@gguf/claw 2026.2.1 → 2026.2.3

package/dist/gateway/server-methods/skills.js

@@ -1,9 +1,10 @@
-import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../../agents/agent-scope.js";
+import { listAgentIds, resolveAgentWorkspaceDir, resolveDefaultAgentId, } from "../../agents/agent-scope.js";
 import { installSkill } from "../../agents/skills-install.js";
 import { buildWorkspaceSkillStatus } from "../../agents/skills-status.js";
 import { loadWorkspaceSkillEntries } from "../../agents/skills.js";
 import { loadConfig, writeConfigFile } from "../../config/config.js";
 import { getRemoteSkillEligibility } from "../../infra/skills-remote.js";
+import { normalizeAgentId } from "../../routing/session-key.js";
 import { ErrorCodes, errorShape, formatValidationErrors, validateSkillsBinsParams, validateSkillsInstallParams, validateSkillsStatusParams, validateSkillsUpdateParams, } from "../protocol/index.js";
 function listWorkspaceDirs(cfg) {
     const dirs = new Set();
@@ -55,7 +56,16 @@ export const skillsHandlers = {
             return;
         }
         const cfg = loadConfig();
-        const workspaceDir = resolveAgentWorkspaceDir(cfg, resolveDefaultAgentId(cfg));
+        const agentIdRaw = typeof params?.agentId === "string" ? params.agentId.trim() : "";
+        const agentId = agentIdRaw ? normalizeAgentId(agentIdRaw) : resolveDefaultAgentId(cfg);
+        if (agentIdRaw) {
+            const knownAgents = listAgentIds(cfg);
+            if (!knownAgents.includes(agentId)) {
+                respond(false, undefined, errorShape(ErrorCodes.INVALID_REQUEST, `unknown agent id "${agentIdRaw}"`));
+                return;
+            }
+        }
+        const workspaceDir = resolveAgentWorkspaceDir(cfg, agentId);
         const report = buildWorkspaceSkillStatus(workspaceDir, {
             config: cfg,
             eligibility: { remote: getRemoteSkillEligibility() },

package/dist/gateway/server-methods/types.d.ts

@@ -2,13 +2,13 @@ import type { ModelCatalogEntry } from "../../agents/model-catalog.js";
 import type { createDefaultDeps } from "../../cli/deps.js";
 import type { HealthSummary } from "../../commands/health.js";
 import type { CronService } from "../../cron/service.js";
+import type { createSubsystemLogger } from "../../logging/subsystem.js";
 import type { WizardSession } from "../../wizard/session.js";
 import type { ChatAbortControllerEntry } from "../chat-abort.js";
 import type { NodeRegistry } from "../node-registry.js";
 import type { ConnectParams, ErrorShape, RequestFrame } from "../protocol/index.js";
 import type { ChannelRuntimeSnapshot } from "../server-channels.js";
 import type { DedupeEntry } from "../server-shared.js";
-import type { createSubsystemLogger } from "../../logging/subsystem.js";
 type SubsystemLogger = ReturnType<typeof createSubsystemLogger>;
 export type GatewayClient = {
     connect: ConnectParams;

package/dist/gateway/server-methods/update.js

@@ -1,6 +1,6 @@
 import { resolveOpenClawPackageRoot } from "../../infra/openclaw-root.js";
-import { scheduleGatewaySigusr1Restart } from "../../infra/restart.js";
 import { formatDoctorNonInteractiveHint, writeRestartSentinel, } from "../../infra/restart-sentinel.js";
+import { scheduleGatewaySigusr1Restart } from "../../infra/restart.js";
 import { runGatewayUpdate } from "../../infra/update-runner.js";
 import { ErrorCodes, errorShape, formatValidationErrors, validateUpdateRunParams, } from "../protocol/index.js";
 export const updateHandlers = {

package/dist/gateway/server-methods/usage.js

@@ -1,6 +1,6 @@
 import { loadConfig } from "../../config/config.js";
-import { loadCostUsageSummary } from "../../infra/session-cost-usage.js";
 import { loadProviderUsageSummary } from "../../infra/provider-usage.js";
+import { loadCostUsageSummary } from "../../infra/session-cost-usage.js";
 const COST_USAGE_CACHE_TTL_MS = 30_000;
 const costUsageCache = new Map();
 const parseDays = (raw) => {

package/dist/gateway/server-methods-list.js

@@ -31,6 +31,9 @@ const BASE_METHODS = [
     "talk.mode",
     "models.list",
     "agents.list",
+    "agents.files.list",
+    "agents.files.get",
+    "agents.files.set",
     "skills.status",
     "skills.bins",
     "skills.install",

package/dist/gateway/server-reload-handlers.js

@@ -1,9 +1,9 @@
+import { resolveAgentMaxConcurrent, resolveSubagentMaxConcurrent } from "../config/agent-limits.js";
 import { startGmailWatcher, stopGmailWatcher } from "../hooks/gmail-watcher.js";
+import { isTruthyEnvValue } from "../infra/env.js";
 import { resetDirectoryCache } from "../infra/outbound/target-resolver.js";
 import { authorizeGatewaySigusr1Restart, setGatewaySigusr1RestartPolicy, } from "../infra/restart.js";
 import { setCommandLaneConcurrency } from "../process/command-queue.js";
-import { resolveAgentMaxConcurrent, resolveSubagentMaxConcurrent } from "../config/agent-limits.js";
-import { isTruthyEnvValue } from "../infra/env.js";
 import { resolveHooksConfig } from "./hooks.js";
 import { startBrowserControlServerIfEnabled } from "./server-browser.js";
 import { buildGatewayCronService } from "./server-cron.js";

package/dist/gateway/server-runtime-state.d.ts

@@ -1,17 +1,17 @@
 import type { Server as HttpServer } from "node:http";
 import { WebSocketServer } from "ws";
-import { type CanvasHostHandler } from "../canvas-host/server.js";
 import type { CliDeps } from "../cli/deps.js";
 import type { createSubsystemLogger } from "../logging/subsystem.js";
+import type { PluginRegistry } from "../plugins/registry.js";
 import type { RuntimeEnv } from "../runtime.js";
 import type { ResolvedGatewayAuth } from "./auth.js";
 import type { ChatAbortControllerEntry } from "./chat-abort.js";
 import type { HooksConfigResolved } from "./hooks.js";
-import type { GatewayWsClient } from "./server/ws-types.js";
-import { type ChatRunEntry, createChatRunState } from "./server-chat.js";
 import type { DedupeEntry } from "./server-shared.js";
-import type { PluginRegistry } from "../plugins/registry.js";
 import type { GatewayTlsRuntime } from "./server/tls.js";
+import type { GatewayWsClient } from "./server/ws-types.js";
+import { type CanvasHostHandler } from "../canvas-host/server.js";
+import { type ChatRunEntry, createChatRunState } from "./server-chat.js";
 export declare function createGatewayRuntimeState(params: {
     cfg: import("../config/config.js").OpenClawConfig;
     bindHost: string;

package/dist/gateway/server-runtime-state.js

@@ -1,14 +1,14 @@
 import { WebSocketServer } from "ws";
 import { CANVAS_HOST_PATH } from "../canvas-host/a2ui.js";
 import { createCanvasHostHandler } from "../canvas-host/server.js";
-import { createGatewayHooksRequestHandler } from "./server/hooks.js";
-import { listenGatewayHttpServer } from "./server/http-listen.js";
 import { resolveGatewayListenHosts } from "./net.js";
-import { createGatewayPluginRequestHandler } from "./server/plugins-http.js";
 import { createGatewayBroadcaster } from "./server-broadcast.js";
 import { createChatRunState } from "./server-chat.js";
 import { MAX_PAYLOAD_BYTES } from "./server-constants.js";
 import { attachGatewayUpgradeHandler, createGatewayHttpServer } from "./server-http.js";
+import { createGatewayHooksRequestHandler } from "./server/hooks.js";
+import { listenGatewayHttpServer } from "./server/http-listen.js";
+import { createGatewayPluginRequestHandler } from "./server/plugins-http.js";
 export async function createGatewayRuntimeState(params) {
     let canvasHost = null;
     if (params.canvasHostEnabled) {

package/dist/gateway/server-startup.js

@@ -1,10 +1,10 @@
 import { DEFAULT_MODEL, DEFAULT_PROVIDER } from "../agents/defaults.js";
 import { loadModelCatalog } from "../agents/model-catalog.js";
 import { getModelRefStatus, resolveConfiguredModelRef, resolveHooksGmailModel, } from "../agents/model-selection.js";
-import { isTruthyEnvValue } from "../infra/env.js";
 import { startGmailWatcher } from "../hooks/gmail-watcher.js";
 import { clearInternalHooks, createInternalHookEvent, triggerInternalHook, } from "../hooks/internal-hooks.js";
 import { loadInternalHooks } from "../hooks/loader.js";
+import { isTruthyEnvValue } from "../infra/env.js";
 import { startPluginServices } from "../plugins/services.js";
 import { startBrowserControlServerIfEnabled } from "./server-browser.js";
 import { scheduleRestartSentinelWake, shouldWakeFromRestartSentinel, } from "./server-restart-sentinel.js";

package/dist/gateway/server-ws-runtime.d.ts

@@ -1,8 +1,8 @@
 import type { WebSocketServer } from "ws";
 import type { createSubsystemLogger } from "../logging/subsystem.js";
 import type { ResolvedGatewayAuth } from "./auth.js";
-import type { GatewayWsClient } from "./server/ws-types.js";
 import type { GatewayRequestContext, GatewayRequestHandlers } from "./server-methods/types.js";
+import type { GatewayWsClient } from "./server/ws-types.js";
 export declare function attachGatewayWsHandlers(params: {
     wss: WebSocketServer;
     clients: Set<GatewayWsClient>;

package/dist/gateway/server.impl.js

@@ -1,54 +1,54 @@
 import { resolveAgentWorkspaceDir, resolveDefaultAgentId } from "../agents/agent-scope.js";
-import { initSubagentRegistry } from "../agents/subagent-registry.js";
 import { registerSkillsChangeListener } from "../agents/skills/refresh.js";
+import { initSubagentRegistry } from "../agents/subagent-registry.js";
 import { listChannelPlugins } from "../channels/plugins/index.js";
-import { createDefaultDeps } from "../cli/deps.js";
 import { formatCliCommand } from "../cli/command-format.js";
+import { createDefaultDeps } from "../cli/deps.js";
 import { CONFIG_PATH, isNixMode, loadConfig, migrateLegacyConfig, readConfigFileSnapshot, writeConfigFile, } from "../config/config.js";
-import { isDiagnosticsEnabled } from "../infra/diagnostic-events.js";
-import { logAcceptedEnvOption } from "../infra/env.js";
 import { applyPluginAutoEnable } from "../config/plugin-auto-enable.js";
 import { clearAgentRunContext, onAgentEvent } from "../infra/agent-events.js";
+import { isDiagnosticsEnabled } from "../infra/diagnostic-events.js";
+import { logAcceptedEnvOption } from "../infra/env.js";
+import { createExecApprovalForwarder } from "../infra/exec-approval-forwarder.js";
 import { onHeartbeatEvent } from "../infra/heartbeat-events.js";
 import { startHeartbeatRunner } from "../infra/heartbeat-runner.js";
 import { getMachineDisplayName } from "../infra/machine-name.js";
 import { ensureOpenClawCliOnPath } from "../infra/path-env.js";
+import { setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { primeRemoteSkillsCache, refreshRemoteBinsForConnectedNodes, setSkillsRemoteRegistry, } from "../infra/skills-remote.js";
 import { scheduleGatewayUpdateCheck } from "../infra/update-startup.js";
-import { setGatewaySigusr1RestartPolicy } from "../infra/restart.js";
 import { startDiagnosticHeartbeat, stopDiagnosticHeartbeat } from "../logging/diagnostic.js";
 import { createSubsystemLogger, runtimeForLogger } from "../logging/subsystem.js";
 import { runOnboardingWizard } from "../wizard/onboarding.js";
 import { startGatewayConfigReloader } from "./config-reload.js";
-import { getHealthCache, getHealthVersion, getPresenceVersion, incrementPresenceVersion, refreshGatewayHealthSnapshot, } from "./server/health-state.js";
-import { startGatewayDiscovery } from "./server-discovery-runtime.js";
 import { ExecApprovalManager } from "./exec-approval-manager.js";
-import { createExecApprovalHandlers } from "./server-methods/exec-approval.js";
-import { createExecApprovalForwarder } from "../infra/exec-approval-forwarder.js";
+import { NodeRegistry } from "./node-registry.js";
 import { createChannelManager } from "./server-channels.js";
 import { createAgentEventHandler } from "./server-chat.js";
 import { createGatewayCloseHandler } from "./server-close.js";
 import { buildGatewayCronService } from "./server-cron.js";
+import { startGatewayDiscovery } from "./server-discovery-runtime.js";
 import { applyGatewayLaneConcurrency } from "./server-lanes.js";
 import { startGatewayMaintenanceTimers } from "./server-maintenance.js";
-import { coreGatewayHandlers } from "./server-methods.js";
 import { GATEWAY_EVENTS, listGatewayMethods } from "./server-methods-list.js";
+import { coreGatewayHandlers } from "./server-methods.js";
+import { createExecApprovalHandlers } from "./server-methods/exec-approval.js";
+import { safeParseJson } from "./server-methods/nodes.helpers.js";
+import { hasConnectedMobileNode } from "./server-mobile-nodes.js";
 import { loadGatewayModelCatalog } from "./server-model-catalog.js";
-import { NodeRegistry } from "./node-registry.js";
 import { createNodeSubscriptionManager } from "./server-node-subscriptions.js";
-import { safeParseJson } from "./server-methods/nodes.helpers.js";
 import { loadGatewayPlugins } from "./server-plugins.js";
 import { createGatewayReloadHandlers } from "./server-reload-handlers.js";
 import { resolveGatewayRuntimeConfig } from "./server-runtime-config.js";
 import { createGatewayRuntimeState } from "./server-runtime-state.js";
-import { hasConnectedMobileNode } from "./server-mobile-nodes.js";
 import { resolveSessionKeyForRun } from "./server-session-key.js";
-import { startGatewaySidecars } from "./server-startup.js";
 import { logGatewayStartup } from "./server-startup-log.js";
+import { startGatewaySidecars } from "./server-startup.js";
 import { startGatewayTailscaleExposure } from "./server-tailscale.js";
-import { loadGatewayTlsRuntime } from "./server/tls.js";
 import { createWizardSessionTracker } from "./server-wizard-sessions.js";
 import { attachGatewayWsHandlers } from "./server-ws-runtime.js";
+import { getHealthCache, getHealthVersion, getPresenceVersion, incrementPresenceVersion, refreshGatewayHealthSnapshot, } from "./server/health-state.js";
+import { loadGatewayTlsRuntime } from "./server/tls.js";
 export { __resetModelCatalogCacheForTest } from "./server-model-catalog.js";
 ensureOpenClawCliOnPath();
 const log = createSubsystemLogger("gateway");

package/dist/gateway/session-utils.d.ts

@@ -1,6 +1,6 @@
+import type { GatewayAgentRow, GatewaySessionRow, GatewaySessionsDefaults, SessionsListResult } from "./session-utils.types.js";
 import { type OpenClawConfig } from "../config/config.js";
 import { type SessionEntry, type SessionScope } from "../config/sessions.js";
-import type { GatewayAgentRow, GatewaySessionRow, GatewaySessionsDefaults, SessionsListResult } from "./session-utils.types.js";
 export { archiveFileOnDisk, capArrayByJsonBytes, readFirstUserMessageFromTranscript, readLastMessagePreviewFromTranscript, readSessionPreviewItemsFromTranscript, readSessionMessages, resolveSessionTranscriptCandidates, } from "./session-utils.fs.js";
 export type { GatewayAgentRow, GatewaySessionRow, GatewaySessionsDefaults, SessionsListResult, SessionsPatchResult, SessionsPreviewEntry, SessionsPreviewResult, } from "./session-utils.types.js";
 export declare function deriveSessionTitle(entry: SessionEntry | undefined, firstUserMessage?: string | null): string | undefined;

package/dist/gateway/sessions-patch.js

@@ -5,9 +5,9 @@ import { normalizeGroupActivation } from "../auto-reply/group-activation.js";
 import { formatThinkingLevels, formatXHighModelHint, normalizeElevatedLevel, normalizeReasoningLevel, normalizeThinkLevel, normalizeUsageDisplay, supportsXHighThinking, } from "../auto-reply/thinking.js";
 import { isSubagentSessionKey } from "../routing/session-key.js";
 import { applyVerboseOverride, parseVerboseOverride } from "../sessions/level-overrides.js";
+import { applyModelOverrideToSessionEntry } from "../sessions/model-overrides.js";
 import { normalizeSendPolicy } from "../sessions/send-policy.js";
 import { parseSessionLabel } from "../sessions/session-label.js";
-import { applyModelOverrideToSessionEntry } from "../sessions/model-overrides.js";
 import { ErrorCodes, errorShape, } from "./protocol/index.js";
 function invalid(message) {
     return { ok: false, error: errorShape(ErrorCodes.INVALID_REQUEST, message) };

package/dist/gateway/test-helpers.mocks.d.ts

@@ -1,6 +1,7 @@
 import { Mock } from "vitest";
 import type { AgentBinding } from "../config/types.agents.js";
 import type { HooksConfig } from "../config/types.hooks.js";
+import type { TailscaleWhoisIdentity } from "../infra/tailscale.js";
 import type { PluginRegistry } from "../plugins/registry.js";
 export declare const setTestPluginRegistry: (registry: PluginRegistry) => void;
 export declare const resetTestPluginRegistry: () => void;
@@ -8,6 +9,9 @@ export declare const setTestConfigRoot: (root: string) => void;
 export declare const testTailnetIPv4: {
     value: string | undefined;
 };
+export declare const testTailscaleWhois: {
+    value: TailscaleWhoisIdentity | null;
+};
 export declare const piSdkMock: {
     enabled: boolean;
     discoverCalls: number;

package/dist/gateway/test-helpers.mocks.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
-import fs from "node:fs/promises";
 import fsSync from "node:fs";
+import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { vi } from "vitest";
@@ -147,6 +147,7 @@ const hoisted = vi.hoisted(() => ({
         waitCalls: [],
         waitResults: new Map(),
     },
+    testTailscaleWhois: { value: null },
     getReplyFromConfig: vi.fn().mockResolvedValue(undefined),
     sendWhatsAppMock: vi.fn().mockResolvedValue({ messageId: "msg-1", toJid: "jid-1" }),
 }));
@@ -170,6 +171,7 @@ export const setTestConfigRoot = (root) => {
     process.env.OPENCLAW_CONFIG_PATH = path.join(root, "openclaw.json");
 };
 export const testTailnetIPv4 = hoisted.testTailnetIPv4;
+export const testTailscaleWhois = hoisted.testTailscaleWhois;
 export const piSdkMock = hoisted.piSdkMock;
 export const cronIsolatedRun = hoisted.cronIsolatedRun;
 export const agentCommand = hoisted.agentCommand;
@@ -221,6 +223,13 @@ vi.mock("../infra/tailnet.js", () => ({
     pickPrimaryTailnetIPv4: () => testTailnetIPv4.value,
     pickPrimaryTailnetIPv6: () => undefined,
 }));
+vi.mock("../infra/tailscale.js", async () => {
+    const actual = await vi.importActual("../infra/tailscale.js");
+    return {
+        ...actual,
+        readTailscaleWhoisIdentity: async () => testTailscaleWhois.value,
+    };
+});
 vi.mock("../config/sessions.js", async () => {
     const actual = await vi.importActual("../config/sessions.js");
     return {

package/dist/gateway/test-helpers.server.d.ts

@@ -1,7 +1,7 @@
 import { createServer } from "node:net";
 import { WebSocket } from "ws";
-import { type SessionEntry } from "../config/sessions.js";
 import type { GatewayServerOptions } from "./server.js";
+import { type SessionEntry } from "../config/sessions.js";
 export declare function writeSessionStore(params: {
     entries: Record<string, Partial<SessionEntry>>;
     storePath?: string;

package/dist/gateway/test-helpers.server.js

@@ -13,9 +13,9 @@ import { resetLogger, setLoggerOverride } from "../logging.js";
 import { DEFAULT_AGENT_ID, toAgentStoreSessionKey } from "../routing/session-key.js";
 import { getDeterministicFreePortBlock } from "../test-utils/ports.js";
 import { GATEWAY_CLIENT_MODES, GATEWAY_CLIENT_NAMES } from "../utils/message-channel.js";
-import { PROTOCOL_VERSION } from "./protocol/index.js";
 import { buildDeviceAuthPayload } from "./device-auth.js";
-import { agentCommand, cronIsolatedRun, embeddedRunMock, piSdkMock, sessionStoreSaveDelayMs, setTestConfigRoot, testIsNixMode, testState, testTailnetIPv4, } from "./test-helpers.mocks.js";
+import { PROTOCOL_VERSION } from "./protocol/index.js";
+import { agentCommand, cronIsolatedRun, embeddedRunMock, piSdkMock, sessionStoreSaveDelayMs, setTestConfigRoot, testIsNixMode, testTailscaleWhois, testState, testTailnetIPv4, } from "./test-helpers.mocks.js";
 // Preload the gateway server module once per worker.
 // Important: `test-helpers.mocks` must run before importing the server so vi.mock hooks apply.
 const serverModulePromise = import("./server.js");
@@ -82,6 +82,7 @@ async function resetGatewayTestState(options) {
     setTestConfigRoot(tempConfigRoot);
     sessionStoreSaveDelayMs.value = 0;
     testTailnetIPv4.value = undefined;
+    testTailscaleWhois.value = null;
     testState.gatewayBind = undefined;
     testState.gatewayAuth = { mode: "token", token: "test-gateway-token-1234567890" };
     testState.gatewayControlUi = undefined;

package/dist/gateway/tools-invoke-http.js

@@ -9,8 +9,8 @@ import { getPluginToolMeta } from "../plugins/tools.js";
 import { isSubagentSessionKey } from "../routing/session-key.js";
 import { normalizeMessageChannel } from "../utils/message-channel.js";
 import { authorizeGatewayConnect } from "./auth.js";
-import { getBearerToken, getHeader } from "./http-utils.js";
 import { readJsonBodyOrError, sendInvalidRequest, sendJson, sendMethodNotAllowed, sendUnauthorized, } from "./http-common.js";
+import { getBearerToken, getHeader } from "./http-utils.js";
 const DEFAULT_BODY_BYTES = 2 * 1024 * 1024;
 const MEMORY_TOOL_NAMES = new Set(["memory_search", "memory_get"]);
 function resolveSessionKeyFromBody(body) {
@@ -153,11 +153,13 @@ export async function handleToolsInvokeHttpRequest(req, res, opts) {
         ]),
     });
     const coreToolNames = new Set(allTools
+        // oxlint-disable-next-line typescript/no-explicit-any
         .filter((tool) => !getPluginToolMeta(tool))
         .map((tool) => normalizeToolName(tool.name))
         .filter(Boolean));
     const pluginGroups = buildPluginToolGroups({
         tools: allTools,
+        // oxlint-disable-next-line typescript/no-explicit-any
         toolMeta: (tool) => getPluginToolMeta(tool),
     });
     const resolvePolicy = (policy, label) => {
@@ -213,10 +215,12 @@ export async function handleToolsInvokeHttpRequest(req, res, opts) {
     }
     try {
         const toolArgs = mergeActionIntoArgsIfSupported({
+            // oxlint-disable-next-line typescript/no-explicit-any
             toolSchema: tool.parameters,
             action,
             args,
         });
+        // oxlint-disable-next-line typescript/no-explicit-any
         const result = await tool.execute?.(`http-${Date.now()}`, toolArgs);
         sendJson(res, 200, { ok: true, result });
     }

package/dist/gateway/ws-log.js

@@ -1,9 +1,9 @@
 import chalk from "chalk";
 import { isVerbose } from "../globals.js";
-import { parseAgentSessionKey } from "../routing/session-key.js";
 import { shouldLogSubsystemToConsole } from "../logging/console.js";
-import { createSubsystemLogger } from "../logging/subsystem.js";
 import { getDefaultRedactPatterns, redactSensitiveText } from "../logging/redact.js";
+import { createSubsystemLogger } from "../logging/subsystem.js";
+import { parseAgentSessionKey } from "../routing/session-key.js";
 import { DEFAULT_WS_SLOW_MS, getGatewayWsLogStyle } from "./ws-logging.js";
 const LOG_VALUE_LIMIT = 240;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;

package/dist/hooks/bundled/command-logger/handler.js

@@ -23,8 +23,8 @@
  * ```
  */
 import fs from "node:fs/promises";
-import path from "node:path";
 import os from "node:os";
+import path from "node:path";
 /**
  * Log all command events to a file
  */

package/dist/hooks/bundled/session-memory/handler.js

@@ -5,8 +5,8 @@
  * Creates a new dated memory file with LLM-generated slug
  */
 import fs from "node:fs/promises";
-import path from "node:path";
 import os from "node:os";
+import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveAgentWorkspaceDir } from "../../../agents/agent-scope.js";
 import { resolveAgentIdFromSessionKey } from "../../../routing/session-key.js";
@@ -30,7 +30,8 @@ async function getRecentSessionContent(sessionFilePath, messageCount = 15) {
                     if ((role === "user" || role === "assistant") && msg.content) {
                         // Extract text content
                         const text = Array.isArray(msg.content)
-                            ? msg.content.find((c) => c.type === "text")?.text
+                            ? // oxlint-disable-next-line typescript/no-explicit-any
+                                msg.content.find((c) => c.type === "text")?.text
                             : msg.content;
                         if (text && !text.startsWith("/")) {
                             allMessages.push(`${role}: ${text}`);

package/dist/hooks/gmail-ops.js

@@ -1,11 +1,11 @@
 import { spawn } from "node:child_process";
+import { formatCliCommand } from "../cli/command-format.js";
 import { CONFIG_PATH, loadConfig, readConfigFileSnapshot, resolveGatewayPort, validateConfigObjectWithPlugins, writeConfigFile, } from "../config/config.js";
 import { runCommandWithTimeout } from "../process/exec.js";
 import { defaultRuntime } from "../runtime.js";
-import { formatCliCommand } from "../cli/command-format.js";
 import { displayPath } from "../utils.js";
-import { buildDefaultHookUrl, buildGogWatchServeArgs, buildGogWatchStartArgs, buildTopicPath, DEFAULT_GMAIL_LABEL, DEFAULT_GMAIL_MAX_BYTES, DEFAULT_GMAIL_RENEW_MINUTES, DEFAULT_GMAIL_SERVE_BIND, DEFAULT_GMAIL_SERVE_PATH, DEFAULT_GMAIL_SERVE_PORT, DEFAULT_GMAIL_SUBSCRIPTION, DEFAULT_GMAIL_TOPIC, generateHookToken, mergeHookPresets, normalizeHooksPath, normalizeServePath, parseTopicPath, resolveGmailHookRuntimeConfig, } from "./gmail.js";
 import { ensureDependency, ensureGcloudAuth, ensureSubscription, ensureTailscaleEndpoint, ensureTopic, resolveProjectIdFromGogCredentials, runGcloud, } from "./gmail-setup-utils.js";
+import { buildDefaultHookUrl, buildGogWatchServeArgs, buildGogWatchStartArgs, buildTopicPath, DEFAULT_GMAIL_LABEL, DEFAULT_GMAIL_MAX_BYTES, DEFAULT_GMAIL_RENEW_MINUTES, DEFAULT_GMAIL_SERVE_BIND, DEFAULT_GMAIL_SERVE_PATH, DEFAULT_GMAIL_SERVE_PORT, DEFAULT_GMAIL_SUBSCRIPTION, DEFAULT_GMAIL_TOPIC, generateHookToken, mergeHookPresets, normalizeHooksPath, normalizeServePath, parseTopicPath, resolveGmailHookRuntimeConfig, } from "./gmail.js";
 const DEFAULT_GMAIL_TOPIC_IAM_MEMBER = "serviceAccount:gmail-api-push@system.gserviceaccount.com";
 export async function runGmailSetup(opts) {
     await ensureDependency("gcloud", ["--cask", "gcloud-cli"]);

package/dist/hooks/gmail-watcher.js

@@ -8,8 +8,8 @@ import { spawn } from "node:child_process";
 import { hasBinary } from "../agents/skills.js";
 import { createSubsystemLogger } from "../logging/subsystem.js";
 import { runCommandWithTimeout } from "../process/exec.js";
-import { buildGogWatchServeArgs, buildGogWatchStartArgs, resolveGmailHookRuntimeConfig, } from "./gmail.js";
 import { ensureTailscaleEndpoint } from "./gmail-setup-utils.js";
+import { buildGogWatchServeArgs, buildGogWatchStartArgs, resolveGmailHookRuntimeConfig, } from "./gmail.js";
 const log = createSubsystemLogger("gmail-watcher");
 const ADDRESS_IN_USE_RE = /address already in use|EADDRINUSE/i;
 export function isAddressInUseError(line) {

package/dist/hooks/install.js

@@ -2,9 +2,9 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { MANIFEST_KEY } from "../compat/legacy-names.js";
+import { extractArchive, fileExists, readJsonFile, resolveArchiveKind, resolvePackedRootDir, } from "../infra/archive.js";
 import { runCommandWithTimeout } from "../process/exec.js";
 import { CONFIG_DIR, resolveUserPath } from "../utils.js";
-import { extractArchive, fileExists, readJsonFile, resolveArchiveKind, resolvePackedRootDir, } from "../infra/archive.js";
 import { parseFrontmatter } from "./frontmatter.js";
 const defaultLogger = {};
 function unscopedPackageName(name) {
@@ -19,11 +19,44 @@ function safeDirName(input) {
     if (!trimmed) {
         return trimmed;
     }
-    return trimmed.replaceAll("/", "__");
+    return trimmed.replaceAll("/", "__").replaceAll("\\", "__");
+}
+function validateHookId(hookId) {
+    if (!hookId) {
+        return "invalid hook name: missing";
+    }
+    if (hookId === "." || hookId === "..") {
+        return "invalid hook name: reserved path segment";
+    }
+    if (hookId.includes("/") || hookId.includes("\\")) {
+        return "invalid hook name: path separators not allowed";
+    }
+    return null;
 }
 export function resolveHookInstallDir(hookId, hooksDir) {
     const hooksBase = hooksDir ? resolveUserPath(hooksDir) : path.join(CONFIG_DIR, "hooks");
-    return path.join(hooksBase, safeDirName(hookId));
+    const hookIdError = validateHookId(hookId);
+    if (hookIdError) {
+        throw new Error(hookIdError);
+    }
+    const targetDirResult = resolveSafeInstallDir(hooksBase, hookId);
+    if (!targetDirResult.ok) {
+        throw new Error(targetDirResult.error);
+    }
+    return targetDirResult.path;
+}
+function resolveSafeInstallDir(hooksDir, hookId) {
+    const targetDir = path.join(hooksDir, safeDirName(hookId));
+    const resolvedBase = path.resolve(hooksDir);
+    const resolvedTarget = path.resolve(targetDir);
+    const relative = path.relative(resolvedBase, resolvedTarget);
+    if (!relative ||
+        relative === ".." ||
+        relative.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relative)) {
+        return { ok: false, error: "invalid hook name: path traversal detected" };
+    }
+    return { ok: true, path: targetDir };
 }
 async function ensureOpenClawHooks(manifest) {
     const hooks = manifest[MANIFEST_KEY]?.hooks;
@@ -81,6 +114,10 @@ async function installHookPackageFromDir(params) {
     }
     const pkgName = typeof manifest.name === "string" ? manifest.name : "";
     const hookPackId = pkgName ? unscopedPackageName(pkgName) : path.basename(params.packageDir);
+    const hookIdError = validateHookId(hookPackId);
+    if (hookIdError) {
+        return { ok: false, error: hookIdError };
+    }
     if (params.expectedHookPackId && params.expectedHookPackId !== hookPackId) {
         return {
             ok: false,
@@ -91,7 +128,11 @@ async function installHookPackageFromDir(params) {
         ? resolveUserPath(params.hooksDir)
         : path.join(CONFIG_DIR, "hooks");
     await fs.mkdir(hooksDir, { recursive: true });
-    const targetDir = resolveHookInstallDir(hookPackId, hooksDir);
+    const targetDirResult = resolveSafeInstallDir(hooksDir, hookPackId);
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    const targetDir = targetDirResult.path;
     if (mode === "install" && (await fileExists(targetDir))) {
         return { ok: false, error: `hook pack already exists: ${targetDir} (delete it first)` };
     }
@@ -163,6 +204,10 @@ async function installHookFromDir(params) {
     const dryRun = params.dryRun ?? false;
     await validateHookDir(params.hookDir);
     const hookName = await resolveHookNameFromDir(params.hookDir);
+    const hookIdError = validateHookId(hookName);
+    if (hookIdError) {
+        return { ok: false, error: hookIdError };
+    }
     if (params.expectedHookPackId && params.expectedHookPackId !== hookName) {
         return {
             ok: false,
@@ -173,7 +218,11 @@ async function installHookFromDir(params) {
         ? resolveUserPath(params.hooksDir)
         : path.join(CONFIG_DIR, "hooks");
     await fs.mkdir(hooksDir, { recursive: true });
-    const targetDir = resolveHookInstallDir(hookName, hooksDir);
+    const targetDirResult = resolveSafeInstallDir(hooksDir, hookName);
+    if (!targetDirResult.ok) {
+        return { ok: false, error: targetDirResult.error };
+    }
+    const targetDir = targetDirResult.path;
     if (mode === "install" && (await fileExists(targetDir))) {
         return { ok: false, error: `hook already exists: ${targetDir} (delete it first)` };
     }

package/dist/hooks/llm-slug-generator.js

@@ -4,8 +4,8 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { runEmbeddedPiAgent } from "../agents/pi-embedded.js";
 import { resolveDefaultAgentId, resolveAgentWorkspaceDir, resolveAgentDir, } from "../agents/agent-scope.js";
+import { runEmbeddedPiAgent } from "../agents/pi-embedded.js";
 /**
  * Generate a short 1-2 word filename slug from session content using LLM
  */

package/dist/hooks/loader.js

@@ -4,12 +4,12 @@
  * Loads hook handlers from external modules based on configuration
  * and from directory-based discovery (bundled, managed, workspace)
  */
-import { pathToFileURL } from "node:url";
 import path from "node:path";
-import { registerInternalHook } from "./internal-hooks.js";
-import { loadWorkspaceHookEntries } from "./workspace.js";
+import { pathToFileURL } from "node:url";
 import { resolveHookConfig } from "./config.js";
 import { shouldIncludeHook } from "./config.js";
+import { registerInternalHook } from "./internal-hooks.js";
+import { loadWorkspaceHookEntries } from "./workspace.js";
 /**
  * Load and register all hook handlers
  *

package/dist/imessage/monitor/monitor-provider.js

@@ -2,13 +2,14 @@ import fs from "node:fs/promises";
 import { resolveHumanDelayConfig } from "../../agents/identity.js";
 import { resolveTextChunkLimit } from "../../auto-reply/chunk.js";
 import { hasControlCommand } from "../../auto-reply/command-detection.js";
+import { dispatchInboundMessage } from "../../auto-reply/dispatch.js";
 import { formatInboundEnvelope, formatInboundFromLabel, resolveEnvelopeFormatOptions, } from "../../auto-reply/envelope.js";
 import { createInboundDebouncer, resolveInboundDebounceMs, } from "../../auto-reply/inbound-debounce.js";
-import { dispatchInboundMessage } from "../../auto-reply/dispatch.js";
-import { finalizeInboundContext } from "../../auto-reply/reply/inbound-context.js";
 import { buildPendingHistoryContextFromMap, clearHistoryEntriesIfEnabled, DEFAULT_GROUP_HISTORY_LIMIT, recordPendingHistoryEntryIfEnabled, } from "../../auto-reply/reply/history.js";
+import { finalizeInboundContext } from "../../auto-reply/reply/inbound-context.js";
 import { buildMentionRegexes, matchesMentionPatterns } from "../../auto-reply/reply/mentions.js";
 import { createReplyDispatcher } from "../../auto-reply/reply/reply-dispatcher.js";
+import { resolveControlCommandGate } from "../../channels/command-gating.js";
 import { logInboundDrop } from "../../channels/logging.js";
 import { createReplyPrefixContext } from "../../channels/reply-prefix.js";
 import { recordInboundSession } from "../../channels/session.js";
@@ -22,7 +23,6 @@ import { buildPairingReply } from "../../pairing/pairing-messages.js";
 import { readChannelAllowFromStore, upsertChannelPairingRequest, } from "../../pairing/pairing-store.js";
 import { resolveAgentRoute } from "../../routing/resolve-route.js";
 import { truncateUtf16Safe } from "../../utils.js";
-import { resolveControlCommandGate } from "../../channels/command-gating.js";
 import { resolveIMessageAccount } from "../accounts.js";
 import { createIMessageRpcClient } from "../client.js";
 import { probeIMessage } from "../probe.js";

package/dist/imessage/send.js

@@ -1,9 +1,9 @@
 import { loadConfig } from "../config/config.js";
 import { resolveMarkdownTableMode } from "../config/markdown-tables.js";
+import { convertMarkdownTables } from "../markdown/tables.js";
 import { mediaKindFromMime } from "../media/constants.js";
 import { saveMediaBuffer } from "../media/store.js";
 import { loadWebMedia } from "../web/media.js";
-import { convertMarkdownTables } from "../markdown/tables.js";
 import { resolveIMessageAccount } from "./accounts.js";
 import { createIMessageRpcClient } from "./client.js";
 import { formatIMessageChatTarget, parseIMessageTarget } from "./targets.js";