@lobu/openclaw-plugin 6.0.1 → 7.0.0

package/dist/index.js

@@ -4,9 +4,55 @@ import { homedir } from 'node:os';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
-import { renderFallbackSystemContext } from './owletto-guidance.js';
-const AUTH_REQUIRED_MSG = 'Lobu memory is not connected. Call the owletto_login tool to authenticate, then show the user the login URL and code. After the user completes login in their browser, call owletto_login_check to finish authentication.';
+import { renderFallbackSystemContext } from './lobu-guidance.js';
+const AUTH_REQUIRED_MSG = 'Lobu memory is not connected. Call the lobu_login tool to authenticate, then show the user the login URL and code. After the user completes login in their browser, call lobu_login_check to finish authentication.';
 const DEFAULT_RECALL_LIMIT = 6;
+// Lobu MCP server tools exposed via `tools/list` (see packages/server/src/tools/registry.ts).
+// Each is registered with OpenClaw as `lobu_<name>`. OpenClaw 2026.5.x requires every
+// runtime-registered tool to appear in `contracts.tools` in openclaw.plugin.json — keep the
+// `lobu_*` entries there in sync with this set (a unit test enforces it). Server tools not
+// listed here are skipped rather than registered (and rejected) until this plugin is updated
+// to declare them.
+export const KNOWN_MCP_TOOL_NAMES = new Set([
+    'search_memory',
+    'save_memory',
+    'list_organizations',
+    'search_sdk',
+    'query_sdk',
+    'query_sql',
+    'run_sdk',
+]);
+// Auth tools the plugin always registers in standalone mode (see register()).
+export const LOGIN_TOOL_NAMES = ['lobu_login', 'lobu_login_check'];
+// `before_prompt_build` / `before_agent_start` run inside OpenClaw's hook budget
+// (~15s) — a slow `search_memory` must not blow that. Bound the recall round-trip
+// well under it and degrade to "no recall" rather than letting OpenClaw kill the hook.
+const RECALL_TIMEOUT_MS = 8_000;
+/**
+ * Run `work` with a hard wall-clock deadline. On timeout, the supplied
+ * `AbortSignal` is aborted (so an in-flight `fetch` cancels instead of
+ * lingering) and `onTimeout` is returned regardless of what is still pending.
+ * `work` is responsible for swallowing its own rejections; if it rejects after
+ * the deadline, the rejection is observed and ignored.
+ */
+export async function runWithAbortDeadline(work, timeoutMs, onTimeout) {
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((resolveDeadline) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            resolveDeadline(onTimeout);
+        }, timeoutMs);
+    });
+    const guarded = work(controller.signal).catch(() => onTimeout);
+    try {
+        return await Promise.race([guarded, deadline]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
 // Minimal fallback context used before the workspace instructions are fetched.
 // Initialized lazily per mode (gateway vs standalone) in register().
 let FALLBACK_SYSTEM_CONTEXT = null;
@@ -37,7 +83,7 @@ let mcpSessionId = null;
 const MCP_PROTOCOL_VERSION = '2025-03-26';
 // Make an MCP JSON-RPC request with session management.
 // Server returns plain JSON when Accept doesn't include text/event-stream.
-async function mcpFetch(url, body, extraHeaders) {
+async function mcpFetch(url, body, extraHeaders, signal) {
     const headers = {
         'Content-Type': 'application/json',
         Accept: 'application/json',
@@ -50,6 +96,7 @@ async function mcpFetch(url, body, extraHeaders) {
         method: 'POST',
         headers,
         body: JSON.stringify(body),
+        signal,
     });
     const newSessionId = response.headers.get('mcp-session-id');
     if (newSessionId) {
@@ -61,7 +108,7 @@ async function mcpFetch(url, body, extraHeaders) {
 // Worker daemon process (auto-started after login)
 let workerProcess = null;
 function getTokenStorePath() {
-    return resolve(homedir(), '.owletto', 'openclaw-auth.json');
+    return resolve(homedir(), '.lobu', 'openclaw-auth.json');
 }
 function normalizeMcpUrl(input) {
     const url = new URL(input);
@@ -122,10 +169,10 @@ function saveStoredSession(mcpUrl, data) {
     writeFileSync(storePath, JSON.stringify(store, null, 2) + '\n', { mode: 0o600 });
 }
 const fallbackLogger = {
-    info: (msg) => console.log(`[openclaw-owletto-plugin] INFO: ${msg}`),
-    warn: (msg) => console.warn(`[openclaw-owletto-plugin] WARN: ${msg}`),
-    error: (msg) => console.error(`[openclaw-owletto-plugin] ERROR: ${msg}`),
-    debug: (msg) => console.debug(`[openclaw-owletto-plugin] DEBUG: ${msg}`),
+    info: (msg) => console.log(`[openclaw-lobu-plugin] INFO: ${msg}`),
+    warn: (msg) => console.warn(`[openclaw-lobu-plugin] WARN: ${msg}`),
+    error: (msg) => console.error(`[openclaw-lobu-plugin] ERROR: ${msg}`),
+    debug: (msg) => console.debug(`[openclaw-lobu-plugin] DEBUG: ${msg}`),
 };
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
@@ -184,9 +231,9 @@ function readPluginConfig(api, pluginId) {
 function resolvePluginConfig(api, pluginId) {
     const cfg = readPluginConfig(api, pluginId);
     const mcpUrl = asString(cfg.mcpUrl);
-    const webUrl = asString(cfg.webUrl) ?? asString(process.env.OWLETTO_WEB_URL);
-    const token = asString(cfg.token) ?? asString(process.env.OWLETTO_MCP_TOKEN);
-    const tokenCommand = asString(cfg.tokenCommand) ?? asString(process.env.OWLETTO_MCP_TOKEN_COMMAND);
+    const webUrl = asString(cfg.webUrl) ?? asString(process.env.LOBU_WEB_URL);
+    const token = asString(cfg.token) ?? asString(process.env.LOBU_MCP_TOKEN);
+    const tokenCommand = asString(cfg.tokenCommand) ?? asString(process.env.LOBU_MCP_TOKEN_COMMAND);
     const gatewayAuthUrl = asString(cfg.gatewayAuthUrl) ?? asString(process.env.GATEWAY_AUTH_URL);
     const headers = {};
     if (isRecord(cfg.headers)) {
@@ -225,10 +272,10 @@ function parseErrorMessage(payload) {
     }
     return 'Unknown MCP error';
 }
-class OwlettoAuthError extends Error {
+class LobuAuthError extends Error {
     constructor(message) {
         super(message);
-        this.name = 'OwlettoAuthError';
+        this.name = 'LobuAuthError';
     }
 }
 async function resolveAuthToken(config) {
@@ -261,55 +308,6 @@ function hasAuthConfigured(config) {
 function getWorkerToken() {
     return asString(process.env.WORKER_TOKEN);
 }
-async function gatewayDeviceAuthStart(gatewayAuthUrl) {
-    const workerToken = getWorkerToken();
-    if (!workerToken)
-        throw new Error('WORKER_TOKEN not set');
-    const response = await fetch(`${gatewayAuthUrl}/internal/device-auth/start`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${workerToken}`,
-        },
-        body: JSON.stringify({ mcpId: 'owletto' }),
-    });
-    if (!response.ok) {
-        const errText = await response.text();
-        throw new Error(`Gateway device auth start failed: ${errText}`);
-    }
-    return (await response.json());
-}
-async function gatewayDeviceAuthPoll(gatewayAuthUrl) {
-    const workerToken = getWorkerToken();
-    if (!workerToken)
-        throw new Error('WORKER_TOKEN not set');
-    const response = await fetch(`${gatewayAuthUrl}/internal/device-auth/poll`, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            Authorization: `Bearer ${workerToken}`,
-        },
-        body: JSON.stringify({ mcpId: 'owletto' }),
-    });
-    return (await response.json());
-}
-async function gatewayDeviceAuthCheck(gatewayAuthUrl) {
-    const workerToken = getWorkerToken();
-    if (!workerToken)
-        return false;
-    try {
-        const response = await fetch(`${gatewayAuthUrl}/internal/device-auth/status?mcpId=owletto`, {
-            headers: { Authorization: `Bearer ${workerToken}` },
-        });
-        if (!response.ok)
-            return false;
-        const data = (await response.json());
-        return !!data.authenticated;
-    }
-    catch {
-        return false;
-    }
-}
 function clearSessionTokens() {
     sessionToken = null;
     _sessionRefreshToken = null;
@@ -325,7 +323,7 @@ function spawnWorkerDaemon(mcpUrl, accessToken, log) {
     if (workerProcess) {
         // Already running — check if the process is still alive
         if (workerProcess.exitCode === null && !workerProcess.killed) {
-            log.info('owletto: worker daemon already running');
+            log.info('lobu: worker daemon already running');
             return;
         }
         workerProcess = null;
@@ -338,7 +336,7 @@ function spawnWorkerDaemon(mcpUrl, accessToken, log) {
             env: { ...process.env, WORKER_API_TOKEN: accessToken },
         });
         workerProcess.unref();
-        log.info(`owletto: worker daemon spawned (pid=${workerProcess.pid})`);
+        log.info(`lobu: worker daemon spawned (pid=${workerProcess.pid})`);
         // Clean up on process exit
         const cleanup = () => {
             if (workerProcess && workerProcess.exitCode === null && !workerProcess.killed) {
@@ -355,7 +353,7 @@ function spawnWorkerDaemon(mcpUrl, accessToken, log) {
         process.on('SIGTERM', cleanup);
     }
     catch (err) {
-        log.warn(`owletto: failed to spawn worker daemon: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`lobu: failed to spawn worker daemon: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 async function initiateDeviceLogin(mcpUrl, scope, resource) {
@@ -367,7 +365,7 @@ async function initiateDeviceLogin(mcpUrl, scope, resource) {
         body: JSON.stringify({
             grant_types: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token'],
             token_endpoint_auth_method: 'none',
-            client_name: 'OpenClaw Owletto Plugin',
+            client_name: 'OpenClaw Lobu Plugin',
             software_id: 'openclaw',
             software_version: PLUGIN_VERSION,
             scope,
@@ -443,6 +441,75 @@ async function pollDeviceLogin(state) {
     const desc = typeof data.error_description === 'string' ? data.error_description : error;
     return { status: 'error', message: desc || 'Unknown error during login' };
 }
+/**
+ * Synchronous variant of {@link tryRefreshToken}, used at plugin `register()`
+ * time before the worker daemon is spawned. The daemon reads `WORKER_API_TOKEN`
+ * from its env once at process start, so a lazy refresh in `callMcpTool` (which
+ * only updates the in-process `sessionToken`) wouldn't reach it — we must hand
+ * the daemon a fresh token up front. Runs the refresh in a short-lived `node -e`
+ * subprocess; the OAuth params are passed via env vars, never interpolated into
+ * the script source.
+ */
+function refreshStoredTokenSync(mcpUrl) {
+    if (!_sessionRefreshToken || !sessionClientId || !sessionIssuer)
+        return;
+    const body = {
+        grant_type: 'refresh_token',
+        client_id: sessionClientId,
+        refresh_token: _sessionRefreshToken,
+    };
+    if (sessionClientSecret)
+        body.client_secret = sessionClientSecret;
+    const script = `
+    async function run() {
+      const r = await fetch(process.env.__TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: process.env.__TOKEN_BODY,
+      });
+      if (!r.ok) return;
+      const d = await r.json();
+      process.stdout.write(JSON.stringify({ access_token: d.access_token, refresh_token: d.refresh_token }));
+    }
+    run().catch(() => {});
+  `;
+    try {
+        const out = spawnSync('node', ['-e', script], {
+            timeout: 10_000,
+            stdio: ['pipe', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                __TOKEN_URL: `${sessionIssuer}/oauth/token`,
+                __TOKEN_BODY: JSON.stringify(body),
+            },
+        })
+            .stdout?.toString()
+            .trim();
+        if (!out)
+            return;
+        const tokens = JSON.parse(out);
+        if (typeof tokens.access_token !== 'string')
+            return;
+        sessionToken = tokens.access_token;
+        if (typeof tokens.refresh_token === 'string')
+            _sessionRefreshToken = tokens.refresh_token;
+        try {
+            saveStoredSession(mcpUrl, {
+                issuer: sessionIssuer,
+                clientId: sessionClientId,
+                clientSecret: sessionClientSecret,
+                refreshToken: _sessionRefreshToken,
+                accessToken: sessionToken,
+            });
+        }
+        catch {
+            // Best-effort persist.
+        }
+    }
+    catch {
+        // Best-effort refresh — fall back to the persisted (possibly stale) token.
+    }
+}
 async function tryRefreshToken(mcpUrl) {
     if (!_sessionRefreshToken || !sessionClientId || !sessionIssuer)
         return false;
@@ -510,7 +577,7 @@ async function reinitializeMcpSession(config) {
                 params: {
                     protocolVersion: MCP_PROTOCOL_VERSION,
                     capabilities: {},
-                    clientInfo: { name: 'openclaw-owletto', version: '1.0.0' },
+                    clientInfo: { name: 'openclaw-lobu', version: '1.0.0' },
                 },
             }),
         });
@@ -525,12 +592,15 @@ async function reinitializeMcpSession(config) {
         return false;
     }
 }
-async function callMcpTool(config, toolName, args) {
+async function callMcpTool(config, toolName, args, options) {
     if (!config.mcpUrl)
         return null;
     const token = await resolveAuthToken(config);
     const rpcId = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
     const authHeaders = { ...config.headers };
+    if (options?.rawJson) {
+        authHeaders['X-MCP-Format'] = 'json';
+    }
     if (token) {
         authHeaders.Authorization = `Bearer ${token}`;
     }
@@ -542,7 +612,7 @@ async function callMcpTool(config, toolName, args) {
     };
     let result;
     try {
-        result = await mcpFetch(config.mcpUrl, rpcBody, authHeaders);
+        result = await mcpFetch(config.mcpUrl, rpcBody, authHeaders, options?.signal);
     }
     catch (err) {
         throw new Error(`MCP fetch failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -554,14 +624,14 @@ async function callMcpTool(config, toolName, args) {
         if (refreshed && sessionToken) {
             authHeaders.Authorization = `Bearer ${sessionToken}`;
             const retryBody = { ...rpcBody, id: `${rpcId}-retry` };
-            const retry = await mcpFetch(config.mcpUrl, retryBody, authHeaders);
+            const retry = await mcpFetch(config.mcpUrl, retryBody, authHeaders, options?.signal);
             data = retry.data;
             response = retry.response;
         }
     }
     if (response.status === 401 || response.status === 403) {
         clearSessionTokens();
-        throw new OwlettoAuthError(AUTH_REQUIRED_MSG);
+        throw new LobuAuthError(AUTH_REQUIRED_MSG);
     }
     // Re-initialize MCP session on stale/missing session errors
     if (response.status === 400 || response.status === 404) {
@@ -572,7 +642,7 @@ async function callMcpTool(config, toolName, args) {
             const newSession = await reinitializeMcpSession(config);
             if (newSession) {
                 const retryBody = { ...rpcBody, id: `${rpcId}-reinit` };
-                const retry = await mcpFetch(config.mcpUrl, retryBody, authHeaders);
+                const retry = await mcpFetch(config.mcpUrl, retryBody, authHeaders, options?.signal);
                 data = retry.data;
                 response = retry.response;
             }
@@ -582,7 +652,7 @@ async function callMcpTool(config, toolName, args) {
         const errMsg = parseErrorMessage(data);
         if (isAuthErrorMessage(errMsg)) {
             clearSessionTokens();
-            throw new OwlettoAuthError(errMsg);
+            throw new LobuAuthError(errMsg);
         }
         throw new Error(errMsg);
     }
@@ -591,7 +661,7 @@ async function callMcpTool(config, toolName, args) {
         const errMsg = parseErrorMessage(rpcResponse.error);
         if (isAuthErrorMessage(errMsg)) {
             clearSessionTokens();
-            throw new OwlettoAuthError(errMsg);
+            throw new LobuAuthError(errMsg);
         }
         throw new Error(errMsg);
     }
@@ -609,7 +679,7 @@ async function callMcpTool(config, toolName, args) {
         const errMsg = contentText || parseErrorMessage(rpcResult.error);
         if (isAuthErrorMessage(errMsg)) {
             clearSessionTokens();
-            throw new OwlettoAuthError(errMsg);
+            throw new LobuAuthError(errMsg);
         }
         throw new Error(errMsg);
     }
@@ -637,7 +707,7 @@ async function fetchWorkspaceInstructions(config, log) {
             params: {
                 protocolVersion: MCP_PROTOCOL_VERSION,
                 capabilities: {},
-                clientInfo: { name: 'openclaw-owletto', version: '1.0.0' },
+                clientInfo: { name: 'openclaw-lobu', version: '1.0.0' },
             },
         }, authHeaders);
         if (!response.ok)
@@ -648,11 +718,11 @@ async function fetchWorkspaceInstructions(config, log) {
             : null;
         if (result && typeof result.instructions === 'string') {
             cachedWorkspaceInstructions = result.instructions;
-            log.info('owletto: loaded workspace instructions after login');
+            log.info('lobu: loaded workspace instructions after login');
         }
     }
     catch (err) {
-        log.warn(`owletto: failed to fetch workspace instructions: ${err instanceof Error ? err.message : String(err)}`);
+        log.warn(`lobu: failed to fetch workspace instructions: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 function fetchMcpBootstrapSync(config) {
@@ -682,7 +752,7 @@ function fetchMcpBootstrapSync(config) {
     const base = { 'Content-Type': 'application/json', 'Accept': 'application/json' };
     if (token) base.Authorization = 'Bearer ' + token;
     async function run() {
-      const initRes = await fetch(url, { method: 'POST', headers: base, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'openclaw-owletto', version: '1.0.0' } } }) });
+      const initRes = await fetch(url, { method: 'POST', headers: base, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-03-26', capabilities: {}, clientInfo: { name: 'openclaw-lobu', version: '1.0.0' } } }) });
       const initData = await initRes.json();
       const sid = initRes.headers.get('mcp-session-id');
       const h2 = { ...base };
@@ -721,28 +791,34 @@ function registerMcpTools(config, registerTool, log) {
     }
     if (instructions) {
         cachedWorkspaceInstructions = instructions;
-        log.info('owletto: loaded workspace instructions from MCP server');
+        log.info('lobu: loaded workspace instructions from MCP server');
     }
     if (tools.length === 0) {
-        log.warn('owletto: no MCP tools found (or fetch failed)');
+        log.warn('lobu: no MCP tools found (or fetch failed)');
         return;
     }
+    let registered = 0;
     for (const tool of tools) {
+        if (!KNOWN_MCP_TOOL_NAMES.has(tool.name)) {
+            log.warn(`lobu: MCP server exposes tool "${tool.name}" not declared in contracts.tools; skipping. Update @lobu/openclaw-plugin to register it.`);
+            continue;
+        }
         registerTool({
-            name: `owletto_${tool.name}`,
+            name: `lobu_${tool.name}`,
             label: tool.name.replace(/_/g, ' '),
-            description: tool.description || `Owletto MCP tool: ${tool.name}`,
+            description: tool.description || `Lobu MCP tool: ${tool.name}`,
             parameters: tool.inputSchema || { type: 'object', properties: {} },
             execute: async (_id, args) => {
                 const result = await callMcpTool(config, tool.name, args);
                 return { content: result?.content ?? [], details: {} };
             },
         });
+        registered++;
     }
-    log.info(`owletto: registered ${tools.length} MCP tools`);
+    log.info(`lobu: registered ${registered} MCP tools`);
 }
 const plugin = {
-    id: 'openclaw-owletto',
+    id: 'openclaw-lobu',
     name: 'Lobu Memory',
     description: 'Lobu long-term memory plugin via MCP.',
     kind: 'memory',
@@ -754,7 +830,7 @@ const plugin = {
             : undefined;
         const config = resolvePluginConfig(api, plugin.id);
         if (!config.mcpUrl) {
-            log.warn('owletto: missing config.mcpUrl (plugins.entries.openclaw-owletto.config.mcpUrl)');
+            log.warn('lobu: missing config.mcpUrl (plugins.entries.openclaw-lobu.config.mcpUrl)');
         }
         // Initialize fallback system context based on mode
         FALLBACK_SYSTEM_CONTEXT = renderFallbackSystemContext({
@@ -774,57 +850,11 @@ const plugin = {
                 sessionClientId = stored.clientId || null;
                 sessionClientSecret = stored.clientSecret || null;
                 sessionIssuer = stored.issuer || null;
-                // Proactively refresh the token — the persisted access token may be expired
-                if (_sessionRefreshToken && sessionIssuer && sessionClientId) {
-                    try {
-                        const body = {
-                            grant_type: 'refresh_token',
-                            client_id: sessionClientId,
-                            refresh_token: _sessionRefreshToken,
-                        };
-                        if (sessionClientSecret)
-                            body.client_secret = sessionClientSecret;
-                        // spawnSync imported at top-level (ESM-safe)
-                        const scriptCode = [
-                            'async function run() {',
-                            `  const r = await fetch(${JSON.stringify(sessionIssuer + '/oauth/token')}, {`,
-                            '    method: "POST",',
-                            '    headers: { "Content-Type": "application/json" },',
-                            `    body: ${JSON.stringify(JSON.stringify(body))},`,
-                            '  });',
-                            '  if (!r.ok) return;',
-                            '  const d = await r.json();',
-                            '  process.stdout.write(JSON.stringify({ access_token: d.access_token, refresh_token: d.refresh_token }));',
-                            '}',
-                            'run().catch(() => {});',
-                        ].join('\n');
-                        const proc = spawnSync('node', ['-e', scriptCode], {
-                            timeout: 10_000,
-                            stdio: ['pipe', 'pipe', 'pipe'],
-                        });
-                        const out = proc.stdout?.toString().trim() ?? '';
-                        if (out) {
-                            const tokens = JSON.parse(out);
-                            if (tokens.access_token) {
-                                sessionToken = tokens.access_token;
-                                if (tokens.refresh_token)
-                                    _sessionRefreshToken = tokens.refresh_token;
-                                saveStoredSession(config.mcpUrl, {
-                                    issuer: sessionIssuer,
-                                    clientId: sessionClientId,
-                                    clientSecret: sessionClientSecret,
-                                    refreshToken: _sessionRefreshToken,
-                                    accessToken: sessionToken,
-                                });
-                                log.info('owletto: refreshed expired access token');
-                            }
-                        }
-                    }
-                    catch (refreshErr) {
-                        log.warn(`owletto: token refresh failed: ${refreshErr instanceof Error ? refreshErr.message : String(refreshErr)}`);
-                    }
-                }
-                // Auto-start worker daemon with (possibly refreshed) token
+                // The persisted access token may be expired — refresh it before
+                // spawning the daemon, which captures WORKER_API_TOKEN at process start
+                // and won't see a later lazy refresh from callMcpTool.
+                refreshStoredTokenSync(config.mcpUrl);
+                // Auto-start worker daemon with the (possibly refreshed) token
                 spawnWorkerDaemon(config.mcpUrl, sessionToken, log);
             }
         }
@@ -835,52 +865,15 @@ const plugin = {
         if (registerTool && config.mcpUrl && !config.gatewayAuthUrl) {
             const mcpUrl = config.mcpUrl;
             registerTool({
-                name: 'owletto_login',
-                label: 'Owletto Login',
-                description: 'Start Lobu memory authentication. Only call this if other Lobu memory tools return authentication errors. If Lobu memory is already connected, skip this step. Returns a URL and code for the user to complete login in their browser. After the user completes login, call owletto_login_check to finish.',
+                name: 'lobu_login',
+                label: 'Lobu Login',
+                description: 'Start Lobu memory authentication. Only call this if other Lobu memory tools return authentication errors. If Lobu memory is already connected, skip this step. Returns a URL and code for the user to complete login in their browser. After the user completes login, call lobu_login_check to finish.',
                 parameters: {
                     type: 'object',
                     properties: {},
                 },
                 execute: async () => {
                     try {
-                        // Gateway mode: delegate to gateway device-auth endpoints
-                        if (config.gatewayAuthUrl) {
-                            // Check if already authenticated via gateway
-                            const alreadyAuth = await gatewayDeviceAuthCheck(config.gatewayAuthUrl);
-                            if (alreadyAuth) {
-                                return {
-                                    content: [
-                                        {
-                                            type: 'text',
-                                            text: JSON.stringify({
-                                                status: 'already_authenticated',
-                                                message: "You are already authenticated with Owletto. Do NOT call owletto_login again. Proceed directly with the user's request using the available owletto tools.",
-                                            }),
-                                        },
-                                    ],
-                                    details: {},
-                                };
-                            }
-                            const started = await gatewayDeviceAuthStart(config.gatewayAuthUrl);
-                            return {
-                                content: [
-                                    {
-                                        type: 'text',
-                                        text: JSON.stringify({
-                                            status: 'login_started',
-                                            message: 'Open this URL in your browser and enter the code to connect Owletto:',
-                                            verification_url: started.verificationUriComplete || started.verificationUri,
-                                            user_code: started.userCode,
-                                            expires_in_seconds: started.expiresIn,
-                                            next_step: 'After the user completes login in their browser, call owletto_login_check to finish authentication.',
-                                        }),
-                                    },
-                                ],
-                                details: {},
-                            };
-                        }
-                        // Standalone mode: direct device flow
                         if (sessionToken) {
                             return {
                                 content: [
@@ -888,7 +881,7 @@ const plugin = {
                                         type: 'text',
                                         text: JSON.stringify({
                                             status: 'already_authenticated',
-                                            message: "You are already authenticated with Owletto. Do NOT call owletto_login again. Proceed directly with the user's request using the available owletto tools (owletto_search to discover SDK methods, owletto_execute to run TypeScript over the typed client SDK, owletto_search_knowledge for entity/knowledge search, owletto_save_knowledge to persist).",
+                                            message: "You are already authenticated with Lobu. Do NOT call lobu_login again. Proceed directly with the user's request using the available lobu tools (lobu_search_sdk to discover SDK methods, lobu_query_sdk for read-only TypeScript over the typed client SDK, lobu_run_sdk for full SDK execution, lobu_search_memory for memory search, lobu_save_memory to persist).",
                                         }),
                                     },
                                 ],
@@ -903,11 +896,11 @@ const plugin = {
                                     type: 'text',
                                     text: JSON.stringify({
                                         status: 'login_started',
-                                        message: 'Open this URL in your browser and enter the code to connect Owletto:',
+                                        message: 'Open this URL in your browser and enter the code to connect Lobu:',
                                         verification_url: activeDeviceLogin.verificationUriComplete,
                                         user_code: activeDeviceLogin.userCode,
                                         expires_in_seconds: activeDeviceLogin.expiresIn,
-                                        next_step: 'After the user completes login in their browser, call owletto_login_check to finish authentication.',
+                                        next_step: 'After the user completes login in their browser, call lobu_login_check to finish authentication.',
                                     }),
                                 },
                             ],
@@ -931,66 +924,15 @@ const plugin = {
                 },
             });
             registerTool({
-                name: 'owletto_login_check',
-                label: 'Owletto Login Check',
-                description: 'Check if the user has completed Owletto login in their browser. Call this after owletto_login. Returns success when authenticated, or pending if still waiting.',
+                name: 'lobu_login_check',
+                label: 'Lobu Login Check',
+                description: 'Check if the user has completed Lobu login in their browser. Call this after lobu_login. Returns success when authenticated, or pending if still waiting.',
                 parameters: {
                     type: 'object',
                     properties: {},
                 },
                 execute: async () => {
                     try {
-                        // Gateway mode: poll gateway for completion
-                        if (config.gatewayAuthUrl) {
-                            const result = await gatewayDeviceAuthPoll(config.gatewayAuthUrl);
-                            if (result.status === 'complete') {
-                                log.info('owletto: gateway device auth completed');
-                                // Fetch workspace instructions now that we're authenticated
-                                if (!cachedWorkspaceInstructions) {
-                                    fetchWorkspaceInstructions(config, log);
-                                }
-                                return {
-                                    content: [
-                                        {
-                                            type: 'text',
-                                            text: JSON.stringify({
-                                                status: 'authenticated',
-                                                message: 'Owletto login successful! Memory tools are now available for this session.',
-                                            }),
-                                        },
-                                    ],
-                                    details: {},
-                                };
-                            }
-                            if (result.status === 'pending') {
-                                return {
-                                    content: [
-                                        {
-                                            type: 'text',
-                                            text: JSON.stringify({
-                                                status: 'pending',
-                                                message: 'Waiting for user to approve in browser...',
-                                                next_step: 'Wait a few seconds, then call owletto_login_check again.',
-                                            }),
-                                        },
-                                    ],
-                                    details: {},
-                                };
-                            }
-                            return {
-                                content: [
-                                    {
-                                        type: 'text',
-                                        text: JSON.stringify({
-                                            status: 'error',
-                                            message: result.message || 'Device auth failed',
-                                        }),
-                                    },
-                                ],
-                                details: {},
-                            };
-                        }
-                        // Standalone mode: direct device flow polling
                         if (!activeDeviceLogin) {
                             return {
                                 content: [
@@ -998,7 +940,7 @@ const plugin = {
                                         type: 'text',
                                         text: JSON.stringify({
                                             status: 'error',
-                                            message: 'No login in progress. Call owletto_login first.',
+                                            message: 'No login in progress. Call lobu_login first.',
                                         }),
                                     },
                                 ],
@@ -1021,10 +963,10 @@ const plugin = {
                                         refreshToken: result.refreshToken,
                                         accessToken: result.accessToken,
                                     });
-                                    log.info('owletto: persisted auth token to disk');
+                                    log.info('lobu: persisted auth token to disk');
                                 }
                                 catch (err) {
-                                    log.warn(`owletto: failed to persist auth token: ${err instanceof Error ? err.message : String(err)}`);
+                                    log.warn(`lobu: failed to persist auth token: ${err instanceof Error ? err.message : String(err)}`);
                                 }
                             }
                             config.token = result.accessToken;
@@ -1039,7 +981,7 @@ const plugin = {
                                         type: 'text',
                                         text: JSON.stringify({
                                             status: 'authenticated',
-                                            message: 'Owletto login successful! Memory tools are now available for this session.',
+                                            message: 'Lobu login successful! Memory tools are now available for this session.',
                                         }),
                                     },
                                 ],
@@ -1054,7 +996,7 @@ const plugin = {
                                         text: JSON.stringify({
                                             status: 'pending',
                                             message: result.message,
-                                            next_step: 'Wait a few seconds, then call owletto_login_check again.',
+                                            next_step: 'Wait a few seconds, then call lobu_login_check again.',
                                         }),
                                     },
                                 ],
@@ -1091,7 +1033,7 @@ const plugin = {
                     }
                 },
             });
-            log.info('owletto: registered login tools (owletto_login, owletto_login_check)');
+            log.info('lobu: registered login tools (lobu_login, lobu_login_check)');
         }
         // Dynamic tool registration from MCP server (synchronous so tools are
         // available before OpenClaw builds the prompt).
@@ -1103,39 +1045,62 @@ const plugin = {
         // When autoRecall is enabled, also inject recalled memories.
         {
             const getSystemContext = () => cachedWorkspaceInstructions
-                ? `<owletto-system>\n${cachedWorkspaceInstructions}\n</owletto-system>`
+                ? `<lobu-system>\n${cachedWorkspaceInstructions}\n</lobu-system>`
                 : FALLBACK_SYSTEM_CONTEXT;
-            const doRecall = async (query) => {
-                if (!config.autoRecall || !hasAuthConfigured(config)) {
-                    return '';
-                }
+            const recallOnce = async (query, signal) => {
                 try {
-                    const result = await callMcpTool(config, 'search_knowledge', {
+                    const result = await callMcpTool(config, 'search_memory', {
                         query,
                         include_content: true,
                         content_limit: config.recallLimit,
                         include_connections: false,
                         limit: 3,
-                    });
+                    }, { signal });
                     if (!result)
                         return '';
                     const text = extractTextFromContent(result.content);
                     if (!text.trim())
                         return '';
-                    return ('<owletto-memory>\n' +
+                    return ('<lobu-memory>\n' +
                         "Use these long-term memories only when directly relevant to the user's request.\n" +
                         'Do not mention this memory block unless needed.\n\n' +
                         text +
-                        '\n</owletto-memory>');
+                        '\n</lobu-memory>');
                 }
                 catch (err) {
-                    if (err instanceof OwlettoAuthError) {
+                    if (err instanceof LobuAuthError)
+                        return '';
+                    if (signal.aborted ||
+                        (err instanceof Error && (err.name === 'AbortError' || err.name === 'TimeoutError'))) {
+                        log.warn(`lobu recall skipped: search_memory exceeded ${RECALL_TIMEOUT_MS}ms`);
                         return '';
                     }
-                    log.error(`owletto recall failed: ${err instanceof Error ? err.message : String(err)}`);
+                    log.error(`lobu recall failed: ${err instanceof Error ? err.message : String(err)}`);
                     return '';
                 }
             };
+            // Hard-bound the recall round-trip so it can never blow OpenClaw's hook
+            // budget: abort the in-flight MCP fetch at RECALL_TIMEOUT_MS and degrade
+            // to "no recall" no matter what is still pending (token command, network).
+            //
+            // OpenClaw fires both `before_prompt_build` and `before_agent_start` for
+            // a turn (often back-to-back with the same prompt text). Memoize the last
+            // (query → recallBlock) so the second event is a free cache hit instead
+            // of a second `search_memory` round-trip.
+            let lastRecallQuery = null;
+            let lastRecallBlock = '';
+            const doRecall = async (query) => {
+                if (!config.autoRecall || !hasAuthConfigured(config)) {
+                    return '';
+                }
+                if (query === lastRecallQuery) {
+                    return lastRecallBlock;
+                }
+                const block = await runWithAbortDeadline((signal) => recallOnce(query, signal), RECALL_TIMEOUT_MS, '');
+                lastRecallQuery = query;
+                lastRecallBlock = block;
+                return block;
+            };
             const buildPrependContext = (recallBlock) => ({
                 prependContext: getSystemContext() + (recallBlock ? '\n' + recallBlock : ''),
             });
@@ -1187,57 +1152,112 @@ const plugin = {
         }
         if (config.autoCapture) {
             let lastCapturedLen = 0;
-            on('before_prompt_build', async (event) => {
+            const messageText = (m) => {
+                if (!isRecord(m))
+                    return '';
+                if (typeof m.content === 'string')
+                    return m.content;
+                if (Array.isArray(m.content)) {
+                    return m.content
+                        .filter((p) => isRecord(p) && p.type === 'text')
+                        .map((p) => (isRecord(p) && typeof p.text === 'string' ? p.text : ''))
+                        .join('\n');
+                }
+                return '';
+            };
+            // Run on `agent_end` — the turn is complete and `messages` ends with the
+            // assistant reply. (The worker's plugin-loader only honors
+            // before_agent_start / agent_end; a before_prompt_build registration was
+            // silently dropped, so autoCapture never ran inside Lobu.)
+            on('agent_end', async (event) => {
                 if (!hasAuthConfigured(config))
                     return;
                 const messages = event.messages;
                 if (!Array.isArray(messages) || messages.length < 2)
                     return;
-                // Only capture when new messages appeared since last capture
                 if (messages.length <= lastCapturedLen)
                     return;
-                // Find the most recent assistant+user pair (the previous turn)
-                let lastUser = null;
-                let lastAssistant = null;
+                // Find the last assistant message, then the user message immediately
+                // before it — pairing the answer with the question that prompted it
+                // (not a trailing unanswered user message with the previous reply).
+                let assistantIdx = -1;
                 for (let i = messages.length - 1; i >= 0; i--) {
-                    const m = messages[i];
-                    if (!isRecord(m))
-                        continue;
-                    const text = typeof m.content === 'string'
-                        ? m.content
-                        : Array.isArray(m.content)
-                            ? m.content
-                                .filter((p) => isRecord(p) && p.type === 'text')
-                                .map((p) => (isRecord(p) && typeof p.text === 'string' ? p.text : ''))
-                                .join('\n')
-                            : '';
-                    if (!text.trim())
-                        continue;
-                    if (m.role === 'assistant' && !lastAssistant)
-                        lastAssistant = text.trim();
-                    if (m.role === 'user' && !lastUser)
-                        lastUser = text.trim();
-                    if (lastUser && lastAssistant)
-                        break;
+                    if (isRecord(messages[i]) && messages[i].role === 'assistant') {
+                        const t = messageText(messages[i]);
+                        if (t.trim()) {
+                            assistantIdx = i;
+                            break;
+                        }
+                    }
                 }
+                if (assistantIdx < 1)
+                    return;
+                let userIdx = -1;
+                for (let i = assistantIdx - 1; i >= 0; i--) {
+                    if (isRecord(messages[i]) && messages[i].role === 'user') {
+                        const t = messageText(messages[i]);
+                        if (t.trim()) {
+                            userIdx = i;
+                            break;
+                        }
+                    }
+                }
+                if (userIdx < 0)
+                    return;
+                const lastUser = messageText(messages[userIdx]).trim();
+                const lastAssistant = messageText(messages[assistantIdx]).trim();
                 if (!lastUser || !lastAssistant)
                     return;
                 const combined = `User: ${lastUser}\nAssistant: ${lastAssistant}`;
-                if (combined.length < 16 || combined.includes('<owletto-memory>'))
+                if (combined.length < 16 || combined.includes('<lobu-memory>'))
                     return;
                 lastCapturedLen = messages.length;
                 const content = combined.length > 2000 ? combined.slice(0, 2000) : combined;
-                // Fire-and-forget — don't block prompt build
-                callMcpTool(config, 'save_knowledge', {
+                // Fire-and-forget — don't block the agent_end path.
+                callMcpTool(config, 'save_memory', {
                     content,
                     semantic_type: 'observation',
                     metadata: {},
                 })
-                    .then(() => log.info('owletto: captured conversation observation'))
-                    .catch((err) => log.warn(`owletto: autoCapture failed: ${err instanceof Error ? err.message : String(err)}`));
+                    .then(() => log.info('lobu: captured conversation observation'))
+                    .catch((err) => log.warn(`lobu: autoCapture failed: ${err instanceof Error ? err.message : String(err)}`));
             });
         }
-        log.info(`owletto: initialized (configured=${!!config.mcpUrl}, token=${!!config.token}, tokenCommand=${!!config.tokenCommand}, tools=${!!registerTool})`);
+        log.info(`lobu: initialized (configured=${!!config.mcpUrl}, token=${!!config.token}, tokenCommand=${!!config.tokenCommand}, tools=${!!registerTool})`);
+        // OpenClaw 2026.5.x only surfaces plugin tools to agents when the host's
+        // tool-policy allowlist explicitly opts them in. With no `tools.*` section
+        // in the OpenClaw config, `registerTool` calls succeed but the agent's
+        // tool list silently excludes every lobu_*, wiki_*, and memory_* tool —
+        // the plugin appears healthy in logs while the agent has no way to call it.
+        // Detect this and shout, with a copy-pasteable fix.
+        if (registerTool && config.mcpUrl) {
+            const cfg = isRecord(api.config) ? api.config : {};
+            const topTools = isRecord(cfg.tools) ? cfg.tools : null;
+            const agentDefaults = isRecord(cfg.agents) && isRecord(cfg.agents.defaults)
+                ? cfg.agents.defaults
+                : null;
+            const agentTools = agentDefaults && isRecord(agentDefaults.tools)
+                ? agentDefaults.tools
+                : null;
+            const hasToolPolicy = (t) => !!t &&
+                (typeof t.profile === 'string' ||
+                    (Array.isArray(t.allow) && t.allow.length > 0) ||
+                    (Array.isArray(t.alsoAllow) && t.alsoAllow.length > 0));
+            if (!hasToolPolicy(topTools) && !hasToolPolicy(agentTools)) {
+                log.warn('lobu: no tools.* policy detected in OpenClaw config. Plugin tools ' +
+                    '(lobu_*, wiki_*, memory_*) register successfully but may not ' +
+                    'reach the agent on OpenClaw 2026.5.x — every plugin on the host ' +
+                    'is gated the same way. The autoRecall hook and autoCapture hook ' +
+                    'still write to Lobu in the background (they call MCP directly, ' +
+                    'not via registered agent tools), so memory continues to flow; ' +
+                    'only deliberate agent-driven tool calls during a conversation ' +
+                    'are affected. We have tested tools.profile="full", ' +
+                    'tools.allow with [group:plugins], [*], and explicit tool names, ' +
+                    'and tools.alsoAllow variants — none surface plugin tools on ' +
+                    'OpenClaw 2026.5.2. If you find a host config that works, please ' +
+                    'file at https://github.com/lobu-ai/lobu/issues.');
+            }
+        }
     },
 };
 export default plugin;