@openclaw/sms 2026.7.1 → 2026.7.2-beta.2

package/dist/channel-plugin-api.js

@@ -1,4 +1,4 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-CS-JLPcU.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries } from "./secret-contract-Cp0f-YPc.js";
 import { DEFAULT_ACCOUNT_ID, normalizeOptionalAccountId } from "openclaw/plugin-sdk/account-id";
 import { createHybridChannelConfigAdapter, createScopedDmSecurityResolver } from "openclaw/plugin-sdk/channel-config-helpers";
 import { buildChannelOutboundSessionRoute, createChatChannelPlugin } from "openclaw/plugin-sdk/channel-core";
@@ -6,19 +6,23 @@ import { createMessageReceiptFromOutboundResults, defineChannelMessageAdapter, w
 import { createConditionalWarningCollector } from "openclaw/plugin-sdk/channel-policy";
 import { createEmptyChannelDirectoryAdapter } from "openclaw/plugin-sdk/directory-runtime";
 import { normalizeStringEntries } from "openclaw/plugin-sdk/string-coerce-runtime";
-import { chunkTextForOutbound, sanitizeAssistantVisibleText, stripMarkdown } from "openclaw/plugin-sdk/text-chunking";
+import { chunkTextForOutbound, renderMarkdownIRChunksWithinLimit, sanitizeAssistantVisibleText, stripMarkdown } from "openclaw/plugin-sdk/text-chunking";
 import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1, listCombinedAccountIds, resolveAccountEntry, resolveListedDefaultAccountId, resolveMergedAccountConfig } from "openclaw/plugin-sdk/account-resolution";
 import { parseStrictInteger } from "openclaw/plugin-sdk/number-runtime";
 import { buildSecretInputSchema, hasConfiguredSecretInput, normalizeResolvedSecretInputString } from "openclaw/plugin-sdk/secret-input";
-import { AllowFromListSchema, DmPolicySchema, buildChannelConfigSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-primitives";
+import { AllowFromListSchema, DmPolicySchema, buildChannelConfigSchema, buildMultiAccountChannelSchema, requireOpenAllowFrom } from "openclaw/plugin-sdk/channel-config-schema";
 import { requireChannelOpenAllowFrom } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
-import { createFixedWindowRateLimiter, readRequestBodyWithLimit, registerPluginHttpRoute } from "openclaw/plugin-sdk/webhook-ingress";
+import { createFixedWindowRateLimiter, readRequestBodyWithLimit, registerPluginHttpRoute, resolveRequestClientIp } from "openclaw/plugin-sdk/webhook-ingress";
+import { runDetachedWebhookWork } from "openclaw/plugin-sdk/webhook-request-guards";
 import { resolveStableChannelMessageIngress } from "openclaw/plugin-sdk/channel-ingress-runtime";
 import { createChannelPairingChallengeIssuer } from "openclaw/plugin-sdk/channel-pairing";
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { createHmac } from "node:crypto";
 import * as querystring from "node:querystring";
+import { readResponseTextPrefix, readResponseWithLimit } from "openclaw/plugin-sdk/response-limit-runtime";
+import { safeEqualSecret } from "openclaw/plugin-sdk/security-runtime";
 import { fetchWithSsrFGuard } from "openclaw/plugin-sdk/ssrf-runtime";
+import { performance } from "node:perf_hooks";
 //#region extensions/sms/src/phone.ts
 function normalizeSmsPhoneNumber(raw) {
 	const trimmed = raw.trim().replace(/^(?:sms|twilio-sms):/i, "");
@@ -129,7 +133,7 @@ function isSmsAccountConfigured(account) {
 //#endregion
 //#region extensions/sms/src/config-schema.ts
 const SecretInputSchema = buildSecretInputSchema();
-const SmsAccountConfigSchema = z.object({
+const SmsChannelConfigSchema = buildChannelConfigSchema(buildMultiAccountChannelSchema(z.object({
 	name: z.string().optional(),
 	enabled: z.boolean().optional(),
 	accountSid: z.string().optional(),
@@ -143,18 +147,17 @@ const SmsAccountConfigSchema = z.object({
 	dmPolicy: DmPolicySchema.optional().default("pairing"),
 	allowFrom: AllowFromListSchema,
 	textChunkLimit: z.number().int().positive().optional()
-}).strict().superRefine((value, ctx) => {
-	requireChannelOpenAllowFrom({
-		channel: "sms",
-		policy: value.dmPolicy,
-		allowFrom: value.allowFrom,
-		ctx,
-		requireOpenAllowFrom
-	});
-});
-const SmsChannelConfigSchema = buildChannelConfigSchema(SmsAccountConfigSchema.extend({
-	accounts: z.record(z.string(), SmsAccountConfigSchema.optional()).optional(),
-	defaultAccount: z.string().optional()
+}).strict(), {
+	optionalAccount: true,
+	refine: (value, ctx) => {
+		requireChannelOpenAllowFrom({
+			channel: "sms",
+			policy: value.dmPolicy,
+			allowFrom: value.allowFrom,
+			ctx,
+			requireOpenAllowFrom
+		});
+	}
 }), { uiHints: {
 	"": {
 		label: "SMS",
@@ -213,6 +216,7 @@ const TWILIO_API_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
 const TRUNCATED_RESPONSE_SUFFIX = "... [truncated]";
 const WEBHOOK_BODY_LIMIT_BYTES = 32 * 1024;
 const WEBHOOK_BODY_TIMEOUT_MS = 5e3;
+const TWILIO_CHANNEL_ADDRESS_RE = /^([a-z][a-z0-9-]*):(.*)$/i;
 function firstString(value) {
 	if (Array.isArray(value)) return firstString(value[0]);
 	return typeof value === "string" ? value : "";
@@ -262,17 +266,16 @@ function requestSearch(req) {
 		return "";
 	}
 }
-function configuredUrlHasQuery(url) {
+function stripUrlFragment(url) {
 	const hashIndex = url.indexOf("#");
-	return (hashIndex === -1 ? url : url.slice(0, hashIndex)).includes("?");
+	return hashIndex === -1 ? url : url.slice(0, hashIndex);
 }
 function resolveTwilioWebhookSignatureUrl(params) {
-	if (configuredUrlHasQuery(params.publicWebhookUrl)) return params.publicWebhookUrl;
+	const signatureBaseUrl = stripUrlFragment(params.publicWebhookUrl);
+	if (signatureBaseUrl.includes("?")) return signatureBaseUrl;
 	const search = requestSearch(params.req);
-	if (!search) return params.publicWebhookUrl;
-	const hashIndex = params.publicWebhookUrl.indexOf("#");
-	if (hashIndex === -1) return `${params.publicWebhookUrl}${search}`;
-	return `${params.publicWebhookUrl.slice(0, hashIndex)}${search}${params.publicWebhookUrl.slice(hashIndex)}`;
+	if (!search) return signatureBaseUrl;
+	return `${signatureBaseUrl}${search}`;
 }
 var TwilioSmsApiError = class extends Error {
 	constructor(httpStatus, responseText, operation = "send") {
@@ -295,21 +298,26 @@ function computeTwilioSignature(params) {
 	const data = params.url + Object.keys(params.form).toSorted().map((key) => `${key}${params.form[key] ?? ""}`).join("");
 	return createHmac("sha1", params.authToken).update(data).digest("base64");
 }
-function safeEqual(a, b) {
-	const left = Buffer.from(a);
-	const right = Buffer.from(b);
-	return left.length === right.length && timingSafeEqual(left, right);
-}
 function verifyTwilioSignature(params) {
 	if (!params.signature || !params.url || !params.authToken) return false;
-	return safeEqual(params.signature, computeTwilioSignature({
+	return safeEqualSecret(params.signature, computeTwilioSignature({
 		url: params.url,
 		authToken: params.authToken,
 		form: params.form
 	}));
 }
+function parseTwilioInboundFrom(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const channelAddress = trimmed.match(TWILIO_CHANNEL_ADDRESS_RE);
+	const kind = channelAddress?.[1]?.toLowerCase();
+	if (kind && kind !== "rcs") return null;
+	const phoneNumber = normalizeSmsPhoneNumber(channelAddress?.[2] ?? trimmed);
+	if (!looksLikeSmsPhoneNumber(phoneNumber)) return null;
+	return phoneNumber;
+}
 function buildTwilioInboundMessage(form) {
-	const from = firstTrimmedString(form.From);
+	const from = parseTwilioInboundFrom(firstTrimmedString(form.From));
 	const to = firstTrimmedString(form.To);
 	const body = firstString(form.Body);
 	const accountSid = firstTrimmedString(form.AccountSid);
@@ -353,37 +361,13 @@ function appendTruncatedResponseSuffix(text) {
 	return `${text.trimEnd()}${TRUNCATED_RESPONSE_SUFFIX}`;
 }
 async function readTwilioApiResponseText(response) {
-	if (!response.body) return "";
 	const maxBytes = response.ok ? TWILIO_API_SUCCESS_BODY_LIMIT_BYTES : TWILIO_API_ERROR_BODY_LIMIT_BYTES;
-	const truncateOnLimit = !response.ok;
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let totalBytes = 0;
-	let text = "";
-	try {
-		while (true) {
-			const { done, value } = await reader.read();
-			if (done) return text + decoder.decode();
-			if (!value?.byteLength) continue;
-			const remainingBytes = maxBytes - totalBytes;
-			if (value.byteLength > remainingBytes) {
-				const clipped = remainingBytes > 0 ? value.slice(0, remainingBytes) : void 0;
-				if (truncateOnLimit) {
-					if (clipped) text += decoder.decode(clipped, { stream: true });
-					await reader.cancel().catch(() => void 0);
-					return appendTruncatedResponseSuffix(text + decoder.decode());
-				}
-				await reader.cancel().catch(() => void 0);
-				throw new Error(`Twilio SMS API response body too large: ${totalBytes + value.byteLength} bytes (limit: ${maxBytes} bytes)`);
-			}
-			text += decoder.decode(value, { stream: true });
-			totalBytes += value.byteLength;
-		}
-	} finally {
-		try {
-			reader.releaseLock();
-		} catch {}
+	if (!response.ok) {
+		const prefix = await readResponseTextPrefix(response, maxBytes);
+		return prefix.truncated ? appendTruncatedResponseSuffix(prefix.text) : prefix.text;
 	}
+	const body = await readResponseWithLimit(response, maxBytes, { onOverflow: ({ size, maxBytes: limit }) => /* @__PURE__ */ new Error(`Twilio SMS API response body too large: ${size} bytes (limit: ${limit} bytes)`) });
+	return new TextDecoder().decode(body);
 }
 function normalizeRequestHeaders(headers) {
 	if (!headers) return {};
@@ -547,17 +531,31 @@ async function sendSmsViaTwilio(params) {
 }
 //#endregion
 //#region extensions/sms/src/send.ts
+const SMS_ASSISTANT_TRANSCRIPT_ROLE_PREFIX = "[assistant-authored transcript] ";
 function toSmsPlainText(text) {
-	return stripMarkdown(sanitizeAssistantVisibleText(text).replace(/```[^\n]*\n?([\s\S]*?)```/g, (_match, body) => body.trim()).replace(/\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g, (_match, label, url) => {
-		const cleanLabel = label.trim();
-		const cleanUrl = url.trim();
-		return cleanLabel && cleanLabel !== cleanUrl ? `${cleanLabel} (${cleanUrl})` : cleanUrl;
-	})).replace(/\r\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+	return stripMarkdown(sanitizeAssistantVisibleText(text), {
+		assistantTranscriptRoleHeaders: true,
+		assistantTranscriptRolePrefix: SMS_ASSISTANT_TRANSCRIPT_ROLE_PREFIX,
+		linkStyle: "label-and-url"
+	}).replace(/\r\n/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+function chunkSmsPlainText(text, limit) {
+	return renderMarkdownIRChunksWithinLimit({
+		ir: {
+			text,
+			styles: [],
+			links: []
+		},
+		limit,
+		assistantTranscriptRoleMessageBoundaries: true,
+		renderChunk: (chunk) => chunk.annotations?.some((annotation) => annotation.type === "assistant_transcript_role") ? `${SMS_ASSISTANT_TRANSCRIPT_ROLE_PREFIX}${chunk.text}` : chunk.text,
+		measureRendered: (rendered) => rendered.length
+	}).map(({ rendered }) => rendered).filter(Boolean);
 }
 async function sendSmsTextChunks(params) {
 	const text = toSmsPlainText(params.text);
 	if (!text) throw new Error("SMS send requires non-empty text.");
-	const chunks = chunkTextForOutbound(text, params.account.textChunkLimit).filter(Boolean);
+	const chunks = chunkSmsPlainText(text, params.account.textChunkLimit);
 	const sendChunks = chunks.length ? chunks : [text];
 	const results = [];
 	for (const textLocal of sendChunks) results.push(await sendSmsViaTwilio({
@@ -729,49 +727,98 @@ async function dispatchSmsInboundEvent(params) {
 	});
 }
 //#endregion
+//#region extensions/sms/src/webhook-replay-guard.ts
+const REPLAY_CACHE_TTL_MS = 10 * 6e4;
+const REPLAY_CACHE_MAX_KEYS = 1e4;
+function createSmsWebhookReplayGuard(options = {}) {
+	const ttlMs = options.ttlMs ?? REPLAY_CACHE_TTL_MS;
+	const maxKeys = options.maxKeys ?? REPLAY_CACHE_MAX_KEYS;
+	const now = options.now ?? (() => performance.now());
+	const entries = /* @__PURE__ */ new Map();
+	const pruneExpired = (nowMs) => {
+		for (const [key, expiresAt] of entries) {
+			if (expiresAt > nowMs) break;
+			entries.delete(key);
+		}
+	};
+	return { remember: (messageSid) => {
+		const nowMs = now();
+		pruneExpired(nowMs);
+		if (entries.has(messageSid)) return { kind: "replayed" };
+		if (entries.size >= maxKeys) {
+			const oldestExpiresAt = entries.values().next().value ?? nowMs;
+			return {
+				kind: "saturated",
+				retryAfterMs: Math.max(0, oldestExpiresAt - nowMs)
+			};
+		}
+		entries.set(messageSid, nowMs + ttlMs);
+		return { kind: "accepted" };
+	} };
+}
+//#endregion
 //#region extensions/sms/src/webhook.ts
-const rateLimiter = createFixedWindowRateLimiter({
-	maxRequests: 30,
+const INVALID_REQUEST_MAX_REQUESTS = 300;
+const CALLBACK_DISPATCH_MAX_REQUESTS = 30;
+const invalidRequestRateLimiter = createFixedWindowRateLimiter({
+	maxRequests: INVALID_REQUEST_MAX_REQUESTS,
 	windowMs: 6e4,
 	maxTrackedKeys: 5e3
 });
-const REPLAY_CACHE_TTL_MS = 10 * 6e4;
-const REPLAY_CACHE_MAX_KEYS = 1e4;
-const replayCache = /* @__PURE__ */ new Map();
+const callbackDispatchRateLimiter = createFixedWindowRateLimiter({
+	maxRequests: CALLBACK_DISPATCH_MAX_REQUESTS,
+	windowMs: 6e4,
+	maxTrackedKeys: 5e3
+});
+const replayGuardsByAccount = /* @__PURE__ */ new Map();
+function resolveSmsWebhookReplayGuard(account) {
+	const key = `${account.accountId}\0${account.accountSid}`;
+	const existing = replayGuardsByAccount.get(key);
+	if (existing) return existing;
+	const created = createSmsWebhookReplayGuard();
+	replayGuardsByAccount.set(key, created);
+	return created;
+}
 function headerValue(value) {
 	if (Array.isArray(value)) return value[0];
 	return value;
 }
-function rateLimitKey(req) {
-	return req.socket?.remoteAddress ?? "unknown";
+function resolvedClientAddress(params) {
+	return resolveRequestClientIp(params.req, params.cfg.gateway?.trustedProxies, params.cfg.gateway?.allowRealIpFallback === true) ?? params.req.socket?.remoteAddress ?? "unknown";
 }
-function rememberWebhookMessage(params) {
-	const now = params.now ?? Date.now();
-	for (const [key, expiresAt] of replayCache) {
-		if (expiresAt > now && replayCache.size <= REPLAY_CACHE_MAX_KEYS) break;
-		replayCache.delete(key);
-	}
-	const key = `${params.accountId}:${params.messageSid}`;
-	if ((replayCache.get(key) ?? 0) > now) return false;
-	replayCache.set(key, now + REPLAY_CACHE_TTL_MS);
+function rateLimitKey(params) {
+	return `${params.account.accountId}:${params.account.webhookPath}:${params.clientAddress}`;
+}
+function rejectInvalidRequestRateLimit(params) {
+	params.log?.warn?.(`SMS webhook invalid-request rate limit exceeded for ${params.key}`);
+	respondTwiml(params.res, 429, "Rate limit exceeded");
 	return true;
 }
 function createSmsWebhookHandler(params) {
+	const webhookReplayGuard = resolveSmsWebhookReplayGuard(params.account);
 	return async (req, res) => {
 		if (req.method !== "POST") {
 			respondTwiml(res, 405, "Method not allowed");
 			return true;
 		}
-		const key = rateLimitKey(req);
-		if (rateLimiter.isRateLimited(key)) {
-			params.log?.warn?.(`SMS webhook rate limit exceeded for ${key}`);
-			respondTwiml(res, 429, "Rate limit exceeded");
-			return true;
-		}
+		const clientAddress = resolvedClientAddress({
+			cfg: params.cfg,
+			req
+		});
+		const key = rateLimitKey({
+			account: params.account,
+			clientAddress
+		});
+		const invalidRequestRateLimited = invalidRequestRateLimiter.isRateLimited(key);
 		let form;
 		try {
 			form = await readTwilioWebhookForm(req);
 		} catch {
+			if (invalidRequestRateLimited) return rejectInvalidRequestRateLimit({
+				key,
+				log: params.log,
+				res
+			});
 			respondTwiml(res, 400, "Invalid request body");
 			return true;
 		}
@@ -785,6 +832,11 @@ function createSmsWebhookHandler(params) {
 				authToken: params.account.authToken,
 				form
 			})) {
+				if (invalidRequestRateLimited) return rejectInvalidRequestRateLimit({
+					key,
+					log: params.log,
+					res
+				});
 				params.log?.warn?.("SMS webhook rejected invalid Twilio signature");
 				respondTwiml(res, 403, "Invalid signature");
 				return true;
@@ -792,29 +844,54 @@ function createSmsWebhookHandler(params) {
 		}
 		const msg = buildTwilioInboundMessage(form);
 		if (!msg) {
+			if (invalidRequestRateLimited) return rejectInvalidRequestRateLimit({
+				key,
+				log: params.log,
+				res
+			});
 			respondTwiml(res, 400, "Missing SMS payload");
 			return true;
 		}
 		if (msg.accountSid && msg.accountSid !== params.account.accountSid) {
+			if (invalidRequestRateLimited) return rejectInvalidRequestRateLimit({
+				key,
+				log: params.log,
+				res
+			});
 			params.log?.warn?.("SMS webhook rejected mismatched Twilio AccountSid");
 			respondTwiml(res, 403, "Invalid account");
 			return true;
 		}
-		if (!rememberWebhookMessage({
-			accountId: params.account.accountId,
-			messageSid: msg.messageSid
-		})) {
+		if (invalidRequestRateLimited && params.account.dangerouslyDisableSignatureValidation) return rejectInvalidRequestRateLimit({
+			key,
+			log: params.log,
+			res
+		});
+		if (callbackDispatchRateLimiter.isRateLimited(key)) {
+			params.log?.warn?.(`SMS webhook rate limit exceeded for ${key}`);
+			respondTwiml(res, 429, "Rate limit exceeded");
+			return true;
+		}
+		const replayDecision = webhookReplayGuard.remember(msg.messageSid);
+		if (replayDecision.kind === "replayed") {
 			params.log?.warn?.(`SMS webhook ignored replayed message ${msg.messageSid}`);
 			respondTwiml(res, 200);
 			return true;
 		}
-		dispatchSmsInboundEvent({
+		if (replayDecision.kind === "saturated") {
+			const retryAfterSeconds = Math.max(1, Math.ceil(replayDecision.retryAfterMs / 1e3));
+			params.log?.warn?.("SMS webhook replay cache is full of unexpired message SIDs");
+			res.setHeader("Retry-After", String(retryAfterSeconds));
+			respondTwiml(res, 429, "Replay cache saturated");
+			return true;
+		}
+		runDetachedWebhookWork(() => dispatchSmsInboundEvent({
 			cfg: params.cfg,
 			account: params.account,
 			msg,
 			channelRuntime: params.channelRuntime,
 			log: params.log
-		}).catch((err) => {
+		})).catch((err) => {
 			params.log?.error?.(`SMS webhook dispatch failed: ${err instanceof Error ? err.message : String(err)}`);
 		});
 		respondTwiml(res, 200);

package/dist/{secret-contract-CS-JLPcU.js → secret-contract-Cp0f-YPc.js}

@@ -1,27 +1,11 @@
-import { collectConditionalChannelFieldAssignments, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
+import { collectConditionalChannelFieldAssignments, createChannelSecretTargetRegistryEntries, getChannelSurface, hasOwnProperty } from "openclaw/plugin-sdk/channel-secret-basic-runtime";
 //#region extensions/sms/src/secret-contract.ts
 const DEFAULT_ACCOUNT_ID = "default";
-const secretTargetRegistryEntries = [{
-	id: "channels.sms.accounts.*.authToken",
-	targetType: "channels.sms.accounts.*.authToken",
-	configFile: "openclaw.json",
-	pathPattern: "channels.sms.accounts.*.authToken",
-	secretShape: "secret_input",
-	expectedResolvedValue: "string",
-	includeInPlan: true,
-	includeInConfigure: true,
-	includeInAudit: true
-}, {
-	id: "channels.sms.authToken",
-	targetType: "channels.sms.authToken",
-	configFile: "openclaw.json",
-	pathPattern: "channels.sms.authToken",
-	secretShape: "secret_input",
-	expectedResolvedValue: "string",
-	includeInPlan: true,
-	includeInConfigure: true,
-	includeInAudit: true
-}];
+const secretTargetRegistryEntries = createChannelSecretTargetRegistryEntries({
+	channelKey: "sms",
+	account: ["authToken"],
+	channel: ["authToken"]
+});
 function hasTopLevelSmsAccount(channel) {
 	for (const field of [
 		"accountSid",

package/dist/secret-contract-api.js

@@ -1,2 +1,2 @@
-import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-CS-JLPcU.js";
+import { n as collectRuntimeConfigAssignments, r as secretTargetRegistryEntries, t as channelSecrets } from "./secret-contract-Cp0f-YPc.js";
 export { channelSecrets, collectRuntimeConfigAssignments, secretTargetRegistryEntries };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@openclaw/sms",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@openclaw/sms",
-      "version": "2026.7.1",
+      "version": "2026.7.2-beta.2",
       "dependencies": {
         "zod": "4.4.3"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/sms",
-  "version": "2026.7.1",
+  "version": "2026.7.2-beta.2",
   "description": "OpenClaw SMS channel plugin for Twilio text messages.",
   "repository": {
     "type": "git",
@@ -26,10 +26,10 @@
       "quickstartAllowFrom": true
     },
     "compat": {
-      "pluginApi": ">=2026.7.1"
+      "pluginApi": ">=2026.7.2-beta.2"
     },
     "build": {
-      "openclawVersion": "2026.7.1",
+      "openclawVersion": "2026.7.2-beta.2",
       "bundledDist": false
     },
     "install": {
@@ -54,7 +54,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.7.1"
+    "openclaw": ">=2026.7.2-beta.2"
   },
   "peerDependenciesMeta": {
     "openclaw": {