@contextableai/clawg-ui 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.2.8 (2026-02-26)
+
+### Fixed
+- Remove literal `process.env` from a code comment in `http-handler.ts` that was itself triggering the security scanner — the comment documenting the v0.2.5/v0.2.6 fix contained the exact pattern the scanner flags
+
+## 0.2.7 (2026-02-18)
+
+### Fixed
+- Close open text messages before emitting `RUN_FINISHED` in `splitRunIfToolFired()` — fixes `AGUIError: Cannot send 'RUN_FINISHED' while text messages are still active` when text streaming is followed by a server-side tool call and then more text
+
 ## 0.2.6 (2026-02-10)
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contextableai/clawg-ui",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "AG-UI protocol channel plugin for OpenClaw — connect CopilotKit and AG-UI clients to your OpenClaw gateway",
   "type": "module",
   "license": "MIT",

package/src/http-handler.ts

@@ -189,7 +189,7 @@ function buildBodyFromMessages(messages: Message[]): {
 export function createAguiHttpHandler(api: OpenClawPluginApi) {
   const runtime: PluginRuntime = api.runtime;
 
-  // Resolve once at init so the per-request handler never touches process.env.
+  // Resolve once at init so the per-request handler never touches env vars.
   const gatewaySecret = resolveGatewaySecret(api);
 
   return async function handleAguiRequest(
@@ -380,6 +380,15 @@ export function createAguiHttpHandler(api: OpenClawPluginApi) {
       if (!wasToolFiredInRun(sessionKey)) {
         return;
       }
+      // Close any open text message before ending the run
+      if (messageStarted) {
+        writeEvent({
+          type: EventType.TEXT_MESSAGE_END,
+          messageId: currentMessageId,
+          runId: currentRunId,
+        });
+        messageStarted = false;
+      }
       // End the tool run
       writeEvent({
         type: EventType.RUN_FINISHED,

package/test-device-setup.md

@@ -0,0 +1,28 @@
+# Integration Test Setup
+
+To run integration tests against the local gateway:
+
+1. Initiate device pairing:
+   ```bash
+   curl -X POST http://localhost:18789/v1/clawg-ui \
+     -H "Content-Type: application/json" \
+     -d '{"messages":[{"role":"user","content":"test"}]}'
+   ```
+   
+2. Copy the pairing code from the 403 response
+
+3. Approve the device:
+   ```bash
+   openclaw pairing approve clawg-ui <pairing-code>
+   ```
+
+4. Copy the device token from step 1's response
+
+5. Run tests with the device token:
+   ```bash
+   OPENCLAW_SERVER_URL="http://localhost" \
+   OPENCLAW_GATEWAY_TOKEN="<device-token>" \
+   npm test
+   ```
+
+**Note**: The OPENCLAW_GATEWAY_TOKEN env var name is misleading in the integration tests - it should be renamed to OPENCLAW_DEVICE_TOKEN in a future update.