@openclaw/clickclack 2026.8.1-beta.3 → 2026.8.2

package/README.md

@@ -119,8 +119,8 @@ not have an account selector.
 Messages in the managed channel run in a stable side session under the same
 agent id as the attached main session. The plugin installs a scoped host grant
 for `sessions_history`, `session_status`, and `sessions_send` between that side
-session and its attached main session, so `tools.sessions.visibility` can stay
-at its safer default `tree`. A second host-side policy blocks session discovery
+session and its attached main session, so `tools.sessions.visibility` can be set
+explicitly to `tree` for narrower access than the agent-wide default. A second host-side policy blocks session discovery
 and alternate targets; the side-agent prompt is not the authorization boundary.
 The agent still needs those three tools in its effective tool allowlist.
 

package/dist/api.js

@@ -1,3 +1,3 @@
-import { _ as DEFAULT_ACCOUNT_ID, b as resolveClickClackAccount, p as clickClackConfigSchema, u as createClickClackClient, v as listClickClackAccountIds, x as resolveDefaultClickClackAccountId, y as listEnabledClickClackAccounts } from "./setup-surface-BQ1Zyohu.js";
-import { a as setClickClackRuntime, i as getClickClackRuntime, n as buildClickClackTarget, r as parseClickClackTarget, t as clickClackPlugin } from "./channel-ChO3E9i2.js";
+import { _ as DEFAULT_ACCOUNT_ID, b as resolveClickClackAccount, p as clickClackConfigSchema, u as createClickClackClient, v as listClickClackAccountIds, x as resolveDefaultClickClackAccountId, y as listEnabledClickClackAccounts } from "./setup-surface-k_ZLgpwc.js";
+import { a as setClickClackRuntime, i as getClickClackRuntime, n as buildClickClackTarget, r as parseClickClackTarget, t as clickClackPlugin } from "./channel-84ZGfWxl.js";
 export { DEFAULT_ACCOUNT_ID, buildClickClackTarget, clickClackConfigSchema, clickClackPlugin, createClickClackClient, getClickClackRuntime, listClickClackAccountIds, listEnabledClickClackAccounts, parseClickClackTarget, resolveClickClackAccount, resolveDefaultClickClackAccountId, setClickClackRuntime };

package/dist/{channel-ChO3E9i2.js → channel-84ZGfWxl.js}

@@ -1,10 +1,11 @@
-import { _ as DEFAULT_ACCOUNT_ID, b as resolveClickClackAccount, c as resolveWorkspaceId, f as normalizeClickClackCorrelationId, g as clickClackMeta, h as clickClackConfigAdapter, l as ClickClackHttpError, m as CLICKCLACK_CHANNEL_ID, n as clickClackSetupContract, p as clickClackConfigSchema, s as resolveChannelId, t as clickClackSetupWizard, u as createClickClackClient, y as listEnabledClickClackAccounts } from "./setup-surface-BQ1Zyohu.js";
+import { _ as DEFAULT_ACCOUNT_ID, b as resolveClickClackAccount, c as resolveWorkspaceId, f as normalizeClickClackCorrelationId, g as clickClackMeta, h as clickClackConfigAdapter, l as ClickClackHttpError, m as CLICKCLACK_CHANNEL_ID, n as clickClackSetupContract, p as clickClackConfigSchema, s as resolveChannelId, t as clickClackSetupWizard, u as createClickClackClient, y as listEnabledClickClackAccounts } from "./setup-surface-k_ZLgpwc.js";
 import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-BKkzzjBA.js";
+import { resolveChannelMediaMaxBytes } from "openclaw/plugin-sdk/account-helpers";
 import { parseDateStringTimestampMs } from "openclaw/plugin-sdk/number-runtime";
 import { mergePairLoopGuardConfig } from "openclaw/plugin-sdk/pair-loop-guard-runtime";
 import { readStringField } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { buildChannelOutboundSessionRoute, buildThreadAwareOutboundSessionRoute, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
-import { buildChannelProgressDraftLine, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, deriveDurableFinalDeliveryRequirements } from "openclaw/plugin-sdk/channel-outbound";
+import { buildChannelProgressDraftLine, createChannelMessageReplyPipeline, createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, deriveDurableFinalDeliveryRequirements } from "openclaw/plugin-sdk/channel-outbound";
 import { createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
 import { channelReadyPatch, channelStoppedPatch } from "openclaw/plugin-sdk/gateway-runtime";
@@ -500,7 +501,7 @@ const CLICKCLACK_MENTION_PATTERN = /(?:^|[^a-z0-9_@-])@([a-z0-9][a-z0-9_-]{1,31}
 function buildLocalMentionRegexes(params) {
 	if (params.mentionPatterns.length === 0) return [];
 	const cfg = params.cfg;
-	return buildMentionRegexes({
+	const syntheticCfg = {
 		...cfg,
 		messages: {
 			...cfg?.messages,
@@ -509,7 +510,8 @@ function buildLocalMentionRegexes(params) {
 				mentionPatterns: params.mentionPatterns
 			}
 		}
-	}, void 0, {
+	};
+	return buildMentionRegexes(syntheticCfg, void 0, {
 		provider: "clickclack",
 		conversationId: params.channelId
 	});
@@ -1081,11 +1083,11 @@ function createClickClackActivityPublisher(params) {
 * Outbound ClickClack delivery helpers for channel messages, thread replies,
 * and direct messages.
 */
-const CLICKCLACK_MAX_UPLOAD_BYTES = 64 * 1024 * 1024;
+const CLICKCLACK_MAX_UPLOAD_BYTES = 67108864;
 const CLICKCLACK_FORMAT_PROFILE = FormatCapabilityProfile.define({
 	mechanism: "markdown",
 	chunk: {
-		limit: 1024 * 1024,
+		limit: 1048576,
 		unit: "bytes"
 	}
 });
@@ -1211,13 +1213,18 @@ async function sendClickClackMedia(params) {
 		deliveryQueueId: params.deliveryQueueId,
 		deliveryPartIndex: params.deliveryPartIndex
 	});
+	const { account, client } = createOutboundContext(params);
+	const maxBytes = Math.min(resolveChannelMediaMaxBytes({
+		cfg: params.cfg,
+		accountId: account.accountId,
+		resolveChannelLimitMb: () => account.config.mediaMaxMb
+	}) ?? CLICKCLACK_MAX_UPLOAD_BYTES, CLICKCLACK_MAX_UPLOAD_BYTES);
 	const preloadedMedia = nonces.upload ? void 0 : await loadOutboundMediaFromUrl(params.mediaUrl, {
-		maxBytes: CLICKCLACK_MAX_UPLOAD_BYTES,
+		maxBytes,
 		mediaAccess: params.mediaAccess,
 		mediaLocalRoots: params.mediaLocalRoots,
 		mediaReadFile: params.mediaReadFile
 	});
-	const { account, client } = createOutboundContext(params);
 	const workspaceId = await resolveWorkspaceId(client, account.workspace);
 	const persistedUpload = nonces.upload ? await client.findUploadByNonce({
 		workspaceId,
@@ -1228,7 +1235,7 @@ async function sendClickClackMedia(params) {
 	let mediaFilename = preloadedMedia?.fileName?.trim();
 	if (!upload) {
 		const media = preloadedMedia ?? await loadOutboundMediaFromUrl(params.mediaUrl, {
-			maxBytes: CLICKCLACK_MAX_UPLOAD_BYTES,
+			maxBytes,
 			mediaAccess: params.mediaAccess,
 			mediaLocalRoots: params.mediaLocalRoots,
 			mediaReadFile: params.mediaReadFile
@@ -1592,7 +1599,7 @@ function resolveClickClackAgentRunId(messageId) {
 }
 async function dispatchModelReply(params) {
 	const runtime = getClickClackRuntime();
-	const text = (await runtime.llm.complete({
+	const result = await runtime.llm.complete({
 		agentId: params.route.agentId,
 		model: params.account.model,
 		purpose: "clickclack bot reply",
@@ -1601,14 +1608,28 @@ async function dispatchModelReply(params) {
 			role: "user",
 			content: params.message.body
 		}]
-	})).text.trim();
-	if (!text) {
+	});
+	const completion = result.text.trim();
+	if (!completion) {
 		runtime.logging.getChildLogger({
 			plugin: "clickclack",
 			feature: "model-reply"
 		}).warn(`[${params.account.accountId}] ClickClack model reply produced no sendable text`);
 		return;
 	}
+	const replyPipeline = createChannelMessageReplyPipeline({
+		cfg: params.cfg,
+		agentId: params.route.agentId,
+		channel: CHANNEL_ID$1,
+		accountId: params.account.accountId
+	});
+	replyPipeline.onModelSelected?.({
+		provider: result.provider,
+		model: result.model,
+		thinkLevel: void 0
+	});
+	const responsePrefix = replyPipeline.resolveResponsePrefix?.();
+	const text = responsePrefix && !completion.startsWith(responsePrefix) ? `${responsePrefix} ${completion}` : completion;
 	await sendClickClackText({
 		cfg: params.cfg,
 		accountId: params.account.accountId,
@@ -1869,7 +1890,7 @@ function parseSocketEvent(data) {
 }
 async function processEvent(params) {
 	if (params.event.type !== "message.created" && params.event.type !== "thread.reply_created") return;
-	if (payloadString(params.event, "author_id") === params.botUserId) return;
+	if (params.abortSignal.aborted || payloadString(params.event, "author_id") === params.botUserId) return;
 	const correlationId = eventCorrelationId(params.event);
 	const message = await resolveEventMessage({
 		client: correlationId ? createClickClackClient({
@@ -1883,12 +1904,13 @@ async function processEvent(params) {
 		params.log?.warn?.(`[${params.account.accountId}] skipped unreadable ClickClack message before agent dispatch: type=${params.event.type} messageId=${payloadString(params.event, "message_id") || "unknown"}`);
 		return;
 	}
-	if (message.author_id === params.botUserId) return;
+	if (params.abortSignal.aborted || message.author_id === params.botUserId) return;
 	const access = await resolveClickClackInboundAccess({
 		account: params.account,
 		config: params.config,
 		message
 	});
+	if (params.abortSignal.aborted) return;
 	if (!access.shouldDispatch) {
 		params.log?.info(`[${params.account.accountId}] skipped ClickClack message before agent dispatch: kind=${message.direct_conversation_id ? "dm" : "group"} requireMention=${access.requireMention ?? "unknown"} wasMentioned=${access.mentionFacts.wasMentioned} hasAnyMention=${access.mentionFacts.hasAnyMention ?? "unknown"} commandAuthorized=${access.commandAuthorized}`);
 		return;
@@ -1938,6 +1960,7 @@ async function startClickClackGatewayAccount(ctx) {
 		botHandle: me.handle
 	};
 	const processIncomingEvent = (event) => processEvent({
+		abortSignal: ctx.abortSignal,
 		account,
 		config: ctx.cfg,
 		client,
@@ -2017,6 +2040,7 @@ async function startClickClackGatewayAccount(ctx) {
 				socket.on("message", (data) => {
 					if (closing || settled) return;
 					messageQueue = messageQueue.then(async () => {
+						if (ctx.abortSignal.aborted) return;
 						const event = parseSocketEvent(data);
 						if (!event) {
 							ctx.log?.warn?.(`[${account.accountId}] skipped malformed ClickClack websocket event`);
@@ -2180,21 +2204,22 @@ const clickClackPlugin = createChatChannelPlugin({
 			},
 			resolveOutboundSessionRoute: ({ cfg, agentId, accountId, target, replyToId, threadId, currentSessionKey }) => {
 				const parsed = parseClickClackTarget(target);
+				const baseRoute = buildChannelOutboundSessionRoute({
+					cfg,
+					agentId,
+					channel: CHANNEL_ID,
+					accountId,
+					recipientSessionExact: parsed.kind === "dm",
+					peer: {
+						kind: parsed.chatType === "direct" ? "direct" : "channel",
+						id: buildClickClackTarget(parsed)
+					},
+					chatType: parsed.chatType,
+					from: `clickclack:${accountId ?? DEFAULT_ACCOUNT_ID}`,
+					to: buildClickClackTarget(parsed)
+				});
 				return buildThreadAwareOutboundSessionRoute({
-					route: buildChannelOutboundSessionRoute({
-						cfg,
-						agentId,
-						channel: CHANNEL_ID,
-						accountId,
-						recipientSessionExact: parsed.kind === "dm",
-						peer: {
-							kind: parsed.chatType === "direct" ? "direct" : "channel",
-							id: buildClickClackTarget(parsed)
-						},
-						chatType: parsed.chatType,
-						from: `clickclack:${accountId ?? DEFAULT_ACCOUNT_ID}`,
-						to: buildClickClackTarget(parsed)
-					}),
+					route: baseRoute,
 					replyToId,
 					threadId: threadId ?? (parsed.kind === "thread" ? parsed.id : void 0),
 					currentSessionKey,

package/dist/channel-plugin-api.js

@@ -1,2 +1,2 @@
-import { t as clickClackPlugin } from "./channel-ChO3E9i2.js";
+import { t as clickClackPlugin } from "./channel-84ZGfWxl.js";
 export { clickClackPlugin };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as registerClickClackDiscussions } from "./runtime-api-B0ChZLhm.js";
+import { t as registerClickClackDiscussions } from "./runtime-api-6Kws_vrf.js";
 import { defineBundledChannelEntry } from "openclaw/plugin-sdk/channel-entry-contract";
 //#region extensions/clickclack/index.ts
 /**

package/dist/{runtime-api-B0ChZLhm.js → runtime-api-6Kws_vrf.js}

@@ -1,10 +1,10 @@
-import { b as resolveClickClackAccount, d as isClickClackChannelNameConflict, l as ClickClackHttpError, u as createClickClackClient, v as listClickClackAccountIds } from "./setup-surface-BQ1Zyohu.js";
-import { C as slugifyDiscussionLabel, D as listPendingDiscussionOpens, E as clearPendingDiscussionOpen, O as recordPendingDiscussionOpen, S as resolveDiscussionLabel, T as clearDiscussionBindingGeneration, _ as getClickClackDiscussionBindingStore, b as fallbackDiscussionLabel, c as markClickClackDiscussionChannelIdentityRevoked, d as discussionInfoForBinding, f as normalizedServerBaseUrl, g as bindingMatchesActiveSessionIncarnation, h as attachBindingToCurrentActiveSession, k as reserveDiscussionBindingGeneration, l as markClickClackDiscussionChannelRevoked, o as clearClickClackDiscussionChannelRevoked, p as resolveDiscussionBindingAccount, s as isClickClackDiscussionChannelRevoked, u as discussionAccounts, v as discussionCredentialFingerprint, w as truncateDiscussionDisplayTitle, x as isDiscussionSessionKey, y as discussionExternalRef } from "./channel-ChO3E9i2.js";
+import { b as resolveClickClackAccount, d as isClickClackChannelNameConflict, l as ClickClackHttpError, u as createClickClackClient, v as listClickClackAccountIds } from "./setup-surface-k_ZLgpwc.js";
+import { C as slugifyDiscussionLabel, D as listPendingDiscussionOpens, E as clearPendingDiscussionOpen, O as recordPendingDiscussionOpen, S as resolveDiscussionLabel, T as clearDiscussionBindingGeneration, _ as getClickClackDiscussionBindingStore, b as fallbackDiscussionLabel, c as markClickClackDiscussionChannelIdentityRevoked, d as discussionInfoForBinding, f as normalizedServerBaseUrl, g as bindingMatchesActiveSessionIncarnation, h as attachBindingToCurrentActiveSession, k as reserveDiscussionBindingGeneration, l as markClickClackDiscussionChannelRevoked, o as clearClickClackDiscussionChannelRevoked, p as resolveDiscussionBindingAccount, s as isClickClackDiscussionChannelRevoked, u as discussionAccounts, v as discussionCredentialFingerprint, w as truncateDiscussionDisplayTitle, x as isDiscussionSessionKey, y as discussionExternalRef } from "./channel-84ZGfWxl.js";
 import "./api.js";
 import { randomUUID } from "node:crypto";
 import { buildControlUiSessionPath, registerSessionDiscussionProvider } from "openclaw/plugin-sdk/session-discussion";
 import { createSessionVisibilityChecker } from "openclaw/plugin-sdk/session-visibility";
-import { resolveSessionAgentId } from "openclaw/plugin-sdk/agent-scope-runtime";
+import { resolveSessionAgentIdStrict } from "openclaw/plugin-sdk/agent-scope-runtime";
 import { textResult } from "openclaw/plugin-sdk/tool-results";
 //#region extensions/clickclack/src/discussions/binding-retention.ts
 var DetachedDiscussionBindingRetention = class {
@@ -257,7 +257,7 @@ async function openClickClackDiscussionBinding(params) {
 		if (listPendingDiscussionOpens(runtime).some((pending) => pending.sessionKey === sessionKey)) throw new Error("A previous ClickClack discussion open is still unresolved; restore its credential and retry");
 	}
 	const config = runtime.config.current();
-	const agentId = resolveSessionAgentId({
+	const agentId = resolveSessionAgentIdStrict({
 		config,
 		sessionKey
 	});
@@ -338,7 +338,7 @@ async function openClickClackDiscussionBinding(params) {
 				}
 				break;
 			} catch (error) {
-				if (isClickClackChannelNameConflict(error) && attempt < CHANNEL_NAME_MUTATION_ATTEMPTS$1 - 1) {
+				if (isClickClackChannelNameConflict(error) && attempt < 3) {
 					channels = await client.channels(workspace.id);
 					assertManagedChannelListContract(channels);
 					continue;
@@ -442,7 +442,7 @@ async function openClickClackDiscussionBinding(params) {
 					assertChannelPatch(currentChannel, latestManagedFields);
 					break;
 				} catch (error) {
-					if (!isClickClackChannelNameConflict(error) || attempt === CHANNEL_NAME_MUTATION_ATTEMPTS$1 - 1) throw error;
+					if (!isClickClackChannelNameConflict(error) || attempt === 3) throw error;
 				}
 			}
 		} catch (error) {
@@ -736,7 +736,7 @@ var ClickClackDiscussionService = class {
 					assertChannelPatch(renamed, patch);
 					return renamed;
 				} catch (error) {
-					if (!isClickClackChannelNameConflict(error) || attempt === CHANNEL_NAME_MUTATION_ATTEMPTS - 1) throw error;
+					if (!isClickClackChannelNameConflict(error) || attempt === 3) throw error;
 				}
 			}
 			throw new Error("ClickClack discussion channel name retries were exhausted");

package/dist/runtime-api.js

@@ -1,4 +1,4 @@
-import { b as resolveClickClackAccount, u as createClickClackClient } from "./setup-surface-BQ1Zyohu.js";
-import { a as setClickClackRuntime, r as parseClickClackTarget } from "./channel-ChO3E9i2.js";
-import { t as registerClickClackDiscussions } from "./runtime-api-B0ChZLhm.js";
+import { b as resolveClickClackAccount, u as createClickClackClient } from "./setup-surface-k_ZLgpwc.js";
+import { a as setClickClackRuntime, r as parseClickClackTarget } from "./channel-84ZGfWxl.js";
+import { t as registerClickClackDiscussions } from "./runtime-api-6Kws_vrf.js";
 export { createClickClackClient, parseClickClackTarget, registerClickClackDiscussions, resolveClickClackAccount, setClickClackRuntime };

package/dist/{setup-claim--cdFCz2P.js → setup-claim-D3B51eQ0.js}

@@ -1,10 +1,10 @@
-import { a as isClickClackSetupLoopbackHost, i as buildClickClackSetupClaimUrl, o as requireClickClackSetupApiBaseUrl } from "./setup-surface-BQ1Zyohu.js";
+import { a as isClickClackSetupLoopbackHost, i as buildClickClackSetupClaimUrl, o as requireClickClackSetupApiBaseUrl } from "./setup-surface-k_ZLgpwc.js";
 import { createProviderOperationDeadline, readProviderJsonResponse, readResponseTextLimited, resolveProviderOperationTimeoutMs } from "openclaw/plugin-sdk/provider-http";
 import { fetchWithSsrFGuard, resolvePinnedHostnameWithPolicy, ssrfPolicyFromHttpBaseUrlAllowedHostname } from "openclaw/plugin-sdk/ssrf-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/clickclack/src/setup-claim.ts
-const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
-const CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES = 64 * 1024;
+const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8192;
+const CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES = 65536;
 const CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS = 3e4;
 var ClickClackSetupCodeClaimError = class extends Error {
 	constructor(status, detail) {

package/dist/setup-plugin-api.js

@@ -1,4 +1,4 @@
-import { g as clickClackMeta, h as clickClackConfigAdapter, n as clickClackSetupContract, p as clickClackConfigSchema, t as clickClackSetupWizard } from "./setup-surface-BQ1Zyohu.js";
+import { g as clickClackMeta, h as clickClackConfigAdapter, n as clickClackSetupContract, p as clickClackConfigSchema, t as clickClackSetupWizard } from "./setup-surface-k_ZLgpwc.js";
 //#region extensions/clickclack/src/channel.setup.ts
 const clickClackSetupPlugin = {
 	id: "clickclack",

package/dist/{setup-surface-BQ1Zyohu.js → setup-surface-k_ZLgpwc.js}

@@ -3,9 +3,9 @@ import { DEFAULT_ACCOUNT_ID, DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$2, normali
 import { resolveNormalizedAccountEntry } from "openclaw/plugin-sdk/account-resolution-runtime";
 import { resolveIntegerOption } from "openclaw/plugin-sdk/number-runtime";
 import { mergePairLoopGuardConfig } from "openclaw/plugin-sdk/pair-loop-guard-runtime";
-import { resolveDefaultSecretProviderAlias } from "openclaw/plugin-sdk/provider-auth";
 import { tryReadSecretFileSync } from "openclaw/plugin-sdk/secret-file-runtime";
 import { buildSecretInputSchema, normalizeSecretInputString, resolveSecretInputString } from "openclaw/plugin-sdk/secret-input";
+import { canResolveEnvSecretRefInReadOnlyPath } from "openclaw/plugin-sdk/secret-ref-readonly";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { getChatChannelMeta } from "openclaw/plugin-sdk/channel-plugin-common";
 import { ChannelBotLoopProtectionSchema, buildChannelAllowBotsSchema, buildChannelConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
@@ -121,11 +121,15 @@ function resolveClickClackToken(params) {
 			};
 		}
 		if (resolved.status === "configured_unavailable" && resolved.ref.source === "env") {
-			const providerConfig = params.cfg.secrets?.providers?.[resolved.ref.provider];
-			if (providerConfig) {
+			if (!canResolveEnvSecretRefInReadOnlyPath({
+				cfg: params.cfg,
+				...resolved.ref
+			})) {
+				const providerConfig = params.cfg.secrets?.providers?.[resolved.ref.provider];
+				if (!providerConfig) throw new Error(`Secret provider "${resolved.ref.provider}" is not configured (ref: env:${resolved.ref.provider}:${resolved.ref.id}).`);
 				if (providerConfig.source !== "env") throw new Error(`Secret provider "${resolved.ref.provider}" has source "${providerConfig.source}" but ref requests "env".`);
-				if (providerConfig.allowlist && !providerConfig.allowlist.includes(resolved.ref.id)) throw new Error(`Environment variable "${resolved.ref.id}" is not allowlisted in secrets.providers.${resolved.ref.provider}.allowlist.`);
-			} else if (resolved.ref.provider !== resolveDefaultSecretProviderAlias({ secrets: params.cfg.secrets }, "env")) throw new Error(`Secret provider "${resolved.ref.provider}" is not configured (ref: env:${resolved.ref.provider}:${resolved.ref.id}).`);
+				throw new Error(`Environment variable "${resolved.ref.id}" is not allowlisted in secrets.providers.${resolved.ref.provider}.allowlist.`);
+			}
 			const token = normalizeSecretInputString((params.env ?? process.env)[resolved.ref.id]);
 			return {
 				token: token ?? "",
@@ -246,6 +250,8 @@ const ClickClackAccountConfigSchema = z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	configWrites: z.boolean().optional(),
+	mediaMaxMb: z.number().positive().optional(),
+	responsePrefix: z.string().optional(),
 	baseUrl: z.string().url().optional(),
 	apiBaseUrl: z.string().url().optional(),
 	token: buildSecretInputSchema().optional(),
@@ -280,11 +286,12 @@ const ClickClackAccountConfigSchema = z.object({
 		section: z.string().optional()
 	}).strict().optional()
 }).strict();
+const ClickClackConfigSchema = buildMultiAccountChannelSchema(ClickClackAccountConfigSchema.extend({ historyLimit: z.number().int().min(0).optional() }), { accountSchema: ClickClackAccountConfigSchema.partial() });
 /**
 * Config schema exported to core so `openclaw doctor` and config validation
 * understand both default and named ClickClack accounts.
 */
-const clickClackConfigSchema = buildChannelConfigSchema(buildMultiAccountChannelSchema(ClickClackAccountConfigSchema, { accountSchema: ClickClackAccountConfigSchema.partial() }));
+const clickClackConfigSchema = buildChannelConfigSchema(ClickClackConfigSchema);
 //#endregion
 //#region extensions/clickclack/src/http-client.ts
 /**
@@ -303,11 +310,11 @@ function provenanceFields(provenance) {
 	if (provenance?.runtime?.trim()) fields.author_runtime = provenance.runtime.trim();
 	return fields;
 }
-const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
+const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8192;
 const CLICKCLACK_CORRELATION_ID_MAX_LENGTH = 128;
 const CLICKCLACK_CORRELATION_ID_PATTERN = /^[A-Za-z0-9._:-]+$/u;
 const CLICKCLACK_CORRELATION_ID_HEADER = "X-Correlation-ID";
-const CLICKCLACK_INBOUND_JSON_LIMIT_BYTES = 16 * 1024 * 1024;
+const CLICKCLACK_INBOUND_JSON_LIMIT_BYTES = 16777216;
 const CLICKCLACK_WEBSOCKET_HANDSHAKE_TIMEOUT_MS = 3e4;
 const CLICKCLACK_EPHEMERAL_REQUEST_TIMEOUT_MS = 15e3;
 const CLICKCLACK_MESSAGE_PAGE_LIMIT = 200;
@@ -772,13 +779,14 @@ function formatClickClackSetupCodeClaimError(error) {
 }
 function applyClickClackSetupConfigPatch(params) {
 	const accountId = normalizeAccountId(params.accountId);
+	const scopedConfig = accountId === DEFAULT_ACCOUNT_ID ? params.cfg : moveSingleAccountChannelSectionToDefaultAccount({
+		cfg: params.cfg,
+		channelKey: channel$1,
+		setupSurface: clickClackSetupAdapter
+	});
 	return patchScopedAccountConfig({
 		cfg: prepareScopedSetupConfig({
-			cfg: accountId === DEFAULT_ACCOUNT_ID ? params.cfg : moveSingleAccountChannelSectionToDefaultAccount({
-				cfg: params.cfg,
-				channelKey: channel$1,
-				setupSurface: clickClackSetupAdapter
-			}),
+			cfg: scopedConfig,
 			channelKey: channel$1,
 			accountId,
 			name: params.name,
@@ -813,7 +821,7 @@ const clickClackSetupAdapter = {
 		const claimUrl = setup.exactClaimUrl && !privateApiBaseUrl ? setup.exactClaimUrl : buildClickClackSetupClaimUrl(privateApiBaseUrl ?? setup.baseUrl);
 		let claim;
 		try {
-			const { claimClickClackSetupCode } = await import("./setup-claim--cdFCz2P.js");
+			const { claimClickClackSetupCode } = await import("./setup-claim-D3B51eQ0.js");
 			claim = await claimClickClackSetupCode({
 				claimUrl,
 				code: setup.code,

package/node_modules/ws/lib/permessage-deflate.js

@@ -167,7 +167,9 @@ class PerMessageDeflate {
             (typeof opts.serverMaxWindowBits === 'number' &&
               opts.serverMaxWindowBits > params.server_max_window_bits))) ||
         (typeof opts.clientMaxWindowBits === 'number' &&
-          !params.client_max_window_bits)
+          (typeof params.client_max_window_bits === 'number'
+            ? opts.clientMaxWindowBits > params.client_max_window_bits
+            : !params.client_max_window_bits))
       ) {
         return false;
       }

package/node_modules/ws/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ws",
-  "version": "8.21.1",
+  "version": "8.21.3",
   "description": "Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js",
   "keywords": [
     "HyBi",

package/openclaw.plugin.json

@@ -24,6 +24,13 @@
           "configWrites": {
             "type": "boolean"
           },
+          "mediaMaxMb": {
+            "type": "number",
+            "exclusiveMinimum": 0
+          },
+          "responsePrefix": {
+            "type": "string"
+          },
           "baseUrl": {
             "type": "string",
             "format": "uri"
@@ -306,6 +313,11 @@
             },
             "additionalProperties": false
           },
+          "historyLimit": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 9007199254740991
+          },
           "accounts": {
             "type": "object",
             "propertyNames": {
@@ -323,6 +335,13 @@
                 "configWrites": {
                   "type": "boolean"
                 },
+                "mediaMaxMb": {
+                  "type": "number",
+                  "exclusiveMinimum": 0
+                },
+                "responsePrefix": {
+                  "type": "string"
+                },
                 "baseUrl": {
                   "type": "string",
                   "format": "uri"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/clickclack",
-  "version": "2026.8.1-beta.3",
+  "version": "2026.8.2",
   "description": "OpenClaw ClickClack channel plugin",
   "type": "module",
   "exports": {
@@ -9,11 +9,11 @@
     "./runtime-api.js": "./dist/runtime-api.js"
   },
   "dependencies": {
-    "ws": "8.21.1",
+    "ws": "8.21.3",
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.8.1-beta.3"
+    "openclaw": ">=2026.8.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -139,10 +139,10 @@
       "allowInvalidConfigRecovery": true
     },
     "compat": {
-      "pluginApi": ">=2026.8.1-beta.3"
+      "pluginApi": ">=2026.8.2"
     },
     "build": {
-      "openclawVersion": "2026.8.1-beta.3",
+      "openclawVersion": "2026.8.2",
       "bundledDist": false
     },
     "release": {