@openclaw/raft 2026.7.1 → 2026.7.2-beta.2

package/dist/channel-plugin-api.js

@@ -1,29 +1,22 @@
 import { a as resolveRaftAccount, i as resolveDefaultRaftAccountId, n as RAFT_CHANNEL_ID, r as listRaftAccountIds, t as raftSetupPlugin } from "./setup-BTG_4kEW.js";
 import { describeAccountSnapshot } from "openclaw/plugin-sdk/account-helpers";
 import { createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
-import { buildBaseChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
 import { detectBinary } from "openclaw/plugin-sdk/setup-tools";
-import { buildChannelConfigSchema } from "openclaw/plugin-sdk/channel-config-schema";
+import { buildBaseChannelStatusSummary, createComputedAccountStatusAdapter, createDefaultChannelRuntimeState } from "openclaw/plugin-sdk/status-helpers";
+import { buildChannelConfigSchema, buildMultiAccountChannelSchema } from "openclaw/plugin-sdk/channel-config-schema";
 import { z } from "zod";
 import { spawn } from "node:child_process";
-import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { createServer } from "node:http";
 import { keepHttpServerTaskAlive, waitUntilAbort } from "openclaw/plugin-sdk/channel-outbound";
 import { KeyedAsyncQueue } from "openclaw/plugin-sdk/keyed-async-queue";
-import { createClaimableDedupe } from "openclaw/plugin-sdk/persistent-dedupe";
-//#region extensions/raft/src/config-schema.ts
-const RaftAccountSchema = z.object({
+import { createChannelReplayGuard } from "openclaw/plugin-sdk/persistent-dedupe";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
+const raftChannelConfigSchema = buildChannelConfigSchema(buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	profile: z.string().min(1).optional()
-}).strict();
-const raftChannelConfigSchema = buildChannelConfigSchema(z.object({
-	name: z.string().optional(),
-	enabled: z.boolean().optional(),
-	profile: z.string().min(1).optional(),
-	defaultAccount: z.string().optional(),
-	accounts: z.record(z.string(), RaftAccountSchema).optional()
-}).strict());
+}).strict()));
 //#endregion
 //#region extensions/raft/src/inbound.ts
 const WAKE_TEXT = "Raft wake hint received. Check Raft for pending messages, then reply through the Raft CLI.";
@@ -137,6 +130,21 @@ const WAKE_EVENT_ID_FIELDS = [
 	"wake_id",
 	"id"
 ];
+function createRaftWakeReplayGuard(params) {
+	return createChannelReplayGuard({
+		dedupe: {
+			ttlMs: WAKE_DEDUPE_TTL_MS,
+			memoryMaxSize: WAKE_DEDUPE_MEMORY_MAX_SIZE,
+			pluginId: RAFT_CHANNEL_ID,
+			namespacePrefix: "raft-wake-dedupe",
+			stateMaxEntries: WAKE_DEDUPE_STATE_MAX_ENTRIES,
+			...params?.env ? { env: params.env } : {},
+			...params?.onDiskError ? { onDiskError: params.onDiskError } : {}
+		},
+		buildReplayKey: (event) => event.key,
+		namespace: (event) => event.accountId
+	});
+}
 var WakeRequestError = class extends Error {
 	constructor(statusCode, message) {
 		super(message);
@@ -168,9 +176,7 @@ function spawnRaftBridge(params) {
 function hasMatchingToken(request, expected) {
 	const value = request.headers[WAKE_TOKEN_HEADER];
 	if (typeof value !== "string") return false;
-	const received = Buffer.from(value);
-	const required = Buffer.from(expected);
-	return received.length === required.length && timingSafeEqual(received, required);
+	return safeEqualSecret(value, expected);
 }
 async function readWakePayload(request) {
 	const chunks = [];
@@ -254,16 +260,9 @@ async function startRaftGatewayAccount(ctx, deps = {}) {
 	if (!profile) throw new Error(`Raft account "${ctx.accountId}" is missing a CLI profile.`);
 	if (!ctx.channelRuntime) throw new Error("Raft requires OpenClaw channel runtime support. Update OpenClaw and retry.");
 	const wakeQueue = new KeyedAsyncQueue();
-	const wakeDedupe = deps.wakeDedupe ?? createClaimableDedupe({
-		ttlMs: WAKE_DEDUPE_TTL_MS,
-		memoryMaxSize: WAKE_DEDUPE_MEMORY_MAX_SIZE,
-		pluginId: "raft",
-		namespacePrefix: "raft-wake-dedupe",
-		stateMaxEntries: WAKE_DEDUPE_STATE_MAX_ENTRIES,
-		onDiskError: (error) => {
-			ctx.log?.warn?.(`Raft wake dedupe storage failed: ${String(error)}`);
-		}
-	});
+	const wakeDedupe = deps.wakeDedupe ?? createRaftWakeReplayGuard({ onDiskError: (error) => {
+		ctx.log?.warn?.(`Raft wake dedupe storage failed: ${String(error)}`);
+	} });
 	const token = (deps.createToken ?? createToken)();
 	const runtimeSession = randomUUID();
 	const sockets = /* @__PURE__ */ new Set();
@@ -306,22 +305,17 @@ async function startRaftGatewayAccount(ctx, deps = {}) {
 			if (!dedupeKey) throw new WakeRequestError(400, "Wake payload must include a stable event identity.");
 			const dispatched = await wakeQueue.enqueue(ctx.accountId, async () => {
 				if (ctx.abortSignal?.aborted) throw new WakeRequestError(503, "Raft Gateway is stopping.");
-				const claim = await wakeDedupe.claim(dedupeKey, { namespace: ctx.accountId });
-				if (claim.kind === "duplicate") return false;
-				if (claim.kind === "inflight") {
-					if (await claim.pending) return false;
-					throw new WakeRequestError(503, "Raft wake delivery is retrying.");
-				}
-				try {
+				const result = await wakeDedupe.processGuarded({
+					accountId: ctx.accountId,
+					key: dedupeKey
+				}, async () => {
 					await dispatchRaftWake({ ctx });
-				} catch (error) {
-					wakeDedupe.release(dedupeKey, {
-						namespace: ctx.accountId,
-						error
-					});
-					throw error;
+				});
+				if (result.kind === "duplicate") return false;
+				if (result.kind === "inflight") {
+					if (await result.pending) return false;
+					throw new WakeRequestError(503, "Raft wake delivery is retrying.");
 				}
-				await wakeDedupe.commit(dedupeKey, { namespace: ctx.accountId });
 				return true;
 			});
 			sendJson(response, 202, {

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
   "name": "@openclaw/raft",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/raft",
-      "version": "2026.7.1",
+      "version": "2026.7.2-beta.2",
       "dependencies": {
         "zod": "4.4.3"
       },
       "peerDependencies": {
-        "openclaw": ">=2026.7.1"
+        "openclaw": ">=2026.7.2-beta.2"
       },
       "peerDependenciesMeta": {
         "openclaw": {

package/openclaw.plugin.json

@@ -24,9 +24,6 @@
             "type": "string",
             "minLength": 1
           },
-          "defaultAccount": {
-            "type": "string"
-          },
           "accounts": {
             "type": "object",
             "propertyNames": {
@@ -48,6 +45,9 @@
               },
               "additionalProperties": false
             }
+          },
+          "defaultAccount": {
+            "type": "string"
           }
         },
         "additionalProperties": false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/raft",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "description": "OpenClaw Raft channel plugin for Raft CLI wake bridges.",
   "repository": {
     "type": "git",
@@ -11,7 +11,7 @@
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "openclaw": ">=2026.7.1"
+    "openclaw": ">=2026.7.2-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {
@@ -29,10 +29,10 @@
       "minHostVersion": ">=2026.6.8"
     },
     "compat": {
-      "pluginApi": ">=2026.7.1"
+      "pluginApi": ">=2026.7.2-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.1"
+      "openclawVersion": "2026.7.2-beta.2"
     },
     "channel": {
       "id": "raft",