@clawling/clawchat-plugin-openclaw 2026.6.23-1 → 2026.6.30-1

package/README.md

@@ -90,20 +90,26 @@ src/
   api-types.ts          /v1/* request/response type definitions
   inbound.ts            envelope → agent turn
   outbound.ts           agent reply → envelope
-  streaming.ts          progressive reply emitter
-  buffered-stream.ts    chunk coalescing + flush policy
   message-mapper.ts     fragment ↔ text/media mapping
   group-message-coalescer.ts
                         per-group idle/max batching for non-mention turns
+  group-settings.ts     per-group agent settings cache (GET /v1/agents/me/
+                        group-settings)
   reply-dispatcher.ts   static vs stream routing
+  no-reply.ts           clawchat:no-reply / :silent suppression token guard
   login.runtime.ts      invite-code exchange flow
+  refresh-manager.ts    ClawChat token refresh + auto-logout orchestration
+  skill-update.ts       conversational, adapter-driven skill hot-update
   media-runtime.ts      media download/upload pipeline
+  liveware-cli.ts       liveware asset download helper (custom CDN User-Agent)
   tools.ts              clawchat_* agent tools (account / media / memory /
                         metadata / moments / mention)
   tools-schema.ts       JSON schemas for the clawchat_* tools
   protocol.ts           inbound payload type guards
   protocol-types.ts     v2 envelope, fragment, transport shapes
   config.ts             defaults + typebox schema
+  config-compat.ts      migration for the plugin rename (openclaw-clawchat →
+                        clawchat-plugin-openclaw id/channel key)
   storage.ts            plugin-owned SQLite (activations, connections,
                         clawchat_messages, tool_calls)
   clawchat-memory.ts    file-backed memory tools (see docs/clawchat-memory.md)
@@ -114,6 +120,8 @@ src/
   plugin-prompts.ts     loads prompts/platform.md and default-* prompts
   ws-alignment.ts       handshake capabilities + hello-ok diagnostics
   ws-log.ts             clawchat.ws single-line log formatting
+  llm-context-debug.ts  opt-in LLM input/output snapshot capture for debugging
+  plugin-report.ts      best-effort read of this plugin's package version
   commands.ts           /clawchat-activate runtime slash command
   terminal-send.ts      terminal-send suppression for clawchat_mention_message
   mock-transport.ts     in-memory Transport double for tests
@@ -178,4 +186,4 @@ plugin tests or publish the package.
 
 ## License
 
-See the repository root.
+MIT — see [LICENSE](./LICENSE).

package/dist/src/api-client.js

@@ -418,6 +418,9 @@ export function createOpenclawClawlingApiClient(opts) {
             if (userId?.trim()) {
                 body.user_id = userId.trim();
             }
+            if (opts.pluginVersion?.trim()) {
+                body.plugin_version = opts.pluginVersion.trim();
+            }
             return await call("POST", "/v1/agents/connect", {
                 // `X-Device-Id` is added globally via `authHeaders` on every request.
                 headers: { "content-type": "application/json" },

package/dist/src/inbound.js

@@ -149,6 +149,27 @@ export async function dispatchOpenclawClawlingInbound(params) {
         chatType,
         userId: account.userId,
     });
+    // Pending-consent gate for conversational skill hot-update. Only owner direct
+    // messages can answer a pending skill-update ask; the gate parses consent
+    // conservatively and, when it consumes the reply (affirm/deny), the message
+    // does NOT continue to the LLM. Ambiguous/unrelated replies return false and
+    // flow on normally (pending survives until timeout). See src/skill-update.ts.
+    if (chatType === "direct" &&
+        params.consumeOwnerConsent &&
+        account.ownerUserId &&
+        sender.id === account.ownerUserId) {
+        let consumed = false;
+        try {
+            consumed = await params.consumeOwnerConsent({ senderId: sender.id, text: rawBody, chatId });
+        }
+        catch (err) {
+            log?.error?.(`[${account.accountId}] clawchat-plugin-openclaw skill-update consent gate error msg=${payload.message_id}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        if (consumed) {
+            log?.info?.(`[${account.accountId}] clawchat-plugin-openclaw owner reply consumed as skill-update consent msg=${payload.message_id}`);
+            return;
+        }
+    }
     // NOTE: the static mention-mode early-drop was removed here (Task 7 fix).
     // Non-mention group messages now always flow through to ingestTurn, which
     // applies the dynamic gate (GroupSettingsCache.effective) and returns

package/dist/src/liveware-cli.js

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveStateDir } from "openclaw/plugin-sdk/state-paths";
+export const LIVEWARE_BASE_URL = "https://media.clawling.chat/liveware/";
+// A non-default User-Agent is required: the CDN (Cloudflare) returns 403 for
+// known scripting/default UAs, so download requests must identify themselves.
+const LIVEWARE_USER_AGENT = "clawchat-liveware-installer";
+/** Directory where the downloaded binaries live: <stateDir>/clawchat/liveware. */
+export function livewareDir(stateDir) {
+    const root = stateDir ?? resolveStateDir();
+    return path.join(root, "clawchat", "liveware");
+}
+/** Map host platform/arch to the two asset filenames, or null if unsupported. */
+export function platformAssets(plat = process.platform, arch = process.arch) {
+    const os = plat === "darwin" ? "darwin" : plat === "linux" ? "linux" : null;
+    const cpu = arch === "x64" ? "amd64" : arch === "arm64" ? "arm64" : null;
+    if (!os || !cpu)
+        return null;
+    return { liveware: `liveware-${os}-${cpu}`, tunneAgent: `tunnel-agent-${os}-${cpu}` };
+}
+function findOnPath(name) {
+    const raw = process.env.PATH ?? "";
+    for (const dir of raw.split(path.delimiter)) {
+        if (!dir)
+            continue;
+        const candidate = path.join(dir, name);
+        try {
+            fs.accessSync(candidate, fs.constants.X_OK);
+            return candidate;
+        }
+        catch {
+            // not here; keep scanning
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the liveware executable to invoke:
+ *  1. on PATH        → "liveware" (let the OS resolve it)
+ *  2. downloaded dir → absolute path
+ *  3. otherwise      → null
+ */
+export function resolveLivewarePath(stateDir) {
+    if (findOnPath("liveware"))
+        return "liveware";
+    const local = path.join(livewareDir(stateDir), "liveware");
+    try {
+        fs.accessSync(local, fs.constants.X_OK);
+        return local;
+    }
+    catch {
+        return null;
+    }
+}
+async function downloadTo(url, dest) {
+    const res = await fetch(url, { headers: { "user-agent": LIVEWARE_USER_AGENT } });
+    if (!res.ok)
+        throw new Error(`download ${url} failed: HTTP ${res.status}`);
+    const buf = Buffer.from(await res.arrayBuffer());
+    if (buf.length === 0)
+        throw new Error(`download ${url} returned empty body`);
+    const tmp = `${dest}.tmp`;
+    await fs.promises.writeFile(tmp, buf);
+    await fs.promises.chmod(tmp, 0o755);
+    await fs.promises.rename(tmp, dest);
+}
+/**
+ * Startup hook: ensure the liveware CLI is available, downloading it when not.
+ * Fire-and-forget — never throws; logs and returns on any failure.
+ */
+export async function ensureLivewareCli(opts = {}) {
+    const { stateDir, log } = opts;
+    try {
+        if (findOnPath("liveware"))
+            return; // PATH wins
+        const dir = livewareDir(stateDir);
+        const target = path.join(dir, "liveware");
+        if (fs.existsSync(target))
+            return;
+        const assets = platformAssets();
+        if (!assets) {
+            log?.warn?.(`clawchat-plugin-openclaw: unsupported platform ${process.platform}/${process.arch}; skipping liveware download`);
+            return;
+        }
+        await fs.promises.mkdir(dir, { recursive: true });
+        await downloadTo(LIVEWARE_BASE_URL + assets.liveware, path.join(dir, "liveware"));
+        await downloadTo(LIVEWARE_BASE_URL + assets.tunneAgent, path.join(dir, "tunnel-agent"));
+        log?.debug?.(`clawchat-plugin-openclaw: liveware CLI downloaded to ${dir}`);
+    }
+    catch (err) {
+        log?.warn?.(`clawchat-plugin-openclaw: liveware CLI download skipped: ${String(err)}`);
+    }
+}

package/dist/src/login.runtime.js

@@ -1,6 +1,7 @@
 import { createInterface } from "node:readline/promises";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
 import { ClawlingApiError } from "./api-types.js";
+import { resolvePluginVersion } from "./plugin-report.js";
 import { CHANNEL_ID, mergeOpenclawClawchatRuntimePluginActivation, mergeOpenclawClawchatToolAllow, resolveOpenclawClawlingAccount, } from "./config.js";
 import { getClawChatStore } from "./storage.js";
 /**
@@ -135,6 +136,7 @@ export async function runOpenclawClawlingLogin(params) {
         // Pre-login we may not have a token yet. Send the current one (or empty)
         // — the server should accept an unauthenticated invite-code exchange.
         token: account.token || "",
+        pluginVersion: resolvePluginVersion(),
     });
     runtime.log("Verifying invite code …");
     let result;

package/dist/src/reply-dispatcher.js

@@ -418,7 +418,7 @@ export function createOpenclawClawlingReplyDispatcher(options) {
     };
     // §7.6 (binding): client-supplied message_id MUST be `msg-` + a 26-char
     // Crockford base32 ULID. Use the shared conformant minter — do not invent a
-    // different scheme (planned msghub Phase-4 validation will reject it).
+    // different scheme (planned backend validation will reject it).
     const mintStaticMessageId = () => mintMessageId();
     const emitTyping = (isTyping) => {
         if (!isTyping && !typingActive)

package/dist/src/runtime.js

@@ -5,11 +5,13 @@ import { createPluginRuntimeStore } from "openclaw/plugin-sdk/runtime-store";
 import { createOpenclawClawlingClient, resolveOpenclawClawlingDeviceId } from "./client.js";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
 import { reportPluginVersionSafe, resolvePluginVersion } from "./plugin-report.js";
+import { ensureLivewareCli } from "./liveware-cli.js";
 import { ClawlingApiError } from "./api-types.js";
 import { RefreshManager } from "./refresh-manager.js";
 import { runOpenclawClawlingLogin, } from "./login.runtime.js";
 import { CHANNEL_ID, effectiveOutputVisibility, effectiveGroupCommandMode, effectiveGroupMode, hasOpenclawClawlingConnectCredentials, resolveOpenclawClawlingAccount, } from "./config.js";
 import { dispatchOpenclawClawlingInbound } from "./inbound.js";
+import { PendingConsentStore, handleOwnerConsentReply, readEffectiveSkillVersions, resolveBundledSkillsDir, resolveManagedSkillsDir, runSkillUpdateCheck, } from "./skill-update.js";
 import { fetchInboundMedia } from "./media-runtime.js";
 import { createOpenclawClawlingReplyDispatcher } from "./reply-dispatcher.js";
 import { runWithTerminalClawChatSendScope } from "./terminal-send.js";
@@ -618,6 +620,15 @@ export async function startOpenclawClawlingGateway(params) {
         authenticated: false,
         log,
     });
+    // Ensure the liveware CLI is installed (async, never blocks startup).
+    void ensureLivewareCli({
+        stateDir: runtime.state?.resolveStateDir?.(),
+        log: {
+            warn: (m) => log?.info?.(m),
+            debug: (m) => log?.debug?.(m),
+            error: (m) => log?.error?.(m),
+        },
+    });
     // §B self-heal — non-interactive env connect-code activation BEFORE blocking on
     // the wait-for-activation loop. Gated so the common path (no env code, or an
     // already-credentialed account) adds NO async work: on success it credentials
@@ -1645,6 +1656,75 @@ export async function startOpenclawClawlingGateway(params) {
     client.on("metadata:invalidated", (env) => {
         void handleMetadataInvalidation(env);
     });
+    // --- Conversational skill hot-update (adapter-driven; see src/skill-update.ts) ---
+    // One pending-consent record per runtime.
+    // WRITE target = the OpenClaw-managed skills dir (`<stateDir>/skills`): it is
+    // chokidar-watched (host src/skills/runtime/refresh.ts:107) so a write bumps
+    // the snapshot + rebuilds the prompt next turn, and it loads at HIGHER
+    // precedence than plugin-bundled skills (managed=3 > bundled=2, host
+    // src/skills/loading/workspace.ts:1220-1239), overriding the bundled copy.
+    // The bundled `./skills` dir is READ-ONLY here: a first-boot fallback for the
+    // "current installed version" only — never written (it lives in node_modules
+    // → may be read-only and is clobbered on `openclaw plugins update`).
+    const skillUpdateConsent = new PendingConsentStore();
+    const managedSkillsDir = resolveManagedSkillsDir();
+    let bundledSkillsDir = null;
+    try {
+        bundledSkillsDir = resolveBundledSkillsDir();
+    }
+    catch (err) {
+        log?.info?.(`[${accountId}] clawchat-plugin-openclaw skill-update: bundled skills dir not resolvable (using managed-only current): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const sendOwnerSkillMessage = async (text) => {
+        const ownerUserId = account.ownerUserId?.trim();
+        if (!ownerUserId)
+            return;
+        await sendOpenclawClawlingText({
+            client,
+            account,
+            to: { chatId: ownerUserId, chatType: "direct" },
+            text,
+            log,
+        });
+    };
+    const triggerSkillUpdateCheck = async () => {
+        const ownerUserId = account.ownerUserId?.trim();
+        if (!ownerUserId) {
+            log?.info?.(`[${accountId}] clawchat-plugin-openclaw skill-update check skipped: no owner user id`);
+            return;
+        }
+        // Effective current = managed copy if present, else bundled (host precedence).
+        const localVersions = await readEffectiveSkillVersions(managedSkillsDir, bundledSkillsDir);
+        await runSkillUpdateCheck({
+            ownerUserId,
+            localVersions,
+            fetchFn: globalThis.fetch,
+            store: skillUpdateConsent,
+            sendOwnerMessage: sendOwnerSkillMessage,
+            log: {
+                info: (m) => log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${m}`),
+                error: (m) => log?.error?.(`[${accountId}] clawchat-plugin-openclaw ${m}`),
+            },
+        });
+    };
+    const consumeOwnerSkillConsent = async (args) => {
+        const ownerUserId = account.ownerUserId?.trim();
+        if (!ownerUserId)
+            return false;
+        return handleOwnerConsentReply({
+            ownerUserId,
+            senderId: args.senderId,
+            text: args.text,
+            store: skillUpdateConsent,
+            fetchFn: globalThis.fetch,
+            skillsDir: managedSkillsDir,
+            sendOwnerMessage: sendOwnerSkillMessage,
+            log: {
+                info: (m) => log?.info?.(`[${accountId}] clawchat-plugin-openclaw ${m}`),
+                error: (m) => log?.error?.(`[${accountId}] clawchat-plugin-openclaw ${m}`),
+            },
+        });
+    };
     client.on("notify:signal", (env) => {
         // §9.4 reliable system notification. The plugin holds no friend/roster
         // cache (friends are fetched on demand via REST tools), so there is nothing
@@ -1660,6 +1740,15 @@ export async function startOpenclawClawlingGateway(params) {
                 log?.info?.(`[${accountId}] clawchat-plugin-openclaw agent.config.changed signal received; re-pulling group settings`);
                 pullGroupSettings();
             }
+            else if (type === "clawchat.skill.update.check") {
+                // Content-free trigger: check the official skill source in code and, if
+                // there is an update, ask the owner in chat for consent. The atomic
+                // overwrite happens later when the owner affirms (consent gate).
+                log?.info?.(`[${accountId}] clawchat-plugin-openclaw clawchat.skill.update.check signal received; checking official skill source`);
+                void triggerSkillUpdateCheck().catch((err) => {
+                    log?.error?.(`[${accountId}] clawchat-plugin-openclaw skill-update check failed: ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }
         }
     });
     client.on("replay:done", (env) => {
@@ -2268,6 +2357,7 @@ export async function startOpenclawClawlingGateway(params) {
                 runtime,
                 account,
                 log,
+                consumeOwnerConsent: consumeOwnerSkillConsent,
                 ingest: async (turn) => {
                     ingestResult = await ingestTurn(turn);
                 },