? 0), 10) || 0,
+  lastSeenAt: Number.parseInt(String(state?.lastSeenAt ?? now), 10) || now,
+});
+
+const createMemoryLoginThrottleStore = () => {
+  const states = new Map();
+
+  return {
+    get: (stateKey) => states.get(stateKey) || null,
+    set: (stateKey, state) => {
+      states.set(stateKey, { ...state });
+    },
+    delete: (stateKey) => {
+      states.delete(stateKey);
+    },
+    entries: () =>
+      Array.from(states.entries()).map(([stateKey, state]) => [
+        stateKey,
+        { ...state },
+      ]),
+    runExclusive: (callback) => callback(),
   };
+};
 
-  const recordLoginFailure = (state, now) => {
-    if (!state) return { lockMs: 0, locked: false };
-    if (now - state.windowStart >= kLoginWindowMs) {
-      state.attempts = 0;
-      state.windowStart = now;
-    }
-    state.attempts += 1;
+const getClientStateKey = (clientKey) =>
+  `client:${String(clientKey || "unknown")}`;
+
+const getOrCreateState = (store, stateKey, now) => {
+  const existing = store.get(stateKey);
+  if (existing) {
+    const state = normalizeState(existing, now);
     state.lastSeenAt = now;
-    if (state.attempts < kLoginMaxAttempts) {
-      return { lockMs: 0, locked: false };
-    }
-    state.failStreak += 1;
+    store.set(stateKey, state);
+    return state;
+  }
+  const next = createLoginAttemptState(now);
+  store.set(stateKey, next);
+  return next;
+};
+
+const evaluateState = ({ store, stateKey, now, windowMs }) => {
+  const state = getOrCreateState(store, stateKey, now);
+  if (state.lockUntil > now) {
+    return {
+      state,
+      blocked: true,
+      retryAfterSec: Math.max(1, Math.ceil((state.lockUntil - now) / 1000)),
+    };
+  }
+  if (now - state.windowStart >= windowMs) {
+    state.attempts = 0;
+    state.windowStart = now;
+    store.set(stateKey, state);
+  }
+  return { state, blocked: false, retryAfterSec: 0 };
+};
+
+const recordStateFailure = ({
+  store,
+  stateKey,
+  now,
+  windowMs,
+  maxAttempts,
+  baseLockMs,
+  maxLockMs,
+}) => {
+  const state = getOrCreateState(store, stateKey, now);
+  if (state.lockUntil > now) {
+    return {
+      state,
+      lockMs: state.lockUntil - now,
+      locked: true,
+      retryAfterSec: Math.max(1, Math.ceil((state.lockUntil - now) / 1000)),
+    };
+  }
+  if (now - state.windowStart >= windowMs) {
     state.attempts = 0;
     state.windowStart = now;
-    const lockMultiplier = Math.max(1, 2 ** (state.failStreak - 1));
-    const lockMs = Math.min(kLoginBaseLockMs * lockMultiplier, kLoginMaxLockMs);
-    state.lockUntil = now + lockMs;
-    return { lockMs, locked: true };
+  }
+  state.attempts += 1;
+  state.lastSeenAt = now;
+  if (state.attempts < maxAttempts) {
+    store.set(stateKey, state);
+    return { state, lockMs: 0, locked: false, retryAfterSec: 0 };
+  }
+  state.failStreak += 1;
+  state.attempts = 0;
+  state.windowStart = now;
+  const lockMultiplier = Math.max(1, 2 ** (state.failStreak - 1));
+  const lockMs = Math.min(baseLockMs * lockMultiplier, maxLockMs);
+  state.lockUntil = now + lockMs;
+  store.set(stateKey, state);
+  return {
+    state,
+    lockMs,
+    locked: true,
+    retryAfterSec: Math.max(1, Math.ceil(lockMs / 1000)),
   };
+};
+
+const chooseThrottleResult = (...results) => {
+  const blockedResults = results.filter((result) => result.blocked);
+  if (blockedResults.length === 0) {
+    return { blocked: false, retryAfterSec: 0 };
+  }
+  return {
+    blocked: true,
+    retryAfterSec: Math.max(
+      ...blockedResults.map((result) => result.retryAfterSec || 0),
+    ),
+  };
+};
+
+const chooseFailureResult = (...results) => {
+  const lockedResults = results.filter((result) => result.locked);
+  if (lockedResults.length === 0) {
+    return { lockMs: 0, locked: false, retryAfterSec: 0 };
+  }
+  return {
+    lockMs: Math.max(...lockedResults.map((result) => result.lockMs || 0)),
+    locked: true,
+    retryAfterSec: Math.max(
+      ...lockedResults.map((result) => result.retryAfterSec || 0),
+    ),
+  };
+};
+
+const createLoginThrottle = ({
+  store = createMemoryLoginThrottleStore(),
+} = {}) => {
+  const runExclusive =
+    typeof store.runExclusive === "function"
+      ? (callback) => store.runExclusive(callback)
+      : (callback) => callback();
+
+  const getOrCreateLoginAttemptState = (clientKey, now) =>
+    runExclusive(() => {
+      const clientStateKey = getClientStateKey(clientKey);
+      return {
+        clientKey,
+        clientStateKey,
+        globalStateKey: kGlobalStateKey,
+        client: getOrCreateState(store, clientStateKey, now),
+        global: getOrCreateState(store, kGlobalStateKey, now),
+      };
+    });
+
+  const evaluateLoginThrottle = (stateBundle, now) =>
+    runExclusive(() => {
+      const clientStateKey =
+        stateBundle?.clientStateKey ||
+        getClientStateKey(stateBundle?.clientKey);
+      const globalStateKey = stateBundle?.globalStateKey || kGlobalStateKey;
+      const clientResult = evaluateState({
+        store,
+        stateKey: clientStateKey,
+        now,
+        windowMs: kLoginWindowMs,
+      });
+      const globalResult = evaluateState({
+        store,
+        stateKey: globalStateKey,
+        now,
+        windowMs: kLoginGlobalWindowMs,
+      });
+      if (stateBundle) {
+        stateBundle.client = clientResult.state;
+        stateBundle.global = globalResult.state;
+      }
+      return chooseThrottleResult(clientResult, globalResult);
+    });
+
+  const recordLoginFailure = (stateBundle, now) =>
+    runExclusive(() => {
+      const clientStateKey =
+        stateBundle?.clientStateKey ||
+        getClientStateKey(stateBundle?.clientKey);
+      const globalStateKey = stateBundle?.globalStateKey || kGlobalStateKey;
+      const clientResult = recordStateFailure({
+        store,
+        stateKey: clientStateKey,
+        now,
+        windowMs: kLoginWindowMs,
+        maxAttempts: kLoginMaxAttempts,
+        baseLockMs: kLoginBaseLockMs,
+        maxLockMs: kLoginMaxLockMs,
+      });
+      const globalResult = recordStateFailure({
+        store,
+        stateKey: globalStateKey,
+        now,
+        windowMs: kLoginGlobalWindowMs,
+        maxAttempts: kLoginGlobalMaxAttempts,
+        baseLockMs: kLoginGlobalBaseLockMs,
+        maxLockMs: kLoginGlobalMaxLockMs,
+      });
+      if (stateBundle) {
+        stateBundle.client = clientResult.state;
+        stateBundle.global = globalResult.state;
+      }
+      return chooseFailureResult(clientResult, globalResult);
+    });
 
   const recordLoginSuccess = (clientKey) => {
     if (!clientKey) return;
-    kLoginAttemptStates.delete(clientKey);
+    runExclusive(() => {
+      store.delete(getClientStateKey(clientKey));
+      store.delete(kGlobalStateKey);
+    });
   };
 
   const cleanupLoginAttemptStates = () => {
     const now = Date.now();
-    for (const [key, state] of kLoginAttemptStates.entries()) {
-      if (!state) {
-        kLoginAttemptStates.delete(key);
-        continue;
+    runExclusive(() => {
+      for (const [stateKey, rawState] of store.entries()) {
+        if (!rawState) {
+          store.delete(stateKey);
+          continue;
+        }
+        const state = normalizeState(rawState, now);
+        if (state.lockUntil > now) continue;
+        if (now - state.lastSeenAt > kLoginStateTtlMs) {
+          store.delete(stateKey);
+        }
       }
-      if (state.lockUntil > now) continue;
-      if (now - state.lastSeenAt > kLoginStateTtlMs) {
-        kLoginAttemptStates.delete(key);
-      }
-    }
+    });
   };
 
   return {
@@ -83,4 +261,8 @@ const createLoginThrottle = () => {
   };
 };
 
-module.exports = { createLoginThrottle };
+module.exports = {
+  createLoginThrottle,
+  createMemoryLoginThrottleStore,
+  kGlobalStateKey,
+};

package/lib/server/model-catalog-bootstrap.json

@@ -554,6 +554,11 @@
       "provider": "anthropic",
       "label": "Claude Opus 4.6"
     },
+    {
+      "key": "anthropic/claude-opus-4-8",
+      "provider": "anthropic",
+      "label": "Claude Opus 4.8"
+    },
     {
       "key": "anthropic/claude-opus-4-7",
       "provider": "anthropic",

package/lib/server/onboarding/index.js

@@ -327,7 +327,7 @@ const createOnboardingService = ({
   authProfiles,
   ensureGatewayProxyConfig,
   getBaseUrl,
-  startGateway,
+  runOnboardedBootSequence,
 }) => {
   const { OPENCLAW_DIR, WORKSPACE_DIR, kOnboardingMarkerPath } = constants;
 
@@ -567,7 +567,7 @@ const createOnboardingService = ({
       console.error("[onboard] Git push error:", e.message);
     }
 
-    startGateway();
+    runOnboardedBootSequence();
     return { status: 200, body: { ok: true } };
   };
 

package/lib/server/openclaw-thinking.js

@@ -0,0 +1,103 @@
+const fs = require("fs");
+const path = require("path");
+const { pathToFileURL } = require("url");
+
+const kThinkingModuleSentinel = "listThinkingLevelOptions";
+
+let thinkingModulePromise = null;
+
+const resolveOpenclawDistDir = () => path.dirname(require.resolve("openclaw"));
+
+const resolveThinkingModulePath = (distDir = resolveOpenclawDistDir()) => {
+  for (const name of fs.readdirSync(distDir)) {
+    if (!/^thinking-.*\.js$/.test(name)) continue;
+    if (name.includes("api") || name.includes("policy")) continue;
+    const fullPath = path.join(distDir, name);
+    const source = fs.readFileSync(fullPath, "utf8");
+    if (source.includes(kThinkingModuleSentinel)) return fullPath;
+  }
+  throw new Error("OpenClaw thinking module not found");
+};
+
+const loadThinkingModule = async () => {
+  if (!thinkingModulePromise) {
+    const modulePath = resolveThinkingModulePath();
+    thinkingModulePromise = import(pathToFileURL(modulePath).href);
+  }
+  return thinkingModulePromise;
+};
+
+const splitModelKey = (modelKey = "") => {
+  const normalized = String(modelKey || "").trim();
+  const slashIndex = normalized.indexOf("/");
+  if (slashIndex <= 0) return { provider: "", model: normalized };
+  return {
+    provider: normalized.slice(0, slashIndex),
+    model: normalized.slice(slashIndex + 1),
+  };
+};
+
+const buildCatalogEntry = ({ provider, model, reasoning, compat } = {}) => {
+  const normalizedProvider = String(provider || "").trim();
+  const normalizedModel = String(model || "").trim();
+  if (!normalizedProvider || !normalizedModel) return null;
+  const entry = {
+    provider: normalizedProvider,
+    id: normalizedModel,
+  };
+  if (typeof reasoning === "boolean") entry.reasoning = reasoning;
+  if (compat && typeof compat === "object") entry.compat = compat;
+  return entry;
+};
+
+const resolveThinkingApi = async () => {
+  const mod = await loadThinkingModule();
+  return {
+    listThinkingLevelOptions: mod.listThinkingLevelOptions || mod.i,
+    resolveThinkingDefaultForModel: mod.resolveThinkingDefaultForModel || mod.s,
+    normalizeThinkLevel: mod.normalizeThinkLevel || mod.p,
+  };
+};
+
+const resolveThinkingOptionsForModel = async ({
+  modelKey = "",
+  catalog = [],
+} = {}) => {
+  const { provider, model } = splitModelKey(modelKey);
+  if (!provider || !model) {
+    return {
+      levels: [],
+      modelDefault: "off",
+    };
+  }
+  const api = await resolveThinkingApi();
+  const levels = api.listThinkingLevelOptions(provider, model, catalog) || [];
+  const modelDefault =
+    api.resolveThinkingDefaultForModel({
+      provider,
+      model,
+      catalog,
+    }) || "off";
+  return {
+    levels: levels.map((entry) => ({
+      id: String(entry?.id || "").trim(),
+      label: String(entry?.label || entry?.id || "").trim(),
+    })),
+    modelDefault: String(modelDefault || "off").trim() || "off",
+  };
+};
+
+const normalizeThinkingDefaultValue = async (raw) => {
+  if (raw === null || raw === undefined || raw === "") return null;
+  const api = await resolveThinkingApi();
+  const normalized = api.normalizeThinkLevel(String(raw || "").trim());
+  return normalized || null;
+};
+
+module.exports = {
+  buildCatalogEntry,
+  loadThinkingModule,
+  normalizeThinkingDefaultValue,
+  resolveThinkingOptionsForModel,
+  splitModelKey,
+};

package/lib/server/openclaw-version.js

@@ -237,7 +237,7 @@ const createOpenclawVersionService = ({
       });
       let restarted = false;
       if (isOnboarded()) {
-        restartGateway();
+        await restartGateway();
         restarted = true;
       }
       return {

package/lib/server/routes/agents.js

@@ -178,7 +178,11 @@ const registerAgentRoutes = ({
 
   app.get("/api/agents", (_req, res) => {
     try {
-      res.json({ ok: true, agents: agentsService.listAgents() });
+      res.json({
+        ok: true,
+        agents: agentsService.listAgents(),
+        defaults: agentsService.getAgentDefaults?.() || {},
+      });
     } catch (error) {
       res.status(500).json({ ok: false, error: error.message });
     }
@@ -237,9 +241,12 @@ const registerAgentRoutes = ({
     }
   });
 
-  app.put("/api/agents/:id", (req, res) => {
+  app.put("/api/agents/:id", async (req, res) => {
     try {
-      const agent = agentsService.updateAgent(req.params.id, req.body || {});
+      const agent = await agentsService.updateAgent(
+        req.params.id,
+        req.body || {},
+      );
       return res.json({ ok: true, agent });
     } catch (error) {
       const status = String(error.message || "").includes("not found")

package/lib/server/routes/browse/constants.js

@@ -1,4 +1,5 @@
-const kDefaultTreeDepth = 10;
+const kDefaultTreeDepth = 3;
+const kMaxTreeDepth = 3;
 const kIgnoredDirectoryNames = new Set([
   ".git",
   ".alphaclaw",
@@ -42,6 +43,7 @@ const kSqliteTablePageSize = 50;
 
 module.exports = {
   kDefaultTreeDepth,
+  kMaxTreeDepth,
   kIgnoredDirectoryNames,
   kImageMimeTypeByExtension,
   kCommitHistoryLimit,

package/lib/server/routes/browse/index.js

@@ -2,6 +2,7 @@ const path = require("path");
 const { kLockedBrowsePaths, kProtectedBrowsePaths } = require("../../constants");
 const {
   kDefaultTreeDepth,
+  kMaxTreeDepth,
   kIgnoredDirectoryNames,
   kCommitHistoryLimit,
 } = require("./constants");
@@ -34,6 +35,16 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
     fs.mkdirSync(kRootResolved, { recursive: true });
   }
 
+  const readVisibleDirectoryEntries = (absolutePath) =>
+    fs
+      .readdirSync(absolutePath, { withFileTypes: true })
+      .filter((entry) => {
+        if (entry.isDirectory() && kIgnoredDirectoryNames.has(entry.name)) {
+          return false;
+        }
+        return entry.isDirectory() || entry.isFile();
+      });
+
   const buildTreeNode = (absolutePath, depthRemaining) => {
     const stats = fs.statSync(absolutePath);
     const nodeName = path.basename(absolutePath);
@@ -44,17 +55,17 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
     }
 
     if (depthRemaining <= 0) {
-      return { type: "folder", name: nodeName, path: nodePath, children: [] };
+      const hasMoreChildren = readVisibleDirectoryEntries(absolutePath).length > 0;
+      return {
+        type: "folder",
+        name: nodeName,
+        path: nodePath,
+        children: [],
+        truncated: hasMoreChildren,
+      };
     }
 
-    const children = fs
-      .readdirSync(absolutePath, { withFileTypes: true })
-      .filter((entry) => {
-        if (entry.isDirectory() && kIgnoredDirectoryNames.has(entry.name)) {
-          return false;
-        }
-        return entry.isDirectory() || entry.isFile();
-      })
+    const children = readVisibleDirectoryEntries(absolutePath)
       .map((entry) =>
         buildTreeNode(path.join(absolutePath, entry.name), depthRemaining - 1),
       )
@@ -70,12 +81,29 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
 
   app.get("/api/browse/tree", (req, res) => {
     const depthValue = Number.parseInt(String(req.query.depth || ""), 10);
-    const depth =
+    const requestedDepth =
       Number.isFinite(depthValue) && depthValue > 0
         ? depthValue
         : kDefaultTreeDepth;
+    const depth = Math.min(requestedDepth, kMaxTreeDepth);
+    const requestedPath = String(req.query.path || "").trim();
     try {
-      const tree = buildTreeNode(kRootResolved, depth);
+      const resolvedPath = requestedPath
+        ? resolveSafePath(
+            requestedPath,
+            kRootResolved,
+            kRootWithSep,
+            kRootDisplayName,
+          )
+        : { ok: true, absolutePath: kRootResolved };
+      if (!resolvedPath.ok) {
+        return res.status(400).json({ ok: false, error: resolvedPath.error });
+      }
+      const stats = fs.statSync(resolvedPath.absolutePath);
+      if (!stats.isDirectory()) {
+        return res.status(400).json({ ok: false, error: "Path is not a folder" });
+      }
+      const tree = buildTreeNode(resolvedPath.absolutePath, depth);
       return res.json({ ok: true, root: tree });
     } catch (error) {
       return res.status(500).json({

package/lib/server/routes/models.js

@@ -1,5 +1,7 @@
-const { kFallbackOnboardingModels } = require("../constants");
+const { kFallbackOnboardingModels, OPENCLAW_DIR } = require("../constants");
 const { createModelCatalogCache } = require("../model-catalog-cache");
+const { resolveThinkingOptionsForModel } = require("../openclaw-thinking");
+const { readOpenclawConfig } = require("../openclaw-config");
 const { getCommandOutputCandidates } = require("../utils/command-output");
 
 const runModelsGitSync = async (shellCmd) => {
@@ -182,6 +184,38 @@ const registerModelRoutes = ({
     return res.json(response);
   });
 
+  app.get("/api/models/thinking-options", async (req, res) => {
+    const modelKey = String(req.query?.modelKey || "").trim();
+    if (!modelKey.includes("/")) {
+      return res
+        .status(400)
+        .json({ ok: false, error: "modelKey is required (provider/model)" });
+    }
+    try {
+      const cfg = readOpenclawConfig({ openclawDir: OPENCLAW_DIR });
+      const globalThinkingDefault =
+        typeof cfg.agents?.defaults?.thinkingDefault === "string"
+          ? cfg.agents.defaults.thinkingDefault.trim()
+          : null;
+      const { levels, modelDefault } = await resolveThinkingOptionsForModel({
+        modelKey,
+      });
+      const inheritedDefault = globalThinkingDefault || modelDefault || "off";
+      return res.json({
+        ok: true,
+        modelKey,
+        levels,
+        modelDefault,
+        inheritedDefault,
+      });
+    } catch (err) {
+      return res.status(500).json({
+        ok: false,
+        error: err.message || "Failed to resolve thinking options",
+      });
+    }
+  });
+
   app.get("/api/models/status", async (req, res) => {
     try {
       const output = await shellCmd("openclaw models status --json", {