@dhf-openclaw/grix 0.4.10 → 0.4.13

package/dist/index.js

@@ -90,6 +90,17 @@ function resolveWsUrl(merged, agentId) {
   }
   return `ws://127.0.0.1:27189/v1/agent-api/ws?agent_id=${encodeURIComponent(agentId)}`;
 }
+function resolveAgentAPIBaseUrl(merged) {
+  const cfgBase = normalizeNonEmpty(merged.apiBaseUrl);
+  if (cfgBase) {
+    return cfgBase;
+  }
+  if (normalizeNonEmpty(merged.wsUrl)) {
+    return "";
+  }
+  const envBase = normalizeNonEmpty(process.env.GRIX_AGENT_API_BASE);
+  return envBase;
+}
 function redactAibotWsUrl(wsUrl) {
   if (!wsUrl) {
     return "";
@@ -113,6 +124,7 @@ function resolveAibotAccount(params) {
   const agentId = normalizeAgentId(merged.agentId || process.env.GRIX_AGENT_ID);
   const apiKey = normalizeNonEmpty(merged.apiKey || process.env.GRIX_API_KEY);
   const wsUrl = resolveWsUrl(merged, agentId);
+  const apiBaseUrl = resolveAgentAPIBaseUrl(merged);
   const configured = Boolean(wsUrl && agentId && apiKey);
   return {
     accountId,
@@ -120,6 +132,7 @@ function resolveAibotAccount(params) {
     enabled,
     configured,
     wsUrl,
+    apiBaseUrl,
     agentId,
     apiKey,
     config: merged
@@ -467,6 +480,9 @@ var AibotWsClient = class {
       `reconnect scheduled in ${params.delayMs}ms attempt=${params.attempt} stable=${params.stable} authRejected=${params.authRejected} penaltyFloor=${params.penaltyFloor} suppressed=${suppressed}`
     );
   }
+  shouldLogInboundPacket(cmd) {
+    return cmd !== "ping" && cmd !== "pong" && cmd !== "send_ack";
+  }
   getStatus() {
     return { ...this.status };
   }
@@ -542,9 +558,6 @@ var AibotWsClient = class {
     if (!normalizedChannel || !normalizedAccountID || !normalizedRouteSessionKey || !normalizedSessionID) {
       throw new Error("grix session_route_bind requires channel/account_id/route_session_key/session_id");
     }
-    this.logInfo(
-      `session_route_bind request channel=${normalizedChannel} accountId=${normalizedAccountID} routeSessionKey=${normalizedRouteSessionKey} sessionId=${normalizedSessionID}`
-    );
     const packet = await this.request(
       "session_route_bind",
       {
@@ -564,9 +577,6 @@ var AibotWsClient = class {
       );
       throw this.packetError(packet);
     }
-    this.logInfo(
-      `session_route_bind ack channel=${normalizedChannel} accountId=${normalizedAccountID} routeSessionKey=${normalizedRouteSessionKey} sessionId=${normalizedSessionID}`
-    );
     return packet.payload;
   }
   async resolveSessionRoute(channel, accountId, routeSessionKey, opts = {}) {
@@ -577,9 +587,6 @@ var AibotWsClient = class {
     if (!normalizedChannel || !normalizedAccountID || !normalizedRouteSessionKey) {
       throw new Error("grix session_route_resolve requires channel/account_id/route_session_key");
     }
-    this.logInfo(
-      `session_route_resolve request channel=${normalizedChannel} accountId=${normalizedAccountID} routeSessionKey=${normalizedRouteSessionKey}`
-    );
     const packet = await this.request(
       "session_route_resolve",
       {
@@ -603,9 +610,6 @@ var AibotWsClient = class {
     if (!normalizedSessionID) {
       throw new Error("grix session_route_resolve ack missing session_id");
     }
-    this.logInfo(
-      `session_route_resolve ack channel=${normalizedChannel} accountId=${normalizedAccountID} routeSessionKey=${normalizedRouteSessionKey} sessionId=${normalizedSessionID}`
-    );
     return {
       ...payload,
       channel: String(payload.channel ?? normalizedChannel),
@@ -1058,7 +1062,7 @@ var AibotWsClient = class {
     }
     const cmd = String(packet.cmd ?? "").trim();
     const seq = Number(packet.seq ?? 0);
-    if (cmd !== "ping") {
+    if (this.shouldLogInboundPacket(cmd)) {
       this.logInfo(
         `inbound packet conn=${resolvedConnSerial} cmd=${cmd || "-"} seq=${seq} bytes=${text.length}`
       );
@@ -3656,9 +3660,6 @@ async function deliverAibotStreamBlock(params) {
     messageSid: params.messageSid,
     clientMsgId: params.clientMsgId
   });
-  params.runtime.log(
-    `[grix:${params.account.accountId}] stream block split into ${chunks.length} chunk(s) ${context} textLen=${params.text.length} chunkDelayMs=${chunkDelayMs}`
-  );
   for (let index = 0; index < chunks.length; index++) {
     if (params.abortSignal?.aborted) {
       params.runtime.log(
@@ -3671,9 +3672,6 @@ async function deliverAibotStreamBlock(params) {
     if (!normalized) {
       continue;
     }
-    params.runtime.log(
-      `[grix:${params.account.accountId}] stream chunk send ${context} chunkIndex=${index + 1}/${chunks.length} deltaLen=${normalized.length}`
-    );
     await params.client.sendStreamChunk(params.sessionId, normalized, {
       eventId: params.eventId,
       clientMsgId: params.clientMsgId,
@@ -3726,9 +3724,6 @@ async function bindSessionRouteMapping(params) {
     return;
   }
   try {
-    params.runtime.log(
-      `[grix:${params.account.accountId}] session route bind begin routeSessionKey=${routeSessionKey} sessionId=${sessionId}`
-    );
     await params.client.bindSessionRoute(
       "grix",
       params.account.accountId,
@@ -3958,9 +3953,6 @@ async function processEvent(params) {
     sessionId,
     controller: runAbortController
   });
-  runtime2.log(
-    `[grix:${account.accountId}] active reply run registered eventId=${eventId || `${sessionId}:${messageSid}`} sessionId=${sessionId} messageSid=${messageSid} activeRun=${activeRun ? "true" : "false"}`
-  );
   try {
     const route = core.channel.routing.resolveAgentRoute({
       cfg: config,
@@ -4186,22 +4178,10 @@ async function processEvent(params) {
           }
           hasSentBlock = false;
           try {
-            const finishContext = buildEventLogContext({
-              eventId,
-              sessionId,
-              messageSid,
-              clientMsgId: streamClientMsgId
-            });
             const finishDelayMs = resolveStreamFinishDelayMs(account);
             if (finishDelayMs > 0) {
-              runtime2.log(
-                `[grix:${account.accountId}] stream finish delay ${finishContext} delayMs=${finishDelayMs}`
-              );
               await sleep2(finishDelayMs);
             }
-            runtime2.log(
-              `[grix:${account.accountId}] stream finish ${finishContext}`
-            );
             await client.sendStreamChunk(sessionId, "", {
               eventId,
               clientMsgId: streamClientMsgId,
@@ -4235,9 +4215,12 @@ async function processEvent(params) {
                 clientMsgId: info.kind === "block" ? streamClientMsgId : `reply_${messageSid}_${outboundCounter}`,
                 outboundCounter
               });
-              runtime2.log(
-                `[grix:${account.accountId}] deliver ${deliverContext} kind=${info.kind} textLen=${text.length} hasMedia=${hasMedia} streamedBefore=${streamedTextAlreadyVisible}`
-              );
+              const isStreamBlock = info.kind === "block" && !guardedText && !hasMedia && text.length > 0;
+              if (!isStreamBlock) {
+                runtime2.log(
+                  `[grix:${account.accountId}] deliver ${deliverContext} kind=${info.kind} textLen=${text.length} hasMedia=${hasMedia} streamedBefore=${streamedTextAlreadyVisible}`
+                );
+              }
               if (guardedText) {
                 runtime2.error(
                   `[grix:${account.accountId}] rewrite internal reply text ${deliverContext} code=${guardedText.code} raw=${JSON.stringify(guardedText.rawText)}`
@@ -4256,7 +4239,7 @@ async function processEvent(params) {
                 );
                 return;
               }
-              if (info.kind === "block" && !guardedText && !hasMedia && text) {
+              if (isStreamBlock) {
                 const didSendBlock = await deliverAibotStreamBlock({
                   text,
                   client,
@@ -4407,7 +4390,7 @@ async function processEvent(params) {
     }
   } finally {
     runtime2.log(
-      `[grix:${account.accountId}] active reply run clearing eventId=${activeRun?.eventId || "-"} sessionId=${activeRun?.sessionId || sessionId} stopRequested=${activeRun?.stopRequested === true} abortReason=${activeRun ? resolveAbortReason(activeRun.controller.signal) : "-"} visibleOutputSent=${visibleOutputSent}`
+      `[grix:${account.accountId}] active reply run clearing eventId=${activeRun?.eventId || "-"} stopRequested=${activeRun?.stopRequested === true} abortReason=${activeRun ? resolveAbortReason(activeRun.controller.signal) : "-"} visibleOutputSent=${visibleOutputSent}`
     );
     clearActiveReplyRun(activeRun);
     if (!inboundEventAccepted) {
@@ -4602,7 +4585,7 @@ var meta = {
   label: "Grix",
   selectionLabel: "Grix",
   docsPath: "/channels/grix",
-  blurb: "Connect OpenClaw to grix.dhf.pub for OpenClaw website management with mobile PWA support.",
+  blurb: "Connect OpenClaw to a Grix deployment for website management with mobile PWA support.",
   aliases: ["gr"],
   order: 90
 };
@@ -4715,6 +4698,7 @@ var aibotPlugin = {
       clearBaseFields: [
         "name",
         "wsUrl",
+        "apiBaseUrl",
         "agentId",
         "apiKey",
         "reconnectMs",
@@ -5309,6 +5293,17 @@ function buildGroupMemberAddRequest(params) {
     body
   };
 }
+function buildGroupLeaveSelfRequest(params) {
+  const sessionID = readRequiredStringParam(params, "sessionId");
+  return {
+    actionName: "group_leave_self",
+    method: "POST",
+    path: "/sessions/leave",
+    body: {
+      session_id: sessionID
+    }
+  };
+}
 function buildGroupMemberRemoveRequest(params) {
   const sessionID = readRequiredStringParam(params, "sessionId");
   const memberIDs = readNumericIDArray(params, "memberIds", true);
@@ -5516,6 +5511,8 @@ function buildAgentHTTPRequest(action, params) {
       return buildMessageHistoryRequest(params);
     case "group_create":
       return buildGroupCreateRequest(params);
+    case "group_leave_self":
+      return buildGroupLeaveSelfRequest(params);
     case "group_member_add":
       return buildGroupMemberAddRequest(params);
     case "group_member_remove":
@@ -5539,13 +5536,19 @@ function buildAgentHTTPRequest(action, params) {
 
 // src/admin/agent-api-http.ts
 var DEFAULT_HTTP_TIMEOUT_MS = 15e3;
+var MAX_LOG_KEYS = 8;
+var MAX_LOG_PAYLOAD_CHARS = 1200;
 function trimTrailingSlash(value) {
   return value.replace(/\/+$/, "");
 }
+function logAgentAPIInfo(message) {
+  console.info(`[grix:agent-api] ${message}`);
+}
+function logAgentAPIError(message) {
+  console.error(`[grix:agent-api] ${message}`);
+}
 function resolveExplicitAgentAPIBase() {
-  const base = String(
-    process.env.GRIX_AGENT_API_BASE ?? process.env.AIBOT_AGENT_API_BASE ?? ""
-  ).trim();
+  const base = String(process.env.GRIX_AGENT_API_BASE ?? "").trim();
   if (!base) {
     return "";
   }
@@ -5595,16 +5598,39 @@ function deriveLocalAgentAPIBaseFromWsUrl(wsUrl) {
   const protocol = parsed.protocol === "wss:" ? "https:" : "http:";
   return trimTrailingSlash(`${protocol}//${parsed.hostname}:${apiPort}`) + "/v1/agent-api";
 }
-function resolveAgentAPIBase(account) {
-  const explicit = resolveExplicitAgentAPIBase();
-  if (explicit) {
-    return explicit;
+function resolveAgentAPIBaseInfo(account) {
+  const accountBase = trimTrailingSlash(String(account.apiBaseUrl ?? "").trim());
+  if (accountBase) {
+    return {
+      base: accountBase,
+      source: "account_api_base_url"
+    };
   }
-  const local = deriveLocalAgentAPIBaseFromWsUrl(account.wsUrl);
+  const normalizedWsUrl = String(account.wsUrl ?? "").trim();
+  const local = deriveLocalAgentAPIBaseFromWsUrl(normalizedWsUrl);
   if (local) {
-    return local;
+    return {
+      base: local,
+      source: "local_ws_url"
+    };
+  }
+  if (normalizedWsUrl) {
+    return {
+      base: deriveAgentAPIBaseFromWsUrl(normalizedWsUrl),
+      source: "derived_from_ws_url"
+    };
+  }
+  const explicit = resolveExplicitAgentAPIBase();
+  if (explicit) {
+    return {
+      base: explicit,
+      source: "env_grix_agent_api_base"
+    };
   }
-  return deriveAgentAPIBaseFromWsUrl(account.wsUrl);
+  return {
+    base: deriveAgentAPIBaseFromWsUrl(normalizedWsUrl),
+    source: "derived_from_ws_url"
+  };
 }
 function buildRequestURL(base, path, query) {
   const normalizedPath = path.startsWith("/") ? path : `/${path}`;
@@ -5647,10 +5673,105 @@ function extractNetworkErrorMessage(error) {
   }
   return String(error);
 }
+function buildAPIKeyState(apiKey) {
+  const normalized = String(apiKey ?? "").trim();
+  if (!normalized) {
+    return "empty";
+  }
+  return "present";
+}
+function summarizePayloadKeys(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return "none";
+  }
+  const keys = Object.keys(payload).map((k) => String(k).trim()).filter(Boolean).sort();
+  if (!keys.length) {
+    return "none";
+  }
+  const limited = keys.slice(0, MAX_LOG_KEYS);
+  if (keys.length <= MAX_LOG_KEYS) {
+    return limited.join(",");
+  }
+  return `${limited.join(",")}...(total=${keys.length})`;
+}
+function summarizePayloadBytes(payload) {
+  try {
+    return String(Buffer.byteLength(JSON.stringify(payload ?? {}), "utf8"));
+  } catch {
+    return "unknown";
+  }
+}
+function isSensitiveLogKey(key) {
+  const normalized = String(key ?? "").trim().toLowerCase();
+  return normalized.includes("api_key") || normalized.includes("apikey") || normalized.includes("token") || normalized.includes("authorization") || normalized.includes("password") || normalized.includes("secret");
+}
+function sanitizePayloadForLog(payload, depth = 0) {
+  if (depth >= 5) {
+    return "[max-depth]";
+  }
+  if (payload == null) {
+    return payload;
+  }
+  if (typeof payload === "string" || typeof payload === "number" || typeof payload === "boolean") {
+    return payload;
+  }
+  if (Array.isArray(payload)) {
+    return payload.map((item) => sanitizePayloadForLog(item, depth + 1));
+  }
+  if (typeof payload === "object") {
+    const raw = payload;
+    const sanitized = {};
+    for (const [key, value] of Object.entries(raw)) {
+      sanitized[key] = isSensitiveLogKey(key) ? "<redacted>" : sanitizePayloadForLog(value, depth + 1);
+    }
+    return sanitized;
+  }
+  return String(payload);
+}
+function stringifyPayloadForLog(payload) {
+  let json = "";
+  try {
+    json = JSON.stringify(sanitizePayloadForLog(payload));
+  } catch {
+    return '"[unserializable]"';
+  }
+  if (!json) {
+    return "{}";
+  }
+  if (json.length <= MAX_LOG_PAYLOAD_CHARS) {
+    return json;
+  }
+  return `${json.slice(0, MAX_LOG_PAYLOAD_CHARS)}...(truncated,len=${json.length})`;
+}
+function buildRequestLogContext(params, context) {
+  const queryPayload = params.query ?? {};
+  const bodyPayload = params.method === "POST" ? params.body ?? {} : {};
+  return [
+    `action=${params.actionName}`,
+    `account=${params.account.accountId}`,
+    `agent=${params.account.agentId}`,
+    `method=${params.method}`,
+    `source=${context.resolvedBase.source}`,
+    `url=${context.url}`,
+    `timeout_ms=${context.timeoutMs}`,
+    `api_key=${buildAPIKeyState(params.account.apiKey)}`,
+    `query_keys=${summarizePayloadKeys(queryPayload)}`,
+    `query_payload=${JSON.stringify(stringifyPayloadForLog(queryPayload))}`,
+    `body_keys=${summarizePayloadKeys(bodyPayload)}`,
+    `body_payload=${JSON.stringify(stringifyPayloadForLog(bodyPayload))}`,
+    `body_bytes=${summarizePayloadBytes(bodyPayload)}`
+  ].join(" ");
+}
 async function callAgentAPI(params) {
-  const base = resolveAgentAPIBase(params.account);
-  const url = buildRequestURL(base, params.path, params.query);
+  const resolvedBase = resolveAgentAPIBaseInfo(params.account);
+  const url = buildRequestURL(resolvedBase.base, params.path, params.query);
   const timeoutMs = Number.isFinite(params.timeoutMs) ? Math.max(1e3, Math.floor(params.timeoutMs)) : DEFAULT_HTTP_TIMEOUT_MS;
+  const requestLogContext = buildRequestLogContext(params, {
+    resolvedBase,
+    url,
+    timeoutMs
+  });
+  logAgentAPIInfo(`request ${requestLogContext}`);
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   let resp;
@@ -5666,6 +5787,9 @@ async function callAgentAPI(params) {
     });
   } catch (error) {
     clearTimeout(timer);
+    logAgentAPIError(
+      `network_error ${requestLogContext} error=${JSON.stringify(extractNetworkErrorMessage(error))}`
+    );
     throw new Error(
       `Grix ${params.actionName} network error: ${extractNetworkErrorMessage(error)}`
     );
@@ -5677,6 +5801,9 @@ async function callAgentAPI(params) {
   try {
     envelope = JSON.parse(rawBody);
   } catch {
+    logAgentAPIError(
+      `invalid_response ${requestLogContext} status=${status} raw_len=${rawBody.length}`
+    );
     throw new Error(
       `Grix ${params.actionName} invalid response: status=${status} body=${rawBody.slice(0, 256)}`
     );
@@ -5684,13 +5811,41 @@ async function callAgentAPI(params) {
   const bizCode = normalizeBizCode(envelope.code);
   if (!resp.ok || bizCode !== 0) {
     const message = normalizeMessage(envelope.msg);
+    logAgentAPIError(
+      `failed ${requestLogContext} status=${status} code=${bizCode} msg=${message} has_data=${envelope.data == null ? "false" : "true"}`
+    );
     throw new Error(
       `Grix ${params.actionName} failed: status=${status} code=${bizCode} msg=${message}`
     );
   }
+  logAgentAPIInfo(`success ${requestLogContext} status=${status}`);
   return envelope.data;
 }
 
+// src/admin/account-binding.ts
+function normalizeNonEmpty2(value) {
+  const normalized = String(value ?? "").trim();
+  return normalized || void 0;
+}
+function resolveStrictToolAccountId(params) {
+  const toolAccountId = normalizeNonEmpty2(params.toolAccountId);
+  const contextAccountId = normalizeNonEmpty2(params.contextAccountId);
+  console.info(
+    `[grix:account-binding] tool=${params.toolName} request_account=${toolAccountId ?? "-"} context_account=${contextAccountId ?? "-"}`
+  );
+  if (!toolAccountId) {
+    throw new Error(
+      `[${params.toolName}] accountId is required. Pass the exact accountId of the current connection.`
+    );
+  }
+  if (contextAccountId && toolAccountId !== contextAccountId) {
+    throw new Error(
+      `[${params.toolName}] accountId mismatch. request=${toolAccountId}, context=${contextAccountId}. Refusing cross-account execution.`
+    );
+  }
+  return toolAccountId;
+}
+
 // src/admin/accounts.ts
 var DEFAULT_ACCOUNT_ID2 = "default";
 function normalizeAccountId2(value) {
@@ -5711,9 +5866,24 @@ function listConfiguredAccountIds2(cfg) {
   }
   return Object.keys(accounts).filter(Boolean);
 }
-function normalizeNonEmpty2(value) {
+function normalizeNonEmpty3(value) {
   return String(value ?? "").trim();
 }
+function trimTrailingSlash2(value) {
+  return value.replace(/\/+$/, "");
+}
+function summarizeEndpoint(value) {
+  const normalized = normalizeNonEmpty3(value);
+  if (!normalized) {
+    return "-";
+  }
+  try {
+    const parsed = new URL(normalized);
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch {
+    return normalized.slice(0, 128);
+  }
+}
 function appendAgentIdToWsUrl2(rawWsUrl, agentId) {
   if (!rawWsUrl) {
     return "";
@@ -5736,8 +5906,8 @@ function appendAgentIdToWsUrl2(rawWsUrl, agentId) {
   }
 }
 function resolveWsUrl2(merged, agentId) {
-  const envWs = normalizeNonEmpty2(process.env.GRIX_WS_URL);
-  const cfgWs = normalizeNonEmpty2(merged.wsUrl);
+  const envWs = normalizeNonEmpty3(process.env.GRIX_WS_URL);
+  const cfgWs = normalizeNonEmpty3(merged.wsUrl);
   const ws = cfgWs || envWs;
   if (ws) {
     return appendAgentIdToWsUrl2(ws, agentId);
@@ -5747,6 +5917,44 @@ function resolveWsUrl2(merged, agentId) {
   }
   return `ws://127.0.0.1:27189/v1/agent-api/ws?agent_id=${encodeURIComponent(agentId)}`;
 }
+function resolveAgentAPIBaseUrl2(merged) {
+  const cfgBase = trimTrailingSlash2(normalizeNonEmpty3(merged.apiBaseUrl));
+  if (cfgBase) {
+    return cfgBase;
+  }
+  if (normalizeNonEmpty3(merged.wsUrl)) {
+    return "";
+  }
+  const envBase = trimTrailingSlash2(normalizeNonEmpty3(process.env.GRIX_AGENT_API_BASE));
+  const webBase = trimTrailingSlash2(normalizeNonEmpty3(process.env.GRIX_WEB_BASE_URL));
+  return envBase || webBase;
+}
+function resolveStrictAccountConfig(cfg, accountId) {
+  const grixCfg = rawGrixConfig(cfg);
+  const accounts = grixCfg.accounts;
+  if (!accounts || typeof accounts !== "object") {
+    console.error(
+      `[grix:account] strict lookup failed account=${accountId} reason=accounts_map_missing`
+    );
+    throw new Error(
+      `Grix account "${accountId}" is not configured under channels.grix.accounts.`
+    );
+  }
+  const configuredIds = Object.keys(accounts).filter(Boolean).sort();
+  const account = accounts[accountId];
+  if (!account || typeof account !== "object") {
+    console.error(
+      `[grix:account] strict lookup failed account=${accountId} reason=account_missing configured_accounts=${configuredIds.join(",") || "none"}`
+    );
+    throw new Error(
+      `Grix account "${accountId}" is missing under channels.grix.accounts.${accountId}.`
+    );
+  }
+  console.info(
+    `[grix:account] strict lookup account=${accountId} configured_accounts=${configuredIds.join(",") || "none"} has_ws=${normalizeNonEmpty3(account.wsUrl) ? "yes" : "no"} has_api_base=${normalizeNonEmpty3(account.apiBaseUrl) ? "yes" : "no"} has_agent_id=${normalizeNonEmpty3(account.agentId) ? "yes" : "no"} has_api_key=${normalizeNonEmpty3(account.apiKey) ? "yes" : "no"}`
+  );
+  return account;
+}
 function resolveMergedAccountConfig(cfg, accountId) {
   const grixCfg = rawGrixConfig(cfg);
   const { accounts: _ignoredAccounts, defaultAccount: _ignoredDefault, ...base } = grixCfg;
@@ -5776,21 +5984,29 @@ function resolveDefaultGrixAccountId(cfg) {
   return ids[0] ?? DEFAULT_ACCOUNT_ID2;
 }
 function resolveGrixAccount(params) {
+  const strictScope = Boolean(params.strictAccountScope);
   const accountId = params.accountId == null || String(params.accountId).trim() === "" ? resolveDefaultGrixAccountId(params.cfg) : normalizeAccountId2(params.accountId);
-  const merged = resolveMergedAccountConfig(params.cfg, accountId);
+  const merged = strictScope ? resolveStrictAccountConfig(params.cfg, accountId) : resolveMergedAccountConfig(params.cfg, accountId);
   const baseEnabled = rawGrixConfig(params.cfg).enabled !== false;
   const accountEnabled = merged.enabled !== false;
   const enabled = baseEnabled && accountEnabled;
-  const agentId = normalizeNonEmpty2(merged.agentId || process.env.GRIX_AGENT_ID);
-  const apiKey = normalizeNonEmpty2(merged.apiKey || process.env.GRIX_API_KEY);
-  const wsUrl = resolveWsUrl2(merged, agentId);
+  const agentId = strictScope ? normalizeNonEmpty3(merged.agentId) : normalizeNonEmpty3(merged.agentId || process.env.GRIX_AGENT_ID);
+  const apiKey = strictScope ? normalizeNonEmpty3(merged.apiKey) : normalizeNonEmpty3(merged.apiKey || process.env.GRIX_API_KEY);
+  const wsUrl = strictScope ? appendAgentIdToWsUrl2(normalizeNonEmpty3(merged.wsUrl), agentId) : resolveWsUrl2(merged, agentId);
+  const apiBaseUrl = strictScope ? trimTrailingSlash2(normalizeNonEmpty3(merged.apiBaseUrl)) : resolveAgentAPIBaseUrl2(merged);
   const configured = Boolean(wsUrl && agentId && apiKey);
+  if (strictScope) {
+    console.info(
+      `[grix:account] strict resolved account=${accountId} enabled=${enabled} configured=${configured} ws_endpoint=${summarizeEndpoint(wsUrl)} api_base_endpoint=${summarizeEndpoint(apiBaseUrl)} agent_id=${agentId || "-"} api_key=${apiKey ? "present" : "empty"}`
+    );
+  }
   return {
     accountId,
-    name: normalizeNonEmpty2(merged.name) || void 0,
+    name: normalizeNonEmpty3(merged.name) || void 0,
     enabled,
     configured,
     wsUrl,
+    apiBaseUrl,
     agentId,
     apiKey,
     config: merged
@@ -5805,6 +6021,7 @@ function summarizeGrixAccounts(cfg) {
       enabled: account.enabled,
       configured: account.configured,
       wsUrl: account.wsUrl || null,
+      apiBaseUrl: account.apiBaseUrl || null,
       agentId: account.agentId || null
     };
   });
@@ -5842,9 +6059,15 @@ function sanitizeCreatedAgentData(data) {
   return payload;
 }
 async function createGrixApiAgent(params) {
+  const accountId = resolveStrictToolAccountId({
+    toolName: "grix_agent_admin",
+    toolAccountId: params.toolParams.accountId,
+    contextAccountId: params.contextAccountId
+  });
   const account = resolveGrixAccount({
     cfg: params.cfg,
-    accountId: params.toolParams.accountId
+    accountId,
+    strictAccountScope: true
   });
   if (!account.enabled) {
     throw new Error(`Grix account "${account.accountId}" is disabled.`);
@@ -5968,9 +6191,10 @@ var GrixAgentAdminToolSchema = {
       required: ["actions"]
     }
   },
-  required: ["agentName", "describeMessageTool"]
+  required: ["accountId", "agentName", "describeMessageTool"]
 };
-function createGrixAgentAdminTool(api) {
+function createGrixAgentAdminTool(api, ctx) {
+  const contextAccountId = ctx?.agentAccountId;
   return {
     name: "grix_agent_admin",
     label: "Grix Agent Admin",
@@ -5981,7 +6205,8 @@ function createGrixAgentAdminTool(api) {
         return jsonToolResult(
           await createGrixApiAgent({
             cfg: api.config,
-            toolParams: params
+            toolParams: params,
+            contextAccountId
           })
         );
       } catch (err) {
@@ -6000,6 +6225,8 @@ function mapGroupActionToRequestAction(action) {
       return "group_create";
     case "detail":
       return "group_detail_read";
+    case "leave":
+      return "group_leave_self";
     case "add_members":
       return "group_member_add";
     case "remove_members":
@@ -6018,9 +6245,15 @@ function mapGroupActionToRequestAction(action) {
   }
 }
 async function runGrixGroupAction(params) {
+  const accountId = resolveStrictToolAccountId({
+    toolName: "grix_group",
+    toolAccountId: params.toolParams.accountId,
+    contextAccountId: params.contextAccountId
+  });
   const account = resolveGrixAccount({
     cfg: params.cfg,
-    accountId: params.toolParams.accountId
+    accountId,
+    strictAccountScope: true
   });
   if (!account.enabled) {
     throw new Error(`Grix account "${account.accountId}" is disabled.`);
@@ -6038,6 +6271,13 @@ async function runGrixGroupAction(params) {
     query: request.query,
     body: request.body
   });
+  if (params.toolParams.action === "leave") {
+    const d = data;
+    const left = d != null && typeof d === "object" ? d["left"] : void 0;
+    console.info(
+      `[grix:group] leave result account=${account.accountId} agent=${account.agentId} session=${String(params.toolParams.sessionId ?? "")} left=${left}`
+    );
+  }
   return {
     ok: true,
     accountId: account.accountId,
@@ -6063,7 +6303,7 @@ var GrixGroupToolSchema = {
         memberIds: { type: "array", items: numericIdSchema },
         memberTypes: { type: "array", items: { type: "integer", enum: [1, 2] } }
       },
-      required: ["action", "name"]
+      required: ["action", "accountId", "name"]
     },
     {
       type: "object",
@@ -6073,7 +6313,17 @@ var GrixGroupToolSchema = {
         accountId: { type: "string", minLength: 1 },
         sessionId: { type: "string", minLength: 1 }
       },
-      required: ["action", "sessionId"]
+      required: ["action", "accountId", "sessionId"]
+    },
+    {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        action: { const: "leave" },
+        accountId: { type: "string", minLength: 1 },
+        sessionId: { type: "string", minLength: 1 }
+      },
+      required: ["action", "accountId", "sessionId"]
     },
     {
       type: "object",
@@ -6085,7 +6335,7 @@ var GrixGroupToolSchema = {
         memberIds: { type: "array", items: numericIdSchema, minItems: 1 },
         memberTypes: { type: "array", items: { type: "integer", enum: [1, 2] } }
       },
-      required: ["action", "sessionId", "memberIds"]
+      required: ["action", "accountId", "sessionId", "memberIds"]
     },
     {
       type: "object",
@@ -6097,7 +6347,7 @@ var GrixGroupToolSchema = {
         memberIds: { type: "array", items: numericIdSchema, minItems: 1 },
         memberTypes: { type: "array", items: { type: "integer", enum: [1, 2] } }
       },
-      required: ["action", "sessionId", "memberIds"]
+      required: ["action", "accountId", "sessionId", "memberIds"]
     },
     {
       type: "object",
@@ -6110,7 +6360,7 @@ var GrixGroupToolSchema = {
         memberType: { type: "integer", enum: [1] },
         role: { type: "integer", enum: [1, 2] }
       },
-      required: ["action", "sessionId", "memberId", "role"]
+      required: ["action", "accountId", "sessionId", "memberId", "role"]
     },
     {
       type: "object",
@@ -6121,7 +6371,7 @@ var GrixGroupToolSchema = {
         sessionId: { type: "string", minLength: 1 },
         allMembersMuted: { type: "boolean" }
       },
-      required: ["action", "sessionId", "allMembersMuted"]
+      required: ["action", "accountId", "sessionId", "allMembersMuted"]
     },
     {
       type: "object",
@@ -6135,7 +6385,7 @@ var GrixGroupToolSchema = {
         isSpeakMuted: { type: "boolean" },
         canSpeakWhenAllMuted: { type: "boolean" }
       },
-      required: ["action", "sessionId", "memberId"],
+      required: ["action", "accountId", "sessionId", "memberId"],
       anyOf: [
         { required: ["isSpeakMuted"] },
         { required: ["canSpeakWhenAllMuted"] }
@@ -6149,11 +6399,12 @@ var GrixGroupToolSchema = {
         accountId: { type: "string", minLength: 1 },
         sessionId: { type: "string", minLength: 1 }
       },
-      required: ["action", "sessionId"]
+      required: ["action", "accountId", "sessionId"]
     }
   ]
 };
-function createGrixGroupTool(api) {
+function createGrixGroupTool(api, ctx) {
+  const contextAccountId = ctx?.agentAccountId;
   return {
     name: "grix_group",
     label: "Grix Group",
@@ -6164,7 +6415,8 @@ function createGrixGroupTool(api) {
         return jsonToolResult(
           await runGrixGroupAction({
             cfg: api.config,
-            toolParams: params
+            toolParams: params,
+            contextAccountId
           })
         );
       } catch (err) {
@@ -6191,9 +6443,15 @@ function mapQueryActionToRequestAction(action) {
   }
 }
 async function runGrixQueryAction(params) {
+  const accountId = resolveStrictToolAccountId({
+    toolName: "grix_query",
+    toolAccountId: params.toolParams.accountId,
+    contextAccountId: params.contextAccountId
+  });
   const account = resolveGrixAccount({
     cfg: params.cfg,
-    accountId: params.toolParams.accountId
+    accountId,
+    strictAccountScope: true
   });
   if (!account.enabled) {
     throw new Error(`Grix account "${account.accountId}" is disabled.`);
@@ -6232,7 +6490,7 @@ var GrixQueryToolSchema = {
         limit: { type: "integer", minimum: 1 },
         offset: { type: "integer", minimum: 0 }
       },
-      required: ["action", "id"]
+      required: ["action", "accountId", "id"]
     },
     {
       type: "object",
@@ -6244,7 +6502,7 @@ var GrixQueryToolSchema = {
         limit: { type: "integer", minimum: 1 },
         offset: { type: "integer", minimum: 0 }
       },
-      required: ["action", "id"]
+      required: ["action", "accountId", "id"]
     },
     {
       type: "object",
@@ -6256,11 +6514,12 @@ var GrixQueryToolSchema = {
         beforeId: { type: "string", pattern: "^[0-9]+$" },
         limit: { type: "integer", minimum: 1 }
       },
-      required: ["action", "sessionId"]
+      required: ["action", "accountId", "sessionId"]
     }
   ]
 };
-function createGrixQueryTool(api) {
+function createGrixQueryTool(api, ctx) {
+  const contextAccountId = ctx?.agentAccountId;
   return {
     name: "grix_query",
     label: "Grix Query",
@@ -6271,7 +6530,8 @@ function createGrixQueryTool(api) {
         return jsonToolResult(
           await runGrixQueryAction({
             cfg: api.config,
-            toolParams: params
+            toolParams: params,
+            contextAccountId
           })
         );
       } catch (err) {
@@ -6364,9 +6624,9 @@ var plugin = {
   register(api) {
     setAibotRuntime(api.runtime);
     api.registerChannel({ plugin: aibotPlugin });
-    api.registerTool(createGrixQueryTool(api), { optional: true });
-    api.registerTool(createGrixGroupTool(api), { optional: true });
-    api.registerTool(createGrixAgentAdminTool(api), { optional: true });
+    api.registerTool((ctx) => createGrixQueryTool(api, ctx), { optional: true });
+    api.registerTool((ctx) => createGrixGroupTool(api, ctx), { optional: true });
+    api.registerTool((ctx) => createGrixAgentAdminTool(api, ctx), { optional: true });
     api.registerCli(({ program }) => registerGrixAdminCli({ api, program }), {
       commands: ["grix"]
     });