@clawling/clawchat-plugin-openclaw 2026.10.9-2 → 2026.10.9-4

package/src/storage.ts

@@ -3,6 +3,7 @@ import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
 import { resolveStateDirFromEnv } from "./state-paths.ts";
+import type { ActivationIdentityLookup } from "./owner-identity.ts";
 
 type Log = { error?: (message: string) => void };
 
@@ -402,6 +403,30 @@ CREATE TABLE IF NOT EXISTS recalled_messages (
   recalled_at INTEGER NOT NULL,
   PRIMARY KEY (platform, account_id, message_id)
 );
+`,
+  },
+  {
+    // Explicit message-id arguments are matched case-insensitively
+    // (findSeenMessageInChat); without these the lookup scans the whole
+    // unpruned ledger synchronously.
+    version: 11,
+    name: "message_id_nocase_indexes",
+    sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_message_id_nocase
+  ON clawchat_messages(message_id COLLATE NOCASE);
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_protocol_message_id_nocase
+  ON clawchat_messages(protocol_message_id COLLATE NOCASE);
+`,
+  },
+  {
+    // A tool chat id from the model is mapped to the case already stored for
+    // that chat (findStoredChatId) before a row is written, so one chat never
+    // ends up under two cases.
+    version: 12,
+    name: "chat_id_nocase_index",
+    sql: `
+CREATE INDEX IF NOT EXISTS idx_clawchat_messages_chat_id_nocase
+  ON clawchat_messages(chat_id COLLATE NOCASE);
 `,
   },
 ];
@@ -643,6 +668,40 @@ export class ClawChatStore {
     }) ?? null;
   }
 
+  /**
+   * Strict owner-identity read for the non-owner turn boundary. Unlike the
+   * other getters (which collapse failure into null), this keeps "storage
+   * unavailable", "no activation row" and "row" apart — including incomplete
+   * rows — because only a proven-absent row may fall back to the config mirror
+   * (see `resolveOwnerIdentity`). Nothing is logged here: the caller warns
+   * once per failure class, and no SQL or credentials reach the log.
+   */
+  lookupActivationIdentity(input: ConversationAccountInput): ActivationIdentityLookup {
+    if (!this.ensureInitialized()) return { status: "unavailable" };
+    try {
+      const row = this.requireDb()
+        .prepare(
+          "SELECT owner_user_id, conversation_id, access_token FROM activations WHERE platform = ? AND account_id = ?",
+        )
+        .get(input.platform, input.accountId) as Record<string, unknown> | undefined;
+      if (!row) return { status: "absent" };
+      const value = (key: string) => {
+        const raw = row[key];
+        return typeof raw === "string" ? raw.trim() || null : null;
+      };
+      return {
+        status: "row",
+        row: {
+          ownerUserId: value("owner_user_id"),
+          conversationId: value("conversation_id"),
+          accessToken: value("access_token"),
+        },
+      };
+    } catch {
+      return { status: "unavailable" };
+    }
+  }
+
   claimPendingActivationBootstrap(
     input: ActivationBootstrapInput,
   ): ActivationBootstrapConversation | null {
@@ -827,6 +886,72 @@ export class ClawChatStore {
     });
   }
 
+  /**
+   * The stored chat id and message id of this account's ledger row that has
+   * `messageId` in `chatId`, both compared case-insensitively. The message id
+   * matches the client id (`message_id`) or the acked protocol id
+   * (`protocol_message_id`); the one that matched is returned, in its stored
+   * case, so callers put the real id on the wire. Answers `false` when no row
+   * matches and `null` when the store is unavailable, so callers can tell
+   * "not seen" from "cannot say". Seeks via the NOCASE message-id indexes
+   * (migration 11); platform, account and chat are post-filters.
+   */
+  findSeenMessageInChat(input: {
+    platform: string;
+    accountId: string;
+    chatId: string;
+    messageId: string;
+  }): SeenMessage | false | null {
+    if (!input.chatId || !input.messageId) return false;
+    return this.read(() => {
+      const row = this.requireDb()
+        .prepare(FIND_SEEN_MESSAGE_SQL)
+        .get(
+          input.messageId,
+          input.platform,
+          input.accountId,
+          input.chatId,
+          input.messageId,
+          input.platform,
+          input.accountId,
+          input.chatId,
+        ) as { chat_id?: unknown; matched_id?: unknown } | undefined;
+      if (typeof row?.chat_id !== "string" || typeof row.matched_id !== "string") return false;
+      return { chatId: row.chat_id, messageId: row.matched_id };
+    });
+  }
+
+  /**
+   * The chat id as this account's ledger already stores it for `chatId`
+   * (compared case-insensitively), preferring an inbound row, whose case is
+   * the server's. `false` when the ledger has no row for that chat, `null`
+   * when the store is unavailable. Seeks via the NOCASE chat-id index
+   * (migration 12); platform, account and direction are post-filters.
+   */
+  findStoredChatId(input: { platform: string; accountId: string; chatId: string }): string | false | null {
+    if (!input.chatId) return false;
+    return this.read(() => {
+      const row = this.requireDb()
+        .prepare(FIND_STORED_CHAT_ID_SQL)
+        .get(input.chatId, input.platform, input.accountId, input.chatId, input.platform, input.accountId) as
+        | { chat_id?: unknown }
+        | undefined;
+      return typeof row?.chat_id === "string" ? row.chat_id : false;
+    });
+  }
+
+  /** True when `message_id` was recalled for this (platform, account). */
+  isMessageRecalled(input: { platform: string; accountId: string; messageId?: string | null }): boolean {
+    if (!input.messageId) return false;
+    const row = this.requireDb()
+      .prepare(
+        `SELECT 1 FROM recalled_messages
+          WHERE platform = ? AND account_id = ? AND message_id = ?`,
+      )
+      .get(input.platform, input.accountId, input.messageId);
+    return row !== undefined;
+  }
+
   /**
    * Erase every ledger row for one `message_id` — the local half of a
    * server-authorised recall (`message.recall`, docs/client-integration.md §9.8).
@@ -845,21 +970,8 @@ export class ClawChatStore {
    * the row may never have been stored (a message that arrived before this
    * account was paired, or one dropped by the inbound filter). `null` means the
    * store is unavailable.
-   */
-  /** True when `message_id` was recalled for this (platform, account). */
-  isMessageRecalled(input: { platform: string; accountId: string; messageId?: string | null }): boolean {
-    if (!input.messageId) return false;
-    const row = this.requireDb()
-      .prepare(
-        `SELECT 1 FROM recalled_messages
-          WHERE platform = ? AND account_id = ? AND message_id = ?`,
-      )
-      .get(input.platform, input.accountId, input.messageId);
-    return row !== undefined;
-  }
-
-  /**
-   * Record the permanent recall tombstone and purge any row already stored,
+   *
+   * Records the permanent recall tombstone and purges any row already stored,
    * atomically. Returns the number of ledger rows deleted (0 when the recall
    * arrived before the message did — the tombstone still stands and the later
    * ingest is refused by {@link claimMessageOnce}).
@@ -1184,6 +1296,10 @@ export class ClawChatStore {
    * as `'thinking'` are excluded so the @-mention prior-context block never
    * surfaces the agent's intermediate output as conversation history.
    * Uses `idx_clawchat_messages_chat_created` for performance.
+   * `ignoreCase` matches `chat_id` case-insensitively (rows keep their stored
+   * case) so memory scope can recover a group id's original case from a
+   * lowercased session key; it cannot use that index, so callers that already
+   * know the exact id leave it off.
    * Returns an empty array if the store is unavailable.
    */
   listRecentGroupMessages(
@@ -1191,12 +1307,14 @@ export class ClawChatStore {
     accountId: string,
     chatId: string,
     limit: number,
+    options: { ignoreCase?: boolean } = {},
   ): MessageRow[] {
+    const chatMatch = options.ignoreCase ? "chat_id = ? COLLATE NOCASE" : "chat_id = ?";
     return this.read(() => {
       const rows = this.requireDb()
         .prepare(
           `SELECT * FROM clawchat_messages
-            WHERE platform = ? AND account_id = ? AND chat_id = ? AND kind = 'message'
+            WHERE platform = ? AND account_id = ? AND ${chatMatch} AND kind = 'message'
             ORDER BY created_at DESC, rowid DESC LIMIT ?`,
         )
         .all(platform, accountId, chatId, limit) as MessageRow[];
@@ -1303,6 +1421,48 @@ export class ClawChatStore {
   }
 }
 
+/**
+ * Lookup behind {@link ClawChatStore.findStoredChatId}: an inbound row first,
+ * then any row. Both halves seek `idx_clawchat_messages_chat_id_nocase`.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_STORED_CHAT_ID_SQL = `SELECT chat_id FROM (
+  SELECT chat_id, 0 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ? AND direction = 'inbound'
+      LIMIT 1
+  )
+  UNION ALL
+  SELECT chat_id, 1 AS rank FROM (
+    SELECT chat_id FROM clawchat_messages
+      WHERE chat_id = ? COLLATE NOCASE AND platform = ? AND account_id = ?
+      LIMIT 1
+  )
+) ORDER BY rank LIMIT 1`;
+
+/** A ledger message as stored: its chat id and the message id that matched. */
+export type SeenMessage = { chatId: string; messageId: string };
+
+/**
+ * Lookup behind {@link ClawChatStore.findSeenMessageInChat}. Two index seeks
+ * (`message_id` / `protocol_message_id`, both COLLATE NOCASE, migration 11);
+ * platform, account and chat are post-filters. A `message_id` match wins.
+ * `INDEXED BY` pins the seek: without table statistics the planner would
+ * otherwise pick the chat-id index (migration 12) and walk the whole chat.
+ * Exported so a test can pin the query plan.
+ */
+export const FIND_SEEN_MESSAGE_SQL = `SELECT chat_id, matched_id FROM (
+  SELECT chat_id, message_id AS matched_id, 0 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_message_id_nocase
+    WHERE message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+  UNION ALL
+  SELECT chat_id, protocol_message_id AS matched_id, 1 AS rank
+    FROM clawchat_messages INDEXED BY idx_clawchat_messages_protocol_message_id_nocase
+    WHERE protocol_message_id = ? COLLATE NOCASE
+      AND platform = ? AND account_id = ? AND chat_id = ? COLLATE NOCASE
+) ORDER BY rank LIMIT 1`;
+
 let singleton: ClawChatStore | null = null;
 
 export function createClawChatStore(options: ClawChatStoreOptions = {}): ClawChatStore {

package/src/terminal-send.ts

@@ -8,14 +8,93 @@ export type TerminalClawChatSendRecord = {
 
 const DEFAULT_TTL_MS = 60_000;
 const terminalSends = new Map<string, TerminalClawChatSendRecord>();
-const terminalSendScope = new AsyncLocalStorage<string>();
+
+/**
+ * One dispatched ClawChat turn, as seen by the tools that run inside it.
+ *
+ * The turn travels in AsyncLocalStorage, but async context alone does not say
+ * which turn a tool call belongs to: the host can start a queued agent run
+ * from another run's continuation (its follow-up queue drains from the
+ * finishing turn's context; hosts before 2026.8.1 also pumped the command
+ * lanes without a context snapshot), so a run can carry an older or a
+ * different chat's store. A scope is therefore only used when it is still
+ * open AND was registered for the same session key as the trusted tool
+ * context. A scope that a later turn of the same session has superseded no
+ * longer supplies default reaction ids (the later message may have been
+ * steered into this run), but it still owns its terminal-send markers because
+ * the run's replies still go through its dispatcher.
+ */
+type TurnScope = {
+  scopeId: string;
+  sessionKey: string | null;
+  open: boolean;
+  superseded: boolean;
+};
+
+const turnScopeStorage = new AsyncLocalStorage<TurnScope>();
+const openScopesBySession = new Map<string, Set<TurnScope>>();
+
+function normalizeSessionKey(sessionKey: string | null | undefined): string | null {
+  const normalized = sessionKey?.trim().toLowerCase();
+  return normalized ? normalized : null;
+}
 
 function key(accountId: string, chatId: string, scopeId: string): string {
   return `${accountId}\0${chatId}\0${scopeId}`;
 }
 
-export function runWithTerminalClawChatSendScope<T>(scopeId: string, fn: () => T): T {
-  return terminalSendScope.run(scopeId, fn);
+function isPromiseLike(value: unknown): value is PromiseLike<unknown> {
+  return typeof (value as { then?: unknown } | null)?.then === "function";
+}
+
+/**
+ * Run one dispatched turn. `sessionKey` is the session the host runs the turn
+ * in; consumers only see this turn when their trusted session key matches.
+ * The scope closes when `fn` returns or its promise settles.
+ */
+export function runWithTerminalClawChatSendScope<T>(
+  init: { scopeId: string; sessionKey: string | null | undefined },
+  fn: () => T,
+): T {
+  const scope: TurnScope = {
+    scopeId: init.scopeId,
+    sessionKey: normalizeSessionKey(init.sessionKey),
+    open: true,
+    superseded: false,
+  };
+  const sessionKey = scope.sessionKey;
+  if (sessionKey) {
+    const open = openScopesBySession.get(sessionKey) ?? new Set<TurnScope>();
+    for (const earlier of open) earlier.superseded = true;
+    open.add(scope);
+    openScopesBySession.set(sessionKey, open);
+  }
+  const close = () => {
+    scope.open = false;
+    if (!sessionKey) return;
+    const open = openScopesBySession.get(sessionKey);
+    open?.delete(scope);
+    if (open?.size === 0) openScopesBySession.delete(sessionKey);
+  };
+  let result: T;
+  try {
+    result = turnScopeStorage.run(scope, fn);
+  } catch (err) {
+    close();
+    throw err;
+  }
+  if (isPromiseLike(result)) {
+    return Promise.resolve(result).finally(close) as T;
+  }
+  close();
+  return result;
+}
+
+/** The caller's own open turn, or null when it cannot be tied to the caller's session. */
+function resolveCallerScope(sessionKey: string | null | undefined): TurnScope | null {
+  const scope = turnScopeStorage.getStore();
+  if (!scope?.open || !scope.sessionKey) return null;
+  return scope.sessionKey === normalizeSessionKey(sessionKey) ? scope : null;
 }
 
 /**
@@ -35,11 +114,14 @@ export function markTerminalClawChatSend(params: {
   accountId: string;
   chatId: string;
   messageId: string;
+  /** Explicit scope; otherwise the caller's own turn, resolved via `sessionKey`. */
   scopeId?: string;
+  /** Trusted session key of the tool call. Without it no turn is attributed. */
+  sessionKey?: string | null;
   ttlMs?: number;
   nowMs?: number;
 }): void {
-  const scopeId = params.scopeId ?? terminalSendScope.getStore();
+  const scopeId = params.scopeId ?? resolveCallerScope(params.sessionKey)?.scopeId;
   if (!scopeId) return;
   const nowMs = params.nowMs ?? Date.now();
   sweepExpiredTerminalSends(nowMs);
@@ -53,10 +135,10 @@ export function markTerminalClawChatSend(params: {
 export function consumeTerminalClawChatSend(params: {
   accountId: string;
   chatId: string;
-  scopeId?: string;
+  scopeId: string;
   nowMs?: number;
 }): TerminalClawChatSendRecord | null {
-  const scopeId = params.scopeId ?? terminalSendScope.getStore();
+  const scopeId = params.scopeId;
   if (!scopeId) return null;
   const recordKey = key(params.accountId, params.chatId, scopeId);
   const record = terminalSends.get(recordKey);
@@ -68,6 +150,7 @@ export function consumeTerminalClawChatSend(params: {
 
 export function clearTerminalClawChatSendsForTest(): void {
   terminalSends.clear();
+  openScopesBySession.clear();
 }
 
 export interface TerminalSendScope {
@@ -77,14 +160,15 @@ export interface TerminalSendScope {
 }
 
 /**
- * Read the current turn's ambient send scope (accountId\0chatId\0messageId).
- * Returns null when not inside a dispatch scope, or when the scope id is not
- * the tripartite form (e.g. a test-only opaque scope id).
+ * The calling turn's default reaction target (accountId\0chatId\0messageId).
+ * Returns null unless the tool call's trusted `sessionKey` matches the open
+ * turn in its async context and no later turn of that session has started
+ * since; also null for a non-tripartite scope id (e.g. a test-only one).
  */
-export function getCurrentTerminalSendScope(): TerminalSendScope | null {
-  const store = terminalSendScope.getStore();
-  if (!store) return null;
-  const parts = store.split("\0");
+export function getCurrentTerminalSendScope(params: { sessionKey: string | null | undefined }): TerminalSendScope | null {
+  const scope = resolveCallerScope(params.sessionKey);
+  if (!scope || scope.superseded) return null;
+  const parts = scope.scopeId.split("\0");
   if (parts.length !== 3) return null;
   const [accountId, chatId, messageId] = parts;
   if (!accountId || !chatId || !messageId) return null;