@clawling/clawchat-plugin-openclaw 2026.7.29-1 → 2026.8.2-1

package/dist/src/api-client.js

@@ -361,6 +361,9 @@ export function createOpenclawClawlingApiClient(opts) {
                 headers: { "content-type": "application/json" },
             });
         },
+        async getMoment(momentId) {
+            return await call("GET", `/v1/moments/${encodeURIComponent(String(momentId))}`);
+        },
         async deleteMoment(momentId) {
             return await call("DELETE", `/v1/moments/${encodeURIComponent(String(momentId))}`);
         },

package/dist/src/awareness-note-turn.js

@@ -16,7 +16,7 @@ export function buildAwarenessNoteEnvelope(params) {
         event: EVENT.MESSAGE_SEND,
         trace_id: `clawchat-plugin-openclaw-awareness-${now}`,
         emitted_at: now,
-        chat_id: ownerConversationId ?? account.ownerUserId,
+        chat_id: ownerConversationId,
         chat_type: "direct",
         to: { id: account.userId, type: "direct" },
         sender: { id: "clawchat-awareness", type: "direct", nick_name: "ClawChat" },
@@ -44,3 +44,29 @@ export function buildAwarenessNoteEnvelope(params) {
         },
     };
 }
+export function buildMomentCommentNoteEnvelope(params) {
+    const { account, ownerConversationId, momentId, replied } = params;
+    const now = Date.now();
+    const text = replied
+        ? `ClawChat: someone replied to your comment on a moment (id ${momentId}). Use the get_moment tool to view it and reply if appropriate.`
+        : `ClawChat: someone commented on your moment (id ${momentId}). Use the get_moment tool to view it and reply if appropriate.`;
+    return {
+        version: "2",
+        event: EVENT.MESSAGE_SEND,
+        trace_id: `clawchat-plugin-openclaw-moment-comment-${now}`,
+        emitted_at: now,
+        chat_id: ownerConversationId,
+        chat_type: "direct",
+        to: { id: account.userId, type: "direct" },
+        sender: { id: "clawchat-awareness", type: "direct", nick_name: "ClawChat" },
+        payload: {
+            message_id: `clawchat-plugin-openclaw-moment-comment-${now}`,
+            message_mode: "normal",
+            message: {
+                body: { fragments: [{ kind: "text", text }] },
+                context: { mentions: [], reply: null },
+                streaming: { status: "static", sequence: 0, mutation_policy: "sealed", started_at: null, completed_at: null },
+            },
+        },
+    };
+}

package/dist/src/client.js

@@ -32,6 +32,7 @@ export function createOpenclawClawlingClient(account, overrides = {}) {
             timeout: account.ack.timeout,
             autoResendOnTimeout: account.ack.autoResendOnTimeout,
         },
+        ...(overrides.now ? { now: overrides.now } : {}),
     });
     if (overrides.wsLifecycle?.onConnectFrameSent) {
         const sendRawEnvelope = client.sendRawEnvelope.bind(client);

package/dist/src/liveware-sample.js

@@ -62,20 +62,67 @@ async function fetchText(fetchFn, url) {
     }
     return text;
 }
+/**
+ * True when `appDir` already holds what the manifest pins: every listed file
+ * present, program files byte-identical to their manifest sha256, and nothing
+ * beyond those files (so a file dropped by a newer manifest still forces a clean
+ * reinstall). USER_DATA_FILES are checked for presence only, never for content —
+ * `state.json` ships in the manifest *and* is owned by the agent afterwards, so
+ * hashing it would make the short-circuit miss on exactly the installs that are
+ * actually in use. Cheap (~20 KB of local reads) next to the per-file GETs it
+ * saves, and fail-safe: any read error answers "no".
+ */
+async function localInstallMatches(appDir, entry) {
+    try {
+        const expected = new Set(entry.files.map((f) => path.basename(f.path)));
+        for (const name of await fs.promises.readdir(appDir)) {
+            if (!expected.has(name) && !USER_DATA_FILES.includes(name))
+                return false;
+        }
+        for (const file of entry.files) {
+            const name = path.basename(file.path);
+            const target = path.join(appDir, name);
+            if (USER_DATA_FILES.includes(name)) {
+                await fs.promises.access(target); // agent-owned: presence is the whole check
+                continue;
+            }
+            const buf = await fs.promises.readFile(target);
+            if (crypto.createHash("sha256").update(buf).digest("hex") !== file.sha256)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false; // missing / unreadable — treat as "not installed"
+    }
+}
 /**
  * Download + verify + atomically install the sample under `<sampleRoot>/app`.
  * Preserves USER_DATA_FILES from an existing install. Throws on any failure;
  * never leaves a partially-written `app/` dir behind.
+ *
+ * Re-install short-circuit: when the installed bytes already match every hash
+ * the manifest pins, nothing is fetched or rewritten (`reused: true`). Every
+ * boot used to re-fetch the whole bundle from GitHub raw even when the identical
+ * files were already on disk — a handful of serial round-trips on the critical
+ * path, and an unreachable raw.githubusercontent then failed a sample that was
+ * already fully installed. Only the manifest itself is still fetched every time,
+ * because that is what tells us which hashes to compare against.
  */
 export async function downloadLivewareSample(opts) {
     const ref = opts.ref ?? DEFAULT_SKILLS_REF;
     const entry = parseLivewaresManifest(await fetchText(opts.fetchFn, livewaresManifestUrl(ref, opts.base)));
     const appDir = path.join(opts.sampleRoot, "app");
+    if (await localInstallMatches(appDir, entry)) {
+        return { version: entry.version, appDir, reused: true };
+    }
     const tmpDir = path.join(opts.sampleRoot, `app.tmp-${process.pid}`);
     await fs.promises.rm(tmpDir, { recursive: true, force: true });
     await fs.promises.mkdir(tmpDir, { recursive: true });
     try {
-        for (const file of entry.files) {
+        // Fetched concurrently: the files are independent and each is a separate
+        // round-trip to the same host, so serializing them only added latency.
+        await Promise.all(entry.files.map(async (file) => {
             const text = await fetchText(opts.fetchFn, livewareFileUrl(file.path, ref, opts.base));
             const buf = Buffer.from(text, "utf8");
             const actual = crypto.createHash("sha256").update(buf).digest("hex");
@@ -83,7 +130,7 @@ export async function downloadLivewareSample(opts) {
                 throw new Error(`sha256 mismatch for ${file.path}: expected ${file.sha256} got ${actual}`);
             }
             await fs.promises.writeFile(path.join(tmpDir, path.basename(file.path)), buf);
-        }
+        }));
         // Preserve agent/user-owned data files from a previous install.
         for (const name of USER_DATA_FILES) {
             const prev = path.join(appDir, name);
@@ -276,6 +323,87 @@ function findIdDeep(value) {
     }
     return null;
 }
+/**
+ * Find the id of an existing liveware app named `name` in `liveware app list`
+ * output. Deliberately conservative: a shape this cannot read must degrade to
+ * "not found" — the caller then creates an app, i.e. the previous behaviour —
+ * and must never return a WRONG id, so the text branch only accepts a line that
+ * contains the exact app name plus one id-looking token outside it, and an
+ * id-looking token must carry a digit/`-`/`_` so a status word ("active",
+ * "running") cannot pass for an id. JSON output (any wrapper key) is the
+ * reliable path; the aligned-table branch is calibrated on `app create`'s table,
+ * the only text shape verified against the real CLI.
+ */
+export function findAppIdByName(stdout, name) {
+    const text = (stdout ?? "").trim();
+    const wanted = (name ?? "").trim();
+    if (!text || !wanted)
+        return null;
+    try {
+        const found = findNamedIdDeep(JSON.parse(text), wanted);
+        if (found)
+            return found;
+    }
+    catch { /* not JSON */ }
+    for (const line of text.split("\n")) {
+        const at = line.indexOf(wanted);
+        if (at < 0)
+            continue;
+        const outsideName = `${line.slice(0, at)} ${line.slice(at + wanted.length)}`;
+        for (const token of outsideName.trim().split(/\s+/)) {
+            if (isAppIdToken(token))
+                return token;
+        }
+    }
+    return null;
+}
+function isAppIdToken(token) {
+    return /^[A-Za-z0-9][A-Za-z0-9_-]{5,}$/.test(token) && /[0-9_-]/.test(token);
+}
+function findNamedIdDeep(value, name) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            const found = findNamedIdDeep(item, name);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (!value || typeof value !== "object")
+        return null;
+    const obj = value;
+    const named = ["name", "app_name", "appName", "title"].some((key) => typeof obj[key] === "string" && obj[key].trim() === name);
+    if (named) {
+        const id = findIdDeep(obj);
+        if (id)
+            return id;
+    }
+    for (const nested of Object.values(obj)) {
+        const found = findNamedIdDeep(nested, name);
+        if (found)
+            return found;
+    }
+    return null;
+}
+/**
+ * `liveware app list` → the id of an existing app with this name, or null.
+ * Best-effort by contract: an exec failure or unreadable output resolves to null
+ * so the caller falls back to `app create` instead of failing the whole flow.
+ */
+export async function livewareAppFindByName(opts) {
+    const execFileFn = opts.execFileFn ?? nodeExecFile;
+    const stdout = await new Promise((resolve) => {
+        execFileFn(opts.livewarePath, ["app", "list"], { timeout: CLI_TIMEOUT_MS }, (err, out, errOut) => {
+            if (err) {
+                opts.log?.debug?.(`liveware-sample: app list failed; falling back to app create: ${String(errOut || out || err)}`);
+                resolve(null);
+                return;
+            }
+            resolve(String(out ?? ""));
+        });
+    });
+    return stdout == null ? null : findAppIdByName(stdout, opts.name);
+}
 export async function livewareAppCreate(opts) {
     const execFileFn = opts.execFileFn ?? nodeExecFile;
     const stdout = await new Promise((resolve, reject) => {
@@ -305,10 +433,15 @@ const INTRO_MAX_TRIES = 20;
 // a one-shot bootstrap would otherwise stay dormant until the next restart.
 const START_RETRY_DELAYS_MS = [30_000, 60_000, 120_000, 300_000];
 export class LivewareSampleSupervisor {
+    /** Not readonly: adoptDeps() re-points a live supervisor at a re-entered
+     * gateway closure (fresh token / REST client / owner-notify path). */
     deps;
     serverChild = null;
     tunnelChild = null;
     stopped = false;
+    /** True while a startAttempt chain (bootstrap/relaunch) is running; read by
+     * isIdle() so adoptDeps never starts a second concurrent flow. */
+    launchInFlight = false;
     restartTimes = [];
     timers = new Set();
     /** Bumped on every (re)launch and on killChildren: a child's exit handler
@@ -323,8 +456,39 @@ export class LivewareSampleSupervisor {
     async start() {
         await this.startAttempt(0);
     }
+    /** Re-point a live supervisor at a freshly re-entered gateway closure, and —
+     * only when nothing is in flight — kick a new attempt.
+     *
+     * `startOpenclawClawlingGateway` re-enters itself on token refresh / transport
+     * backoff, so runtime.ts keeps ONE supervisor per (abortSignal, account) and
+     * hands the new closure here instead of constructing a second supervisor: two
+     * supervisors raced the bootstrap "account has zero apps" gate and registered
+     * two liveware apps for the same account, one of which no row then tracked.
+     * The re-entered closure owns the fresh token, REST client and owner-notify
+     * path; children, timers and the crash-restart budget keep running untouched.
+     * A flow already mid-await finishes on the deps it captured. */
+    adoptDeps(deps) {
+        this.deps = deps;
+        // A re-entry used to re-run the whole flow through the brand-new supervisor,
+        // which is what healed an attempt that had skipped (no token yet) or burnt
+        // through its retry ladder. Keep that healing, but only when there is
+        // genuinely nothing live: no in-flight flow, no pending retry/crash-restart
+        // timer, no children — a second concurrent flow is exactly the duplicate
+        // registration the single-supervisor registry exists to prevent.
+        if (this.isIdle())
+            void this.startAttempt(0);
+    }
+    /** Nothing running and nothing scheduled: safe to (re)start a flow. */
+    isIdle() {
+        return !this.stopped
+            && !this.launchInFlight
+            && this.timers.size === 0
+            && this.serverChild === null
+            && this.tunnelChild === null;
+    }
     async startAttempt(attempt) {
         const { deps } = this;
+        this.launchInFlight = true;
         try {
             if (!deps.enabled)
                 return;
@@ -357,6 +521,9 @@ export class LivewareSampleSupervisor {
             deps.log?.warn?.(`clawchat-plugin-openclaw liveware-sample start failed (attempt ${attempt + 1}, retrying in ${delayMs / 1000}s): ${String(err)}`);
             this.schedule(() => { void this.startAttempt(attempt + 1); }, delayMs);
         }
+        finally {
+            this.launchInFlight = false;
+        }
     }
     stop() {
         this.stopped = true;
@@ -396,24 +563,18 @@ export class LivewareSampleSupervisor {
         const { deps } = this;
         if (this.stopped)
             return;
+        // Retryable-vs-opt-out: a missing CLI, an absent token and a flaky listApps
+        // are all transient, but they used to `return`, which left the sample dormant
+        // for the whole process lifetime (nothing re-enters bootstrap on its own).
+        // Throw instead so startAttempt's START_RETRY_DELAYS_MS ladder gets its turn;
+        // only a genuine opt-out (disabled row, owner already has apps) returns.
         const livewarePath = deps.resolveLivewarePath();
-        if (!livewarePath) {
-            deps.log?.warn?.("liveware-sample: liveware CLI not ready; skip");
-            return;
-        }
+        if (!livewarePath)
+            throw new Error("liveware CLI not ready");
         const token = deps.resolveToken();
-        if (!token) {
-            deps.log?.debug?.("liveware-sample: no token; skip");
-            return;
-        }
-        let apps;
-        try {
-            apps = await deps.listApps();
-        }
-        catch (err) {
-            deps.log?.debug?.(`liveware-sample: listApps failed; skip bootstrap: ${String(err)}`);
-            return;
-        }
+        if (!token)
+            throw new Error("no ClawChat token available yet");
+        const apps = await deps.listApps();
         if (this.bailIfStopped())
             return;
         if (apps.apps.length > 0) {
@@ -433,9 +594,31 @@ export class LivewareSampleSupervisor {
         if (this.bailIfStopped())
             return;
         await livewareLogin({ livewarePath, token, execFileFn: deps.execFileFn });
-        const appId = await livewareAppCreate({
+        // Reuse an app we already own before minting another one. `app create` is not
+        // idempotent and nothing here ever reconciled against the liveware side, so
+        // every bootstrap that died past this point (no row was written until the very
+        // end, see below) left one more orphan app behind and ate into the account's
+        // app quota. Best-effort: an unreadable list falls through to `app create`.
+        const existingAppId = await livewareAppFindByName({
+            livewarePath, name: LIVEWARE_SAMPLE_APP_NAME, execFileFn: deps.execFileFn, log: deps.log,
+        });
+        if (this.bailIfStopped())
+            return;
+        if (existingAppId) {
+            deps.log?.debug?.(`liveware-sample: reusing existing liveware app ${existingAppId}`);
+        }
+        const appId = existingAppId ?? await livewareAppCreate({
             livewarePath, name: LIVEWARE_SAMPLE_APP_NAME, execFileFn: deps.execFileFn,
         });
+        // Persist the app id BEFORE the steps that can still fail. Without this a
+        // failure anywhere below left no row at all, so the next boot ran bootstrap
+        // again and created yet another app; a "pending" row makes the next attempt
+        // resume through relaunch() with the same app id instead.
+        deps.store.upsertLivewareSample({
+            platform: deps.platform, accountId: deps.accountId,
+            appId, appName: LIVEWARE_SAMPLE_APP_NAME, port: server.port,
+            publicUrl: null, sampleVersion: version, status: "pending",
+        });
         const publicUrl = await tunnelBind({
             livewarePath, appId, port: server.port, execFileFn: deps.execFileFn,
         });
@@ -459,24 +642,23 @@ export class LivewareSampleSupervisor {
         const { deps } = this;
         if (this.stopped)
             return;
+        // Both of these used to `return` and strand the sample until the next process
+        // start; they are transient, so throw and let the retry ladder run (see
+        // bootstrap). Only a successful list that no longer contains the app is an
+        // opt-out.
         const livewarePath = deps.resolveLivewarePath();
-        if (!livewarePath) {
-            deps.log?.warn?.("liveware-sample: liveware CLI not ready; skip relaunch");
-            return;
-        }
+        if (!livewarePath)
+            throw new Error("liveware CLI not ready");
+        const apps = await deps.listApps();
         // The user deleting the app tile is an explicit opt-out — never reinstall.
-        try {
-            const apps = await deps.listApps();
-            if (!apps.apps.some((a) => a.app_id === row.app_id)) {
-                deps.store.updateLivewareSampleStatus({
-                    platform: deps.platform, accountId: deps.accountId, status: "disabled",
-                    lastError: "app removed by user",
-                });
-                return;
-            }
-        }
-        catch (err) {
-            deps.log?.debug?.(`liveware-sample: listApps failed; skip relaunch: ${String(err)}`);
+        // Exception: a "pending" row was persisted mid-bootstrap, before the app was
+        // ever registered with ClawChat, so its absence from this list means "not
+        // registered yet", not "deleted" — disabling it there would strand the app id.
+        if (row.status !== "pending" && !apps.apps.some((a) => a.app_id === row.app_id)) {
+            deps.store.updateLivewareSampleStatus({
+                platform: deps.platform, accountId: deps.accountId, status: "disabled",
+                lastError: "app removed by user",
+            });
             return;
         }
         if (this.bailIfStopped())
@@ -504,8 +686,46 @@ export class LivewareSampleSupervisor {
         this.serverChild = server.child;
         if (this.bailIfStopped())
             return;
+        // Re-login before touching the CLI. Its credentials live in $HOME/.clawling,
+        // a different volume from the stateDir holding the row that sent us down this
+        // path: a container that persists stateDir but not $HOME comes back with a row
+        // AND a logged-out CLI, so every tunnelBind/agent below fails auth until the
+        // retry ladder gives up — the sample then never returns for the whole process
+        // lifetime. `login` is idempotent; best-effort, so a stale token still falls
+        // through to whatever credentials the CLI already has.
+        const token = deps.resolveToken();
+        if (token) {
+            try {
+                await livewareLogin({ livewarePath, token, execFileFn: deps.execFileFn });
+            }
+            catch (err) {
+                deps.log?.warn?.(`liveware-sample: relaunch re-login failed; continuing with cached CLI credentials: ${String(err)}`);
+            }
+            if (this.bailIfStopped())
+                return;
+        }
+        else {
+            deps.log?.debug?.("liveware-sample: no token; relaunch without re-login");
+        }
+        // Kept after the re-login above so the lookup runs against a CLI that is
+        // actually authenticated: a pending row's app id came straight from
+        // `app create`'s parser and was never confirmed by the liveware side, so
+        // prefer a by-name lookup — a mis-parsed id then self-heals instead of
+        // failing every tunnel bind for the rest of this row's life.
+        let appId = row.app_id;
+        if (row.status === "pending") {
+            const found = await livewareAppFindByName({
+                livewarePath, name: row.app_name, execFileFn: deps.execFileFn, log: deps.log,
+            });
+            if (found && found !== appId) {
+                deps.log?.warn?.(`liveware-sample: pending app id ${appId} not listed; adopting ${found}`);
+                appId = found;
+            }
+            if (this.bailIfStopped())
+                return;
+        }
         const publicUrl = await tunnelBind({
-            livewarePath, appId: row.app_id, port: server.port, execFileFn: deps.execFileFn,
+            livewarePath, appId, port: server.port, execFileFn: deps.execFileFn,
         });
         if (this.bailIfStopped())
             return;
@@ -513,14 +733,16 @@ export class LivewareSampleSupervisor {
         this.tunnelChild = agent.child;
         if (this.bailIfStopped())
             return;
-        if (publicUrl !== row.public_url) {
+        // A pending row has never been registered with ClawChat (public_url is null),
+        // so this condition also covers "register it for the first time".
+        if (publicUrl !== row.public_url || appId !== row.app_id) {
             await deps.registerApp({
-                name: row.app_name, appId: row.app_id, url: publicUrl,
+                name: row.app_name, appId, url: publicUrl,
             });
         }
         deps.store.upsertLivewareSample({
             platform: deps.platform, accountId: deps.accountId,
-            appId: row.app_id, appName: row.app_name, port: server.port,
+            appId, appName: row.app_name, port: server.port,
             publicUrl, sampleVersion: version, status: "active",
         });
         this.watchChildren();
@@ -553,7 +775,15 @@ export class LivewareSampleSupervisor {
                 });
                 if (!row || row.status === "disabled")
                     return;
-                void this.relaunch(row).catch((err) => {
+                // This relaunch does NOT go through startAttempt, so it must do that
+                // method's launchInFlight bookkeeping itself: the timer has already been
+                // dropped from `timers` and children are only assigned a few awaits in, so
+                // without this isIdle() reports idle for the whole early part of a
+                // crash-restart and a concurrent adoptDeps kick would run a SECOND launch
+                // flow — the duplicate registration the single-supervisor rule prevents.
+                this.launchInFlight = true;
+                void this.relaunch(row)
+                    .catch((err) => {
                     // A partially-completed relaunch may have spawned children before
                     // failing — never leave them running unwatched.
                     this.killChildren();
@@ -562,7 +792,8 @@ export class LivewareSampleSupervisor {
                         platform: this.deps.platform, accountId: this.deps.accountId,
                         status: "failed", lastError: String(err),
                     });
-                });
+                })
+                    .finally(() => { this.launchInFlight = false; });
             }, delay);
         };
         for (const child of [this.serverChild, this.tunnelChild]) {

package/dist/src/no-reply.js

@@ -8,10 +8,12 @@
  * anchored, wrapping decorations (`<>`, `[]`, `{}`, `/`, backticks, `*`) are
  * tolerated for free and must not be written into the pattern itself.
  *
- * RULE B — the host's bare markers (`NO_REPLY` / `[SILENT]` / `SILENT` /
- * `NO REPLY`), matched as a WHOLE STRING ONLY. These are ordinary English
- * words; substring-matching them would swallow prose such as "there is no reply
- * from the server".
+ * RULE B — bare runtime silence markers (`NO_REPLY` / `[SILENT]` / `SILENT` /
+ * `NO REPLY`), matched as a WHOLE STRING ONLY. OpenClaw itself has no such
+ * convention; these are carried because other agent runtimes define them, so a
+ * model may fall back to one instead of the `clawchat:` form. They are ordinary
+ * English words — substring-matching them would swallow prose such as "there is
+ * no reply from the server".
  *
  * This module MUST stay a literal mirror of the Hermes plugin's equivalent
  * module. When one side changes, change the other in the same breath.

package/dist/src/outbound.js

@@ -1,5 +1,6 @@
 import { randomInt } from "node:crypto";
-import { EVENT, MessageSendError } from "./protocol-types.js";
+import { EVENT, MessageSendError, TERMINAL_CHAT_CODES } from "./protocol-types.js";
+import { CHAT_ID_PREFIX, isValidChatId } from "./ws-client.js";
 import { createAttachedChannelResultAdapter, } from "openclaw/plugin-sdk/channel-send-result";
 import { chunkMarkdownText } from "openclaw/plugin-sdk/reply-runtime";
 import { createOpenclawClawlingApiClient } from "./api-client.js";
@@ -115,14 +116,71 @@ function getAlignedMessageErrorTracker(client, account, log) {
 export function setAlignedOutboundLogContext(client, context) {
     alignedOutboundContexts.set(client, context);
 }
+/**
+ * The single outbound gate predicate. Narrow by design: only a SERVER-confirmed
+ * rejection blocks, never a `conversation.dissolved` inference, and never the
+ * owner's direct chat (the client applies that exemption inside isSendBlocked).
+ * Optional-call form because outbound tests hand-roll a client mock.
+ */
+function isOutboundBlocked(client, chatId) {
+    if (!chatId)
+        return false;
+    return client.isSendBlocked?.(chatId) === true;
+}
 export function flushAlignedOutboundQueue(client) {
     const queue = alignedOutboundQueues.get(client);
-    queue?.flush((wire) => client.sendWire(wire));
+    // Re-check the gate at write time: this replay path (called on every
+    // `connected` edge) does not re-enter sendAlignedAckableEnvelope.
+    queue?.flush((wire) => client.sendWire(wire), { isBlocked: (item) => isOutboundBlocked(client, item.chatId) });
 }
 export function getAlignedOutboundQueueSize(client) {
     return alignedOutboundQueues.get(client)?.snapshot().length ?? 0;
 }
 async function sendAlignedAckableEnvelope(params) {
+    // Static addressing check, before any server state is consulted: this one is
+    // decidable locally and is never revocable, so it is not a "gate" that can
+    // later clear. msghub refuses such a frame with `invalid conversation id`.
+    if (!isValidChatId(params.chatId)) {
+        params.log?.info?.(formatWsLog({
+            event: "send_blocked",
+            accountId: params.account.accountId,
+            ...(alignedOutboundContexts.get(params.client)?.() ?? {
+                attempt: 1,
+                reconnectCount: 0,
+                state: params.client.transportState === "open" ? "ready" : "reconnecting",
+            }),
+            action: "drop",
+            fields: [
+                ["event_name", params.eventName],
+                ["chat_id", params.chatId],
+                ["reason", "invalid_chat_id"],
+            ],
+        }));
+        throw new MessageSendError("-", "invalid_chat_id", `"${params.chatId}" is not a ClawChat conversation id (expected ${CHAT_ID_PREFIX}…); refusing to send`, params.chatId);
+    }
+    // The server has already rejected this conversation with a terminal code and
+    // that rejection has not expired. Stop here: every further frame would be
+    // refused the same way. Gated on the narrow server-confirmed tier ONLY — a
+    // `conversation.dissolved` signal must never reach this branch, and the
+    // owner's direct chat is exempt (see ClawChatClient.isSendBlocked).
+    if (isOutboundBlocked(params.client, params.chatId)) {
+        params.log?.info?.(formatWsLog({
+            event: "send_blocked",
+            accountId: params.account.accountId,
+            ...(alignedOutboundContexts.get(params.client)?.() ?? {
+                attempt: 1,
+                reconnectCount: 0,
+                state: params.client.transportState === "open" ? "ready" : "reconnecting",
+            }),
+            action: "drop",
+            fields: [
+                ["event_name", params.eventName],
+                ["chat_id", params.chatId],
+                ["reason", "chat_rejected_by_server"],
+            ],
+        }));
+        throw new MessageSendError("-", "chat_rejected_local", "conversation was rejected by the server; refusing to send", params.chatId);
+    }
     const traceId = params.client.nextTraceId();
     const env = {
         version: "2",
@@ -206,6 +264,15 @@ async function sendAlignedAckableEnvelope(params) {
                     : typeof payload.message === "string" && payload.message
                         ? payload.message
                         : "message send failed";
+                // A terminal refusal proves the conversation is unreachable for this
+                // sender right now. Record it on the SERVER tier so the gates below
+                // stop subsequent frames — this is fact, not the inference that
+                // `conversation.dissolved` gives us. It expires; see the client.
+                if (TERMINAL_CHAT_CODES.has(code)
+                    && typeof ack.chat_id === "string"
+                    && ack.chat_id) {
+                    params.client.markChatDead?.(ack.chat_id, "server");
+                }
                 fail(new MessageSendError(traceId, code, hint, ack.chat_id));
                 return;
             }
@@ -242,6 +309,9 @@ async function sendAlignedAckableEnvelope(params) {
             onDrop: () => {
                 fail(new Error(`send queue full; dropped ${params.eventName} before write for trace_id=${traceId}`));
             },
+            onBlock: () => {
+                fail(new MessageSendError("-", "chat_rejected_local", "conversation was rejected by the server while this frame was queued", params.chatId));
+            },
         };
         function isTerminalClose(close) {
             return close?.code === 1000 || close?.reason === "client close" || close?.reason === "auth failed";
@@ -280,7 +350,7 @@ async function sendAlignedAckableEnvelope(params) {
         }
         try {
             queue.enqueue(item);
-            queue.flush((queuedWire) => params.client.sendWire(queuedWire));
+            queue.flush((queuedWire) => params.client.sendWire(queuedWire), { isBlocked: (queued) => isOutboundBlocked(params.client, queued.chatId) });
         }
         catch {
             // The queue keeps the failed frame at the head for reconnect retry, so
@@ -494,6 +564,14 @@ export async function sendOpenclawClawlingMedia(params) {
  * path used for message.send/reply does not apply). Matches the mobile client.
  */
 export function sendOpenclawClawlingReaction(params) {
+    if (!isValidChatId(params.chatId)) {
+        params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=invalid_chat_id`);
+        return;
+    }
+    if (isOutboundBlocked(params.client, params.chatId)) {
+        params.log?.info?.(`clawchat reaction blocked chat_id=${params.chatId} reason=chat_rejected_by_server`);
+        return;
+    }
     const payload = {
         target_message_id: params.targetMessageId,
         emoji: params.emoji,