@karmaniverous/jeeves 0.5.10 → 0.5.12

package/content/tools-platform.md

@@ -24,6 +24,20 @@ When editing files outside the workspace, use the bridge pattern: copy in → ed
 
 **Cross-channel sends:** Use the `message` tool with an explicit `target` to send to a different channel or DM.
 
+### Slack File Downloads
+
+To download a Slack-hosted file, first try the `message` tool's `download-file` action. If that fails, fall back to a direct HTTP fetch using the bot token:
+
+```js
+fetch(url_private_download, {
+  headers: { Authorization: 'Bearer ' + botToken },
+});
+```
+
+The bot token is at `channels.slack.accounts.default.botToken` in `openclaw.json`.
+
+Never tell the user a file can't be downloaded until both methods have been tried.
+
 ### Plugin Lifecycle
 
 ```bash

package/dist/cli/jeeves/index.js

@@ -268,14 +268,14 @@ const PLATFORM_COMPONENTS = [
  * Core library version, inlined at build time.
  *
  * @remarks
- * The `0.5.9` placeholder is replaced by
+ * The `0.5.11` placeholder is replaced by
  * `@rollup/plugin-replace` during the build with the actual version
  * from `package.json`. This ensures the correct version survives
  * when consumers bundle core into their own dist (where runtime
  * `import.meta.url`-based resolution would find the wrong package.json).
  */
 /** The core library version from package.json (inlined at build time). */
-const CORE_VERSION = '0.5.9';
+const CORE_VERSION = '0.5.11';
 
 /**
  * Runtime Node.js version floor check.
@@ -430,12 +430,26 @@ function resolveConfigValue(flagValue, envValue, fileValue, defaultValue) {
  * - `{configRoot}/jeeves-{name}/` for each component
  */
 let state;
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:/;
+/**
+ * Throw if a path looks like a Windows drive letter on a non-Windows platform.
+ *
+ * @param label - Human-readable name for the path (used in error messages).
+ * @param value - The raw path string to validate.
+ */
+function rejectWindowsDrivePath(label, value) {
+    if (process.platform !== 'win32' && WINDOWS_DRIVE_RE.test(value)) {
+        throw new Error(`jeeves-core: ${label} "${value}" looks like a Windows drive-letter path and will not resolve correctly on this platform.`);
+    }
+}
 /**
  * Initialize the core library with workspace and config root paths.
  *
  * @param options - Workspace and config root paths.
  */
 function init(options) {
+    rejectWindowsDrivePath('configRoot', options.configRoot);
+    rejectWindowsDrivePath('workspacePath', options.workspacePath);
     state = {
         workspacePath: options.workspacePath,
         configRoot: options.configRoot,
@@ -468,7 +482,8 @@ var init$1 = /*#__PURE__*/Object.freeze({
 	__proto__: null,
 	getCoreConfigDir: getCoreConfigDir,
 	getWorkspacePath: getWorkspacePath,
-	init: init
+	init: init,
+	rejectWindowsDrivePath: rejectWindowsDrivePath
 });
 
 /**
@@ -519,6 +534,10 @@ function resolveCliConfig(opts) {
  */
 function initFromOptions(opts) {
     const resolved = resolveCliConfig(opts);
+    // Validate raw values BEFORE resolve() — on Linux, resolve('j:/config')
+    // produces '/cwd/j:/config' which masks the drive-letter pattern.
+    rejectWindowsDrivePath('configRoot', resolved.core.configRoot.value);
+    rejectWindowsDrivePath('workspacePath', resolved.core.workspace.value);
     init({
         workspacePath: resolve(resolved.core.workspace.value),
         configRoot: resolve(resolved.core.configRoot.value),
@@ -1358,6 +1377,20 @@ When editing files outside the workspace, use the bridge pattern: copy in → ed
 
 **Cross-channel sends:** Use the \`message\` tool with an explicit \`target\` to send to a different channel or DM.
 
+### Slack File Downloads
+
+To download a Slack-hosted file, first try the \`message\` tool's \`download-file\` action. If that fails, fall back to a direct HTTP fetch using the bot token:
+
+\`\`\`js
+fetch(url_private_download, {
+  headers: { Authorization: 'Bearer ' + botToken },
+});
+\`\`\`
+
+The bot token is at \`channels.slack.accounts.default.botToken\` in \`openclaw.json\`.
+
+Never tell the user a file can't be downloaded until both methods have been tried.
+
 ### Plugin Lifecycle
 
 \`\`\`bash

package/dist/cli/plugin/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
+import { execSync } from 'node:child_process';
 import { writeFileSync, renameSync, unlinkSync, existsSync, mkdirSync, readFileSync, readdirSync, copyFileSync, rmSync } from 'node:fs';
 import { dirname, basename, join, resolve } from 'node:path';
 import * as commander from 'commander';
 import { randomUUID } from 'node:crypto';
 import { lock } from 'proper-lockfile';
 import 'semver';
-import 'node:child_process';
 import { homedir } from 'node:os';
 import { z } from 'zod';
 import { fileURLToPath } from 'node:url';
@@ -128,14 +128,14 @@ const COMPONENT_VERSIONS_FILE = 'component-versions.json';
  * Core library version, inlined at build time.
  *
  * @remarks
- * The `0.5.9` placeholder is replaced by
+ * The `0.5.11` placeholder is replaced by
  * `@rollup/plugin-replace` during the build with the actual version
  * from `package.json`. This ensures the correct version survives
  * when consumers bundle core into their own dist (where runtime
  * `import.meta.url`-based resolution would find the wrong package.json).
  */
 /** The core library version from package.json (inlined at build time). */
-const CORE_VERSION = '0.5.9';
+const CORE_VERSION = '0.5.11';
 
 /**
  * Shared file I/O helpers for managed section operations.
@@ -374,12 +374,26 @@ const SECTION_ORDER = [
  * - `{configRoot}/jeeves-{name}/` for each component
  */
 let state;
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:/;
+/**
+ * Throw if a path looks like a Windows drive letter on a non-Windows platform.
+ *
+ * @param label - Human-readable name for the path (used in error messages).
+ * @param value - The raw path string to validate.
+ */
+function rejectWindowsDrivePath(label, value) {
+    if (process.platform !== 'win32' && WINDOWS_DRIVE_RE.test(value)) {
+        throw new Error(`jeeves-core: ${label} "${value}" looks like a Windows drive-letter path and will not resolve correctly on this platform.`);
+    }
+}
 /**
  * Initialize the core library with workspace and config root paths.
  *
  * @param options - Workspace and config root paths.
  */
 function init(options) {
+    rejectWindowsDrivePath('configRoot', options.configRoot);
+    rejectWindowsDrivePath('workspacePath', options.workspacePath);
     state = {
         workspacePath: options.workspacePath,
         configRoot: options.configRoot,
@@ -1695,9 +1709,8 @@ function createPluginCli(options) {
         const configPath = resolveConfigPath(openClawHome);
         // 1. Copy dist to extensions
         const extensionsDir = join(openClawHome, 'extensions', pluginId);
-        if (!existsSync(distDir)) {
-            throw new Error(`Plugin dist directory not found: ${distDir}. Ensure the plugin is built before installing.`);
-        }
+        if (!existsSync(distDir))
+            throw new Error(`Plugin dist directory not found: ${distDir}`);
         console.log(`Copying dist to ${extensionsDir}...`);
         copyDistFiles(distDir, join(extensionsDir, 'dist'));
         // Copy package.json and openclaw.plugin.json from package root
@@ -1708,6 +1721,20 @@ function createPluginCli(options) {
             }
         }
         console.log('  ✓ Dist files copied');
+        // 1b. Install production dependencies
+        console.log('Installing dependencies...');
+        try {
+            execSync('npm install --omit=dev', {
+                cwd: extensionsDir,
+                stdio: 'pipe',
+            });
+        }
+        catch (err) {
+            throw new Error(`npm install failed in ${extensionsDir}`, {
+                cause: err,
+            });
+        }
+        console.log('  ✓ Dependencies installed');
         // 2. Patch openclaw.json
         console.log('Patching OpenClaw config...');
         const config = readJsonFile(configPath);
@@ -1753,9 +1780,9 @@ function createPluginCli(options) {
         // 4. Write initial HEARTBEAT entry and seed jeeves skill
         try {
             const cfgRoot = opts.configRoot;
-            const agents = config.agents;
-            const defaults = agents?.defaults;
-            const ws = opts.workspace ?? defaults?.workspace;
+            const ag = config.agents;
+            const defs = ag?.defaults;
+            const ws = opts.workspace ?? defs?.workspace;
             if (ws) {
                 init({ workspacePath: ws, configRoot: cfgRoot });
                 const heartbeatPath = join(ws, WORKSPACE_FILES.heartbeat);

package/dist/cli/service/index.js

@@ -251,12 +251,26 @@ const COMPONENT_CONFIG_PREFIX = 'jeeves-';
  * - `{configRoot}/jeeves-{name}/` for each component
  */
 let state;
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:/;
+/**
+ * Throw if a path looks like a Windows drive letter on a non-Windows platform.
+ *
+ * @param label - Human-readable name for the path (used in error messages).
+ * @param value - The raw path string to validate.
+ */
+function rejectWindowsDrivePath(label, value) {
+    if (process.platform !== 'win32' && WINDOWS_DRIVE_RE.test(value)) {
+        throw new Error(`jeeves-core: ${label} "${value}" looks like a Windows drive-letter path and will not resolve correctly on this platform.`);
+    }
+}
 /**
  * Initialize the core library with workspace and config root paths.
  *
  * @param options - Workspace and config root paths.
  */
 function init(options) {
+    rejectWindowsDrivePath('configRoot', options.configRoot);
+    rejectWindowsDrivePath('workspacePath', options.workspacePath);
     state = {
         workspacePath: options.workspacePath,
         configRoot: options.configRoot,

package/dist/index.d.ts

@@ -176,9 +176,11 @@ type ConfigApplyHandler = (request: ConfigApplyRequest) => Promise<ConfigApplyRe
  * 5. Calls `descriptor.onConfigApply` with the merged config (if defined)
  *
  * @param descriptor - The component descriptor.
+ * @param configPath - Optional explicit config file path. When provided, takes
+ *   precedence over registered and derived paths.
  * @returns An async handler returning `{ status, body }`.
  */
-declare function createConfigApplyHandler(descriptor: JeevesComponentDescriptor): ConfigApplyHandler;
+declare function createConfigApplyHandler(descriptor: JeevesComponentDescriptor, configPath?: string): ConfigApplyHandler;
 
 /**
  * Generic config query handler with JSONPath support.
@@ -275,6 +277,20 @@ declare function createStatusHandler(options: CreateStatusHandlerOptions): Statu
  */
 declare function checkNodeVersion(): void;
 
+/**
+ * @packageDocumentation
+ *
+ * Deep-walks config objects and replaces `${VAR_NAME}` patterns with environment variable values.
+ * Canonical implementation in `@karmaniverous/jeeves` (jeeves-core).
+ */
+/**
+ * Deep-walk a value and substitute `${VAR_NAME}` patterns in all string values.
+ *
+ * @param value - The value to walk (object, array, or primitive).
+ * @returns A new value with all env var references resolved.
+ */
+declare function substituteEnvVars<T>(value: T): T;
+
 /**
  * Workspace-level shared configuration: `jeeves.config.json`.
  *
@@ -1068,9 +1084,16 @@ declare function checkRegistryVersion(packageName: string, cacheDir: string, ttl
 interface InitOptions {
     /** Absolute path to the OpenClaw workspace root. */
     workspacePath: string;
-    /** Absolute path to the platform config root (e.g., `j:/config`). */
+    /** Absolute path to the platform config root. */
     configRoot: string;
 }
+/**
+ * Throw if a path looks like a Windows drive letter on a non-Windows platform.
+ *
+ * @param label - Human-readable name for the path (used in error messages).
+ * @param value - The raw path string to validate.
+ */
+declare function rejectWindowsDrivePath(label: string, value: string): void;
 /**
  * Initialize the core library with workspace and config root paths.
  *
@@ -1947,5 +1970,5 @@ declare function getErrorMessage(err: unknown): string;
  */
 declare function isTransientError(err: unknown): boolean;
 
-export { AGENTS_MARKERS, CLEANUP_FLAG, COMPONENT_CONFIG_PREFIX, COMPONENT_VERSIONS_FILE, CONFIG_FILE, CORE_CONFIG_DIR, CORE_VERSION, ComponentWriter, DEFAULT_BIND_ADDRESS, DEFAULT_CORE_VERSION, DEFAULT_PORTS, HEARTBEAT_HEADING, JEEVES_SKILL_DIR, MEMORY_HEARTBEAT_NAME, META_PORT, PLATFORM_COMPONENTS, REGISTRY_CACHE_FILE, RUNNER_PORT, SECTION_IDS, SECTION_ORDER, SERVER_PORT, SKILLS_DIR, SOUL_MARKERS, STALENESS_THRESHOLD_MS, STALE_LOCK_MS, TEMPLATES_DIR, TOOLS_MARKERS, VERSION_STAMP_PATTERN, WATCHER_PORT, WORKSPACE_CONFIG_DEFAULTS, WORKSPACE_CONFIG_FILE, WORKSPACE_FILES, analyzeMemory, appendJsonl, atomicWrite, buildEffectiveConfig, buildHeartbeatSection, checkMemoryHealth, checkNodeVersion, checkRegistryVersion, connectionFail, coreConfigSchema, createAsyncContentCache, createComponentWriter, createConfigApplyHandler, createConfigQueryHandler, createGoogleAuth, createPluginCli, createPluginToolset, createServiceCli, createServiceManager, createStatusHandler, ensureDir, fail, fetchJson, fetchWithTimeout, formatBeginMarker, formatEndMarker, generateJsonSchema, generateWorkspaceJsonSchema, getArg, getBindAddress, getChannelWorkspace, getComponentConfigDir, getComponentConfigPath, getConfigRoot, getCoreConfigDir, getCoreConfigFile, getEffectiveServiceName, getErrorMessage, getPackageRoot, getPackageVersion, getServiceState, getServiceUrl, getWorkspacePath, init, isPrime, isTransientError, jaccard, jeevesComponentDescriptorSchema, loadEnvFile, loadWorkspaceConfig, needsCleanup, nowIso, ok, orchestrateHeartbeat, parseArgs, parseHeartbeat, parseManaged, patchConfig, postJson, readComponentVersions, readJson, readJsonl, refreshPlatformContent, registerComponentConfigPath, removeComponentVersion, removeManagedSection, resetInit, resolveConfigPath, resolveConfigValue, resolveOpenClawHome, resolveOptionalPluginSetting, resolvePluginSetting, resolveWorkspacePath, run, runScript, runWithRetry, saveCache, seedContent, seedSkill, seedSkills, shingles, shouldWrite, sleepAsync, sleepMs, updateManagedSection, uuid, withFileLock, workspaceConfigSchema, writeComponentVersion, writeHeartbeatSection, writeJsonAtomic, writeJsonl };
+export { AGENTS_MARKERS, CLEANUP_FLAG, COMPONENT_CONFIG_PREFIX, COMPONENT_VERSIONS_FILE, CONFIG_FILE, CORE_CONFIG_DIR, CORE_VERSION, ComponentWriter, DEFAULT_BIND_ADDRESS, DEFAULT_CORE_VERSION, DEFAULT_PORTS, HEARTBEAT_HEADING, JEEVES_SKILL_DIR, MEMORY_HEARTBEAT_NAME, META_PORT, PLATFORM_COMPONENTS, REGISTRY_CACHE_FILE, RUNNER_PORT, SECTION_IDS, SECTION_ORDER, SERVER_PORT, SKILLS_DIR, SOUL_MARKERS, STALENESS_THRESHOLD_MS, STALE_LOCK_MS, TEMPLATES_DIR, TOOLS_MARKERS, VERSION_STAMP_PATTERN, WATCHER_PORT, WORKSPACE_CONFIG_DEFAULTS, WORKSPACE_CONFIG_FILE, WORKSPACE_FILES, analyzeMemory, appendJsonl, atomicWrite, buildEffectiveConfig, buildHeartbeatSection, checkMemoryHealth, checkNodeVersion, checkRegistryVersion, connectionFail, coreConfigSchema, createAsyncContentCache, createComponentWriter, createConfigApplyHandler, createConfigQueryHandler, createGoogleAuth, createPluginCli, createPluginToolset, createServiceCli, createServiceManager, createStatusHandler, ensureDir, fail, fetchJson, fetchWithTimeout, formatBeginMarker, formatEndMarker, generateJsonSchema, generateWorkspaceJsonSchema, getArg, getBindAddress, getChannelWorkspace, getComponentConfigDir, getComponentConfigPath, getConfigRoot, getCoreConfigDir, getCoreConfigFile, getEffectiveServiceName, getErrorMessage, getPackageRoot, getPackageVersion, getServiceState, getServiceUrl, getWorkspacePath, init, isPrime, isTransientError, jaccard, jeevesComponentDescriptorSchema, loadEnvFile, loadWorkspaceConfig, needsCleanup, nowIso, ok, orchestrateHeartbeat, parseArgs, parseHeartbeat, parseManaged, patchConfig, postJson, readComponentVersions, readJson, readJsonl, refreshPlatformContent, registerComponentConfigPath, rejectWindowsDrivePath, removeComponentVersion, removeManagedSection, resetInit, resolveConfigPath, resolveConfigValue, resolveOpenClawHome, resolveOptionalPluginSetting, resolvePluginSetting, resolveWorkspacePath, run, runScript, runWithRetry, saveCache, seedContent, seedSkill, seedSkills, shingles, shouldWrite, sleepAsync, sleepMs, substituteEnvVars, updateManagedSection, uuid, withFileLock, workspaceConfigSchema, writeComponentVersion, writeHeartbeatSection, writeJsonAtomic, writeJsonl };
 export type { AccountConfig, AsyncContentCacheOptions, ComponentDependencies, ComponentState, ComponentVersionEntry, ComponentVersionsState, ComponentWriterOptions, ConfigApplyHandler, ConfigApplyRequest, ConfigApplyResult, ConfigProvenance, ConfigQueryHandler, ConfigQueryResponse, CoreConfig, CreatePluginCliOptions, CreateStatusHandlerOptions, GoogleAuthOptions, HeartbeatEntry, InitOptions, JeevesComponentDescriptor, ManagedMarkers, ManagedSection, MemoryHygieneOptions, MemoryHygieneResult, OrchestrateHeartbeatOptions, ParseManagedResult, ParsedHeartbeat, PlatformComponent, PluginApi, PluginInstallRecord, RefreshPlatformContentOptions, RemoveManagedSectionOptions, ResolvedCliConfig, ResolvedValue, RetryOptions, RunOptions, SectionId, SeedContentOptions, ServiceAccountFileConfig, ServiceManager, ServiceManagerOptions, ServiceState, SlackWorkspaceOptions, StatusHandler, StatusHandlerResult, StatusResponse, ToolDescriptor, ToolRegistrationOptions, ToolResult, UpdateManagedSectionOptions, VersionStamp, WorkspaceConfig, WorkspaceOptions, WriteComponentVersionOptions };

package/dist/index.js

@@ -5,8 +5,8 @@ import { lock } from 'proper-lockfile';
 import { JSONPath } from 'jsonpath-plus';
 import { major, valid, gte, gt } from 'semver';
 import { z } from 'zod';
-import * as commander from 'commander';
 import cp, { execSync } from 'node:child_process';
+import * as commander from 'commander';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { packageDirectorySync } from 'package-directory';
@@ -184,14 +184,14 @@ const PLATFORM_COMPONENTS = [
  * Core library version, inlined at build time.
  *
  * @remarks
- * The `0.5.9` placeholder is replaced by
+ * The `0.5.11` placeholder is replaced by
  * `@rollup/plugin-replace` during the build with the actual version
  * from `package.json`. This ensures the correct version survives
  * when consumers bundle core into their own dist (where runtime
  * `import.meta.url`-based resolution would find the wrong package.json).
  */
 /** The core library version from package.json (inlined at build time). */
-const CORE_VERSION = '0.5.9';
+const CORE_VERSION = '0.5.11';
 
 /**
  * Workspace and config root initialization.
@@ -204,12 +204,26 @@ const CORE_VERSION = '0.5.9';
  * - `{configRoot}/jeeves-{name}/` for each component
  */
 let state;
+const WINDOWS_DRIVE_RE = /^[a-zA-Z]:/;
+/**
+ * Throw if a path looks like a Windows drive letter on a non-Windows platform.
+ *
+ * @param label - Human-readable name for the path (used in error messages).
+ * @param value - The raw path string to validate.
+ */
+function rejectWindowsDrivePath(label, value) {
+    if (process.platform !== 'win32' && WINDOWS_DRIVE_RE.test(value)) {
+        throw new Error(`jeeves-core: ${label} "${value}" looks like a Windows drive-letter path and will not resolve correctly on this platform.`);
+    }
+}
 /**
  * Initialize the core library with workspace and config root paths.
  *
  * @param options - Workspace and config root paths.
  */
 function init(options) {
+    rejectWindowsDrivePath('configRoot', options.configRoot);
+    rejectWindowsDrivePath('workspacePath', options.workspacePath);
     state = {
         workspacePath: options.workspacePath,
         configRoot: options.configRoot,
@@ -537,16 +551,19 @@ function readConfigFile(filePath) {
  * 5. Calls `descriptor.onConfigApply` with the merged config (if defined)
  *
  * @param descriptor - The component descriptor.
+ * @param configPath - Optional explicit config file path. When provided, takes
+ *   precedence over registered and derived paths.
  * @returns An async handler returning `{ status, body }`.
  */
-function createConfigApplyHandler(descriptor) {
+function createConfigApplyHandler(descriptor, configPath) {
     return async (request) => {
         const { patch, replace } = request;
-        // Use registered config path if available, otherwise derive from configRoot
-        const configPath = getComponentConfigPath(descriptor.name) ??
+        // Prefer explicit > registered > derived config path
+        const resolvedConfigPath = configPath ??
+            getComponentConfigPath(descriptor.name) ??
             join(getComponentConfigDir(descriptor.name), descriptor.configFileName);
         // Read existing config
-        const existing = readConfigFile(configPath);
+        const existing = readConfigFile(resolvedConfigPath);
         // Merge or replace
         const mergeFn = descriptor.customMerge ?? deepMerge;
         const merged = replace ? { ...patch } : mergeFn(existing, patch);
@@ -567,7 +584,7 @@ function createConfigApplyHandler(descriptor) {
         // Write atomically
         try {
             const json = JSON.stringify(validatedConfig, null, 2) + '\n';
-            atomicWrite(configPath, json);
+            atomicWrite(resolvedConfigPath, json);
         }
         catch (err) {
             return {
@@ -704,6 +721,52 @@ function checkNodeVersion() {
     }
 }
 
+/**
+ * @packageDocumentation
+ *
+ * Deep-walks config objects and replaces `${VAR_NAME}` patterns with environment variable values.
+ * Canonical implementation in `@karmaniverous/jeeves` (jeeves-core).
+ */
+const ENV_PATTERN = /\$\{([^}]+)\}/g;
+/**
+ * Replace `${VAR_NAME}` patterns in a string with `process.env.VAR_NAME`.
+ *
+ * @param value - The string to process.
+ * @returns The string with resolved env vars; unresolvable expressions left untouched.
+ */
+function substituteString(value) {
+    return value.replace(ENV_PATTERN, (match, varName) => {
+        const envValue = process.env[varName];
+        if (envValue === undefined)
+            return match;
+        return envValue;
+    });
+}
+/**
+ * Deep-walk a value and substitute `${VAR_NAME}` patterns in all string values.
+ *
+ * @param value - The value to walk (object, array, or primitive).
+ * @returns A new value with all env var references resolved.
+ */
+function substituteEnvVars(value) {
+    if (typeof value === 'string') {
+        return substituteString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => substituteEnvVars(item));
+    }
+    if (value !== null &&
+        typeof value === 'object' &&
+        Object.getPrototypeOf(value) === Object.prototype) {
+        const result = {};
+        for (const [key, val] of Object.entries(value)) {
+            result[key] = substituteEnvVars(val);
+        }
+        return result;
+    }
+    return value;
+}
+
 /**
  * Workspace-level shared configuration: `jeeves.config.json`.
  *
@@ -913,6 +976,10 @@ function resolveCliConfig(opts) {
  */
 function initFromOptions(opts) {
     const resolved = resolveCliConfig(opts);
+    // Validate raw values BEFORE resolve() — on Linux, resolve('j:/config')
+    // produces '/cwd/j:/config' which masks the drive-letter pattern.
+    rejectWindowsDrivePath('configRoot', resolved.core.configRoot.value);
+    rejectWindowsDrivePath('workspacePath', resolved.core.workspace.value);
     init({
         workspacePath: resolve(resolved.core.workspace.value),
         configRoot: resolve(resolved.core.configRoot.value),
@@ -3219,9 +3286,8 @@ function createPluginCli(options) {
         const configPath = resolveConfigPath(openClawHome);
         // 1. Copy dist to extensions
         const extensionsDir = join(openClawHome, 'extensions', pluginId);
-        if (!existsSync(distDir)) {
-            throw new Error(`Plugin dist directory not found: ${distDir}. Ensure the plugin is built before installing.`);
-        }
+        if (!existsSync(distDir))
+            throw new Error(`Plugin dist directory not found: ${distDir}`);
         console.log(`Copying dist to ${extensionsDir}...`);
         copyDistFiles(distDir, join(extensionsDir, 'dist'));
         // Copy package.json and openclaw.plugin.json from package root
@@ -3232,6 +3298,20 @@ function createPluginCli(options) {
             }
         }
         console.log('  ✓ Dist files copied');
+        // 1b. Install production dependencies
+        console.log('Installing dependencies...');
+        try {
+            execSync('npm install --omit=dev', {
+                cwd: extensionsDir,
+                stdio: 'pipe',
+            });
+        }
+        catch (err) {
+            throw new Error(`npm install failed in ${extensionsDir}`, {
+                cause: err,
+            });
+        }
+        console.log('  ✓ Dependencies installed');
         // 2. Patch openclaw.json
         console.log('Patching OpenClaw config...');
         const config = readJsonFile(configPath);
@@ -3277,9 +3357,9 @@ function createPluginCli(options) {
         // 4. Write initial HEARTBEAT entry and seed jeeves skill
         try {
             const cfgRoot = opts.configRoot;
-            const agents = config.agents;
-            const defaults = agents?.defaults;
-            const ws = opts.workspace ?? defaults?.workspace;
+            const ag = config.agents;
+            const defs = ag?.defaults;
+            const ws = opts.workspace ?? defs?.workspace;
             if (ws) {
                 init({ workspacePath: ws, configRoot: cfgRoot });
                 const heartbeatPath = join(ws, WORKSPACE_FILES.heartbeat);
@@ -4110,6 +4190,20 @@ When editing files outside the workspace, use the bridge pattern: copy in → ed
 
 **Cross-channel sends:** Use the \`message\` tool with an explicit \`target\` to send to a different channel or DM.
 
+### Slack File Downloads
+
+To download a Slack-hosted file, first try the \`message\` tool's \`download-file\` action. If that fails, fall back to a direct HTTP fetch using the bot token:
+
+\`\`\`js
+fetch(url_private_download, {
+  headers: { Authorization: 'Bearer ' + botToken },
+});
+\`\`\`
+
+The bot token is at \`channels.slack.accounts.default.botToken\` in \`openclaw.json\`.
+
+Never tell the user a file can't be downloaded until both methods have been tried.
+
 ### Plugin Lifecycle
 
 \`\`\`bash
@@ -5806,4 +5900,4 @@ async function getChannelWorkspace(channelId, token, options) {
     return teamId;
 }
 
-export { AGENTS_MARKERS, CLEANUP_FLAG, COMPONENT_CONFIG_PREFIX, COMPONENT_VERSIONS_FILE, CONFIG_FILE, CORE_CONFIG_DIR, CORE_VERSION, ComponentWriter, DEFAULT_BIND_ADDRESS, DEFAULT_CORE_VERSION, DEFAULT_PORTS, HEARTBEAT_HEADING, JEEVES_SKILL_DIR, MEMORY_HEARTBEAT_NAME, META_PORT, PLATFORM_COMPONENTS, REGISTRY_CACHE_FILE, RUNNER_PORT, SECTION_IDS, SECTION_ORDER, SERVER_PORT, SKILLS_DIR, SOUL_MARKERS, STALENESS_THRESHOLD_MS, STALE_LOCK_MS, TEMPLATES_DIR, TOOLS_MARKERS, VERSION_STAMP_PATTERN, WATCHER_PORT, WORKSPACE_CONFIG_DEFAULTS, WORKSPACE_CONFIG_FILE, WORKSPACE_FILES, analyzeMemory, appendJsonl, atomicWrite, buildEffectiveConfig, buildHeartbeatSection, checkMemoryHealth, checkNodeVersion, checkRegistryVersion, connectionFail, coreConfigSchema, createAsyncContentCache, createComponentWriter, createConfigApplyHandler, createConfigQueryHandler, createGoogleAuth, createPluginCli, createPluginToolset, createServiceCli, createServiceManager, createStatusHandler, ensureDir, fail, fetchJson, fetchWithTimeout, formatBeginMarker, formatEndMarker, generateJsonSchema, generateWorkspaceJsonSchema, getArg, getBindAddress, getChannelWorkspace, getComponentConfigDir, getComponentConfigPath, getConfigRoot, getCoreConfigDir, getCoreConfigFile, getEffectiveServiceName, getErrorMessage, getPackageRoot, getPackageVersion, getServiceState, getServiceUrl, getWorkspacePath, init, isPrime, isTransientError, jaccard, jeevesComponentDescriptorSchema, loadEnvFile, loadWorkspaceConfig, needsCleanup, nowIso, ok, orchestrateHeartbeat, parseArgs, parseHeartbeat, parseManaged, patchConfig, postJson, readComponentVersions, readJson, readJsonl, refreshPlatformContent, registerComponentConfigPath, removeComponentVersion, removeManagedSection, resetInit, resolveConfigPath, resolveConfigValue, resolveOpenClawHome, resolveOptionalPluginSetting, resolvePluginSetting, resolveWorkspacePath, run, runScript, runWithRetry, saveCache, seedContent, seedSkill, seedSkills, shingles, shouldWrite, sleepAsync, sleepMs, updateManagedSection, uuid, withFileLock, workspaceConfigSchema, writeComponentVersion, writeHeartbeatSection, writeJsonAtomic, writeJsonl };
+export { AGENTS_MARKERS, CLEANUP_FLAG, COMPONENT_CONFIG_PREFIX, COMPONENT_VERSIONS_FILE, CONFIG_FILE, CORE_CONFIG_DIR, CORE_VERSION, ComponentWriter, DEFAULT_BIND_ADDRESS, DEFAULT_CORE_VERSION, DEFAULT_PORTS, HEARTBEAT_HEADING, JEEVES_SKILL_DIR, MEMORY_HEARTBEAT_NAME, META_PORT, PLATFORM_COMPONENTS, REGISTRY_CACHE_FILE, RUNNER_PORT, SECTION_IDS, SECTION_ORDER, SERVER_PORT, SKILLS_DIR, SOUL_MARKERS, STALENESS_THRESHOLD_MS, STALE_LOCK_MS, TEMPLATES_DIR, TOOLS_MARKERS, VERSION_STAMP_PATTERN, WATCHER_PORT, WORKSPACE_CONFIG_DEFAULTS, WORKSPACE_CONFIG_FILE, WORKSPACE_FILES, analyzeMemory, appendJsonl, atomicWrite, buildEffectiveConfig, buildHeartbeatSection, checkMemoryHealth, checkNodeVersion, checkRegistryVersion, connectionFail, coreConfigSchema, createAsyncContentCache, createComponentWriter, createConfigApplyHandler, createConfigQueryHandler, createGoogleAuth, createPluginCli, createPluginToolset, createServiceCli, createServiceManager, createStatusHandler, ensureDir, fail, fetchJson, fetchWithTimeout, formatBeginMarker, formatEndMarker, generateJsonSchema, generateWorkspaceJsonSchema, getArg, getBindAddress, getChannelWorkspace, getComponentConfigDir, getComponentConfigPath, getConfigRoot, getCoreConfigDir, getCoreConfigFile, getEffectiveServiceName, getErrorMessage, getPackageRoot, getPackageVersion, getServiceState, getServiceUrl, getWorkspacePath, init, isPrime, isTransientError, jaccard, jeevesComponentDescriptorSchema, loadEnvFile, loadWorkspaceConfig, needsCleanup, nowIso, ok, orchestrateHeartbeat, parseArgs, parseHeartbeat, parseManaged, patchConfig, postJson, readComponentVersions, readJson, readJsonl, refreshPlatformContent, registerComponentConfigPath, rejectWindowsDrivePath, removeComponentVersion, removeManagedSection, resetInit, resolveConfigPath, resolveConfigValue, resolveOpenClawHome, resolveOptionalPluginSetting, resolvePluginSetting, resolveWorkspacePath, run, runScript, runWithRetry, saveCache, seedContent, seedSkill, seedSkills, shingles, shouldWrite, sleepAsync, sleepMs, substituteEnvVars, updateManagedSection, uuid, withFileLock, workspaceConfigSchema, writeComponentVersion, writeHeartbeatSection, writeJsonAtomic, writeJsonl };

package/package.json

@@ -3,12 +3,6 @@
   "bin": {
     "jeeves": "./dist/cli/jeeves/index.js"
   },
-  "auto-changelog": {
-    "output": "CHANGELOG.md",
-    "unreleased": true,
-    "commitLimit": false,
-    "hideCredit": true
-  },
   "bugs": {
     "url": "https://github.com/karmaniverous/jeeves/issues"
   },
@@ -18,13 +12,13 @@
     "jsonpath-plus": "^10.4.0",
     "package-directory": "^8.2.0",
     "proper-lockfile": "^4.1.2",
-    "semver": "^7.8.0",
+    "semver": "^7.8.1",
     "zod": "^4.4.3"
   },
   "description": "Shared library and CLI for the Jeeves AI assistant platform.",
   "devDependencies": {
     "@commander-js/extra-typings": "^14.0.0",
-    "@dotenvx/dotenvx": "^1.65.0",
+    "@dotenvx/dotenvx": "^1.69.1",
     "@eslint/js": "^10.0.1",
     "@rollup/plugin-alias": "^6.0.0",
     "@rollup/plugin-commonjs": "^29.0.2",
@@ -33,33 +27,33 @@
     "@rollup/plugin-replace": "^6.0.3",
     "@rollup/plugin-typescript": "^12.3.0",
     "@types/fs-extra": "^11.0.4",
-    "@types/node": "^25.7.0",
+    "@types/node": "^25.9.1",
     "@types/proper-lockfile": "^4.1.4",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^4.1.6",
-    "@vitest/eslint-plugin": "^1.6.17",
-    "auto-changelog": "^2.5.1",
+    "@vitest/coverage-v8": "^4.1.7",
+    "@vitest/eslint-plugin": "^1.6.18",
     "cross-env": "^10.1.0",
-    "eslint": "^10.3.0",
+    "eslint": "^10.4.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-prettier": "^5.5.5",
+    "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-simple-import-sort": "^13.0.0",
     "eslint-plugin-tsdoc": "^0.5.2",
     "fs-extra": "^11.3.5",
-    "knip": "^6.13.0",
-    "lefthook": "^2.1.6",
+    "git-cliff": "^2.13.1",
+    "knip": "^6.14.2",
+    "lefthook": "^2.1.9",
     "prettier": "^3.8.3",
     "release-it": "^20.0.1",
     "rimraf": "^6.1.3",
-    "rollup": "^4.60.3",
+    "rollup": "^4.60.4",
     "rollup-plugin-dts": "^6.4.1",
     "tslib": "^2.8.1",
     "typedoc": "^0.28.19",
     "typedoc-plugin-mdn-links": "^5.1.1",
     "typedoc-plugin-replace-text": "^4.2.0",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.59.3",
-    "vitest": "^4.1.6"
+    "typescript-eslint": "^8.60.0",
+    "vitest": "^4.1.7"
   },
   "engines": {
     "node": ">=22"
@@ -92,7 +86,7 @@
   },
   "release-it": {
     "git": {
-      "changelog": "npx auto-changelog --unreleased-only --stdout --template https://raw.githubusercontent.com/release-it/release-it/main/templates/changelog-compact.hbs",
+      "changelog": "npx git-cliff --unreleased --strip header",
       "commitMessage": "chore: release v${version}",
       "requireBranch": "main"
     },
@@ -112,7 +106,7 @@
         "git switch ${branchName}"
       ],
       "after:bump": [
-        "npx auto-changelog -p",
+        "npx git-cliff -o CHANGELOG.md",
         "npm run docs",
         "git add CHANGELOG.md"
       ]
@@ -127,7 +121,7 @@
   },
   "scripts": {
     "build": "rimraf dist && cross-env NO_COLOR=1 rollup --config rollup.config.ts --configPlugin @rollup/plugin-typescript",
-    "changelog": "auto-changelog",
+    "changelog": "git-cliff -o CHANGELOG.md",
     "diagrams": "cd diagrams/src && plantuml -tpng -o ../out -r .",
     "docs": "typedoc",
     "knip": "knip",
@@ -140,5 +134,5 @@
   },
   "type": "module",
   "types": "dist/index.d.ts",
-  "version": "0.5.10"
+  "version": "0.5.12"
 }