@coffeexdev/openclaw-sentinel 0.5.1 → 0.7.0

package/dist/index.js

@@ -8,13 +8,14 @@ const DEFAULT_HOOK_SESSION_PREFIX = "agent:main:hooks:sentinel";
 const DEFAULT_RELAY_DEDUPE_WINDOW_MS = 120_000;
 const DEFAULT_HOOK_RESPONSE_TIMEOUT_MS = 30_000;
 const DEFAULT_HOOK_RESPONSE_FALLBACK_MODE = "concise";
+const HOOK_RESPONSE_RELAY_CLEANUP_INTERVAL_MS = 60_000;
 const MAX_SENTINEL_WEBHOOK_BODY_BYTES = 64 * 1024;
 const MAX_SENTINEL_WEBHOOK_TEXT_CHARS = 8000;
 const MAX_SENTINEL_PAYLOAD_JSON_CHARS = 2500;
 const SENTINEL_CALLBACK_WAKE_REASON = "cron:sentinel-callback";
 const SENTINEL_CALLBACK_CONTEXT_KEY = "cron:sentinel-callback";
-const HEARTBEAT_ACK_TOKEN_PATTERN = /\bHEARTBEAT_OK\b/gi;
-const SENTINEL_EVENT_INSTRUCTION_PREFIX = "SENTINEL_TRIGGER: This system event came from /hooks/sentinel. Evaluate action policy, decide whether to notify configured deliveryTargets, and execute safe follow-up actions.";
+const RESERVED_CONTROL_TOKEN_PATTERN = /\b(?:NO[\s_-]*REPLY|HEARTBEAT[\s_-]*OK)\b/gi;
+const SENTINEL_EVENT_INSTRUCTION_PREFIX = "SENTINEL_TRIGGER: This system event came from /hooks/sentinel. Use watcher + payload context to decide safe follow-up actions and produce a user-facing response.";
 const SUPPORTED_DELIVERY_CHANNELS = new Set([
     "telegram",
     "discord",
@@ -43,20 +44,48 @@ function asIsoString(value) {
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
+function sniffGatewayDispatchToken(configRoot) {
+    if (!configRoot)
+        return undefined;
+    const auth = isRecord(configRoot.auth) ? configRoot.auth : undefined;
+    const gateway = isRecord(configRoot.gateway) ? configRoot.gateway : undefined;
+    const gatewayAuth = gateway && isRecord(gateway.auth) ? gateway.auth : undefined;
+    const server = isRecord(configRoot.server) ? configRoot.server : undefined;
+    const serverAuth = server && isRecord(server.auth) ? server.auth : undefined;
+    const candidates = [
+        auth?.token,
+        gateway?.authToken,
+        gatewayAuth?.token,
+        serverAuth?.token,
+        configRoot.gatewayAuthToken,
+        configRoot.authToken,
+    ];
+    for (const candidate of candidates) {
+        const token = asString(candidate);
+        if (token)
+            return token;
+    }
+    return undefined;
+}
 function resolveSentinelPluginConfig(api) {
     const pluginConfig = isRecord(api.pluginConfig)
-        ? api.pluginConfig
+        ? { ...api.pluginConfig }
         : {};
     const configRoot = isRecord(api.config) ? api.config : undefined;
     const legacyRootConfig = configRoot?.sentinel;
-    if (legacyRootConfig === undefined)
-        return pluginConfig;
-    api.logger?.warn?.('[openclaw-sentinel] Detected deprecated root-level config key "sentinel". Move settings to plugins.entries.openclaw-sentinel.config. Root-level "sentinel" may fail with: Unrecognized key: "sentinel".');
-    if (!isRecord(legacyRootConfig))
-        return pluginConfig;
-    if (Object.keys(pluginConfig).length > 0)
-        return pluginConfig;
-    return legacyRootConfig;
+    let resolved = pluginConfig;
+    if (legacyRootConfig !== undefined) {
+        api.logger?.warn?.('[openclaw-sentinel] Detected deprecated root-level config key "sentinel". Move settings to plugins.entries.openclaw-sentinel.config. Root-level "sentinel" may fail with: Unrecognized key: "sentinel".');
+        if (isRecord(legacyRootConfig) && Object.keys(pluginConfig).length === 0) {
+            resolved = { ...legacyRootConfig };
+        }
+    }
+    if (!asString(resolved.dispatchAuthToken)) {
+        const sniffedToken = sniffGatewayDispatchToken(configRoot);
+        if (sniffedToken)
+            resolved.dispatchAuthToken = sniffedToken;
+    }
+    return resolved;
 }
 function isDeliveryTarget(value) {
     return (isRecord(value) &&
@@ -136,25 +165,26 @@ function extractDeliveryContext(payload) {
         context.deliveryTargets = deliveryTargets;
     return Object.keys(context).length > 0 ? context : undefined;
 }
+function asBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
 function buildSentinelEventEnvelope(payload) {
+    const watcherRecord = isRecord(payload.watcher) ? payload.watcher : undefined;
+    const triggerRecord = isRecord(payload.trigger) ? payload.trigger : undefined;
     const watcherId = asString(payload.watcherId) ??
-        getNestedString(payload, ["watcher", "id"]) ??
+        asString(watcherRecord?.id) ??
         getNestedString(payload, ["context", "watcherId"]);
     const eventName = asString(payload.eventName) ??
-        getNestedString(payload, ["watcher", "eventName"]) ??
+        asString(watcherRecord?.eventName) ??
         getNestedString(payload, ["event", "name"]);
     const skillId = asString(payload.skillId) ??
-        getNestedString(payload, ["watcher", "skillId"]) ??
+        asString(watcherRecord?.skillId) ??
         getNestedString(payload, ["context", "skillId"]) ??
         undefined;
     const matchedAt = asIsoString(payload.matchedAt) ??
         asIsoString(payload.timestamp) ??
-        asIsoString(getNestedString(payload, ["trigger", "matchedAt"])) ??
+        asIsoString(triggerRecord?.matchedAt) ??
         new Date().toISOString();
-    const rawPayload = payload.payload ??
-        (isRecord(payload.event) ? (payload.event.payload ?? payload.event.data) : undefined) ??
-        payload;
-    const boundedPayload = clipPayloadForPrompt(rawPayload);
     const dedupeSeed = JSON.stringify({
         watcherId: watcherId ?? null,
         eventName: eventName ?? null,
@@ -164,8 +194,15 @@ function buildSentinelEventEnvelope(payload) {
     const dedupeKey = asString(payload.dedupeKey) ??
         asString(payload.correlationId) ??
         asString(payload.correlationID) ??
-        getNestedString(payload, ["trigger", "dedupeKey"]) ??
+        asString(triggerRecord?.dedupeKey) ??
         generatedDedupe;
+    const rawPayload = payload.payload ??
+        (isRecord(payload.event) ? (payload.event.payload ?? payload.event.data) : undefined) ??
+        payload;
+    const rawContext = payload.context ??
+        (isRecord(rawPayload) ? rawPayload.context : undefined) ??
+        (isRecord(payload.event) ? payload.event.context : undefined) ??
+        null;
     const deliveryTargets = Array.isArray(payload.deliveryTargets)
         ? payload.deliveryTargets.filter(isDeliveryTarget)
         : undefined;
@@ -173,13 +210,41 @@ function buildSentinelEventEnvelope(payload) {
     const sourcePlugin = getNestedString(payload, ["source", "plugin"]) ?? "openclaw-sentinel";
     const hookSessionGroup = asString(payload.hookSessionGroup) ??
         asString(payload.sessionGroup) ??
-        getNestedString(payload, ["watcher", "sessionGroup"]);
+        asString(watcherRecord?.sessionGroup);
     const deliveryContext = extractDeliveryContext(payload);
+    const watcherIntent = asString(payload.intent) ?? asString(watcherRecord?.intent) ?? null;
+    const watcherStrategy = asString(watcherRecord?.strategy) ?? asString(payload.strategy) ?? null;
+    const watcherEndpoint = asString(watcherRecord?.endpoint) ?? asString(payload.endpoint) ?? null;
+    const watcherMatch = asString(watcherRecord?.match) ?? asString(payload.match) ?? null;
+    const watcherConditions = Array.isArray(watcherRecord?.conditions)
+        ? watcherRecord.conditions
+        : Array.isArray(payload.conditions)
+            ? payload.conditions
+            : [];
+    const watcherFireOnce = asBoolean(watcherRecord?.fireOnce ?? payload.fireOnce) ?? null;
+    const triggerPriority = asString(payload.priority) ?? asString(triggerRecord?.priority) ?? null;
     const envelope = {
         watcherId: watcherId ?? null,
         eventName: eventName ?? null,
         matchedAt,
-        payload: boundedPayload,
+        watcher: {
+            id: watcherId ?? null,
+            skillId: skillId ?? null,
+            eventName: eventName ?? null,
+            intent: watcherIntent,
+            strategy: watcherStrategy,
+            endpoint: watcherEndpoint,
+            match: watcherMatch,
+            conditions: watcherConditions,
+            fireOnce: watcherFireOnce,
+        },
+        trigger: {
+            matchedAt,
+            dedupeKey,
+            priority: triggerPriority,
+        },
+        context: clipPayloadForPrompt(rawContext),
+        payload: clipPayloadForPrompt(rawPayload),
         dedupeKey,
         correlationId: dedupeKey,
         source: {
@@ -198,8 +263,26 @@ function buildSentinelEventEnvelope(payload) {
     return envelope;
 }
 function buildSentinelSystemEvent(envelope) {
-    const jsonEnvelope = JSON.stringify(envelope, null, 2);
-    const text = `${SENTINEL_EVENT_INSTRUCTION_PREFIX}\nSENTINEL_ENVELOPE_JSON:\n${jsonEnvelope}`;
+    const callbackContext = {
+        watcher: envelope.watcher,
+        trigger: envelope.trigger,
+        source: envelope.source,
+        deliveryTargets: envelope.deliveryTargets ?? [],
+        deliveryContext: envelope.deliveryContext ?? null,
+        context: envelope.context,
+        payload: envelope.payload,
+    };
+    const text = [
+        SENTINEL_EVENT_INSTRUCTION_PREFIX,
+        "Callback handling requirements:",
+        "- Base actions on watcher intent/event/skill plus the callback context and payload.",
+        "- Return a concise user-facing response that reflects what triggered and what to do next.",
+        "- Never emit control tokens such as NO_REPLY or HEARTBEAT_OK.",
+        "SENTINEL_CALLBACK_CONTEXT_JSON:",
+        JSON.stringify(callbackContext, null, 2),
+        "SENTINEL_ENVELOPE_JSON:",
+        JSON.stringify(envelope, null, 2),
+    ].join("\n");
     return trimText(text, MAX_SENTINEL_WEBHOOK_TEXT_CHARS);
 }
 function normalizeDeliveryTargets(targets) {
@@ -300,9 +383,11 @@ function summarizeContext(value) {
 function buildRelayMessage(envelope) {
     const title = envelope.eventName ? `Sentinel alert: ${envelope.eventName}` : "Sentinel alert";
     const watcher = envelope.watcherId ? `watcher ${envelope.watcherId}` : "watcher unknown";
-    const payloadRecord = isRecord(envelope.payload) ? envelope.payload : undefined;
-    const contextSummary = summarizeContext(payloadRecord && isRecord(payloadRecord.context) ? payloadRecord.context : payloadRecord);
+    const intent = envelope.watcher.intent ? `intent ${envelope.watcher.intent}` : undefined;
+    const contextSummary = summarizeContext(envelope.context) ?? summarizeContext(envelope.payload);
     const lines = [title, `${watcher} · ${envelope.matchedAt}`];
+    if (intent)
+        lines.push(intent);
     if (contextSummary)
         lines.push(contextSummary);
     const text = lines.join("\n").trim();
@@ -310,12 +395,25 @@ function buildRelayMessage(envelope) {
         ? text
         : "Sentinel callback received, but no assistant detail was generated.";
 }
+function normalizeControlTokenCandidate(value) {
+    return value.replace(/[^a-zA-Z]/g, "").toUpperCase();
+}
+function sanitizeAssistantRelaySegment(value) {
+    if (typeof value !== "string")
+        return "";
+    const tokenCandidate = normalizeControlTokenCandidate(value.trim());
+    if (tokenCandidate === "NOREPLY" || tokenCandidate === "HEARTBEATOK")
+        return "";
+    const withoutTokens = value.replace(RESERVED_CONTROL_TOKEN_PATTERN, " ").trim();
+    if (!withoutTokens)
+        return "";
+    const collapsed = withoutTokens.replace(/\s+/g, " ").trim();
+    return /[a-zA-Z0-9]/.test(collapsed) ? collapsed : "";
+}
 function normalizeAssistantRelayText(assistantTexts) {
     if (!Array.isArray(assistantTexts) || assistantTexts.length === 0)
         return undefined;
-    const parts = assistantTexts
-        .map((value) => value.replace(HEARTBEAT_ACK_TOKEN_PATTERN, "").trim())
-        .filter(Boolean);
+    const parts = assistantTexts.map(sanitizeAssistantRelaySegment).filter(Boolean);
     if (parts.length === 0)
         return undefined;
     return trimText(parts.join("\n\n"), MAX_SENTINEL_WEBHOOK_TEXT_CHARS);
@@ -334,9 +432,12 @@ function resolveHookResponseFallbackMode(config) {
     return config.hookResponseFallbackMode === "none" ? "none" : DEFAULT_HOOK_RESPONSE_FALLBACK_MODE;
 }
 function buildIsolatedHookSessionKey(envelope, config) {
-    const rawPrefix = asString(config.hookSessionKey) ??
-        asString(config.hookSessionPrefix) ??
-        DEFAULT_HOOK_SESSION_PREFIX;
+    const configuredPrefix = asString(config.hookSessionPrefix);
+    const legacyPrefix = asString(config.hookSessionKey);
+    const hasCustomPrefix = typeof configuredPrefix === "string" && configuredPrefix !== DEFAULT_HOOK_SESSION_PREFIX;
+    const rawPrefix = hasCustomPrefix
+        ? configuredPrefix
+        : (legacyPrefix ?? configuredPrefix ?? DEFAULT_HOOK_SESSION_PREFIX);
     const prefix = rawPrefix.replace(/:+$/g, "");
     const group = asString(envelope.hookSessionGroup) ?? asString(config.hookSessionGroup);
     if (group) {
@@ -350,10 +451,28 @@ function buildIsolatedHookSessionKey(envelope, config) {
     }
     return `${prefix}:event:unknown`;
 }
+function assertJsonContentType(req) {
+    const raw = req.headers["content-type"];
+    const header = Array.isArray(raw) ? raw[0] : raw;
+    if (!header)
+        return;
+    const normalized = header.toLowerCase();
+    const isJson = normalized.includes("application/json") ||
+        normalized.includes("application/cloudevents+json") ||
+        normalized.includes("+json");
+    if (!isJson) {
+        throw new Error(`Unsupported Content-Type: ${header}`);
+    }
+}
 async function readSentinelWebhookPayload(req) {
+    assertJsonContentType(req);
     const preParsed = req.body;
-    if (isRecord(preParsed))
+    if (preParsed !== undefined) {
+        if (!isRecord(preParsed)) {
+            throw new Error("Payload must be a JSON object");
+        }
         return preParsed;
+    }
     const chunks = [];
     let total = 0;
     for await (const chunk of req) {
@@ -446,21 +565,16 @@ class HookResponseRelayManager {
     recentByDedupe = new Map();
     pendingByDedupe = new Map();
     pendingQueueBySession = new Map();
+    cleanupTimer;
+    disposed = false;
     constructor(config, api) {
         this.config = config;
         this.api = api;
     }
     register(args) {
+        this.cleanup();
         const dedupeWindowMs = resolveHookResponseDedupeWindowMs(this.config);
         const now = Date.now();
-        if (dedupeWindowMs > 0) {
-            for (const [key, ts] of this.recentByDedupe.entries()) {
-                if (now - ts > dedupeWindowMs) {
-                    this.recentByDedupe.delete(key);
-                    this.pendingByDedupe.delete(key);
-                }
-            }
-        }
         const existingTs = this.recentByDedupe.get(args.dedupeKey);
         if (dedupeWindowMs > 0 &&
             typeof existingTs === "number" &&
@@ -477,6 +591,7 @@ class HookResponseRelayManager {
             };
         }
         this.recentByDedupe.set(args.dedupeKey, now);
+        this.scheduleCleanup();
         const timeoutMs = resolveHookResponseTimeoutMs(this.config);
         const fallbackMode = resolveHookResponseFallbackMode(this.config);
         if (args.relayTargets.length === 0) {
@@ -527,8 +642,7 @@ class HookResponseRelayManager {
     async handleLlmOutput(sessionKey, assistantTexts) {
         if (!sessionKey)
             return;
-        const assistantMessage = normalizeAssistantRelayText(assistantTexts);
-        if (!assistantMessage)
+        if (!Array.isArray(assistantTexts) || assistantTexts.length === 0)
             return;
         const dedupeKey = this.popNextPendingDedupe(sessionKey);
         if (!dedupeKey)
@@ -536,7 +650,70 @@ class HookResponseRelayManager {
         const pending = this.pendingByDedupe.get(dedupeKey);
         if (!pending || pending.state !== "pending")
             return;
-        await this.completeWithMessage(pending, assistantMessage, "assistant");
+        const assistantMessage = normalizeAssistantRelayText(assistantTexts);
+        if (assistantMessage) {
+            await this.completeWithMessage(pending, assistantMessage, "assistant");
+            return;
+        }
+        await this.completeWithMessage(pending, pending.fallbackMessage, "guardrail");
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        if (this.cleanupTimer) {
+            clearTimeout(this.cleanupTimer);
+            this.cleanupTimer = undefined;
+        }
+        for (const pending of this.pendingByDedupe.values()) {
+            if (pending.timer) {
+                clearTimeout(pending.timer);
+                pending.timer = undefined;
+            }
+        }
+        this.pendingByDedupe.clear();
+        this.pendingQueueBySession.clear();
+        this.recentByDedupe.clear();
+    }
+    scheduleCleanup() {
+        if (this.disposed || this.cleanupTimer)
+            return;
+        this.cleanupTimer = setTimeout(() => {
+            this.cleanupTimer = undefined;
+            this.cleanup();
+        }, HOOK_RESPONSE_RELAY_CLEANUP_INTERVAL_MS);
+        this.cleanupTimer.unref?.();
+    }
+    cleanup(now = Date.now()) {
+        const dedupeWindowMs = resolveHookResponseDedupeWindowMs(this.config);
+        if (dedupeWindowMs > 0) {
+            for (const [key, ts] of this.recentByDedupe.entries()) {
+                if (now - ts > dedupeWindowMs) {
+                    this.recentByDedupe.delete(key);
+                }
+            }
+        }
+        for (const [key, pending] of this.pendingByDedupe.entries()) {
+            const gcAfterMs = Math.max(pending.timeoutMs, dedupeWindowMs, 1_000);
+            if (pending.state !== "pending" && now - pending.createdAt > gcAfterMs) {
+                this.pendingByDedupe.delete(key);
+                this.removeFromSessionQueue(pending.sessionKey, key);
+            }
+        }
+        if (this.pendingByDedupe.size > 0 || this.recentByDedupe.size > 0) {
+            this.scheduleCleanup();
+        }
+    }
+    removeFromSessionQueue(sessionKey, dedupeKey) {
+        const queue = this.pendingQueueBySession.get(sessionKey);
+        if (!queue || queue.length === 0)
+            return;
+        const filtered = queue.filter((key) => key !== dedupeKey);
+        if (filtered.length === 0) {
+            this.pendingQueueBySession.delete(sessionKey);
+            return;
+        }
+        this.pendingQueueBySession.set(sessionKey, filtered);
     }
     popNextPendingDedupe(sessionKey) {
         const queue = this.pendingQueueBySession.get(sessionKey);
@@ -571,7 +748,12 @@ class HookResponseRelayManager {
     async completeWithMessage(pending, message, source) {
         const delivery = await deliverMessageToTargets(this.api, pending.relayTargets, message);
         this.markClosed(pending, source === "assistant" ? "completed" : "timed_out");
-        this.api.logger?.info?.(`[openclaw-sentinel] ${source === "assistant" ? "Relayed assistant response" : "Sent timeout fallback"} for dedupe=${pending.dedupeKey} delivered=${delivery.delivered} failed=${delivery.failed}`);
+        const action = source === "assistant"
+            ? "Relayed assistant response"
+            : source === "guardrail"
+                ? "Sent guardrail fallback"
+                : "Sent timeout fallback";
+        this.api.logger?.info?.(`[openclaw-sentinel] ${action} for dedupe=${pending.dedupeKey} delivered=${delivery.delivered} failed=${delivery.failed}`);
     }
     markClosed(pending, state) {
         pending.state = state;
@@ -586,7 +768,7 @@ export function createSentinelPlugin(overrides) {
     const config = {
         allowedHosts: [],
         localDispatchBase: "http://127.0.0.1:18789",
-        dispatchAuthToken: process.env.SENTINEL_DISPATCH_TOKEN,
+        dispatchAuthToken: asString(process.env.SENTINEL_DISPATCH_TOKEN),
         hookSessionPrefix: DEFAULT_HOOK_SESSION_PREFIX,
         hookRelayDedupeWindowMs: DEFAULT_RELAY_DEDUPE_WINDOW_MS,
         hookResponseTimeoutMs: DEFAULT_HOOK_RESPONSE_TIMEOUT_MS,
@@ -606,11 +788,24 @@ export function createSentinelPlugin(overrides) {
             const headers = { "content-type": "application/json" };
             if (config.dispatchAuthToken)
                 headers.authorization = `Bearer ${config.dispatchAuthToken}`;
-            await fetch(`${config.localDispatchBase}${path}`, {
+            const response = await fetch(`${config.localDispatchBase}${path}`, {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
             });
+            if (!response.ok) {
+                let responseBody = "";
+                try {
+                    responseBody = await response.text();
+                }
+                catch {
+                    responseBody = "";
+                }
+                const details = responseBody ? ` body=${trimText(responseBody, 256)}` : "";
+                const error = new Error(`dispatch failed with status ${response.status}${details}`);
+                error.status = response.status;
+                throw error;
+            }
         },
     });
     return {
@@ -622,11 +817,18 @@ export function createSentinelPlugin(overrides) {
             const runtimeConfig = resolveSentinelPluginConfig(api);
             if (Object.keys(runtimeConfig).length > 0)
                 Object.assign(config, runtimeConfig);
-            const hookResponseRelayManager = new HookResponseRelayManager(config, api);
-            if (typeof api.on === "function") {
-                api.on("llm_output", (event, ctx) => {
-                    void hookResponseRelayManager.handleLlmOutput(ctx?.sessionKey, event.assistantTexts);
-                });
+            config.dispatchAuthToken = asString(config.dispatchAuthToken);
+            manager.setLogger(api.logger);
+            if (Array.isArray(config.allowedHosts) && config.allowedHosts.length === 0) {
+                api.logger?.warn?.("[openclaw-sentinel] allowedHosts is empty. Watcher creation will fail until at least one host is configured.");
+            }
+            const hasLegacyHookSessionKey = !!asString(config.hookSessionKey);
+            const hasCustomHookSessionPrefix = !!asString(config.hookSessionPrefix) &&
+                asString(config.hookSessionPrefix) !== DEFAULT_HOOK_SESSION_PREFIX;
+            if (hasLegacyHookSessionKey) {
+                api.logger?.warn?.(hasCustomHookSessionPrefix
+                    ? "[openclaw-sentinel] hookSessionKey is deprecated and ignored when hookSessionPrefix is set. Remove hookSessionKey from config."
+                    : "[openclaw-sentinel] hookSessionKey is deprecated. Rename it to hookSessionPrefix.");
             }
             manager.setNotifier({
                 async notify(target, message) {
@@ -648,6 +850,12 @@ export function createSentinelPlugin(overrides) {
                 manager.setWebhookRegistrationStatus("ok", "Route already registered (idempotent)", path);
                 return;
             }
+            const hookResponseRelayManager = new HookResponseRelayManager(config, api);
+            if (typeof api.on === "function") {
+                api.on("llm_output", (event, ctx) => {
+                    void hookResponseRelayManager.handleLlmOutput(ctx?.sessionKey, event.assistantTexts);
+                });
+            }
             try {
                 api.registerHttpRoute({
                     path,
@@ -693,7 +901,14 @@ export function createSentinelPlugin(overrides) {
                             const message = String(err?.message ?? err);
                             const badRequest = message.includes("Invalid JSON payload") ||
                                 message.includes("Payload must be a JSON object");
-                            const status = message.includes("too large") ? 413 : badRequest ? 400 : 500;
+                            const unsupportedMediaType = message.includes("Unsupported Content-Type");
+                            const status = message.includes("too large")
+                                ? 413
+                                : unsupportedMediaType
+                                    ? 415
+                                    : badRequest
+                                        ? 400
+                                        : 500;
                             res.writeHead(status, { "content-type": "application/json" });
                             res.end(JSON.stringify({ error: message }));
                         }
@@ -704,6 +919,7 @@ export function createSentinelPlugin(overrides) {
                 api.logger?.info?.(`[openclaw-sentinel] Registered default webhook route ${path}`);
             }
             catch (err) {
+                hookResponseRelayManager.dispose();
                 const msg = `Failed to register default webhook route ${path}: ${String(err?.message ?? err)}`;
                 manager.setWebhookRegistrationStatus("error", msg, path);
                 api.logger?.error?.(`[openclaw-sentinel] ${msg}`);
@@ -719,8 +935,8 @@ const sentinelPlugin = {
     configSchema: sentinelConfigSchema,
     register(api) {
         const plugin = createSentinelPlugin(api.pluginConfig);
-        void plugin.init();
         plugin.register(api);
+        void plugin.init();
     },
 };
 export const register = sentinelPlugin.register.bind(sentinelPlugin);

package/dist/strategies/httpLongPoll.js

@@ -1,29 +1,55 @@
+function isAbortError(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.name === "AbortError" || err.message.toLowerCase().includes("aborted");
+}
 export const httpLongPollStrategy = async (watcher, onPayload, onError) => {
     let active = true;
+    let inFlightAbort;
     const loop = async () => {
         while (active) {
             try {
+                inFlightAbort = new AbortController();
                 const response = await fetch(watcher.endpoint, {
                     method: watcher.method ?? "GET",
                     headers: watcher.headers,
                     body: watcher.body,
-                    signal: AbortSignal.timeout(watcher.timeoutMs ?? 60000),
+                    signal: AbortSignal.any([
+                        inFlightAbort.signal,
+                        AbortSignal.timeout(watcher.timeoutMs ?? 60000),
+                    ]),
+                    redirect: "error",
                 });
                 if (!response.ok)
                     throw new Error(`http-long-poll non-2xx: ${response.status}`);
                 const contentType = response.headers.get("content-type") ?? "";
-                if (!contentType.toLowerCase().includes("json"))
+                if (!contentType.toLowerCase().includes("json")) {
                     throw new Error(`http-long-poll expected JSON, got: ${contentType || "unknown"}`);
-                await onPayload(await response.json());
+                }
+                let payload;
+                try {
+                    payload = await response.json();
+                }
+                catch (err) {
+                    throw new Error(`http-long-poll invalid JSON response: ${String(err?.message ?? err)}`);
+                }
+                await onPayload(payload);
             }
             catch (err) {
+                if (!active && isAbortError(err))
+                    return;
                 await onError(err);
                 return;
             }
+            finally {
+                inFlightAbort = undefined;
+            }
         }
     };
     void loop();
     return async () => {
         active = false;
+        inFlightAbort?.abort();
+        inFlightAbort = undefined;
     };
 };

package/dist/strategies/httpPoll.js

@@ -1,35 +1,66 @@
+function isAbortError(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.name === "AbortError" || err.message.toLowerCase().includes("aborted");
+}
 export const httpPollStrategy = async (watcher, onPayload, onError) => {
     const interval = watcher.intervalMs ?? 30000;
     let active = true;
+    let timer;
+    let inFlightAbort;
     const tick = async () => {
         if (!active)
             return;
         try {
+            inFlightAbort = new AbortController();
             const response = await fetch(watcher.endpoint, {
                 method: watcher.method ?? "GET",
                 headers: watcher.headers,
                 body: watcher.body,
-                signal: AbortSignal.timeout(watcher.timeoutMs ?? 15000),
+                signal: AbortSignal.any([
+                    inFlightAbort.signal,
+                    AbortSignal.timeout(watcher.timeoutMs ?? 15000),
+                ]),
+                redirect: "error",
             });
             if (!response.ok)
                 throw new Error(`http-poll non-2xx: ${response.status}`);
             const contentType = response.headers.get("content-type") ?? "";
-            if (!contentType.toLowerCase().includes("json"))
+            if (!contentType.toLowerCase().includes("json")) {
                 throw new Error(`http-poll expected JSON, got: ${contentType || "unknown"}`);
-            const payload = await response.json();
+            }
+            let payload;
+            try {
+                payload = await response.json();
+            }
+            catch (err) {
+                throw new Error(`http-poll invalid JSON response: ${String(err?.message ?? err)}`);
+            }
             await onPayload(payload);
         }
         catch (err) {
+            if (!active && isAbortError(err))
+                return;
             await onError(err);
             return;
         }
-        if (active)
-            setTimeout(() => {
+        finally {
+            inFlightAbort = undefined;
+        }
+        if (active) {
+            timer = setTimeout(() => {
                 void tick();
             }, interval);
+        }
     };
     void tick();
     return async () => {
         active = false;
+        if (timer) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+        inFlightAbort?.abort();
+        inFlightAbort = undefined;
     };
 };